EN 16603-60-30:2015

2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.Vesoljska tehnika - Zahteve za satelitski AOCS (sistem obvladovanja orbitalne lege /satelita/)Raumfahrttechnik - Anforderungen an Satelliten-AOCSIngénierie spatiale - Exigences pour le système de contrôle d'attitude et d'orbite d'un satelliteSpace engineering - Satellite AOCS requirements49.140Vesoljski sistemi in operacijeSpace systems and operations33.070.40SatelitSatelliteICS:Ta slovenski standard je istoveten z:EN 16603-60-30:2015SIST EN 16603-60-30:2015en,fr,de01-november-2015SIST EN 16603-60-30:2015SLOVENSKI
STANDARD
EUROPEAN STANDARD NORME EUROPÉENNE EUROPÄISCHE NORM
EN 16603-60-30
September 2015 ICS 49.140
English version
Space engineering - Satellite AOCS requirements
Ingénierie spatiale - Exigences pour le système de contrôle d'attitude et d'orbite d'un satellite
Raumfahrttechnik - Anforderungen an Satelliten-AOCS This European Standard was approved by CEN on 16 November 2014.
CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN and CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC Management Centre has the same status as the official versions.
CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United Kingdom.
CEN-CENELEC Management Centre: Avenue Marnix 17, B-1000 Brussels © 2015 CEN/CENELEC All rights of exploitation in any form and by any means reserved worldwide for CEN national Members and for CENELEC Members. Ref. No. EN 16603-60-30:2015 E SIST EN 16603-60-30:2015

Tables Table F-1 : Typical AOCS documentation. 50
This Standard provides a baseline for the AOCS requirements which are used in the specification and the validation process. The Standard is intended to be used for each programme as an input for writing the Project Requirements Document. It includes all subjects related to AOCS: • Functional and FDIR requirements • Operational requirements • Performance requirements • Verification requirements • Documentation requirements SIST EN 16603-60-30:2015

Project requirements documents are included in business agreements, which are agreed between the parties and binding them, at any level of space programmes, as described in ECSS-S-ST-00.
This Standard deals with the attitude and orbit control systems developed as part of a satellite space project. The classical attitude and orbit control systems considered here include the following functions: • Attitude estimation • Attitude guidance • Attitude control • Orbit control • Orbit estimation, called Navigation in this document, can be part of the function for missions which explicitly require this function • Acquisition and maintenance of a safe attitude in emergency cases and return to nominal mission upon command The present Standard does not cover missions that include the following functions:
• Real-time on-board trajectory guidance and control • Real-time on-board relative position estimation and control Example of such missions are rendezvous, formation flying, launch vehicles and interplanetary vehicles. Although the present document does not cover the above mentioned types of mission, it can be used as a reference document for them. This standard may be tailored for the specific characteristic and constraints of a space project in conformance with ECSS-S-ST-00. SIST EN 16603-60-30:2015

EN reference Reference in text Title EN 16601-00-01 ECSS-S-ST-00-01 ECSS system - Glossary of terms EN 16603-10 ECSS-E-ST-10 Space engineering - System engineering general requirements EN 16603-10-03 ECSS-E-ST-10-03 Space engineering - Testing EN 16603-60-10 ECSS-E-ST-60-10 Space engineering - Control performances EN 16603-70-11 ECSS-E-ST-70-11 Space engineering - Space segment operability
In particular, the following terms are used in the present Standard, with the definition given in the ECSS-E-ST-60-10: • Absolute knowledge error (AKE) • Absolute performance error (APE) • Relative knowledge error (RKE) • Relative performance error (RPE) • Robustness 3.2 Terms specific to the present Standard The definitions given in this clause are specific to the present Standard and are applicable for the understanding of the requirements. Other names or definitions may be used however during the development of space programmes. 3.2.1 attitude and orbit control system (AOCS) functional chain of a satellite which encompasses attitude and orbit sensors, attitude estimation and guidance, attitude and orbit control algorithms, attitude and orbit control actuators NOTE 1 The AOCS can include an orbit estimation function usually called Navigation. NOTE 2 The AOCS can include additional items such as AOCS dedicated computer and AOCS application software, depending on satellite architecture.
• Environmental conditions • External and internal disturbances NOTE 2 The AOCS performance can be for instance:
• Pointing accuracy • Duration of a manoeuvre • Fuel consumption NOTE 3 The objective is to have an order of magnitude of the contribution, and this can be achieved by analysis, simulation or test. 3.2.9 worst case analysis deterministic analysis to identify a set of parameters, disturbances and initial conditions, which, when combined at some given values within their nominal operational range, define a worst case situation or scenario for the evaluation of AOCS performances NOTE 1 The parameter variations and disturbances are as defined for the sensitivity analysis, and their selection can rely on a sensitivity analysis. NOTE 2 The initial conditions can be for instance: • Angular rates • Initial angular momentum • Sun, Earth or planetary positions • Orbit parameters NOTE 3 The worst case scenarios depend on the considered AOCS performance. 3.2.10 tranquilization phase phase following an attitude manoeuvre, or possibly an orbit correction manoeuvre, during which the full attitude performance is not yet achieved
GEO geostationary orbit GNC guidance navigation and control GNSS global navigation satellite system H/W
hardware I/F interface ICD interface control document LEO low Earth orbit LEOP launch and early orbit phase MCI mass, CoM and inertia MEO medium Earth orbit MRD mission requirements document P/L
payload PDR preliminary design review PRD project requirements document QR qualification review RKE relative knowledge error RPE relative performance error S/C
spacecraft SIST EN 16603-60-30:2015

software SRD system requirements document
SSUM space segment user manual TBD to be defined TBS to be specified TC telecommand TM telemetry UM user manual VCD verification control document VP verification plan 3.4 Nomenclature The following nomenclature applies throughout this document: a. The word “shall” is used in this Standard to express requirements. All the requirements are expressed with the word “shall”. b. The word “should” is used in this Standard to express recommendations. All the recommendations are expressed with the word “should”. NOTE It is expected that, during tailoring, all the recommendations in this document are either converted into requirements or tailored out. c. The words “may” and “need not” are used in this Standard to express positive and negative permissions, respectively. All the positive permissions are expressed with the word “may”. All the negative permissions are expressed with the words “need not”. d. The word “can” is used in this Standard to express capabilities or possibilities, and therefore, if not accompanied by one of the previous words, it implies descriptive text. NOTE In ECSS “may” and “can” have completely different meanings: “may” is normative (permission), and “can” is descriptive. e. The present and past tenses are used in this Standard to express statements of fact, and therefore they imply descriptive text. SIST EN 16603-60-30:2015

The Failure Detection, Isolation and Recovery (FDIR) is usually defined and specified at satellite level. The FDIR requirements included in this document relate to the contribution from AOCS. But this Standard does not specify the FDIR implementation architecture. It is compatible with architectures, where a part of the FDIR is implemented locally at AOCS level. The required AOCS documentation is defined in clause 5.5.2a, with the key documents being specified in the DRD annexes. A major part of this documentation can be part of the satellite level or avionics level documentation. SIST EN 16603-60-30:2015

NOTE 1 The possible pointing includes Earth pointing, nadir pointing and tracking of a fixed point on ground, inertial pointing, Sun pointing or pointing to scientific targets. NOTE 2 Attitudes can be constrained by payload and platform requirements related for example to illumination or platform thermal constraints. NOTE 3 Intermediate attitudes can be needed between mission operational sequences, or for the acquisition of new targets. NOTE 4 Specific attitudes can be needed for system purposes, like communications for instance. 5.1.1.7 Orbit acquisition and maintenance a. The AOCS shall provide the capability for achieving orbit control manoeuvres specified by mission analysis. NOTE Orbit control manoeuvres include the following cases:
• initial orbit acquisition or transfer phase so as to reach the operational orbit, • orbit correction manoeuvres on-station for orbit maintenance,
• orbit change on station for repositioning, • end-of-life orbit change for de-orbiting, transfer towards graveyard orbit or parking orbit. 5.1.1.8 Safe mode a. In case of major anomaly, the AOCS shall provide the autonomous capability to reach and control safe pointing attitude and angular rates to ensure the integrity of the spacecraft vital functions, including power, thermal and communications. NOTE 1 Depending on satellite design and operational sequences, the safe pointing attitude can be required to be compatible with several satellite mechanical configurations corresponding to solar arrays and appendages in stowed, partially deployed or fully deployed configurations. NOTE 2 Major anomalies are defined programme by programme. b. The entry into safe mode shall be commandable by ground TC. c. The return from safe mode shall be commandable by ground TC SIST EN 16603-60-30:2015

NOTE 3 This can include the capability to reach the final orbit and to perform the passivation of the propulsion even in degraded configurations, after a failure. NOTE 4 This can involve using the propulsion function directly from safe mode. 5.1.1.11 System and satellite requirements on AOCS a. It shall be demonstrated that the AOCS design does not prevent meeting the requirements imposed by the mission and payload constraints. NOTE These constraints can come from payload (e.g. forbidden attitudes, limited mechanical or magnetic disturbances, and sensitivity to environment) or from mission needs (e.g. antenna pointing for communication and operational constraints). b. At satellite level, it shall be demonstrated that the AOCS design is compatible with other functional chains for the attitudes and durations. NOTE 1 Examples of other functional chains are power, thermal and communications. SIST EN 16603-60-30:2015

5.1.1.14 Sign convention for inertia a. The AOCS shall define an unambiguous sign convention for inertia to be used throughout the AOCS documentation. b. For diagonal terms, the following convention should be used:
∫+=dmzyIxx)(22,
∫+=dmxzIyy)(22,
∫+=dmyxIzz)(22 c. For inertia cross-products, one of the following usual conventions should be used : ∫−=dmxyIxy,
∫−=dmxzIxz,
∫−=dmyzIyz or:
∫+=dmxyPxy,
∫+=dmxzPxz,
∫+=dmyzPyz SIST EN 16603-60-30:2015

b. The AOCS shall provide to satellite FDIR, for the purpose of failure monitoring, parameters observed on AOCS units or derived from AOCS embedded algorithms. c. The AOCS shall implement actions on AOCS units and AOCS modes required by the satellite FDIR in case of anomaly. NOTE This AOCS FDIR actions can involve for instance one or several of the following features: • A filtering of transient and erroneous data without any action at hardware level.
• A local hardware reconfiguration replacing a faulty unit by the redundant one without any change of AOCS mode or function. • A reconfiguration at higher level involving several types of units. • A reconfiguration of several units and a switch to another mode, including safe mode. • A reconfiguration of several units and a restart of the computer. d. The selection of the requirements for AOCS monitoring and actions, with respect to satellite autonomy, availability, reliability and fault tolerance, shall be justified. NOTE 1 Justification of the AOCS monitoring and actions can be based on the outcomes of dedicated failure events, based on FMECA (Refer to ECSS-Q-ST-30-02).
NOTE 2 FDIR design includes a trade-off between the maximization of autonomy and mission availability on one side, and satellite design and validation complexity on the other side. For the AOCS, an important subject is to know if it is possible and necessary to remain in the same operational mode after the considered failure or to have a direct transition to safe mode when the anomaly is triggered. SIST EN 16603-60-30:2015

2. modify by ground command the parameters of FDIR monitoring and actions. NOTE The FDIR monitoring and actions are usually part of the AOCS design, and they are defined and verified in the frame of the satellite validation. The required capability to change the activation scheme or the parameters can be useful to perform specific operations, but may have some consequences on the overall satellite design and validation. 5.1.2.2 Hardware and software redundancy scheme a. The AOCS shall justify the hardware redundancy implemented against failure tolerance requirements and reliability requirements. b. The AOCS shall justify the design of the safe mode against the risk of common design error and common failure with the modes used for the nominal mission.
NOTE This AOCS safe mode justification can involve for instance one or several of the following features: • use of redundant hardware branches in safe mode; • use of different sensors and actuators in the two classes of modes;
• use of separated software for the two classes of modes; • potential in-flight validation of the safe mode, which provides confidence in the design. 5.1.3 Propulsion related functional requirements 5.1.3.1 Utilization constraints a. The AOCS shall contribute to the definition of a propulsion thruster configuration for: 1. force and torque directions, according to mission needs, 2. pure torque or pure force generation, if needed by the mission. NOTE Some missions can require several kinds of propulsion and thrusters, resulting in identification of multiple configurations. SIST EN 16603-60-30:2015

NOTE 2 Pulse counting is a common alternative. NOTE 3 Fuel gauging requirements are generally related to the estimation of the remaining lifetime and the estimation of satellite MCI evolution. 5.1.3.3 Fuel sizing a. The AOCS shall quantify for all mission phases, including end-of-life disposal, the amount of propellant to be able to perform the propulsion sizing.
5.1.3.4 Thruster qualification a. The AOCS shall identify for every propulsion-based AOCS mode, the number of pulses commanded to the thruster, the associated pulse profiles and the total impulse. NOTE This data is used for thruster qualification. 5.2 Operational requirements 5.2.1 Requirements for ground telecommand 5.2.1.1 Requirements for parameters update a. Both the system data base and the user manual shall identify the AOCS parameters to be updated periodically, for operating the satellite during its whole orbital life.
b. The modification of periodically updated AOCS parameters shall be implemented through dedicated TCs. SIST EN 16603-60-30:2015

e. If the AOCS cannot correct a polarity error by changing one or more parameters, then the AOCS supplier shall propose a work around solution to be agreed with the customer.
5.2.1.2 Orbit control manoeuvres a. An orbit control manoeuvre shall be performed using a Delta-V magnitude command, or a thrust activation profile command, to be decided at system level.
NOTE 1
Orbit control manoeuvre can need attitude manoeuvres before and after the thrust, constant attitude or attitude profiles during the thrust.
NOTE 2
Thrust activation profiles can be used for low thrust propulsion. NOTE 3
A Delta-V magnitude command can be expressed as a total thruster actuation number command or equivalent, which does not require on-board knowledge of the satellite mass. 5.2.1.3 Orbit determination a. The AOCS shall identify if specific TCs are needed from ground in order to update its on-board orbit state or parameters. NOTE This update can be necessary if the on-board measurements are interrupted, or if no measurement are available on board. b. The data content and frequency of orbit parameters TCs shall be specified. 5.2.1.4 Attitude guidance a. The AOCS shall identify constraints for the generation of the attitude profiles by the ground. NOTE These constraints include maximum angular velocity, maximum angular acceleration and continuity between profiles. SIST EN 16603-60-30:2015

5.2.2.2 Housekeeping TM a. The AOCS shall provide housekeeping TM to enable the verification of the nominal behaviour of sensors, actuators and on-board functionalities, on ground. NOTE Housekeeping TM can be periodic or filtered, see clause 8.2.1.3 of ECSS-E-70-41.
b. Depending on the mission need, the AOCS shall provide TM for ground reconstruction of the spacecraft attitude and orbit. NOTE 1 The ground reconstruction can be in real time or a posteriori. NOTE 2 Orbit reconstruction can also use data which are not transmitted from the satellite. NOTE 3 The ground processing can combine attitude and orbit measurements to compute geo-location products, for instance. NOTE 4 The volume and frequency of the attitude and orbit TM depend on the required accuracy of the reconstructed attitude and orbit, as well as the system constraints (such as communication with the ground and on-board storage capacity). c. Depending on the required accuracy of the attitude reconstruction, algorithms for ground processing shall be specified. NOTE This requirement is applicable only for some missions needing more accurate attitude estimation on ground, when a dedicated ground processing can bring a significant improvement on this performance. SIST EN 16603-60-30:2015

NOTE 1 Depending on the mission, a degradation of the nominal performance can be accepted while the redundant sensor is switched on. NOTE 2 This cannot be applied to low cost satellites without redundancy. c. AOCS shall provide the capability to switch on a redundant unit for health diagnostic without impacting the current mode functionality. NOTE 1 This requirement might not be applicable to all cases of actuators, such as magnetorquers or thrusters.
NOTE 2 This cannot be applied to low cost satellites without redundancy. 5.2.3 Requirements for autonomous operations a. The initial attitude acquisition shall be performed as an automatic sequence, autonomously from the ground. b. The AOCS shall provide the capability to maintain the nominal AOCS mode used during the mission, without ground contact during a TBS days autonomy period. c. Once the safe mode is triggered, the AOCS shall be able to reach and keep the safe attitude during at least TBS days, autonomously without ground intervention. 5.2.4 Requirement for calibration operations a. The AOCS shall identify the need for in-flight calibration of sensors and actuators, and specify the tools and procedures to perform them.
b. The AOCS shall identify operational constraints in order to meet its calibration needs. NOTE Operational constraints include orbit conditions, specific attitude conditions and durations. SIST EN 16603-60-30:2015
...