See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/263847388

THE BEPICOLOMBO ATTITUDE AND ORBIT CONTROL SYSTEM

Conference Paper · June 2014

CITATIONS READS
2 2,083

6 authors, including:

Pascal Espeillac Massimo Casasco

Airbus European Space Agency
4 PUBLICATIONS   8 CITATIONS    40 PUBLICATIONS   135 CITATIONS   

SEE PROFILE SEE PROFILE

Some of the authors of this publication are also working on these related projects:

AIM - The Asteroid Impact Mission View project

Orekit View project

All content following this page was uploaded by Massimo Casasco on 09 January 2018.

The user has requested enhancement of the downloaded file.

 THE BEPICOLOMBO ATTITUDE AND ORBIT CONTROL SYSTEM
L. Szerdahelyi1, S. Fugger1, P. Espeillac1,
G. Monroig2, T. Pareaud2, M. Casasco3
1,2
AIRBUS Defence and Space (1Germany and 2France),
3
ESA/ESTEC (The Netherlands)
Laszlo.Szerdahelyi@astrium.eads.net

ABSTRACT
BepiColombo is one of ESA’s cornerstone missions; it will study and understand the composition, geophysics,
atmosphere, magnetosphere and history of Mercury, the least explored planet in the inner Solar System [1]. It is
a joint mission between ESA and the Japan Aerospace Exploration Agency (JAXA). The BepiColombo
spacecraft is being developed by AIRBUS Defence and Space. Both to build the three spacecraft modules and to
place the two orbiters into orbit at Mercury are an industrial and technological challenge requiring best
engineering practices and effort. The thermal conditions become already critical during cruise when
approaching the inner solar system and are also a main driver of the very high sensitivity of the spacecraft
performance to attitude excursions. Additionally, three major changes in the spacecraft configuration over
mission resulting from each of the module separations increase the AOCS complexity in comparison to other
missions. The BepiColombo AOCS is required to control and safeguard the spacecraft under these hard
environmental and spacecraft constraints while still achieving the demanding scientific pointing requirements.
This paper presents an overview of the AOCS design including the most original features like the complex safe
and survival mode concept based on uninterrupted attitude knowledge through on-board computer resets, the
autonomous High Gain Antenna guidance smoothing algorithm, and the gyro-stellar harmonic drift estimator.

1. THE MISSION
BepiColombo is the 5th Cornerstone of the ESA’s Cosmic Vision Programme, and is aimed at studying the
planet, its evolution and its surrounding environment in order to understand the process of planetary formation
and evolution in the hottest part of the proto- planetary nebula. In addition, the mission offers unique
possibilities for testing Einstein’s theory of general relativity.
The spacecraft is composed of two orbiters and one transfer module. One orbiter, the Mercury Planetary Orbiter
(MPO), is led by ESA and its payload comprises eleven experiments and instrument suites. The MPO will focus
on a global characterization of Mercury through the investigation of its interior, surface, exosphere and
magnetosphere and it will test Einstein’s theory of general relativity. The second orbiter, the Mercury
Magnetospheric Orbiter (MMO), is led by JAXA and will carry five experiments or instrument suites to study
the environment around the planet including the planet’s exosphere and magnetosphere, and their interaction
processes with the solar wind and the planet itself. In contrast to the MPO, the MMO is spin-stabilized and thus
requires protection from Sun illumination during cruise phase until it is deployed into its science orbit. This is
achieved with the dedicated MMO Sunshade and Interface (MOSIF) structure. The Mercury Transfer Module
(MTM) will provide the electrical and chemical propulsion systems and the required power for the
interplanetary cruise to Mercury. Upon arrival at Mercury after a cruise phase of about 7 years, the MTM will
be jettisoned and the chemical propulsion of the MPO will be used to inject both spacecraft into their dedicated
elliptical polar orbits.

Fig 1: Artists view of the the BepiColombo spacecraft ©ESA

Page 1 of 15
In summary the scientific objectives to be addressed by the BepiColombo mission can be listed as follows:
 Origin and evolution of a planet close to its parent star
 Mercury as a planet: form, interior structure, geology, composition and craters
 Mercury’s vestigial atmosphere (exosphere): composition and dynamics
 Mercury’s magnetized envelope (magnetosphere): structure and dynamics
 Origin of Mercury’s magnetic field
 Test of Einstein’s theory of general relativity

2. THE SPACECRAFT DESIGN

With its four modules in total, the BepiColombo spacecraft will commence its mission as a spacecraft stack, the
Mercury Composite Spacecraft (MCS) composed from the transfer module MTM, the two orbiters MPO and
MMO, and the MOSIF protecting the MMO.
The MTM is used to provide the needed impulse for the spacecraft during the cruise phase. This module
includes the Solar Electric Propulsion System (MEPS), the Chemical Propulsion System (CPS) and the
Electrical Power System by means of its own two solar array wings. Since the MPO requires all the
functionalities of a classical spacecraft, notably attitude control, communication and command and data
management, the MPO provides all the intelligence for the complete initial MCS, first operating the MTM
power and propulsion systems and - after separation of this module - operating its own chemical propulsion
system and receiving power from its own solar array. Both MTM and MPO solar arrays are rotated as a
function of spacecraft-Sun distance in order to control temperature and/or reduce torque loads on the spacecraft.
During cruise phase, the MPO solar array will be kept edge to Sun to minimize degradation. This is equivalent
to keeping the MPO SA wing in the spacecraft YZ plane. This is also in order to prevent plume impingement
from the MTM thrusters and not to protrude into the Sun sensors FOV.

MGA swath

MPO Radiator Side

HGA

MPO
Solar Array
+Y
+X
+Z

Fig 2: MCSS - MCS Stowed Fig 3: MCSC – Cruise configuration

The evolution of the spacecraft configuration along the mission phases is one of the major challenges for the
system and, in particular, for the AOCS due to the significant changes in spacecraft body properties and
subsystems to be controlled by the AOCS. At launch and during the autonomous launcher separation and
attitude acquisition sequence, the MCS will be in its launch (stowed) configuration, called MCSS (MCS -
Stowed). Following deployment of the outer appendages, it will be in its cruise configuration - MCSC (MCS -
Cruise), which will be the configuration for the long journey to Mercury. Shortly before arrival at Mercury, the
MCS performs its first staging by ejecting the MTM and transforms into a 2-module stack called Mercury
Approach configuration MCSA (MCS - Approach). Then, the MPO chemical propulsion system will produce
the deltaV needed for orbit capture and the orbit lowering to MMO and MPO operational orbits. The second
staging occurs with spin-up and separation of the MMO, leaving the spacecraft in its MCSO (MCS - Orbit)

Page 2 of 15
configuration. The final separation ejects the MOSIF – leaving the free-flying MPO to descend to its final
operational orbit.

+Y +X
+Z
+Y +X
+Y +X
+Z +Z
Fig 4: MCSA - MCS Approach Fig 5: MCSO - MCS Orbit Fig 6: MPO - Science Orbit

3. THE PRIMARY MISSION SYSTEM, AOCS AND FDIR REQUIREMENTS

Already during the interplanetary cruise phase the thermal environment will largely vary with a Sun distance of
1.16 AU down to 0.298 AU resulting in solar flux increasing up to 15 kW/m², i.e. up to 11 times the solar flux
experienced in Earth orbit. Also in its orbit around Mercury the BepiColombo spacecraft will face an
unforgiving environment with solar illumination varying from 6 to 14.5 kW/m² from aphelion to perihelion and
in addition Mercury infrared and albedo radiation of up to 4.5 kW/m². The thermal conditions become already
critical during cruise, when approaching the inner solar system, and are also a main driver of the very high
temperature sensitivity of appendages to attitude excursions. From the demanding thermal environment, the
numerous sensitive spacecraft surfaces (also called danger zones), which are listed in Table 1, are then a logical
consequence. During cruise, the Sun will always be kept in the Y/Z plane to avoid overheating of the MMO, the
MEPS and the MTM and MPO radiators. The MMO needs to be protected from Sun under all circumstances
until its separation. The severe solar and IR irradiation conditions in mission orbit require special protection of
the payload, the radiator and the solar array. In addition, the spacecraft design has to cope with major changes in
the spacecraft configuration over mission following each of the module separations.

The mission thus requires a very high level of onboard autonomy and a highly performing Avionics system
resulting in a continuous attitude and solar array control also in failure case. These requirements led to the
implementation of a second on-board computer (OBC), the so-called Failure Control Electronics (FCE), and a
second Inertial Measurement Unit (IMU) running in hot-redundancy to the main OBC and its own IMU. This is
explained further in sections 4 and 8.
Further in Mercury orbit, the environment requires unique functionalities for the operational concept. Without
special measures, the direct solar and IR illumination of the MPO radiator, of the solar array or the payload
could lead to an extreme increase of temperature and consequently loss of mission. In order to handle these
constraints the spacecraft attitude is synchronized with Mercury in Survival Mode.

In the case of BepiColombo it is not possible to define a single safe operational mode for the whole mission and
for all critical failure situations due to the large variation in the overall spacecraft configuration and the mission
phase dependent environmental constraints, e.g. the additional infrared radiation in Mercury orbit. Since
resources availability (e.g. Sun sensors covered by modules not yet separated) may imply additional constraints
on the safeguard modes, the safe mode design ended in two basic AOCS safe modes, as explained in section 8,
and in the following three Sun oriented safe mode attitudes used in MCSC, MCSA/O and MPO configuration:
 MCSC: rotation around the +Y axis, providing maximum Sun illumination safety margin towards MMO
and radiators
 MCSA/O: rotation around an axis close to +X, optimized for synchronisation to avoid payload, radiator or
MMO Sun illumination in the higher MCSA/O orbits
 MPO: rotation around an axis close to -Z, optimized for synchronisation to avoid illumination of the
payload and the MPO radiator in the low MPO science orbit

Page 3 of 15
These safe mode attitude configurations are of course supported by proper communication with ground.

As a consequence of the severe thermal conditions and high autonomy requirements, it is thus essential to react
fast to safety critical events and not to lose time with inefficient recovery attempts, while avoiding unnecessary
interrupts of normal operations as far as possible. Therefore a hierarchical Failure Detection Isolation and
Recovery (FDIR) concept has been implemented. This is further briefly explained in section 9.

The BepiColombo AOCS is moreover required to achieve a number of demanding performance requirements
(refer to Table 1). Firstly, trajectory manoeuvers required to reach the science orbit around Mercury shall be
achieved with a high accuracy: the Absolute Pointing Error (APE) of the thrust vector shall not exceed 0.5° half
cone. This requirement is especially challenging during the Mercury insertion, as at that time the ratio between
the overall thrust and the spacecraft inertia does not favor a high AOCS performance. Optimized thruster
modulators have then been developed specifically for BepiColombo to remove, and if not possible minimize,
the realization errors due to the thruster modulators. This point is further treated in section 10A.
Secondly, the contribution of the AOCS to the Relative Pointing Error (RPE) of the instruments‘ lines of sight
shall be less than 1 arcsec over 1s in NM. The HGA rate, acceleration and jerk are thus limited to reduce its
impact on the AOCS performance. The HGA is also only allowed to move within a complex, non-rectangular
domain. These two constraints require a dedicated on-board antenna guidance algorithm that is detailed further
in section 10B. When the HGA tracks the Earth or is being re-oriented, it generates significant disturbances on
the spacecraft. As a consequence, the AOCS controller includes a compensation of the HGA motion as
described in section 10C.
Thirdly, BepiColombo scientific goals require a very accurate estimation of the spacecraft attitude. In particular
the half-cone Attitude Measurement Error (AME) of the main instruments line of sight shall be less than 4
arcsec. The design of the Gyro-Stellar Estimator (GSE) has been set up such as to meet this requirement. This is
presented in section 10D.

Table 1: AOCS and FDIR primary requirements

AOCS primary requirements
Cruise Mercury Science
insertion orbit
APE of thrust vector: 0.5° X X
Contribution to the APE of the HGA & instruments' lines of sight:
X X X
10 arcsec (half-cone, 95%)
AME of the instruments’ lines of sight:
X
4 arcsec (half-cone, 95%)
Contribution to the RPE of the instruments‘ lines of sight:
X
1 arcsec over 1s (half-cone, 95%)
FDIR primary requirement: minimize Sun illumination in danger zones
Spacecraft danger zone Cruise Mercury Science
insertion orbit
MPO radiator: -Y axis hemisphere
X X X
(This implies the protection of the MTM radiator.)
MMO: -ZM axis, 93° half-cone. ZM is the Z axis, once tilted by 18°
X X
towards +Y axis
Payload: +Z axis, 37° half-cone X X
Electrical Propulsion System: +Z axis, 78° half-cone X
MPO SA: ±X axis, 87° half-cone X

4. THE SPACECRAFT'S AOCS

The AOCS is in charge of attitude and orbit control using sensors and actuators for autonomous attitude
determination and control as well as pre-programmed manoeuvring.
The BepiColombo AOCS is designed to fulfil the requirements imposed on the attitude and orbit control
subsystem in the context of the BepiColombo mission. The driving requirements originate from spacecraft
safety as explained in section 3, from payload needs/operations and from specific mission constraints (like
usage of solar electric propulsion, various module separations, harsh space environment, etc.).

The AOCS hardware architecture and interconnections are shown in Fig 7. The AOCS is built around the On-
Board Computer (OBC), Failure Correction Electronics (FCE) and the Remote Interface Units (RIU). The

Page 4 of 15
OBC/FCE is either communicating directly via the 1553B interfaces or via the Space Wire interface and the
RIUs to the AOCS sensors and actuators. This way, the Central Software with the embedded AOCS SW
exchange functional data with:
 the sensors:
 3 Star Trackers (STR),
 4 x 2 Fine Sun Sensors (FSS) and
 2 Inertial Measurement Units (IMU) where each IMU includes 4 gyros + 4 accelerometers,

 the actuators:
 the Reaction Wheel Assembly (RWA) consisting of 4 wheels and corresponding drive channels,
 the Reaction Control System (RCS),
 the High and Medium Gain Antenna Pointing Mechanism (HGAPM/MGAPM),
 the 3 Solar Array Drive Mechanisms (SADM), and
 the Solar Electrical Propulsion Subsystem (SEPS).

Fig 7: AOCS hardware architecture and interconnections

The BepiColombo mission software runs on the OBC processor module (PM). The OBC PM controls the
spacecraft under normal circumstances. There is a nominal and a redundant PM within the OBC. Autonomous
reconfigurations between the nominal and redundant PM are controlled by the OBC reconfiguration module
(RM). During an OBC emergency reset, the FCE PM takes over the attitude and solar array control of the
BepiColombo spacecraft. There is a nominal and a redundant FCE PM. The SpaceWire router connects the
OBC, the FCE and the MTM and MPO RIUs. Both the OBC and FCE are connected to the MPO/MTM SADEs

Page 5 of 15
via the 1553B MIL-BUS. Hence, both OBC and FCE can control the MPO and MTM transverse thrusters and
solar arrays, as required during normal and emergency operations. Note that the FCE does not use Sun sensor
measurements. Hence, an uninterrupted propagation of attitude knowledge across OBC and FCE is needed in
order to be able to perform attitude recovery.
Therefore, a new approach was baselined for the BepiColombo safe and survival mode. The spacecraft attitude
information is always known on-board with sufficient accuracy. This is achieved by maintaining the spacecraft
attitude information across a PM reset, performed either by the OBC or the FCE. Based on this attitude
information, when the FCE takes over attitude control, it keeps propagating the attitude by means of gyro
measurements coming from the IMU assigned to the FCE. This is sufficient for the short time until the OBC re-
gains the control of the spacecraft and retrieves also the attitude information from the FCE. On the OBC,
absolute attitude sensors (star trackers and Sun sensors) compensate for the accumulating gyro measurement
errors. During normal operation, the FCE attitude is regularly updated by the STR measurements.

The optical sensors of the AOCS, i.e. the star trackers and Sun sensors, are protected against the Sun
illumination. The aperture of each STR is protected by shutters as shown in Fig 8, which are closed in danger
situations (attitude loss and module separations). The shutters are operated via high power commands (HPC),
which can also be sent by the RM in an emergency case. Each Sun sensor is passively protected by
implementation of a Heat Rejection Filter in front of the Sun sensor’s aperture. Only 15% of the incoming Sun
light generates the photo current.

The following sections briefly describe the AOCS modes and the used sensors and actuators as well as the units
controlled by the AOCS. Also, the AOCS FDIR is addressed briefly.

5. AOCS SENSORS
The BepiColombo spacecraft is equipped with Sun sensors (FSS), star trackers (STR) and inertial measurement
units (IMU).

Star Tracker (STR)

BepiColombo carries three APS STRs. The STRs together with their baffles are accommodated within the
spacecraft behind the MPO radiator. Their boresights are almost equally separated on a half-cone, with a half-
cone angle of 47 degrees, and drawing almost a half-circle. The APS detector allows high measurement
frequencies of typically up to 10 Hz. On BepiColombo, the frequency is set at 8 Hz, which is sufficient for the
attitude measurement processing and eases the data traffic management on the MIL-BUS.

Fig 8: The BepiColombo STR unit in test environment

Inertial Measurement Unit (IMU)

There are two high precision IMU packages on BepiColombo (SSIRU - Scalable Space Inertial Reference Unit).
One is primarily associated with the OBC (IMU1) and the other is primarily associated with the FCE (IMU2).
Each IMU incorporates 4 gyro and 4 accelerometer measurement devices with a common redundant electrical
power interface.

For robustness reasons, both OBC and FCE can use the measurements from both IMUs. IMU1 is mounted on
the optical bench and therefore it must be used for the high-precision attitude estimation in combination with the
STRs. IMU2 is mounted on the +X panel (less thermal stability) and is therefore primarily for use by the FCE.

Page 6 of 15
Fine Sun Sensors (FSS)
The FSS is an analogue quadrant Sun sensor and provides two-axis Sun direction measurement over a 64°
square FOV. Specifically for the BepiColombo mission, each Sun sensor is passively protected by
implementation of a Heat Rejection Filter. FOV coverage is provided around the three Sun-pointed directions in
SASM (refer to section 3). In total, there are 8 identical FSSs on BepiColombo; and they are accommodated:
 A nominal and a redundant FSS is provided for the +X axis (MCSA/O and initially in MPO)
 A nominal and a redundant FSS is provided for the -Z axis (MPO)
 A nominal and a redundant Virtual Sun Sensor, VSS, is provided for the +Y axis (MCSS, MCSC). Each
VSS is made up of two FSSs whose boresights are inclined to the +Y axis in the XY plane. This provides
an overlap of 2  4° around the +Z axis, ensuring that (1) the +Y direction is contained within their
combined field of view, and (2) the MPO solar array is outside their individual fields of view.

Fig 9: The BepiColombo Fine Sun Sensor

6. AOCS ACTUATORS
The AOCS actuators are composed of reaction wheels, chemical and electric propulsion thrusters. The MTM
and MPO modules have their own chemical thruster systems, each composed of axial and transverse set of
thrusters.

Reaction Wheels (RW)

Four reaction wheels are accommodated on-board BepiColombo in a pyramidal configuration around the
spacecraft Y axis. Each wheel has a momentum storage capacity of about 23 Nms and provides a maximum net
torque capability of 0.2 Nm. The reaction wheels allow a smooth attitude control required for the stringent
pointing and stability requirements of BepiColombo. Also, the usage of reaction wheels minimises the required
amount of fuel and, hence, the overall system mass. Each RW is connected to its associated WDE. As shown in
Fig 7, there are two WDE boxes, each containing two WDE modules. The split of the WDE function into two
boxes was due to accommodation reasons.

Fig 10: The BepiColombo reaction wheels and wheel drive electronics boards

MTM axial and transverse thrusters

As shown in Fig 7, two sets of redundant 10N bi-propellant thrusters, an axial and a transverse set of thrusters,
have been included on the MTM. These thrusters are operated in blow-down mode providing a minimum
nominal thrust of 7.5N over their life time. The axial thrusters, in total 2x4, allow delta-V manoeuvres to be
performed along the -Z axis (the axial direction). The transverse thrusters, 2x8 in total, produce force in the YZ
plane and allow delta-Vs to be performed roughly in the +/-Y directions. Besides delta-V manoeuvres, the
transverse thrusters are also used for attitude control and wheel offloading. They are then operated such to

Page 7 of 15
produce no force (pure torque system). This was required in order not to alter the spacecraft trajectory when
using thrusters for attitude control and wheel offloading.

MTM electric propulsion thrusters

The mission uses solar electric propulsion (SEP) to perform the large delta-V adjustments on the way to
Mercury. The SEP engines are accommodated on the MTM using the electrical power provided by the MTM
solar arrays. The SEP associated functionality is called the MEPS function (MTM Electric Propulsion System
Function). The MEPS consists of three sub-systems:
 The Solar Electric Propulsion System (SEPS) that is used to provide thrust for the ΔV manoeuvres and for
wheel momentum off-loading. The SEPS consists of four SEP engines of which either one or two can be
used at the same time. The SEP engines are fed with Xenon, for which purpose a High Pressure
Regulation System is necessary, incorporating a high pressure regulator HPR and pressure regulation
electronics (PRE).
 The Thruster Pointing Assembly (TPA), which consists of four two-axis thruster pointing mechanisms
(TPMs, one per SEP engine) and their electronics (TPE). The TPA is used to orientate the SEP engines
relative to the spacecraft.
 The High-Pressure Regulation System (HPRS), which consists of High Pressure Regulators (HPRs) and
their electronics (PRE).

A dedicated application, the MEPS Control Function (MCF) has been implemented in the Central Software to
control the hardware equipment included in the MEPS function. The AOCS controls the MEPS through the
MEPS Control Function (MCF). The MCF is seen by the AOCS as a kind of virtual unit. The parameters of a
SEP burn manoeuvre (used SEP engines, spacecraft attitude, MTM solar array position profile, initial TPM
angles, SEP thrust levels, etc.) are commanded by ground. During a SEP manoeuvre, the TPM angles are
controlled by the AOCS around their ground commanded set-value and they are used to offload the wheels
when two SEP engines are used. When a single SEP engine is used, no offloading is possible along the SEP
thrust axis. In this case, the MTM CPS is used for momentum offloading along that axis.

At the beginning of the mission, only one thruster is required to provide a thrust of 75 - 145mN (as no more
electrical power can be delivered by the MTM SA far from the Sun), then two thrusters are simultaneously
operated to exert a total thrust of 145-290mN.

MPO axial and transverse thrusters

Two sets of redundant thrusters, an axial (22N) and a transverse (5N) set of thrusters, have been accommodated
on the MPO. The axial thrusters, in total 4x2, are operated in pressurized mode, providing a constant thrust level
over their operational life. They are bi-propellant thrusters operating on pure hydrazine + oxidizer (rather than
MMH+oxidizer), and producing a total thrust of 88N approximately in the –Z direction. These thrusters are
required to lower the spacecraft orbit around Mercury (i.e. the apoherm height) in order to achieve the final
MPO scientific orbit. After achieving the scientific orbit, the axial thrusters are not used anymore. The
transverse thrusters, in total 4x2 mono-propellant hydrazine thrusters, are initially operated in pressurized mode,
delivering an initial nominal thrust of 3.3N. Then, after achieving the scientific orbit, they are operated in blow
down mode providing a nominal thrust range of 3.3N to 2.7N. The transverse thrusters produce force in the YZ
plane and allow delta-Vs to be performed roughly in the +Y direction. Besides performing delta-V manoeuvres,
the transverse thrusters are also used for attitude control and wheel offloading. Their sizing dominated the
SASM attitude recovery performance of the MCSA/MCSO/MPO configurations.

7. EQUIPMENT CONTROLLED BY AOCS

Medium Gain Antenna (MGA)

The MGA is mounted on a two-axis drive mechanism in order to allow communication with ground during the
entire mission. The AOCS commands the MGA drive mechanism within the allowed MGA angular domain. For
the MGA, the allowed angular domain is equivalent to the range defined by the mechanical end-stops. In certain
configurations and modes, however, there are also functional limitations on the MGA angular domain. For
example, in the MPO configuration in SASM, the MGA boom angle domain is limited in order not to shadow
the MPO SA.

Page 8 of 15
High Gain antenna (HGA)
The HGA is mounted on a two-axis drive mechanism in order to allow communication with ground during the
entire mission. The AOCS commands the HGA drive mechanism within the allowed HGA angular domain. The
allowed HGA angular domain depends on the spacecraft configuration; one domain applies for the
MCSC/MCSA/MCSO configurations, i.e. while the MOSIF is attached, and one for the MPO configuration.
Leaving the allowed HGA angular domain in the MCSC/MCSA/MCSO configurations could damage the
spacecraft by collision with the MOSIF.

Solar Array drive mechanisms (MPO and MTM SADE/SADM pairs)

The solar arrays are attached to the spacecraft through rotary drive mechanisms, allowing a continuous rotation
around their length axis. The drive mechanisms are necessary to rotate the arrays to achieve the required
electrical power while keeping the array temperatures within the operational limits over the large range of the
Sun distance during the mission. Knowing the attitude with respect to the Sun, ground defines appropriate solar
array position angles that result in the required solar array Sun aspect angles.

8. AOCS MODES
An overview of the AOCS modes and transitions is shown in Fig 11. The AOCS mode logic includes two safe
modes (SASM, SHM) and three normal operational modes (NM, OCM, EPCM). The AOCS also possesses a
Standby mode (SBM), which is of no operational relevance from the ground’s points of view.

AOCS Mode Overview

Major system
SBM Power up
failure

CMD CMD
(After solar
array
deployment) SASM

CMD Auto CMD

SHM

TC

TC NM TC
EPCM OCM
TC or Auto Auto or TC

SBM: Standby Mode

SASM: Sun Acquisition and Survival Mode
Mode controlled
SHM: Safe Hold Mode
with thrusters
NM: Normal Mode
OCM: Orbit Control Mode
Mode controlled
EPCM: Electrical Propulsion Control Mode
with wheels
TC: Ground commanded mode transition
Mode controlled with
Auto: Autonomous mode transition triggered by AOCS
thrusters or wheels
CMD: Autonomous mode transition triggered by DMS

Fig 11: AOCS overall mode logic

SASM
The Sun Acquisition and Survival Mode, SASM, is dedicated to the initial Sun acquisition after launcher
separation and, later, to attitude recovery after OBC resets. Its definition in terms of attitude and solar array
guidance as well as ground communication is based on simple, hence, most reliable means. Nevertheless, its
implementation for the BepiColombo mission is extremely complex.

The control actuation is exclusively based on thrusters; no wheels are used for control. The attitude
measurement concept is based on rate and incremental attitude measurements from the IMU, Sun position

Page 9 of 15
measurements from the Sun sensor and 3-axis attitude measurement from the STRs (if available). In SASM, the
spacecraft is brought into a safe Sun pointing attitude with a rotation around the Sun direction which is different
for the spacecraft configurations, i.e. for MCSC, MCSA/O and MPO. Hence, each configuration has its specific
SASM definition in terms of attitude and solar array guidance as well as MGA strobing definition.

The SASM recovery logic is common for each configuration. The attitude recovery logic first re-acquires the
Sun pointing attitude after having damped the spacecraft rate. This is performed either by the FCE or the OBC
depending on the type of the OBC PM reset (emergency/nominal). During this period of SASM, the relevant
solar array is pointed edge on to the Sun at a maximum speed of 6 deg/s. This safeguards the solar array from
potential over-heating in the attitude loss situation. When stable attitude and solar array pointing is achieved, the
handover from FCE to OBC is performed in case of an emergency OBC reset situation.
Further, the SASM logic moves the antennas to safe positions in order to avoid reflection/shadowing effects
with respect to Sun sensors and the MPO solar array. The relevant solar array is moved to the position defined
by ground resulting in stable electrical power generation (excluding eclipse periods). The spacecraft rotation
around the Sun line starts and the Sun sensors are used to maintain accurately the Sun on the required body axis.
After a cool-down period, the STR shutters are opened. From this point onwards, the STRs replace the Sun
sensors in the attitude estimator algorithm. Finally, if the AOCS cannot proceed to the next mode (Safe Hold
Mode), the SASM phase is entered where ground communication is possible via MGA strobing. In SASM, a
sequence of solar array position angles are defined on-board which are autonomously commanded by the AOCS
according to the on-board time.
Before solar array deployment, when the FCE is not yet used, a Sun search strategy is used in SASM to find the
Sun and establish the Sun oriented attitude of the spacecraft with its Y axis pointed to the Sun. For this purpose
only the VSS is used.

SHM
The Safe and Hold Mode, SHM, is normally the AOCS mode where the AOCS waits for ground intervention
after an OBC reset. It is more fuel economic than SASM because the attitude is eventually controlled on wheels.
The attitude is estimated by the gyro-stellar estimator. Ground communication is maintained by the MGA in
Earth tracking mode but optionally the HGA can also be used. Wheel offloading is managed autonomously by
the AOCS.
The attitude guidance is defined by Chebyshev polynomials and harmonic series pre-loaded by ground. The
MCSA/O/MPO configurations use solar array guidance profile defined by Chebyshev polynomials in SHM. The
MTM SA guidance profile is defined by a sequence of discrete position angles as in SASM.

In comparison to SASM, SHM is a more complex mode in terms of its definition of attitude and solar array
guidance and control, and communication with ground which requires the Earth ephemeris. Hence, SHM
provides better communication with ground supported by accurate attitude pointing on wheels than SASM. This
mode however requires more complex information defined and maintained by ground and which is valid for the
given autonomy period only. Hence, the distinction between the SASM and SHM modes is fundamental from
the spacecraft autonomy point of view to be robust also against ground operations failures. All necessary
information (e.g. attitude and solar guidance) required in SASM and SHM are loaded from SGM EEPROM at
entry to SASM thereby ensuring always consistent mode definitions.

NM
The Normal Mode, NM, is the central mode of ground operations. From SHM, it is entered by ground command
only. The same guidance profiles and attitude control equipment are used in NM as in SHM. Hence, this
transition is rather smooth. However, there are responsibilities of ground which do not apply in SHM but do in
NM. For example, in the scientific phase of the MPO configuration, the transition from the attitude orientation
in SHM to the nadir orientation in NM is ground’s responsibility. In SHM, wheel offloading is autonomously
performed by the AOCS whereas it has to be commanded by ground in NM. This is a consequence of the
necessity to pre-heat the MPO hydrazine thrusters’ catalyst bed heaters in the MPO orbit before their usage
(which are normally switched off for power reasons). Both the MGA and HGA can be used for communication
with ground most preferably in Earth tracking mode.
In the MPO configuration, the gyro-stellar attitude estimation algorithm can be configured such as to provide its
highest accuracy performance by means of harmonic drift estimation at orbital frequency and its second
harmonic (see section 10.D).

OCM
The Orbit Control Mode, OCM, provides the specific service of performing delta-Vs by means of the chemical
propulsion system (CPS). Both the MPO and MTM modules have their own CPS comprising an axial and a

Page 10 of 15
transverse thruster system. Large delta-V manoeuvres are to be performed by the axial thrusters for fuel
economic reasons whereas small delta-V and navigation manoeuvres can be performed by means of the
transverse thrusters as convenient. Attitude constraints might also prevent ground from using the axial thrusters
(e.g. for thermal reasons) in which case the less efficient transverse thrusters are used. The performance of
different thruster modulators have been assessed and eventually developed to command the MTM and MPO
axial and transverse thrusters (see section 10.A). A thrust ramp function is applied to mitigate fuel sloshing
effects and minimize the initial attitude pointing error. The OCM mode is subdivided into two phases: the thrust
firing phase and the thrust tranquillization phase from where Normal Mode can be entered.

The accelerometers can be used during delta-V manoeuvres for measuring the performed delta-V (the other
option to measure the delta-V is the thruster impulse counting method which is however less accurate for large
burns). Either a single set of accelerometers from one IMU or both sets of accelerometers can be used. Using
both sets of accelerometers reduces the risk that the accelerometer data becomes invalid during the burn because
immediate isolation of the failed channel is performed by the FDIR algorithms. The Mercury Orbit Insertion
(MOI) burns, which are critical with regard to spacecraft and solar array guidance in case the burn is aborted,
are performed on accelerometers. Should the accelerometer data become invalid during these critical burns, an
entry to SASM is performed. Then, in SASM, the spacecraft and solar array guidance are corrected according to
the achieved burn by the Guidance Correction Function (GCF). The GCF adapts the SASM/SHM autonomous
attitude guidance parameters as a function of the achieved delta-V to maintain a correct rotation phase that is
synchronized with the orbital rate for thermal and STR blinding reasons.

EPCM
The Electric Propulsion Control Mode, EPCM, is dedicated to the specific needs of performing delta-V
manoeuvres using the Solar Electric Propulsion engines (SEP). The attitude control equipment used in EPCM is
the same as used in NM. The wheels are however continuously offloaded by means of the SEP engines. If only
one SEP engine is used for thrusting (e.g. when no sufficient electrical power is available due to large Sun
distance), an offloading of the wheel momentum is not possible along the SEP thrust axis. Hence, the chemical
thrusters are used for this purpose.
The EPCM design incorporates the autonomous reorientation of the spacecraft and MTM solar array such as to
provide the SEP thrust in the required inertial direction and to provide the necessary electrical power for the
SEP engines. The reorientation slew between the NM and EPCM attitude guidance profiles is computed
autonomously on-board based on target profiles defined by ground while respecting the constraint to keep the
Sun in the YZ plane.
The SEP thrust manoeuvre is optionally continued in a MEPS failure case after the necessary reconfigurations.
The backup SEP engine pairs together with the backup attitude and solar array guidance profiles are defined by
ground in advance to the EPCM manoeuvre. When the SEP engines are reconfigured, the spacecraft and MTM
solar array must also be re-oriented accordingly. This is performed autonomously by the AOCS.

9. AOCS FDIR
As already mentioned, a hierarchical Failure Detection Isolation and Recovery (FDIR) concept has been
implemented across the System. In order to maximize the system availability for normal operations, the aim is
to recover from failures at the lowest possible level, where possible, before recourse to a higher level involving
system back-up modes. This is handled by a Redundancy Management Level at the bottom and a System Safety
Level at higher stages of the hierarchy, which - in a last stage - serves to safe-guarding the system by means of
hardware temperature and battery low voltage alarms. The essential difference between the two global levels is
that in the Redundancy Management Level the failure can be unambiguously identified and isolated by local
reconfiguration, whereas in the System Safety Level the origin of the problem cannot be immediately identified
on-board and therefore the principle ‘safety first’ must be followed to avert the possible danger. This includes in
particular the immediate safeguarding of payload, solar array and Attitude and Orbit Control System (AOCS).

The AOCS FDIR is conceptually embedded into the System FDIR, though it represents a self-standing function.
The AOCS FDIR detects and isolates failures within the AOCS function. The AOCS FDIR has a hierarchical
structure and is composed of three levels: 1) unit level, 2) functional level (e.g. cross check between units) and
3) the global level (e.g. spacecraft rate and attitude monitoring). The tuning of the FDIR surveillance thresholds
ensures that the lower levels trigger before the higher levels. The reaction to a failure depends on the failure and
the associated FDIR level. In general, the reaction is such that the impact to the overall system is the minimum
required to isolate the suspected failure.
For the BepiColombo mission, the outmost objective of the FDIR is to safeguard the spacecraft attitude
information which is correctly maintained on board all the time, even across a PM reset. This is achieved at the

Page 11 of 15
cost of increased design complexity. The FDIR ensures this requirement by means of, first of all, the FCE with
its associated IMU and respective STR and IMU unit surveillances as well as consistency checks across units
which are implemented at AOCS level.

10. AOCS ALGORITHMS

A. THRUSTER MODULATORS
BepiColombo embeds a large number of thrusters spread among the two main modules (MTM and MPO) as
described in section 6. These thrusters are split into two categories: the axial thrusters, mainly devoted to the
large delta-V production required for the insertion of the spacecraft around Mercury and flybys, and transverse
thrusters. This second category of thruster is principally used for attitude control in survival mode and wheel-off
loading in upper modes (SHM and NM). In addition, constraints imposed to the spacecraft attitude (to ensure
thermally safe condition for the danger zones listed in Table 1) do not allow performing delta-V manoeuvers in
all directions using axial thrusters. Thus, this second category is also used to perform transverse delta-V
manoeuvers. The complexity resulting from the large number of thrusters, their combination with respect to the
different types of manoeuvre, and S/C configuration makes the thruster management and thruster modulation a
major function of the AOCS.

There are five algorithms of thruster modulator in BepiColombo to cope with the very stringent requirements on
consumption and precision in presence of thruster geometric configurations that are degenerate (i.e. insufficient
number of thrusters with respect to the degrees of freedom to be controlled).

There are three kinds of algorithms:

 Look-Up-tables: MTM transverse thrusters used for attitude control, e.g. in SASM, allow per axis pure
torque production. A simple and efficient way to implement thruster modulation is to use a six vectors
look-up-table (three axes / two signs) defining the thrusters involved in per axis torque production. The
algorithm ensures that the provided torque is accurate in direction and also in norm.
 Pseudo-Inverse: axial OCM manoeuvre and MPO attitude control thruster modulators rely on pseudo-
inverse algorithms. This algorithm makes use of the pseudo-inverse of the influence matrix. The
computed thruster on-time commands are outside the domain (i.e. positive and smaller than the
actuation period) and are moved into their domain using a gradient descent vector of the kernel of the
influence matrix. The algorithms give priority to torque delivery.
 Simplex: MTM transverse thruster configuration is not efficient for OCM transverse manoeuver. Thus,
for propellant consumption optimization purposes, a heuristic version of the simplex algorithm was
implemented on board. This heuristic version provides the same results as the simplex algorithm but
with a predetermined, bounded, and limited number of iterations.

The MPO transverse OCM manoeuvers requires controlling five degrees of freedom with the four MPO tilted
thrusters. In practice, this problem is not feasible. A variant of the pseudo-inverse algorithm has been developed
specially to deal with this singularity. This algorithm minimizes the norm of the force realization error while
giving priority to torque delivery. First the thruster command to produce the requested torque is computed.
Then, a thruster command from the null space of the torque influence matrix is added such that the norm of the
total produced force is equal to the norm of the requested force.

It is finally noted that the algorithms pre-compensate for some deterministic effects of thrusters. The most
emblematic compensation concerns under-efficiencies for small on-times.

B. HGA/MGA GUIDANCE
The link with the Ground via the HGA or MGA must be maintained as long as possible. This is achieved thanks
to the two-axis pointing mechanism of the HGA in Normal Mode or of the MGA in Safe Hold Mode.
The antenna guidance algorithm commands the required articulation angles and rates to point the antenna
towards the Earth. As the spacecraft is rotating about a quasi-inertial spin axis, both during the cruise and at
Mercury orbit, the Earth direction describes a cone in spacecraft frame that the antenna must follow to track the
Earth.
The function autonomously computes the required commands using the Earth direction ephemeris that is
uploaded by the Ground.

Page 12 of 15
The HGA/MGA guidance has been designed under two main constraints:
1. In Normal Mode, the contribution of the AOCS to the APE of the HGA and of the instruments’ line of
sight must be below 10 arcsec and the contribution to the RPE (relative pointing error) of the
instruments’ line of sight must be below 1 arcsec over an interval of 1 sec, during the science
operations (recalled from Table 1).
2. The guidance must command the antenna mechanisms inside their allowed domains, which are defined
to avoid clashes with the structure.

To achieve the stringent AOCS performance requirements, the on-board guidance algorithm autonomously
limits the commanded antenna angular rate, acceleration and jerk. The limitations are always applied, i.e. both
when tracking the Earth and when accelerating/decelerating, e.g. close to a boundary of the allowed domain.
This reduces significantly the reaction torques exerted on the central body due to the antenna motion.

Rally points after

mechanical blockages

Rotation Boundary
direction avoidance

Track loss due to the

HGA dynamics limits

Fig 12: Example of HGA commanded profile (blue), to track the Earth direction (green) inside the allowed domain (red)

The HGA domain contains two boundaries that are neither vertical nor horizontal, i.e. that couple the two
articulation axes, the azimuth and the elevation, as shown in Fig 12. Consequently, the dynamics limitations are
not managed independently axis by axis, but together in the azimuth/elevation plane.

Fig 12 shows in green an example of theoretic profile that the antenna must follow to track the Earth in green
and the commanded smoothed profile in blue that is limited in rate, acceleration and jerk. Two periods of the
spacecraft rotation rate are shown. As it can be seen, the Earth direction goes two times per period out of the
HGA domain. Note that this example is a worst case in terms of required HGA rate to track the Earth because
the angle between the Earth direction and the S/C rotation axis is 90 degrees. In case the Earth direction is out of
the domain, the antenna is commanded to a rally point to wait until the S/C rotation brings it back inside the
domain.

Page 13 of 15
 C. ATTITUDE CONTROLLER
One challenge of the mission is to satisfy the APE and RPE requirements presented in Table 1 despite the
disturbances generated by the moving appendages.

The first step of the solution consists in smoothing the movement of the HGA, autonomously as explained in
section 10B, and of the MPO solar array to reduce the reaction torques. For the MPO solar array, the smoothed
guidance profile is directly uploaded by the Ground given the complexity of the conflicting power and thermal
constraints.
As a second step, the complete 3-axis reaction torques arising from the antennas and the MPO solar array are
calculated on-board and pre-compensated in open-loop by feeding them forward to the attitude controller.

Apart from the appendage reaction torque compensation, the attitude controller is composed of a classical PID
controller with a filter to cope with the solar array flexible modes and of the feed-forward compensations of the
guidance acceleration torque and of the gyroscopic torque.
Despite the classical controller structure, advanced methods have been used for tuning, including a structured
H-infinity optimisation method for robust rejection in phase of sloshing and flexible modes. An example of the
resulting frequency response over the uncertainty range is given in Fig 13 for OCM in MCSC configuration.

Sloshing
modes

First flexible
mode

Fig 13: Open loop frequency response of X axis attitude control over uncertainty range (for OCM in MCSC configuration)

D. GYRO-STELLAR ESTIMATOR
The demanding BepiColombo AME requirements made it necessary to select a cutting-edge technology for
GYRO and STR, as presented in section 5 as well as a specific gyro-stellar estimator (GSE).
The AME requirement during Mercury nadir pointing is equal to 4 arcsec, half-cone (95% confidence level),
considering the gyro-stellar attitude estimation errors as well as the effect of temperature variations on star
tracker and gyro internal alignment.

The driving feature for the design of the BepiColombo GSE is the shape of the MPO science orbit, which is
elliptic.

Page 14 of 15
 Mercury Sun
mean =
Apoherm Periherm 7.5110-4 rad/s

1 orbit

Fig 14: MPO science orbit (left) and spacecraft angular rate profile in nadir pointing (right)

With the elliptic orbit, the spacecraft angular rate in nadir pointing is non-constant. The combination of the
GYRO scale factors and the varying spacecraft angular rate results in a varying drift at the orbital period.

One logical way to remove the effects of the GYRO scale factors would be to estimate the full equivalent scale
factor matrix. However, such estimation is only efficient for a spacecraft that performs frequent attitude slews
about all the spacecraft axes, which is not the case of the MPO. Indeed, the MPO remains nadir pointing most of
the time, which does not allow estimating the full scale factor matrix.
Consequently, rather than estimating the GYRO scale factors at the source, the GSE has been designed to
estimate their effects in nadir pointing. In addition to the attitude and constant drift states, the GSE estimates the
harmonic drifts at the orbital frequency and at its second harmonic. This allows a very good approximation of
the elliptic drift induced by the elliptic angular rate.
This design is fully appropriate for BepiColombo since the stringent AME requirements are applicable on nadir
pointing attitude only. This approach has also the advantage of estimating the thermal contribution of the GYRO
(periodic misalignment distortions and periodic scale factors).

11. CONCLUSION
The BepiColombo mission is a planetary exploration mission imposing demanding requirements on the AOCS
on the way to Mercury and in the mission scientific orbit. It employs a hot-redundant processor scheme together
with uninterrupted on-board 3-axis attitude knowledge for fast attitude recovery during emergency
reconfigurations. It uses solar electric propulsion during the cruise phase for delivering the required impulse.
For mass saving purposes, the solar electric engines are also used for wheel offloading during the electrical
thrust phases and extensive work has been invested also in the development of the thruster modulator algorithms
to get the best accuracy while being fuel efficient. The pointing requirements resulted in complex design tasks
with regard to attitude measurement, control accuracy, and antenna guidance.
The design definition and validation of the complex AOCS architecture and FDIR was successfully achieved
thanks to a hand in hand working between the prime contractor in Germany and the AOCS and SW teams in
France.

12. ACKNOWLEDGEMENTS
The authors would like to express their appreciation and honour to all colleagues at ESA and AIRBUS Defence
and Space for their fruitful cooperation on the way to define the BepiColombo AOCS. Special honour is
dedicated to Robert S. Harris (RHEA), already in retirement, and Alessandro Pasetti (P&P Software) for their
outstanding contribution to the BepiColombo AOCS design definition and verification.

References:
[1] ESA BepiColombo Mission website (http://sci.esa.int/bepicolombo)

Page 15 of 15

View publication stats