ENVISAT Gyro Monitoring & Early Warning: Operational Assessment of an Advanced Prototype Tool

Gyroscopes are instruments capable of sensing changes in their inertial orientation. Satellites usually have gyroscopes within their Attitude and Orbit Control System as attitude (orientation) sensors that measure angular displacements. They are critical components and constantly monitored during the duration of the mission. In face of serious failures, proper corrective actions are possible, but their execution depends on the time available for the spacecraft operators to react. Currently used gyroscope monitoring methods (low-level hardware checks and verification of operational parameters) are adequate for detecting failures that can happen in the short-term but fail to identify anomalies developing in the long-term. To detect these long-term degradation trends, spacecraft operation engineers perform on a routine basis detailed analysis of the power spectral density properties of the gyroscope output. In a real in-flight situation, the decision made by the control team to declare a gyroscope faulty depends on a qualitative reasoning based on operational experience. This paper describes in the first part a model for gyroscope fault detection based on a fuzzy expert system solution that formalizes and captures the knowledge and experience gathered in different space missions. This expert system provides the flight control engineers with a new type of gyroscope health diagnostic tool. This diagnostic tool generates alarms with different degrees of criticality and a severity level of the alarm itself, instead of a simple presence/absence of the alarm. It also supplies a detailed explanation of the alarm to assist the operations engineer in the failure analysis. The model presented here is embedded in a decision support system, the ENVISAT Gyroscope Monitoring Tool (EGM), specifically designed for monitoring the ENVISAT gyroscopes sensor package. The ENVISAT Flight Control Team has been using the EGM tool during the various spacecraft mission phases including LEOP, commissioning and routine operations. In particular, this tool has been providing the flight control team with the capability of performing critical activities such as weekly gyroscopes health and performance verification for the used sensors, and heath assessment during the yearly maintenance of the backup gyroscopes. SpaceOps 2004 Conference Montreal, Canada – May 17 – 21 2004 2 of 10 In the second part of the paper, an assessment of the 18 months long operational validation campaign is discussed together with the significant results acquired so far in terms of tool reliability in generating correct early warnings of performance degradation and supporting the associated diagnostic process. Introduction Successor of the ERS 1&2 satellites, ENVISAT is the new component of the European Remote Sensing (ERS) program, a long-term program of environmental remote sensing of the Earth. This initiative aims to collect highly reliable data on the entire planet to be used in scientific studies of critical environmental problems. ENVISAT is the largest spacecraft ever built by Europe, designed to fulfil an Earth observation and imaging mission. It is orbiting on a sun-synchronous orbit, at 800 km altitude and carries a suite of 10 instruments comprising both optical and radar imaging payloads [1]. ENVISAT was launched by an Ariane V rocket on the 1 of March 2002. Following successful completion of LEOP (Launch and Early Orbit Phase) and Commissioning, ENVISAT officially entered the routine mission phase in January 2003. Figure 1: Artist view of ENVISAT in orbit configuration Optimum instruments performance and correct platform functioning result in very strict constraints in terms of spacecraft pointing accuracy and stability. To meet these demanding requirements, ENVISAT uses four two-axis dry tuned gyroscopes in its Inertial Measurement Unit, one of the main components of the Attitude Estimation and Control System. This unit is used in all satellite Operational Modes, as well as Back-up Modes (Attitude Acquisition and Safe Mode). Gyroscope units mounted in ENVISAT are essentially mechanical devices subject to drift and ageing. Any performance degradation as well as minor/major equipment failures of the Inertial Measurement Unit has to be considered as potentially critical as it could severely impact the spacecraft ability to meet its objectives and even result in loss of mission. Therefore, the gyroscope assembly has a built-in redundancy (i.e. there are more sensitive axis and gyroscopes than necessary) to provide measurement output coherency automatic verification and specially to supply backup gyros in case of prime sensors anomaly. Moreover, a technical solution to assist in the monitoring of the short and long term evolution SpaceOps 2004 Conference Montreal, Canada – May 17 – 21 2004 3 of 10 of the ENVISAT gyroscopes was required to support the Flight Control Team during operations in all mission phases. Current Gyroscope Monitoring Techniques Flight control engineers have learnt from experience during past missions how to recognize gyroscope progressive degradation through specific data transformation, data analysis and engineering judgment. In particular, three main fault-detection monitoring techniques are traditionally applied: • In orbit autonomous surveillance algorithms. These are automatic checks performed by the flight software at on-board computer level. • Out of Limits alarms issued by the Mission Control System based on spacecraft telemetry data. Out of Limits alarms are simple crisp rules, a range or a fixed value is defined for a parameter. If the parameter goes outside the range or differs from the fix status then an Out of Limit alarm is issued to the spacecraft controller. • On ground off-line analysis of gyroscope telemetry data, performed by the Flight Control and Flight Dynamics Teams. This activity involves detailed studies of the power spectral density, noise and scale factors properties of the gyroscope output allowing assessment of sensor performance trends. These techniques have their own advantages and disadvantages for the diagnostic task. They are targeted for short-term detection and avoidance of false alarms and therefore they will not trigger any intermediate alarm levels. In addition, they are defined as a set of rigid rules where each rule either is satisfied or not. A target sensor parameter can stay within limits, but the actual pattern of the gyroscope data may represent a signature of future problems [2]. In summary, traditional monitoring techniques might not be able to detect in advance long-term degradation trends. ENVISAT Gyroscope Monitoring Tool Implementation of a specific monitoring tool was proposed by the ENVISAT flight control engineers to improve their capability of assessing operational gyroscopes performance and to enhance early failure detection allowing reconfiguration of the affected unit without hampering the spacecraft’s operational status and productivity. The Operational Prototype of the ENVISAT Gyro Monitoring Tool, hereafter referred to as the EGM Tool, was developed for the Flight Control Team of the ENVISAT satellite by “GTD Ingeniería de Systemas y de Software” and “Uninova Instituto de Desenvolvimento de Novas Tecnologias”, in the frame of the Fuzzy Logic for Mission Control Processes Program. This project aimed at designing and implementing a gyroscope fault detection model based on a fuzzy expert system solution that formalizes and captures the knowledge of the ENVISAT gyroscope SpaceOps 2004 Conference Montreal, Canada – May 17 – 21 2004 4 of 10 assembly. Deciding that a fuzzy expert system approach was applicable and adequate to this problem came from realizing that: • No detailed mathematical model exists to describe the overall gyroscope degradation process. • Experts perform the detection of potential anomalies that occur in the long-term based on engineering judgement. However, for ENVISAT the knowledge to diagnose them in a gyroscope was already partially formalized in a set of crisp rules defined at spacecraft Flight Operations Manual level. Each rule had an associated alarm types and the different types corresponded to various criticality levels [2]. The expected benefits of the fuzzy logic approach, comparing to a direct use of the crisp rules, are related to the nature of the gyroscope degradation observed usually. The traditional monitoring approach issues an alarm only when the current status crosses some pre-defined levels. However, this technique does not focus on the potential benefits brought by the early identification of gradual degradation processes. With the fuzzy logic approach, it is possible to express statements such as "The deviation of the current status from the nominal situation is not tolerable" and obtain a measure of how true such a statement is. The result of the fuzzy expert system allows the spacecraft operations engineer to detect earlier a potential failure, by looking at the evolution of the diagnostic, instead of waiting for the alarm to be declared. Fuzzy Logic is therefore well suited for the implementation of a set of experience-based rules provided by the Gyro manufacturer and partly based on previous missions experience (like ERS 1&2), whereas it would be quite difficult, if not impossible, to describe the gyro degradation process by means of an overall analytical model. Furthermore, Fuzzy Logic naturally offers the benefit of generating intermediate alarm levels that can greatly enhance a traditional monitoring strategy strictly based on Out Of Limit checks. In summary, the main expected benefits deriving from usage of a Fuzzy Logic based monitoring tool are: • Enhance the traditional gyro monitoring techniques and allow for early detection of potential degradation patterns. • Improve situation awareness allowing preventive measures instead of corrective ones. • Mitigate risk of mission disruption due to sudden gyro failure. • Automate routine gyroscopes telemetry data analysis processing tasks. Gyro Monitoring Tool Design The EGM Tool architecture is based on three different diagnostic models [4]: • Gyro Diagnostic model. • System Diagnostic model. SpaceOps 2004 Conference Montreal, Canada – May 17 – 21 2004 5 of 10 • Data Quality model. The EGM Gyro Diagnostic model implements a set of rules intended to discriminate the shape of the spectrum of a healthy gyro from that of a potentially faulty sensor. This model is mostly based on the Power Spectral Density (PSD) of the gyro signal and the associated signal and noise contents. In summary, the output signal of a gyroscope should have certain properties, specifically a nominal PSD profile, specific noise levels and, in the case of ENVISAT, a well known PSD peak at the so-called hunting frequency should be observable. The hunting frequency acts like a signature of the gyroscope health status and qualitative changes to it can be related with specific mechanical failures. Gyroscope diagnostic variables are all based on the PSD of each gyroscope output, the IDVA (Integrateur Digital de Vitesse Angulaire or Angular Speed Digital Integrator), an 8Hz snapshot of the contents of a simple digital counter, updated when the gyroscope senses a rate change in the sensitive axis. Figure 1 provides an overview of the two sets of diagnostic variables implementing the Gyro Diagnostic model: hunting noise and gyro noise. In addition, the figure also summarizes the crisp rules used in the fuzzy expert system and the different alarm types. These variables and rules were provided by the IMU assembly manufacturer [2]. Analysis of Hunting Noise ∆IDVA PSD Analysis Analysis of Gyro Noise No more Hunting Hunting Frequency Shift Hunting Frequency Energy Random Noise Change Hunting Noise Energy Change AND NOT Random Noise Change Hunting Shift OR No Hunting Alert Hunting Noise Alert Gyro Noise Alert Figure 1: Gyroscope Diagnostic model overview The EGM System Diagnostic model implements a set of rules intended to associate a potential gyro failure pattern to other macroscopic (i.e. satellite level) effects. For instance, a variation of the gyro spectrum due to an increase of the gyro wheel friction torque might be associated to an anomalous evolution of the gyro drift as estimated by the on-board Kalman filter. Basically the system model is devoted to identify any anomalous behaviour of the on-board estimator in order to possibly associate this to gyro failure patterns. SpaceOps 2004 Conference Montreal, Canada – May 17 – 21 2004 6 of 10 Finally, the EGM Data Quality model is intended to provide an indication (in the Fuzzy Logic sense) about the quality of the telemetry data fed as an input into the EGM tool. In order to fulfil all monitoring tasks described in the ENVISAT AOCS Flight Operations Manual, the nominal usage of the EGM Tool consists in the analysis of 2 orbits (i.e. 200 minutes) of gyro telemetry every week and the production of the relative diagnostic. Figure 2 provides an overview of the gyroscope telemetry analysis process: • Selected telemetry data is pre-processed to generate a set of derived variables (i.e. signal PSD profile, noise, hunting frequency and energy, random noise, etc). • The computed values are transformed into fuzzy sets using specific membership functions. • The three different diagnostic models are applied to the fuzzy data sets by means of mission specific rules. • The analysis output is transformed into an alarm type and level.