Landsat 8's Emergency RMM

Landsat 8's Emergency RMM A Quick-Turnaround Method Bob Scheid Landsat 8 Flight Operations KBRwyle Goddard Space Flight Center, MD November 5, 2016

Agenda Brief overview of Landsat s mission and command loads Risk Mitigation Maneuvers (RMM) for debris avoidance Nominal Process (old method) New Process (Emergency RMM E-RMM) Case Study: 24 April 2016 First use of E-RMM process to mitigate risk Reference Material 2

Landsat 8 Mission Overview Key Elements Landsat 8 is a medium-resolution (30m ground sample, 185km swath width), well-calibrated Earth imaging satellite building on a 43-year history of NASA/USGS Earth science data collection from space Primary instrument: Operational Land Imager (OLI) Secondary instrument: Thermal Infrared Sensor (TIRS) Data are geometrically corrected; operations control box is relatively tight Sun-synchronous, 705km orbit Busy area with tight control requirements Lots of traffic, lots of debris Drag is still a major factor 3

Standardized Command Loads Daily Load Buffers Main command load controlling daily activities Maintain spacecraft communication, housekeeping, and science operations schedule Take weeks to plan (e.g. Collect pool, special requests), hours to generate, hours to modify (or regenerate) Uplinked at least a few hours in advance (nominally 8 9 hours) Operate on absolute timestamps Relative Time Sequences (RTS) Permanent, routine, rigorously controlled command sequences Commands are issued at predetermined intervals (relative time) Activate communications subsystems, prepare for spacecraft burns, recover from onboard failures 4

Relative Operation Sequence (ROS) Small (<1kB), can be uplinked quickly Sequential commands separated by defined offsets (delays) in seconds and/or fractional seconds Can be purpose-built in minutes, rather than days for the primary stored command loads on the spacecraft Lots of uses Science data file maintenance on the spacecraft on-board recorder Reset balky equipment without operator intervention Perform special operations with fewer person-hours Test new methodologies and operations concepts Perform other repetitive, routine operations 5

Risk Mitigation Maneuver (RMM) aka Debris Avoidance Maneuver A propulsive maneuver designed to increase separation (reducing the probability of collision) between the spacecraft and, usually, debris with a predicted close approach (CA) We usually have a few days warning of a CA, but occasionally the CA is less than 24 hours away. Because the secondary object is usually not maneuverable, the orbit geometry dictates the time and magnitude of the burn, and all the action falls on us 6

The Old (Nominal) Process When a burn may be required, begin planning ~3 days in advance Build and uplink the main spacecraft command load with bestguess maneuver inputs This guarantees loss of science data because the sensors must be deactivated prior to the burn (to prevent contamination or damage) This is also the point of burn sequence commit, and can be up to 50 hours before the actual ignition time Manual special-purpose commanding is sometimes required to modify any burn parameters, leading to the potential for bad or missing commands If atmospheric drag changes, we risk over-burning and potentially leaving the control box or under-burning and not mitigating the risk sufficiently If we waive the maneuver after load uplink and prior to burn, the maneuver will not execute, but science data will still be lost 7

The New (E-RMM) Process Utilizes ROS buffers and two Ground Command Procedures ENABLE/EXECUTE buffers UNLOAD buffers, cleanup and return to nominal operations Build and review buffers A computer script reads a short simple text input file and produces a binary (ROS) file for review and uplink ROS file can easily be rebuilt if commanding fails on a particular contact or if burn parameters change Load buffers to spacecraft Takes ~2 minutes Enable buffers to execute maneuver or leave buffers disabled to waive the maneuver 8

The New (E-RMM) Process - Benefits A single-page text file is filled out with key times and burn parameters; human-readable for easy review Time of Ignition (TIG) Thruster durations Times for payload safing and resuming science operation Allows shorter lead time for maneuver before the Time of Closest Approach (TCA) Process requires less effort, time, and uncertainty ROS buffers vs primary load Much less commanding than performing a manual burn Inputs are completely adjustable until uplink (and can be modified afterward) 9

The New Process Benefits (cont) Ultimately, the biggest benefit is that we can wait until the last minute to burn (with the best inputs available at that time), or to wave off (which is usually the case) Limiting factor for time of ROS buffer load becomes the need for a post-burn analysis from the conjunction assessment group that the maneuver does not put us in danger of a new predicted CA In some waive/abort scenarios, NO science imaging will be lost 10

Case Study: Using E-RMM on 24 April 2016 First instance of using the E-RMM process in anger Unknown object 81293; head-on approach Object was poorly tracked First reported April 21 (Yellow) Pc ~3x10-4 Fell out of tasking volume on April 22 (no additional reporting for a few days) CA reappeared in the routine CARA report 23 April 15:50 UTC (Yellow) Pc ~3x10-4; 1.3 days to TCA (24 April 23:51:50) CARA report 23 April 22:45 UTC (Red) Pc ~7x10-4; 1.0 days to TCA (24 April 23:51:50) First meeting 24 April 9:00am EDT (13:00 UTC) Engineers on-console 24 April 11:00am EDT (15:00 UTC) Maneuver 24 April 5:24pm EDT (21:24 UTC) Nominal OPS_NADIR science collection mode ~24 April 6:00pm EDT (22:00 UTC) 11

The Old (Nominal) Process DOY 112 00:00 UTC DOY 113 00:00 UTC DOY 114 00:00 UTC DOY 115 00:00 UTC DOY 116 00:00 UTC Collect Inputs for DOY 115 Active Load Build DOY 115 Active Load (has the RMM maneuver burn) Uplink DOY 115 Active Load ~13:00 UTC Load DOY 115 Active 00:00 UTC RMM Maneuver 21:24 UTC Nominal Science collection mode Science Images lost around RMM (not scheduled in load) 12

Case Study: ermm 24 April 2016 E-RMM Process: Case Study 24 April 2016 DOY 115 13:00 UTC DOY 115 14:00 UTC DOY 115 15:00 UTC DOY 115 16:00 UTC DOY 115 17:00 UTC DOY 115 18:00 UTC DOY 115 19:00 UTC Initial Meeting Team Arrives Build and Review burn ROS CARA screening GO/ NO GO Meeting (Contact) ROS uplink Timeline DOY 115 20:00 UTC DOY 115 21:00 UTC DOY 115 22:00 UTC DOY 115 23:00 UTC (Contact) ROS enable RMM Maneuver 21:24 UTC ROS unload Nominal Science Science Images lost around RMM 13

Timeline Comparison Daily Load Method Load uplink Load build Commit to burn parameters Load activation Commit to science loss Standard load input collection CAM Load review DOY 112 DOY 113 DOY 114 DOY 115 Tagup Load build/review CAM and load uplink E-RMM (As Executed) Load activation Commit to burn parameters Commit to science loss Clean up FSW and ground system 14

Summary and Forward Work Building an ad-hoc collision-avoidance maneuver (E-RMM) using a special-purpose ROS command buffer allows for Later implementation of a burn, with more accurate parameters A longer abort window Ultimately, it means fewer burns Better orbit maintenance within our science collection limits Managing our fuel supply Future expansion Retrograde maneuvers Expand to routine drag make-up and inclination-change maneuvers Identifying downstream imaging impacts Continue monthly simulations for proficiency and possible further efficiencies 15

Additional Information Next slides: For back-up and personal edification Further questions or details: Bob Scheid: Robert.J.Scheid@nasa.gov AIAA Paper Landsat 8: Applications for General Purpose Command Buffers: The Emergency Conjunction Avoidance Maneuver http://dx.doi.org/10.2514/6.2016-2416 16

Driving Requirements/Considerations Maximize the use of existing, certified products and just insert our new operations in the gaps Maximize flexibility in using whatever communications are available to us, regardless of pass duration or quality Aborts are good things: give us the best chance to do so without sacrificing safety in case we can t Time math is hard: don t make us do it by hand when we re in a crunch 17

Timeline Preparatory Actions Notification can come out days or hours in advance and tends to change, sometimes significantly, at regular intervals through the day Begin evaluating burn parameters and commanding timeline (based on existing comm schedule) 18

Timeline Preparatory Actions Notification can come out days or hours in advance and tends to change, sometimes significantly, at regular intervals through the day Begin evaluating burn parameters and commanding timeline (based on existing comm schedule) 19

Timeline Preparatory Actions Notification can come out days or hours in advance and tends to change, sometimes significantly, at regular intervals through the day Begin evaluating burn parameters and commanding timeline (based on existing comm schedule) 20

Timeline Preparatory Actions Notification can come out days or hours in advance and tends to change, sometimes significantly, at regular intervals through the day Begin evaluating burn parameters and commanding timeline (based on existing comm schedule) 21

Timeline Preparatory Actions Notification can come out days or hours in advance and tends to change, sometimes significantly, at regular intervals through the day Begin evaluating burn parameters and commanding timeline (based on existing comm schedule) 22

Proximity Timeline After authorization has been received to perform the maneuver, we determine specific information about the burn, including our science data impacts, and organize it into an input file The remainder of the timeline can take as few as two hours in an emergency; 12 hours is more realistic 23

Timeline Uplink and Activation Build the uplink binary, review the file for correctness, and uplink To commit, enable and activate the load at the specified time 24

Input File Some parameters are fixedvalue (left in either for explicit confirmation or for future expansion) Companion written procedure includes criteria for determining other parameters Requires review from Operations, Engineering, and Instrument personnel Starting time is used later to start the buffer onboard at the appropriate time 25

Timeline Uplink and Activation Build the uplink binary, review the file for correctness, and uplink. To commit, enable and activate the load at the specified time Can be more than one contact 26

Timeline Onboard Preparations Immediately after activation, the ROS performs the following steps Onboard burn control software is enabled Spacecraft parameters are set and downlinked for final review by the team This marks the beginning of the abort window Master ROS then delays (seconds to hours, as specified) until the next stage One of two commands happens next: Halt the imaging activities, or Begin configuring spacecraft subsystems to burn state Whichever one happens first, the other happens next in the command sequence Specific command order depends on the imaging, communications, and burn schedule 27

Timeline Onboard Preparations 28

Timeline Onboard Preparations 29

Timeline Onboard Preparations 30

Timeline Onboard Preparations 31

Timeline Postburn Reconfiguration After the computed delay, the ROS executes the postburn reconfiguration command load Zero out burn parameters to fully safe the system Deactivate burn processing and hardware Slew back to normal science collection attitude At least 10 minutes after the burn, imaging ops are resumed In a gap in predicted imaging, restart the science schedule 10 minutes is to prevent instrument contamination from burn products; can be longer in some cases 32

Timeline Postburn Reconfiguration 33

Timeline Postburn Reconfiguration 34

Timeline Postburn Reconfiguration 35

Resume Normal Operations At our convenience, unload the buffer and stand down staffing Perform postburn analysis (like we do after a normal orbitadjust maneuver) New orbit determination Confirm conjunction clearance has improved Clean up science recordkeeping to explain lost scenes to the automation system 36

Validation and Implementation Performed two test burns on the spacecraft in May 2015 without incident; completely normal function Burns occurred within 0.25 seconds of desired ignition time This is actually more accurate than the old method because we empirically determined and fine-tuned time offsets All timing variances were explained and well within tolerances Subsequent Ops Team simulations and training sessions have proven we can reduce turnaround time to within four hours or so, confirming that we will no longer be the limiting factor in performing these burns All operational products, documentation, and templates are deployed and ready for use Simulations performed every two months to maintain proficiency 37

Special Simulation Concerns If the simulation is being run for a future activity, the wallclock and spacecraft times are different and not all our scripts will work normally without some modification Subtracting time is hard. Hard-coding math to make it easier detracted from ability of the computer scripts to be accurate Best solution is to build the instructions into the written procedure Simulations are a requirement for all special spacecraft operations, and can occasionally represent another time crunch on the road to the burn, depending on the timeline and comm schedule 38