Build a CubeSat Satellite that actually works, Part 2: Make it Reliable
Interplanetary CubeSats MarCO-A and MarCO-B Image Credit: NASA
The first interplanetary CubeSats MarCO-A and MarCO-B (AKA WALL-E and EVE) have just completed their mission to relay telemetry to Earth from NASA’s InSight probe as it lands on Mars. The main event on this occasion was definitely the landing of the $830m Insight craft. The $13m MarCO (Mars Cube One) spacecraft were launched by the same rocket as InSight to provide a near real-time indication of its successful arrival on the surface. Both CubeSats worked perfectly and their work done, are now heading out onto a heliocentric orbit.
Low-Earth Orbit (LEO) and Interplanetary Travel
Most ‘amateur’ CubeSats in LEO might only be expected to remain fully functional for six months or so. The Marco craft were required to survive a six and a half month journey to Mars, then operate for just a few minutes. Both types of craft have to work in the hazardous environment of Space for a similar amount of time and yet interplanetary travel seems to need much more sophisticated and expensive hardware. A fairly obvious difference in operating conditions between the CubeSat in LEO and its friend on its way to Mars is the latter’s rapidly increasing distance from Earth.
You only get about 5 minutes in every 90 to talk to your satellite in LEO (see Part 1) as it whizzes across the sky, but at least the distance from the Earth is the same each time (Figure 1a). The interplanetary probe’s range R increases each day (Figure 1b) and as a result, its received radio signal weakens by a factor proportional to R2. The LEO probe will work with a relatively low-power transmitter and a low-gain but wide beamwidth antenna, ensuring as much coverage of the surface below as possible. The same arrangement will work for our Mars probe in the early stages of its journey, but towards the middle a switch to a higher gain, narrower beamwidth antenna will improve reception back on Earth. So far, radio traffic will have been limited to short messages relaying commands and status reports. As the probe reaches its target destination, large amounts of mission data will need to be sent back to Earth, for example, camera images.
In order to achieve this higher rate for science data, the spacecraft switches to a high-gain very narrow bandwidth antenna, preferably bringing in a second, more powerful radio. This improves reliability through redundancy because should the high-gain system fail, the science mission can be salvaged to some extent by using the first radio at a very much reduced data rate.
The example shown features a spacecraft able to communicate with a lander on the surface, such as MarCO with the InSight Lander on Mars. This uses a third radio system operating in the UHF band with its own separate antenna.
Antenna and Solar Panel Deployment
Electro-mechanical actuators can seem very reliable on Earth but have proved to be a serious liability in the vacuum of Space because lubrication of moving parts is very difficult. The slightest trace of grease exposed to pure oxygen can burst into flames. Conventional grease in Space can solidify in the intense cold – Mars rover motors require heaters to stop them from seizing up. Rovers obviously need electric motors to move about over the course of the mission. But there are mechanisms on spacecraft that only need to operate once, for example, to deploy antennae and solar panels stowed during the launch phase. On the rocket itself, this would include a means of separating the booster stages in flight. For these highly mission-critical tasks and others such as landing parachute release, designers have traditionally used pyrotechnic fasteners (explosive bolts) as a crude but reliable way of ensuring successful operation. Pyrotechnics are not a good idea for CubeSats because a) explosives need special handling and b) just one detonating could destroy the spacecraft. A much cheaper and less hazardous solution is to use a technique called Burn-Wire deployment (Figure 2).
The basic mechanism consists of a coil spring held compressed by a plastic retainer. This retainer, perhaps a cable zip-tie or a length of fishing line, is in contact with a heating element which can be turned on by the onboard computer to melt the plastic and release the spring. The heating element is usually a low-value ceramic resistor or a piece of nichrome wire.
The deployment mechanism shown is cheap, easy to make and reliable. Fishing line is ideal for the burn-through tether because it’s obtainable in a range of tensile strengths and easily breaks when subjected to a localised heat source. The coil spring around the hinge rod serves two purposes: holding the tether in tension so it breaks easily when heated and to deploy the panel, holding it firmly against the end stop. A lever-operated microswitch normally held closed by the tether will provide useful feedback of successful deployment to mission control via telemetry, while signalling the MCU to shut off the burn current. The burn circuit is so small and cheap, duplication or even triplication is possible to increase reliability at little extra cost.
On-Board Processing and Control
Selection of a suitable microcontroller device for a basic LEO CubeSat was discussed in Part 1. The main concerns of space operation, large temperature range and radiation, while not so important for a relatively short-life satellite, have a significantly greater influence on the design of interplanetary craft. There are a number of control boards for CubeSats on the market with varying degrees of sophistication, but they are all very expensive compared with Arduino-format or Raspberry Pi products. In most cases a price is not quoted because they’re not COTS: they are made to order. Their MCU chips are designed for the Space environment, able to tolerate high doses of radiation and operate over a wide temperature range. Here are a couple of examples.
The Vorago Technologies VA10820 is based on the ARM Cortex-M0 core implemented on an FPGA with triple-redundancy and majority voting on each flip-flop. See my article on the Saturn V rocket of the 1960s to see how that form of redundant operation greatly improves reliability. Apart from being ‘ruggedized’ and having memory with Error Detection & Correction (EDAC) logic, it features much the same I/O as a commercial part.
The ÅAC-Clyde Sirius OBC is a complete CubeSat-format computer board with another FPGA ‘soft’ processor, this time based on the European Space Agency-designed LEON3FT RISC core which is in turn based on the OpenRISC SPARC v8 instruction set architecture! The LEON3FT (Fault Tolerant) core uses the same triple-redundancy technique as the Vorago device along with memory EDAC to achieve greater reliability.
ESA is currently evaluating the Movidius Myriad-2 Vision Processor chip for use in Space. It’s likely to fly in a CubeSat soon providing onboard image processing using Artificial Intelligence algorithms. Not really suitable as a command and control processor, it could be used in an amateur satellite for payload data processing. It has the advantage of being available for under 90 GBP packaged as the Neural Compute Stick evaluation and development tool!
Internal Bus System
Basic amateur CubeSats use common serial busses (SPI, I2C, RS-485) for inter-board communication via PC/104 format connectors. You may have noticed that ‘nanosatellites’ are turning professional: the format is becoming popular with Space agencies for technology demonstrators. Powerful, fault-tolerant control processor boards such as the Sirius need an equally reliable and fast communications link with payload and spacecraft system modules working with large volumes of data. Enter the SpaceWire protocol based on LVDS hardware. It enables the construction of redundant bus systems of any complexity and has been used on a number of spacecraft such as the Mercury probe BepiColombo and the James Webb Space Telescope.
A major component of the cost of developing a long-life, reliable spacecraft lies with testing the hardware and debugging software. Unlike some domestic piece of equipment destined to operate in a pretty benign environment, the spacecraft needs to be subjected to the extremes of Space – while still on Earth. The test equipment alone costs a fortune: vacuum chambers, vibration platforms, high-temperature ovens, very low-temperature refrigerators and so on. But if you don’t make sure your project will even survive the launch, failure is inevitable. Using tried and trusted designs help of course, but any new innovations will require full lifetime tests.
In the early design stages of the Mars rover Curiosity, NASA engineers decided to develop motor-gearboxes which would run with dry lubricant and so remove the need for power-hungry heaters (night time temperatures can drop to -130°C). Prototypes with titanium gears and molybdenum disulphide lubricant were run for months at this temperature. A stunning success, or so it seemed until one day the gears just disintegrated with metal fatigue. Back to the drawing board with wet lubrication and heaters. If that weakness had not been discovered until Curiosity had been on Mars for a while….
MarCO CubeSat looks back at Mars, mission completed Image Credit: NASA
State of the Art of Small Spacecraft Technology is a NASA web resource cataloguing the latest small satellite components on the market.
MarCO: Interplanetary Mission Development is a paper summarizing the technical details of Mars Cube 1.
Small Mechanisms for CubeSat Satellites is a paper describing solar panel and antenna deployment mechanism design for a CubeSat.
If you're stuck for something to do, follow my posts on Twitter. I link to interesting articles on new electronics and related technologies, retweeting posts I spot about robots, space exploration and other issues.
CommentsAdd a comment
POSTSCRIPT 2. Here is a link to the technical details of CubeSat M-Cubed launched in 2011. It has a couple of 'low-cost' features: one that worked and one that had an unforeseen problem.
The simple dipole antenna is made from two strips of spring-steel anchored at one end, wrapped around the satellite and secured by the burn-wire deployment system described above. A simple tape measure provides the spring steel and while not optimal, it makes for a very cheap and reliable deployable antenna.
The passive attitude control system consists of a permanent magnet with additional magnetic hysteresis materials aligned on each additional perpendicular body axis. It aligns the satellite with the Earth's magnetic field. Soon after launch it became apparent that M-Cubed was stuck to another Cubesat launched at the same time. It is thought that the magnets aboard each satellite may be responsible! Oops.
POSTSCRIPT: Until I started doing some research for these two CubeSat articles, I hadn't fully appreciated the importance of the Watchdog timer in spacecraft controller design. Careful design of a watchdog system can lead to fault recovery without the expensive loss of a space vehicle or a repair robot inside a damaged nuclear reactor. I recommend reading this article by Jack Ganssle to find out just how difficult it is to cover all possible failure modes. But it's worth the effort.