Cassini mission hinges on Wednesday's engine firing
BY WILLIAM HARWOOD
STORY WRITTEN FOR CBS NEWS "SPACE PLACE" & USED WITH PERMISSION
Posted: June 29, 2004
After a seven-year voyage from Earth, NASA's $3.3 billion Cassini probe is racing toward a make-or-break rocket firing Wednesday, a 96-minute maneuver designed to put the craft in orbit around the ringed planet Saturn for a four-year scientific odyssey.
Flight controllers at NASA's Jet Propulsion Laboratory in Pasadena, Calif., sent final commands to Cassini over the weekend, setting the stage for main engine ignition at 10:35:42 p.m. Wednesday.
At this point, flight controllers can only sit and wait. And chew their nails.
"I think about the Cassini mission as having three primary segments and then two rather hair-graying events that connect those segments into one continuous mission," said project manager Bob Mitchell. "The segments are designing and building the spacecraft, flying the spacecraft to Saturn and then conducting the science mission at Saturn.
"And the hair graying events are launch and orbit insertion, which is coming up tomorrow. Now for the launch event, I think we've all recovered from that very nicely, primarily because it was just so outstandingly successful. ... We're about to go through our second hair-graying event."
At a news conference today, he told reporters "I think I can speak for all the team members when I say that while we're all at least a little bit nervous, we're also very excited. It's an event we welcome very much and are pleased to have here."
The goal of the Cassini mission is to study Saturn's windy atmosphere, its complex ring system, several of its icy moons and how the planet's magnetic field interacts with the space environment. In what promises to be one of the most exciting phases of the mission, a European-built probe called Huygens will be released from Cassini on Christmas Eve for a parachute descent into the thick nitrogen atmosphere of Saturn's moon, Titan, on Jan. 14.
In all, Cassini is expected to complete 77 orbits of Saturn over the next four years, requiring 157 trajectory-nudging rocket firings. The gravity of Titan will be used for major course changes, with 45 planned flybys. Seven close flybys of smaller, icy moons also are planned.
But first, Cassini must execute the Saturn Orbit Insertion maneuver, or SOI.
If the engine shuts down early, the computer will switch to a spare. But the end result must be roughly the same - 96 minutes of braking - or Cassini might not be able to achieve its long-awaited mission.
"There are no problems, we have no indication of any problems with the spacecraft that would have any adverse effect on SOI," Mitchell said. Added Julie Webster, lead spacecraft engineer: "This spacecraft, this whole mission has been an incredibly smooth one to fly."
"This orbit insertion sequence is self contained on the spacecraft," she said. "We loaded up the last command we're going to send to it late Saturday night, Sunday morning, and we've just been clocking it out ever since and getting no indications of anything. We expect this to go very, very smoothly."
The propulsion system has worked flawlessly since Cassini's launch aboard a Titan 4B rocket on Oct. 15, 1997. The only issue of any consequence was a leaking helium regulator that forced engineers to change the way they pressurize the system for major rocket firing.
Helium is used to push propellants through Cassini's plumbing and into the main engine's combustion chamber at a constant pressure. The regulator controls that pressurization, which is needed for long firings like the upcoming Saturn Orbit Insertion burn.
In this case, Cassini's complexity and built-in redundancy came to the rescue. By delaying the opening of a downstream latch valve to just 70 seconds or so before main engine ignition, engineers were able to work around the regulator issue with no impact to mission operations. The procedure was used for a major 88-minute Deep Space Maneuver rocket firing back in 1998 and again in late May for a six-minute burn that set up a flyby of the moon Phoebe.
"We've got a real nice propulsion system," lead propulsion engineer Todd Barber said in an earlier interview. "It's a plumber's nightmare, there are so many valves and alternate paths and contingency paths available that basically, we're able to handle a lot of anomalies. And the regulator leak we saw was right after launch and we've been able to accommodate that with the way we time the opening of valves, etc."
Even so, Barber will feel much better after Cassini successfully brakes into orbit. "It's been a long time coming and the hopes and dreams of thousands of engineers are resting on that one evening. When we get the signal back is when we'll all go take a deep breath. Hold your ears, because they might pop."
Mitchell said in an interview he had high confidence the SOI maneuver will work normally and that REA-B will not be needed "based on all of the testing, all the elaborate work that we have put into this, as well as our experience with the spacecraft to date. We've done 15 or 16 maneuvers using the main engine ... and so we have every reason to believe this thing is going to work just fine."
But, he added, "the software the thing flies is all complex and I just worry about what bugs are still in there. I think it must be inevitable that there are still bugs in there for something this complex. We've tested it extensively, we have a test bed here in the basement of our building that is a quite high fidelity spacecraft simulator and the sequences have been run through there many, many times. We have injected faults, we've had various components break, where we simulated a break in the test bed and looked to see what response we got. And at the moment, everything works. All the tests that we've done, all the simulations indicate that everything is just fine."
The maneuver has little margin for error. Cassini first must avoid any crippling debris impacts when it crosses the ring plane between the F and G rings, moving from the lower side of the rings to the upper side as viewed from Earth.
Pioneers 10 and 11, along with Voyager 2, flew through the gap with no problems but Cassini flight planners are taking no chances. Before traversing the ring plane, the spacecraft will be oriented with its high-gain dish antenna facing the direction of travel to act as a shield.
Voyager 2 went through outer edge of the G ring and its instruments recorded "lots of evidence of micrometeoroid hits when going through, but nothing serious," said Voyager veteran Torrence Johnson, a Cassini imaging team member and chief scientist for the Galileo mission.
"So we have that maneuvering to do and then there's the fact that the place is just a junky system," he said in an interview. "We're going in close, we're skimming right over the rings, everybody thinks we've modeled all this right and we're being reasonably cautious. But I told some of the guys early on, if they're going to be scared of ring particles they ought to remember John Paul Jones' letter to Congress, 'give me a fast ship for I intend to sail in harm's way.'
"I don't think anybody's real complacent about this thing," Johnson said. "I think we've done everything we can to make sure we don't have any human or systems screw ups, but nature can still get you."
Jerry Jones, Cassini's chief navigator, said flying through the ring plane relatively close to Saturn will save propellant and makes the rocket firing more efficient. "But the real clincher, given all that, is the science in that close. We're going to be sitting there looking right down on those rings."
"We've got one class-A camera on this spacecraft," he said in an interview. "It's a beautiful telescope, it has great resolution, very sharp edges and for optical navigation, I'm just pleased as punch. ... The science opportunity going over the rings should be just fantastic, to say nothing of showing the public what they've paid for."
"So we went back and scrambled then," Barber said. "We had a compromise solution. We could have pointed the high-gain antenna to Earth during the whole burn and have telemetry but there was a large delta V (fuel) penalty to do so. So the plan is to switch to a low gain antenna and that will allow us to maintain Doppler during the burn."
While no actual data will be transmitted to Earth, analysis of the Doppler shift of a carrier signal from the spacecraft will tell engineers when the burn started, the precise deceleration it produces and when it stops.
"There were two key things we wanted to be sure we could differentiate between," Mitchell said. "One was in the event we just lost it entirely and never saw it again, we wanted to be able to differentiate between whether we had a problem going through the ring plane or whether we did that successfully and had a problem during the course of the burn itself. So with the data we have, we will know that quite well."
After re-orienting itself for SOI, Cassini will begin transmitting a carrier signal. Six minutes later, the burn will begin, showing up on computer screens at the Jet Propulsion Laboratory as a change in the slope of the carrier frequency. Thirty minutes later, the signal is expected to fade out for 25 minutes or so as Cassini passes behind Saturn's A ring as viewed from Earth.
Engineers then expect six minutes of carrier through a gap in the rings known as the Cassini division before another 28-minute communications blackout while the spacecraft passes behind the broad B ring. Closest approach to Saturn - 12,400 miles from the planet's cloud tops - is expected at 12:03 a.m. July 1, nine minutes before the SOI burn comes to an end. The first images and other data from the orbit insertion maneuver are expected around 8:39 a.m.
Here is an edited timeline of critical events in the SOI maneuver for the evening of June 30 through the morning of July 1 (all times in EDT):
"Then when we turn back to go to the burn attitude, at about the time we get to that attitude, which is six minutes prior to the burn start, we will crank up a signal that comes from one of the low gain antennas. There's no telemetry, it's just a carrier.
"But that carrier will allow us to get Doppler and that'll tell us if the spacecraft is operating fine and has not had any safing events. And then during the course of the burn, that Doppler will let us see quite accurately what the acceleration levels are. So if the system is performing nominally or over performing or under performing, the Doppler will show that very well."
The day after orbit insertion, Cassini will pass within 205,000 miles of Titan, the first official Titan encounter of the mission. Between July 4 and 11, the spacecraft will be out of contact as Saturn passes behind the sun as viewed from Earth. The SOI sequence will end on July 30 as tour sequence No. 3 begins.
Sometime around Aug. 23, Cassini's main engine is scheduled to fire in what will be the last fully helium-regulated burn of the mission: a 51-minute maneuver that will change the spacecraft's velocity by 877 mph. The Perigee Raise Maneuver, or PRM, will raise the low point of Cassini's orbit and set up the first close flyby of Titan in October. After another flyby in December, the Huygens probe will be released for atmospheric entry during the mission's third Titan encounter in January.
The SOI maneuver is one of only three so-called "critical sequences" built into Cassini's mission software. A critical sequence is one that simply must execute properly to ensure mission success. The launch to Venus was one such sequence and the only other one is the Huygens data relay sequence.
SOI is "the only maneuver that we will do throughout the entire course of the mission where we just absolutely have to do this burn right now," Mitchell said at a news briefing. "If this burn doesn't work, then we would have a Saturn flyby and that's not what we're here about. So we have designed what we refer to as a critical sequence where no matter what fault might occur, the spacecraft will not let the burn halt. Now in some modes it will stop the burn, swap to the other engine and then continue on with the burn. But the burn will continue even in the presence of faults."
During normal operations, a problem with a spacecraft system would trigger fault-protection software that would shut down unnecessary activity, a condition known as safe mode. There are numerous variations, depending on the nature and timing of the fault and whether the spacecraft still knows its orientation in space. The end result, however, is the same: Cassini shuts down, finds the sun (Earth will never be more than six degrees away), switches to low-data-rate communications and awaits instructions from Earth.
Because of Saturn's great distance and the slow-speed radio link used in safe mode, engineers would need at least 48 hours to restore Cassini to normal operations. Such a fault during the SOI maneuver would shut the main engine down, interrupting the all-important rocket firing and possibly dooming the mission. But in critical sequence mode, that will not be allowed to happen.
"In critical mode, if the spacecraft detects a fault - we get a glint in the eye of the star scanner or the thrusters don't like what they're doing or a piece of hardware doesn't work right - the spacecraft will detect a fault," Webster said. "The sequence will halt and the spacecraft is allowed through its autonomous fault protection to go off and fix the fault.
"And then it will come back and say I've detected a fault, I've fixed the fault. And then it'll come back and say OK, critical sequence, you can restart. And the critical sequence will say Oh, but I've gotta remember where I was. We have what we call a mark and rollback strategy. So it'll roll back to the last good mark point and it will resend all the commands necessary to execute the next states that it needs to be in. It'll recommend all of those and continue on. And so, if there's a fault anytime during the critical sequence, it'll stop, halt, detect the fault, correct the fault and then restart the sequence."
That's where Cassini's second main engine comes in. If a fault of any kind interrupts the SOI sequence, the computer will fire up rocket engine assembly B and continue the burn.
"In the burn, we have already disabled any fault protection activity that's not necessary to complete the burn," Webster said. "So we've got fault monitors, say, on the CDS (command and data system) computer and on the radio. Well, the radio's not necessary to complete a burn. Neither is the CDS, ironically, because the attitude and articulation control system also has its own computer and once the CDS has told it to go do a burn, it takes over and says I don't need you anymore, I'll complete this burn and I'll let you know when I'm done. So only the fault protection that's necessary to complete the burn is active.
"It would detect a fault in where it's pointing or the propulsion system wasn't acting right, maybe under thrusting or over thrusting. If there's a fault during the burn, then we terminate the burn. We try to fix the fault and then we mark and roll back, pick up where we did, restart but we're going to restart on the second engine. It takes at least two hours to cool down one engine. So 10 minutes later, we can restart on engine B and minimize our overall cost."
But any safe mode that would necessitate firing REA-B also would terminate priceless SOI science operations, a small price to pay if survival of the mission is at stake. Cassini has a seven-hour window in which to complete the SOI maneuver and "as long as we got the correct amount of burn at any time in that seven-hour period, we would get into orbit," Webster said. "We might not like the orbit, but we'd get into orbit."