Simulation engineers insert deliberate faults to test team reactions

Simulation Control Engineers inject failures

A few metres away, in the Simulation Control Room located separately from the MCR and with no contact allowed, simulation engineers inject a carefully planned series of faults, mis-configurations, hardware failures and software bugs into the spacecrafts' Mission Control Systems. This tests the multiple immediate actions and recovery procedures that have been developed by the individual Flight Control Teams over the past year.

LEOP: Time is very short

"LEOP - the launch and early operations phase immediately after launch - is really critical. Time is very short, and we've got to complete a series of automated and commanded steps to ensure that the spacecraft have properly separated, switched on all systems and have power to survive," says Andreas Rudolph, Deputy Flight Operations Director, overseeing the combined teams.

Flight Director Andreas Rudolph in ESOC's Main Control Room

After launch, LEOP is planned to last for approximately five days for both spacecraft. ESOC's Main Control Room will be staffed 24 hours/day during this period.

Rudolph coordinates not only the separate Herschel and Planck Flight Control Teams, each with a separate SOM and each dedicated to their respective spacecraft, but also the teams of supporting experts - from flight dynamics, software maintenance, ground stations and other ESOC functional specialities.

He also sits on console beside the project representative, who coordinates contact with the ESA project office at ESTEC and the satellites' manufacturer and is involved in any critical decisions.

Ongoing simulation training

Herschel SOM Micha Schmidt explains that this week's simulation is just one of an on-going series of full and partial simulations, training sessions and preparatory exercises that have kept Herschel and Planck engineers and mission control specialists at ESOC busy over the past several months as the dual launch date became more certain.

"In December, the Herschel team were allocated five full days' time with the actual spacecraft for a full Systems Operations Validation Test while it was in the Large Space Simulator test chamber at ESTEC. We were able to operate our full mission control system connected to the spacecraft, and communicate with Herschel as though it were actually in orbit. This was very valuable for validating procedures - we ran the test over a weekend and straight though the five days because such access is very valuable," he says.

The test was held with participation by the mission's extended ESA team - the Mission Operations Team at ESOC, the Science Operations team at ESAC, and the individual instrument science teams located at various locations in Europe and the USA.

Herschel also underwent another System Validation Test in January 2009.

Planck: Critical milestones after launch

The Planck team has also worked hard to prepare. One of the critical early milestones for Planck will be a trajectory correction - a TCM, in which the spacecraft's engine will burn for a preplanned time period - to remove launch dispersion. This will occur during LEOP, about two days after launch.

"It's important that we get onto the right trajectory early on; even a two- or three-day delay could cost us a lot of fuel later on. So we are practising to make sure our team can quickly react to any technical problems," says Planck SOM Chris Watson.

"For spacecraft operations, we really rely on each other and the individual mission teams could not succeed without direct support from flight dynamics, the ground stations experts, the software people and the other ground systems teams here at ESOC. It really is a joint effort and that's why these simulations are so important for us," says Rudolph.