Solar Orbiter prepared for ‘worst-case scenario’

Mission control to Solar Orbiter. Come in Solar Orbiter…

“It’s our worst-case scenario,” says flight controller Daniel Lakey. “If Solar Orbiter were to experience some major issue on board, and then we were unable to reestablish communications.”

Solar Orbiter’s close approach to the Sun ('perihelion') is a period of peak scientific activity.

It requires flight control teams and flight dynamics experts at ESA’s ESOC mission control centre to carry out a series of highly complex operations.

If something goes wrong during these activities, the spacecraft could auto-reset itself into ‘safe mode’.

In safe mode, the spacecraft’s software restarts and only its most basic functions are reactivated. Teams on Earth then work out what triggered the safe mode, solve the issue, and restart more advanced systems like scientific instruments.

A safe mode during perihelion would be particularly bad because of the severe impact on science operations during this busy period.

Solar Orbiter also has less power available during perihelion as the intense heat requires it to tilt its solar arrays away from the Sun in order to avoid damage.

The spacecraft must be recovered as quickly as possible before science is lost, or worse, it runs out of power.

The stars guide the way

“The Sun is so bright that even a basic Sun sensor is enough to make sure that Solar Orbiter always knows where the Sun is and can always point its heat shield towards it. This sensor activates during safe mode and keeps the spacecraft’s internal systems safe from the radiation emanating from our star,” says Lakey.

“So, we know that Solar Orbiter will always point its ‘front’ towards the Sun. But to work out which way ‘up’ it is, we rely on star trackers.”

The top priority for a spacecraft in safe mode is to point its communication antenna towards Earth and reestablish contact as soon as possible.

The star trackers switch on automatically during safe mode and the spacecraft uses them to recognise certain patterns of stars. It can then determine its orientation, and in which direction it should point its antenna to communicate with Earth.

“But if the star trackers fail to lock on to the right stars, or the recovery sequence is interrupted before they can be switched on, Solar Orbiter has no way of knowing where Earth is.”

Spinning into control

To make the situation even more challenging, in safe mode, Solar Orbiter can only use its back-up communication antenna.

The back-up antenna can move ‘up and down’ in one axis, but not ‘left and right’ in the other. This prevents a number of potential complications, but it also means the whole spacecraft must rotate in order to point the antenna in certain directions.

The solution is ‘strobing’ – if Solar Orbiter ever finds itself in safe mode and unable to locate Earth, it will begin to roll around one axis while keeping its heat shield pointed safely at the Sun.

“In strobing mode, Solar Orbiter emits a signal with a special ‘tone’ – a beacon in the darkness of space,” says Lakey.

“Eventually, this signal will sweep across Earth. As soon as we detect it at one of our ground stations, we can assess the situation, work out what caused the safe mode and carry out our problem solving and recovery operations.”

That’s the theory, anyway. During Solar Orbiter’s four years in space, it has never had to rely on a strobing recovery – and it has never been tested in flight.

Until now.

The teams at ESOC used a recent period of low communication delay with Solar Orbiter to test whether they are ready to handle a real strobing recovery.

“We began to spin Solar Orbiter around and see if we could detect the beacon from the back-up, antenna,” says Lakey. “We preloaded commands to return to normal operations in case we failed to detect it, so there was never any risk to the spacecraft.”

The recovery tests were a success. The teams confirmed that they could detect Solar Orbiter's emergency beacon and identify the status of the spacecraft in the event of a safe mode with malfunctioning star trackers.

These are the first vital steps in regaining control of the spacecraft and demonstrated the team’s readiness for this critical but unlikely scenario.

“We also successfully tested our ability to communicate with the satellite in particularly tricky situations, such as when its own heat shield partially obscures the antenna’s view of Earth.”

This is just one of hundreds of potential issues that our teams dream up and plan for every day. ESA’s missions are unique one-of-a-kind spacecraft: they may face problems that no other spacecraft ever has.

There are few similar examples to learn from, and few established procedures to follow. It’s essential to test our spacecraft recovery operations in space and for the teams on Earth to practice them when they have a good opportunity.

“We’ll never stop thinking about new challenges that our missions could face,” says Lakey. “Or about how we would overcome them.”