MIAMI The EUMETSAT Operational Process T

SpaceOps 2010 Conference Delivering on the Dream Hosted by NASA Mars AIAA 2010-2296
25 - 30 April 2010, Huntsville, Alabama
MIAMI: the EUMETSAT Operational Process to Implement

a Late Collision Avoidance Maneuver
Lionel de la Taille1 and Gareth Williams.2

EUMETSAT, Darmstadt, Germany
David Lazaro3
Space Operations Consulting at EUMETSAT, Darmstadt, Germany
and
Francisco Sancho4
GMV at EUMETSAT, Darmstadt, Germany
Downloaded by 18.206.13.133 on June 18, 2020 | http://arc.aiaa.org | DOI: 10.2514/6.2010-2296
As part of the EUMETSAT-NOAA cooperative Initial Joint Polar System, MetOp-A

performs an operational Earth observation mission for meteorological purposes from a high-
inclination Low Earth Orbit. EUMETSAT Flight Dynamics performs an independent
evaluation of the collision risk based on conjunction data supplied by USAF Joint Space
Operations Center (JSpOC) via NOAA. In the case of an identified collision risk, the optimal
avoidance maneuver is computed. At the same time the effect of the maneuver is analyzed to
ensure that a secondary conjunction does not result. The proposed avoidance maneuver is
reassessed and refined upon receipt of updated conjunction information. MIAMI, the
Manual In-plane Avoidance Maneuver Insertion, is an innovative solution to better manage
the late implementation of a collision avoidance maneuver. This special procedure allows
EUMETSAT to continue routine operations of the MetOp-A satellite and the EUMETSAT
Polar System with minimal disturbance until implementation of an avoidance maneuver
becomes necessary. This paper will present how, from the D-5 warning, all the flight
dynamics processes are running to better understand the risk, predict conjunction events,
and to prepare an avoidance maneuver. It will also discuss how the MIAMI activities are
integrated with on-going operations of the EPS system in order to ensure operational
continuity and minimize potential disruption of mission services provided continuously to
the user community.
1
Deputy Spacecraft Operations Manager, EUMETSAT Operations Department, EUMETSAT-Allee 1, 64295
Darmstadt, Germany.
2
Deputy System Operations Manager, EUMETSAT Operations Department, EUMETSAT-Allee 1, 64295
Darmstadt, Germany.
3
Flight Dynamics Engineer, EUMETSAT Operations Department, EUMETSAT-Allee 1, 64295 Darmstadt,
Germany.
4
Flight Dynamics Engineer, EUMETSAT Operations Department, EUMETSAT-Allee 1, 64295 Darmstadt,
Germany.
1
American Institute of Aeronautics and Astronautics
Copyright © 2010 by EUMETSAT. Published by the American Institute of Aeronautics and Astronautics, Inc., with permission.
I. Introduction
A s part of the EUMETSAT-NOAA cooperative Initial Joint Polar System, MetOp-A performs an operational
Earth observation mission for meteorological from a high-inclination Low Earth Orbit. This orbit is a
congested place to be, where many spacecraft and items of debris cross paths at extremely high relative velocities.
The hazards of operating in this orbit were adequately demonstrated in February 2009 when Iridium-33 was lost in a
collision with the expired Cosmos-2251.
Although the probability of impact remains very low at present, such an impact could result in loss of mission. It
is therefore essential for mission continuity that MetOp-A does not suffer any in-orbit collision. As the spacecraft is
equipped with thrusters for orbital maintenance, these can be used to avoid a collision, provided that the encounter
can be accurately predicted with sufficient time to assess the risk and make the necessary preparations. Risk of such
events will also increase with the introduction of further satellites in the MetOp series.
Typically, first warning of a potential conjunction is received 5 days before the event. Following this warning,
the parameters of the collision are continuously refined - with increasing accuracy - as the event approaches. It is
therefore important to wait until as late as possible to determine if an avoidance maneuver is truly necessary, in
order to ensure that the most appropriate maneuver is executed and to avoid unnecessary maneuvers with
consequent negative effects on the mission, such as fuel wastage, orbit degradation and mission data outages.
MIAMI, the Manual In-plane Avoidance Maneuver Insertion, is an innovative solution to better manage the late
implementation of a collision avoidance maneuver. This special procedure allows EUMETSAT to continue routine
operations of the MetOp-A satellite and the EUMETSAT Polar System with minimal disturbance until
implementation of an avoidance maneuver becomes necessary.
EUMETSAT Flight Dynamics performs an independent evaluation of the collision risk based on conjunction
data supplied by USAF Joint Space Operations Center (JSpOC) via NOAA. The optimal avoidance maneuver is
computed, if deemed necessary. At the same time the effect of the maneuver is analyzed to ensure that a secondary
conjunction does not result. The proposed avoidance maneuver is reassessed and refined (or cancelled) upon receipt
of updated conjunction information.
This paper will present how from the D-5 warning, all the flight dynamics processes are running to better
understand the risk, predict conjunction events, and to prepare an avoidance maneuver. It will also discuss how the
MIAMI activities are integrated with on-going operations of the EPS system in order to ensure operational
continuity and minimize potential disruption of mission services provided continuously to the user community.
II. System Operations Processes Relating to Avoidance Maneuvers
Activities of the Flight

Dynamics Team and Satellite
Operations team in relation to
conjunction handling and
MIAMI implementation are
detailed later in this paper.
In this section, the EPS

system operations activities
performed in response to a
potential conjunction are
addressed.
These system activities

have been validated and
operations team participation
rehearsed through dedicated
simulations and pre-
operational responses to
received conjunction
Figure 1. The EUMETSAT EPS Mission Control Room warnings.
2
A. Conjunction Warning Handling
Activities involved in the handling of conjunction warnings, and implementation of the MIAMI processes, are
coordinated at a system operations level and range from initial warning processing and event escalation, to
coordinating maneuver decision processes and maneuver implementation. This is summarized in Figure 2.
Conjunction warnings for MetOp are generated by the Joint Space Operations Centre (JSpOC), a combined
services unit of the United States armed forces and those of the UK, Australia and Canada, at Vandenberg AFB,
California. Conjunction Summary Reports are sent by email to EUMETSAT by the Shift Supervisor at the National
Environmental Satellite, Data and Information Service (NESDIS) Office of Satellite Operations in Suitland,
Maryland, detailing potential conjunctions with a predicted overall miss distance of 1000 meters or less. If no such
conjunctions are predicted, a Summary Report with no conjunction events is generated as positive confirmation.
Figure 2. Flowchart summarizing the MIAMI System Operations process

3
The Summary Report presents a summary table indicating the Time of Closest Approach (TCA) and predicted
miss distance for any potential conjunctions, followed by a more detailed description of the predicted conjunction
parameters.
EPS Operations receives these Summary Reports by e-mail into a set of pre-prepared e-mail addresses
configured with logic-based filtering and forwarding to ensure the information is routed in a timely manner to the
24/7 shift operations controller, Flight Dynamics Team, Spacecraft Operations Manager, and System Operations
Authority.
Initial assessment of conjunction warnings in the Summary Report is performed by the operations controller to
identify potentially high risk events. This assessment is based on two criteria:
the predicted radial miss distance should be less than 300 m; and
the time of the conjunction event should be less than 48 hours in the future.
Predicted conjunctions that meet these criteria are escalated immediately to the flight dynamics group for
detailed assessment of the level of risk presented to the MetOp spacecraft, using on-call support if outside normal
working hours. Predicted conjunctions that fail to meet the defined criteria for escalation will be logged by the
controller and routinely assessed by the Flight Dynamics Team during normal working hours.
If the flight dynamics assessment determines that the probability of collision from a predicted conjunction
exceeds a pre-defined threshold, this will be declared a high risk event to be escalated to operations management.
B. Maneuver Decision Process
In the event that a high-risk event is identified, a Conjunction Review Meeting will be convened by operations
management to review the conjunction risk and to determine if an avoidance maneuver is appropriate. Participation
in this meeting will involve flight dynamics, spacecraft and system operations management, the Mission Control
Centre Manager, and the Director of Operations. This consideration is typically initiated 24 hours prior to the
conjunction, with final maneuver authorization (if forthcoming) withheld until 12 hours before the conjunction. If
necessary, the decision process can be focused on the TCA-12 hours threshold (as shown in Figure 2).
Flight Dynamics Team will present a summary of the predicted conjunction to the Conjunction Review. In
addition, the level of confidence in the orbital data for both MetOp and the secondary object used to generate the
conjunction warning will be presented. Both these factors will be used by Flight Dynamics Team to generate a
maneuver recommendation. If an avoidance maneuver is to be recommended and if sufficient time is available for
its preparation, Flight Dynamics Team will have maneuver parameters prepared for consideration by the
Conjunction Review.
Confidence in the accuracy of the orbital data used to will be a key factor in the decision process, as is the time
remaining until a conjunction event. The MIAMI process has been defined in order to ensure an avoidance
maneuver, if recommended, can be safely implemented. However, if there is little time to implement the maneuver
before the conjunction occurs, it may represent a higher risk to implement the maneuver in a rushed manner than it
would to allow the conjunction to occur with the orbit of MetOp unchanged.
EPS Operations requires at least eight hours from maneuver authorization to maneuver execution in order to
ensure the maneuver is subjected to stringent quality assurance checks, and commands uplinked with a second
uplink opportunity in reserve.
If it is assumed that any avoidance maneuver will occur up to four hours (approximately 2.5 orbits) before the
time of the predicted conjunction (a trade-off between delaying the maneuver to receive the most accurate orbital
data and bringing forward the maneuver to minimize fuel expenditure and orbital disruption, to allow smooth
continuation of operations, as presented in the previous chapter), then a latest maneuver authorization threshold can
be drawn at approximately twelve hours before the conjunction.
4
This will be reviewed by operations management, with the perceived risk from the conjunction to be weighed
against the near-term degradation to operational services and possible longer-term impact of an unscheduled
maneuver.
Any maneuver represents a general increase in operational risk due to the use of propellants and the need to
reconfigure the MetOp payload instruments both before and after, resulting in outages to some operational services.
An avoidance maneuver will expend fuel that would otherwise be used for routine orbital maintenance. Although
not necessarily significant for any one maneuver, the cumulative effect on satellite lifetime of multiple unscheduled
avoidance maneuvers should not be overlooked.
The Conjunction Review will weight these factors against the knowledge that any collision involving an
operational satellite represents a high risk of significant damage or complete operational loss. While the criteria for
implementing an avoidance maneuver can be outlined in advance, each conjunction event will be assessed on its
own merits by operations management based on the recommendations received from the operations team.
If an avoidance maneuver is not authorized, the conjunction will continue to be monitored by the Flight
Dynamics Team until the predicted conjunction time has passed. A future increase in the probability of collision
may then be presented to operations management if necessary.
If an avoidance maneuver is authorized, the MIAMI process will be initiated.
C. The MIAMI Process
The MIAMI process is a series of coordinated system and spacecraft operations designed to safely prepare and
implement an avoidance maneuver with minimal disruption to ongoing operational services.
The EPS System is routinely operated by means of an automated operations schedule produced by the mission
planning group in order to monitor and control the MetOp satellite, the two Command and Data Acquisition (CDA)
ground stations located in Svalbard, Norway, and the product processing and dissemination facilities in Darmstadt,
Germany. After the decision to perform a maneuver, the mission planning team will suspend the currently executing
operations schedule. They will begin preparation of a new schedule that will be enabled immediately after the
maneuver has been completed successfully.
Flight Dynamics Team will finalize the maneuver parameters and perform the necessary quality assurance
checks before generating the operational data sets to be used by spacecraft operations to command the maneuver.
As described elsewhere in this paper, the MetOp Satellite Operations Team will implement instrument and
maneuver operations based on the pre-defined MIAMI process and flight dynamics maneuver parameters.
The Operations Analyst will, using the User Notification System (UNS) as well as established e-mail interfaces
with EUMETSAT operational partners, notify the EPS user community and operational partners of the expected
degradation to EPS operational services from the start of satellite pre- maneuver configuration until after the post-
maneuver reconfiguration has been completed and all services have returned to nominal.
The Operations Analyst will also determine the suitability of any satellite passes, after the maneuver and after
the predicted conjunction TCA, over ground stations of the External TT&C network (XTTC) that would allow
earlier visibility of the satellite telemetry and orbit than could be provided by Svalbard. If such passes were an
option, the Analyst will request them from the XTTC service provider (ESOC) via the established operational
interface.
D. Maneuver, Conjunction and Recovery
The maneuver will be automatically executed by the MetOp satellite, according to the uplinked maneuver
parameters, up to four hours before the predicted conjunction time.
At the first of opportunity after the maneuver, satellite health will be assessed by means of telemetry received at
Svalbard or an XTTC station, if appropriate. Normal ranging and Doppler measurements will be performed at the
5
first pass of the satellite over Svalbard to establish the new parameters of the satellite‟s orbit and compare them with
the anticipated orbit. For passes supported by the XTTC network, ranging and Doppler data will be available to EPS
shortly after the pass has ended.
Assuming there are no anomalies indicated, payload reconfiguration will proceed to allow the resumption of
operational services at the earliest opportunity. The EUMETSAT user community and operational partners will be
notified of the status of the maneuver and the resumption of operational services. Some services may require a
period of product quality assessment before the operational dissemination of products is resumed.
Following the predicted conjunction time, satellite health and orbital parameters will be reassessed to determine
if there are any prompt anomalous indications. These will continue to be monitored by the operations controllers and
satellite operations team to identify any trends that might indicate degraded performance as a result of the maneuver
or conjunction.
III. Flight Dynamics Activities relating to Predicted Conjunctions

The EUMETSAT Flight Dynamics Team is in charge of analyzing the conjunction data received from NOAA in
order to assess the probability of collision and, if this is above a pre-defined threshold, escalate the situation to the
operations management and provide them with sufficient information to support the decision of whether or not to
perform an avoidance maneuver following the process discussed in this paper.
This section describes the kind of data received routinely from NOAA and how they are processed by the Flight
Dynamics Team. Finally, an operational example is used to illustrate the process and show one of the main
advantages of the MIAMI process: how waiting as much as possible can lead to the cancellation of an avoidance
maneuver that would otherwise have been performed.
A. Conjunction Warning Messages
Thanks to the partnership established by the IJPS, which includes MetOp satellites carrying US instruments,
NOAA receives from JSpOC conjunction information on the MetOp spacecraft. Part of this information (the
Summary Report) is forwarded daily to EUMETSAT by NOAA.
The Summary Report contains information on objects for which the estimated total miss distance with respect to
MetOp-A is below 1,000m. Once an object has been included in a Summary Report, it is retained until its
conjunction time has passed, even if the estimated miss distance subsequently exceeds the 1,000-meter limit.
For each reported conjunction, the Summary Report contains the following basic information:
time of closest approach (TCA),
secondary object NORAD identifier,
miss distance (total, radial, along-track and cross-track) in the MetOp-A local orbital frame, unless the
total miss distance exceeds 5,000m,
probability of collision (Pc), unless the total miss distance exceeds 1,000m,
graphs showing the evolution of these parameters from five days before TCA.
It has to be taken into account that there is no formal commitment on the provided probability of collision, and
that EUMETSAT has no knowledge of the way this value is computed, particularly in relation to assumptions on the
MetOp spacecraft. Therefore, independent determination of this probability in the case of encounters thought to
present a risk to MetOp is deemed necessary.
The analysis of these messages is performed in two steps, using software tools developed by the EUMETSAT
Flight Dynamics Operations Team:
1. a first tool (First Filter) that allows to filter the warning messages and trigger an alarm for the ones
considered potentially dangerous, and
6
2. a second tool (Detailed Conjunction Analysis) that computes, for the selected dangerous encounters, the
probability of collision and allows the selection of an appropriate collision avoidance maneuver.
As discussed in the following paragraphs, the information contained in these Summary Reports is not enough for
computing a reliable value of the probability of collision, and a number of hypotheses have to be made within these
tools. In order to be able to compute more accurate values that better serve the purpose of supporting the decision-
making process, EUMETSAT has already asked for authorization to receive the so-called Orbital Conjunction
Messages (OCMs) from JSpOC. These messages contain, apart from the miss-distance, the detailed position and
velocity estimated for MetOp-A and the secondary object, their covariance matrices, and further information on the
tracking campaigns leading to the estimation of both orbits. The second of the tools listed above is able to
automatically use these OCMs as input.
B. First Filter
This first tool works under two assumptions that output an indication of the criticality of the conjunction event,
using as input only the three components of the miss distance (secondary object position relative to MetOp orbit
reference frame at the time of closest approach), contained in the daily Summary Reports received from NOAA. The
two assumptions are:

1. the velocity modulus of the object is that of MetOp (i.e. the object is flying at approximately the same
orbital altitude), and
2. the radial component of the relative velocity is 0 (i.e. the object is in a circular orbit, as MetOp).
The First Filter tool computes the geometry of the conjunction as seen from the secondary object. Such
visualization of the event is very intuitive, since the MetOp position error covariance matrix is typically much better
known than that of the secondary object. For the latter, a (conservative) diagonal error covariance matrix of (250,
2000, 250) meters in respectively radial, along-track and cross-track components is applied. Projections of the object
error ellipsoid and of MetOp-A relative position and velocity in the object along/cross-track plane and in the
collision plane are generated for each conjunction warning received (an example is shown in Figure 3). The
approach angle is also computed and shown graphically. This allows categorizing the event as a lateral or frontal
collision.
However, the most important output of the tool is the so-called “depth of intrusion”, which is a measure of the
maximum penetration around TCA of the MetOp trajectory into the secondary object error ellipsoid. This
penetration is computed using ellipsoidal instead of spherical distance, and it gives a first warning of a dangerous
condition. Depth of intrusion values below 2.0 are analyzed in depth using the Detailed Conjunction Analysis tool
described in next paragraph.
C. Detailed Conjunction Analysis
When, according to the output of the First Filter, a conjunction event merits further and refined analysis, more
data are needed for computing the probability of collision. Depending on the level of the available information on
the object, the Flight Dynamics team faces one of the following three situations for the collection of those data:
1. An OCM is available: in this case, the inertial state vectors and the covariance matrices at TCA (both for
MetOp-A and the secondary object) contained in it are automatically ingested by the Detailed
Conjunction Analysis software. Also the Radar Cross-Section (RCS) of the object contained in the OCM
is used in the computation of the probability of collision. As discussed above, EUMETSAT is currently
not receiving OCMs.
2. No OCM is received, but the object belongs to the publicly available NORAD database: if this is the case,
MetOp-A state vector is taken from EUMETSAT operational ephemerides, the velocity at TCA of the
secondary object is computed from the Two-Line Element (TLE) extracted from NORAD database, and
its position is derived from the miss distance contained in the Summary Report. The RCS of the object is
also taken from NORAD. MetOp covariance matrix is known, and a-priori values for the object
covariance matrix are assumed depending on its size, the refresh rate of its orbital data, and the time to
TCA since the epoch of the TLE.
7
3. No OCM is received, and the object does not belong to the publicly available NORAD database: the
difference with previous situation is that the object state vector is taken from the First Filter tool, its RCS
is set to a typical value for space debris, and only the time to TCA since the time of the Summary Report
can be considered for the a-priori values of its covariance matrix.
As can be seen, without receiving OCMs, some estimation has to be made on the covariance matrix of the
secondary object. As this represents the weakest point in the computation of the probability of collision at
EUMETSAT, the algorithm implemented in the Detailed Conjunction Analysis software tool makes a user-defined
scattering in the values of this error covariance matrix, in order to be able to analyze worst-case scenarios.
The probability of collision is computed using the projection of the covariance ellipsoids on the conjunction
plane, using the formulas proposed by Akella and Alfriend 1,2. If this probability exceeds a given threshold, the
situation is escalated to operations management and different possible avoidance maneuvers are considered. At this
stage in the MetOp-A lifetime, that threshold is 1/104.
The flight dynamics software tools are run upon arrival of updated information from JSpOC via NOAA. The
conjunction situation is reassessed after each run, and the evolution over time of the different parameters for a
particular conjunction is kept by the tool for further analysis.
In specific cases of dangerous conjunctions, where further information is needed for helping the correct
assessment of the situation or where a large mismatch between the values of the probability of collision computed at
EUMETSAT and provided by JSpOC, further information may be requested and received from NOAA in the form
of relative velocity between the objects, details on the tracking campaigns, and the radial error covariance for both
MetOp-A and the secondary object. This information is used to select the most adequate values for the covariance
matrix used in the risk estimation.
D. Preparation of an Avoidance Maneuver
The Detailed Conjunction Analysis tool described in previous paragraphs also includes the Euler-Hill
formulation to easily, but very accurately, compute the new MetOp-A state vector at TCA after a maneuver of a
given size executed at a given time, and to update the covariance matrix to consider the added uncertainty
introduced by the maneuver execution performance. The resulting post-maneuver probability of collision is
computed using the new MetOp-A state vector and covariance matrix.
A parametric analysis in maneuver execution time (ranging usually from 0.5 to 2.5 orbits before TCA) and in
maneuver size (from 2.5 to 7.5 cm/s) permits assessment of the impact of the different options, which can then
presented to management (if time permits) for selection of the maneuver to be implemented. A trade-off between
maneuver size and epoch has to be performed. In case there is no time for consulting management, the smallest
maneuver performed 2.5 orbits before TCA that results in a post-maneuver Pc of less than 1/109 is selected.
The selected maneuver, or set of maneuver options to be presented to management, are fed back into the First
Filter tool to analyze the new depth of intrusion with respect to other known neighboring objects and check that the
maneuver does not result in another dangerous encounter.
Once a maneuver has been finally selected, the on-shift Flight Dynamics Operations Engineer generates the
corresponding operational maneuver file on a dedicated workstation. In case operations management subsequently
authorize an avoidance maneuver, the information is transferred to the operational flight dynamics server for
generation of the maneuver data store, ingestion of the maneuver into the operational orbit, and the generation and
delivery of post-maneuver products to mission planning, spacecraft operations and CDA antenna pointing.
Up to the moment of the final authorization from management, any updated information received from NOAA is
thoroughly analyzed in order to assess the need and the adequacy of the selected maneuver.
8
E. An Operational Example
As an example, partial results of the analysis performed around the conjunction on 28 December 2009 at
17:13:17 UTC with object ID 80188 are presented.
The first warning concerning this conjunction was received on 25 December, with updates in the following days.
Table 1 shows the evolution of the input data, of the assumed covariance for the secondary object, and of the results
obtained with the two software tools described above.
Table 1. Evolution of the conjunction parameters upon reception of consecutive Summary Reports
Date of Miss distance (m) Secondary covariance (m) Probability of collision
Depth of
Summary Along- Cross- Along- Cross-
Total Radial intrusion Radial JSpOC EUMETSAT
Report track track track track
25 Dec 995.0 94.5 -824.9 -549.3 0.7 60 800 60 1/4000 1/20000
26 Dec 325.0 29.7 -269.5 -180.5 0.2 30 400 30 1/1600 1/2100
27 Dec 395.0 27.0 -329.4 -217.2 0.1 30 400 30 1/1570 1/2400
28 Dec 395.0 27.0 -329.4 -217.2 0.1 79 1050 79 1/1570 1/17000

The geometry of the conjunction, as obtained from the First Filter tool with the data from the Summary Report
from 26 December, is presented in Figure 3. The impact angle in MetOp frame was 56deg.
Debris Error Ellipsoid and Metop-A relative position, velocity (m, m/s)
Debris Error Ellipsoid and Metop-A relative position in Collision
500 Plane (m), relative velocity perpendicular to the plane
300
250
Debris estimated Radial-Track
250
0 200
Debris estimated Cross-Track
-2500 -2000 -1500 -1000 -500 0 500 1000 1500 2000 2500
-250
100
-500
1668
Metop-A, 2904,4, -2819,5
-750 0
-2000 -1500 -1000 -500 0 500 1000 1500 2000
-1000
-100
-1250
-200
-1500
Debris estimated Along-Track
Debris Along/Cross-Track projected Error ellipsoid Metop-A rel.Position, collision plane -300
Metop-A rel.Velocity tangent to project in collision plane Debris estimated Along/Cross-Track
Projected ellipse in collision plane MetopA at delta Time Debris Error ellipsoid projected in Collision Plane (AC-R) Metop-A rel.Position, collision plane
Figure 3. Reconstructed geometry of a conjunction centered in the debris with First Filter tool
Since no information is publicly available for object 80188, some assumptions had to be made in the Detailed
Conjunction Analysis tool for computing a probability of collision. The highest probability that could be computed
with the data from 26 December was 1/2100, assuming a quite large RCS of 1m 2 and the covariance matrix shown
in Table 1. The conjunction was therefore escalated, and maneuver preparation activities initiated.
An in-plane maneuver of -2.5cm/s, to be performed 2.5 orbits before TCA (i.e. on 28 December at 12:59:53
UTC) was selected. The newly estimated P c was of the order of 1/1010. The subsequent ground-track drift would
have led to a violation of the Eastern dead band (+/-5 km) 16 days after the maneuver. As seen in Table 1, the
Summary Report received on the night of 27 December confirmed the figures. Therefore, a Maneuver Authorization
Meeting was scheduled for the morning of 28 December.
In parallel, requests for more detailed information were sent to NOAA. This information was received in the
early hours of 28 December and showed that the latest tracking available for the secondary object had been
performed on 24 December, and that therefore the confidence level given to the reported miss distance should be
low. Additional information received later included the value of the radial components of the covariances: 2m for
MetOp-A, 79m for the secondary object.
9
Taking into account the provided radial covariance for the object, scaling the along- and cross-track components
accordingly, and reducing the RCS of the debris to 0.01m2 (which would justify the described coarse tracking), the
obtained probability of collision was 1/17000, which is below the threshold used to initiate corrective action.
At the Conjunction Review Meeting, this information was considered and operations management decided that
an avoidance maneuver was not appropriate. If the decision had had to be taken only a few hours earlier, an
unnecessary avoidance maneuver would have been performed.
IV. Satellite Operations relating to Avoidance Maneuvers
Each MetOp-A orbit lasts approximately 101 minutes, with a ground station in Svalbard providing S- and X-
band telemetry and S-band telecommand capability every orbit. Ground contact times (passes) vary from roughly 11
to 16 minutes (from Acquisition Of Signal (AOS) for the telemetry until the Loss Of Signal (LOS)).
The EUMETSAT operational approach implemented for MetOp-A routine operations is to have a continuous
schedule of spacecraft commanding running on-ground, and during each pass the necessary commands to maintain
routine operations are uploaded to the spacecraft for an orbit 6 hours in the future for „routine‟ platform commands,
or 36 hours in the future for payload and instrument commands. This means that, coupled with the spacecraft
autonomous failure detection and recovery mechanisms, MetOp-A is capable of up to 36 hours of autonomous
operations without ground contact, and will be safe (even if not producing scientific data) for up to five days3.
In the routine phase, maneuvers are therefore planned a long time in advance. Activities to prepare the maneuver
and the overall system for a change in orbit (and by consequence, a shift in all timing) start on Monday for a
maneuver which will be executed Thursday afternoon. This long duration is not compatible with the process of
Flight Dynamics Team to assess the risk of the collision and the prediction of the best maneuver to perform.
Conjunction warnings were received by EUMETSAT in December 2008 and in January 2009, and the response
was to slow down the overall system to ensure an “easy” possibility of inserting a maneuver. As the system was not
optimized for this mode of operations, a significant number of system alarms were raised requiring more than 500
manual activities (triggering the execution of procedures, acknowledgements of alarm) be performed. At the time,
due to the nature of the risk to the satellite, the following risks were temporarily accepted:
risk of overlooking an alarm due to the rate of alarms,
risk of performing incorrect manual activities due to the fact that all automatic procedures should be
manually triggered and monitored.
Timing to well prepare the maneuver and to perform a consolidated risk assessment is a priority for collision
avoidance, therefore operation engineers considered how best to keep the automatic system running smoothly
without triggering continuously alarms and how to command a maneuver as late as possible.
It is the aim of the MIAMI procedure to be as integrated as possible with on-going routine operations of the EPS
System, in order to ensure operational continuity and minimize potential disruption of mission services that are
provided continuously to the user community. In addition the procedure should be simple to follow, and allow
activities to take place as soon as possible after the authorization to proceed has been issued.
When a collision avoidance maneuver is confirmed as mandatory (i.e. without a maneuver the probability of
collision with another object is above a pre-defined threshold) then the on-ground schedule is suspended (paused) at
a convenient point. This is usually the case a maximum of only 12 hours from the planned maneuver time itself. The
impact of this is that payload and instrument commands are still on-board for the following 36 hours of operations,
spanning over and beyond the time of the maneuver execution, but after this 36 hour period from schedule
suspension there will be no further commands pre-loaded on-board until such time as the schedule is continued. In
any case the spacecraft is in a safe state, since platform commands are already loaded to maintain good performance
of attitude and control over this entire period, and after the maneuver these commands will be re-uploaded with
updated parameters.
10
The selected maneuver type is in-
plane, with the burn magnitude relatively
small (typically 5 cm/s), but nevertheless
this requires that some of MetOp-A‟s
thirteen instruments be commanded into
a „safe‟ state due to the forces or possible
contamination during the maneuver.
After consulting with the instrument
providers and the spacecraft
manufacturer, it was decided that only
two of the instruments need to be
commanded as such: GOME (Global
Ozone Monitoring Experiment) and SEM
(Space Environment Monitor). The other
instruments remain in their operational
modes, but all science data generated
around the period of the maneuver are
flagged to indicate potential degradation

in quality. Figure 4. Artist’s impression of MetOp in orbit
The activities to perform the avoidance maneuver can be broken down into four main steps:
1. Delete routine operation commands for GOME and SEM around the time of the maneuver;
a. GOME has at least one command per orbit to activate a Time Line
b. SEM has one command per week to put this instrument into the calibration mode,
2. Load the maneuver commands including „routine‟ platform commands for post-maneuver orbital status5;
3. Load commands to put GOME and SEM into safe mode before maneuver, and back to operational mode
after maneuver;
4. After the maneuver has completed, acquire spacecraft tables giving additional information about the burn,
and perform Doppler and ranging to reconstruct the new orbit.
Figure 5 presents the order of activities on-ground and on-board during the MIAMI operation. All commands are
loaded as time-tagged, meaning that they are uploaded to the spacecraft for execution at a later pre-defined time.
The advantage of this approach is that all commands can be loaded anytime up to three orbits before the maneuver
burn (possibly later in case of a late update to collision parameters), and that during the execution of the commands
themselves the engineer must only observe and possibly intervene in case of problems. This allows the process to be
as relaxed as possible during what is an inherently stressful operation.
5
„Routine‟ platform commands include parameters for on-orbit position, day-night transitions, Earth sensor
parameters and masking, Sun sensor parameters, and solar array canonical position timing
11
Figure 5. Schematic displaying the order of activities on-ground with respect to MetOp passes during the
MIAMI operation, and how this translates to command execution on-board. Pass-2 is the backup in case of
major anomaly, linked link outage, during Pass-3.
A single top-level procedure has been created to perform all spacecraft commanding required for MIAMI. The
only input needed, for this top-level procedure, is the time of the burn itself. All other times (i.e. the times
before/after the burn when GOME and SEM operations should be deleted and replaced with safing commands) are
calculated automatically by the procedure based on the burn time. That ensures respect for all timing constraints
among the different commands, by definition of the script. This is made possible due to the flexible language used
by the EPS Mission Control System, called STOL (System Test and Operations Language). This is akin to a simple
scripting language, and allows procedures to perform calculations at run-time based on user-input, convert UTC to
OBT and vice-versa, and initiate procedures for different subsystems from the same top-level procedure. All steps of
the procedure can be validated at system level beforehand, and checks can be performed on user-inputs to ensure
they are not outside of expected limits.
All parameters for the platform commands to perform the maneuver (propulsion pre-heating, number of thruster
pulses, which thrusters to be used, AOCS mode changes etc.) are contained in data files that have been provided and
validated by the Flight Dynamics team. These data files are automatically accessed by the MIAMI procedure at run-
time. The parameters are read in as procedure variables and used to instantiate the necessary commands, with no
manual intervention.
Once all commands are loaded, the remaining engineer tasks are purely monitoring based. This includes:
- confirming GOME is „safed‟ state,
- confirming SEM is „safed‟ appropriately, and the pass-2 is a margin, which has been built into the schedule
to allow for re-commanding if not,
- observing the pre-heating of the propulsion system,
- confirming all spacecraft subsystems are nominal after the maneuver itself.
After the maneuver has taken place specific tables are downloaded from the spacecraft during the next pass over
Svalbard to give additional detailed information about the burn. Doppler and ranging is also performed to allow
Flight Dynamics to reconstruct the new MetOp orbit accurately on-ground.
The orbital information is then passed to the Mission Planning team who will continue the on-ground schedule
from exactly the point it was suspended, but using the new orbital information as input (see Figure 6). Bearing in
mind that payload and instrument commands for up to the following 36 hours are already on-board, having been
loaded before the suspension of the schedule, there are several hours margin before the new schedule must be
created and started. In addition, the „routine‟ platform commands uploaded as part of the maneuver itself ensure the
spacecraft is safe for many hours after the maneuver. This therefore allows plenty of time for system verification
beforehand.
12
Figure 6. Schematic showing a high-level view of the order of activities on-board the MetOp spacecraft
during the MIAMI operation. The maneuver (including the GOME and SEM safety/re-activation commands)
replace a portion of the routine on-board schedule. The payload and all other instruments continue nominal
operations throughout. Also shown is the transition of the on-board schedule from commands loaded using the
‘old’ orbit data and the ‘new’ orbit data calculated after the maneuver has been completed. Diagram is not to
scale.
Due to the typical size of a MIAMI maneuver burn (maximum 5 cm/s), the drift of the on-board schedule
(loaded using timings assuming the maneuver-free orbit) in the maximum 36 hours before the schedule using the
orbit containing the maneuver of MetOp begins, is small enough (below 4 seconds) to have no operational impact.
This means that there is already enough margin at system level to ensure that no alarm will be triggered, no data will
be lost if there is a discrepancy in term of time up to 5 seconds between the predicted time of event using the old
orbit and the actual time of event due to the new orbit. This means that the MIAMI operation is integrated almost
seamlessly with on-going operations of the EPS system.
The disruption to mission services provided to the user community is also kept to an absolute minimum. Still,
spacecraft safety is ensured thanks to the automatic procedure which incorporates all satellite constraints in terms of
commanding.
V. Conclusion
The MIAMI process is a validated operational activity designed to streamline the assessment of, and response to,
potential conjunction events involving the MetOp satellite. This process emphasizes satellite operational safety
through clear assessment and decision processes, while minimizing disruption to the continuity of operational
services to end-users. As such, it has proven to be a highly-effective tool in the execution of the EPS mission.
References
1
Alfriend, K. T., Akella, M. R., Frisbee, J, Foster, J. L., Lee, D, and Wilkins, M., “Probability of Collision Error Analysis,”
Space Debris, Vol. 1, No. 1, 1999, pp. 21-35.
2
Alfriend, K. T., and Akella, M. R., “Probability of Collision Between Two Space Objects,” Journal of Guidance, Control
and Dynamics, Vol. 23, No. 5, 2000, pp. 769-772.
3
Crozat, C., Righetti, P. L., de la Taille, L., Perlik, F. and Collins, P., “MetOp-A Attitude and Orbit Control Operations”,
SpaceOps, CP3318, AIAA, 2008.
13

MIAMI The EUMETSAT Operational Process T

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

MIAMI The EUMETSAT Operational Process T

Uploaded by

Copyright:

Available Formats

SpaceOps 2010 Conference<br> <b><i>Delivering on the Dream</b></i><br> <i>Hosted by NASA Mars AIAA 2010-2296

25 - 30 April 2010, Huntsville, Alabama

MIAMI: the EUMETSAT Operational Process to Implement

Lionel de la Taille1 and Gareth Williams.2

As part of the EUMETSAT-NOAA cooperative Initial Joint Polar System, MetOp-A

II. System Operations Processes Relating to Avoidance Maneuvers

Activities of the Flight

In this section, the EPS

These system activities

Figure 2. Flowchart summarizing the MIAMI System Operations process

B. Maneuver Decision Process

may then be presented to operations management if necessary.

If an avoidance maneuver is authorized, the MIAMI process will be initiated.

C. The MIAMI Process

D. Maneuver, Conjunction and Recovery

III. Flight Dynamics Activities relating to Predicted Conjunctions

A. Conjunction Warning Messages

two assumptions are:

C. Detailed Conjunction Analysis

particular conjunction is kept by the tool for further analysis.

D. Preparation of an Avoidance Maneuver

28 Dec 395.0 27.0 -329.4 -217.2 0.1 79 1050 79 1/1570 1/17000

IV. Satellite Operations relating to Avoidance Maneuvers

flagged to indicate potential degradation

You might also like