SPACECRAFT ELECTRICAL PASSIVATION : FROM STUDY TO REALITY

Due to the increasing risk posed on satellites from space debris, requirements are now being implemented into satellites to be launched in the future to prevent the release of additional debris. One of the key requirements is the electrical passivation of satellites at end of mission (EoM) in order to prevent the break-up of satellites due to the stored energy in the power subsystem. In order to comply with these new specifications and find suitable solutions for the upcoming missions, a set of workshops and R&D activities have been initiated and conducted in the past few years. In particular it has provided a better understanding of the environmental constraints and the battery safety after EoM, together with the identification of the most appropriate implementations for electrical passivation. The latest available results of these activities and the ongoing work are presented within this paper. In addition, new spacecraft under development are currently implementing electrical passivation solutions taking into account the conclusions of these studies.


INTRODUCTION
The increasing number of space debris has become problematic for the sustainment of space activities in earth orbit.Several spacecraft breakups have been observed in the past and some of them are due to a battery breakup.In order to mitigate the risk to generate debris in the future, passivation of the spacecraft after end of mission is now required in some cases.In particular the electrical passivation is intended to deplete and/or make safe the on-board battery.More detailed background information can be found in a previous paper [8].

CURRENT SPECIFICATIONS AND GUIDELINES
This section reviews the current space debris mitigation specifications and guidelines related to electrical passivation and applicable to most European spacecraft.
The European standard ECSS-U-AS-10C [1] -adoption notice of ISO 24113:2011 [2] -is applicable to all new ESA missions [3].In particular the ISO §6.2.2.3 specifies that "During the disposal phase, a spacecraft or launch vehicle orbit stage shall permanently deplete or make safe all remaining on-board sources of stored energy in a controlled sequence".The associated ESA handbook ESSB-HB-U-002-Iss1 [4] published in 2015 provides guidelines for interpretation of the requirements, implementation and demonstration of compliance.For example it clarifies that the capability to passivate is not required to be single point failure tolerant or that passivation is not required in case of controlled atmospheric re-entry at EoM.It also provides some possible generic passivation methods.The French law LOS [5] is applicable to spacecraft operated by French or France-based operators.The associated guidelines [6] provide also clarifications and more detailed specifications.For example it specifies that the battery shall be discharged at EoM and if isolated from the spacecraft the auto-discharge shall be less than 1 year.It also clarifies that the solar generator deactivation can be fulfilled either by solar array short/open circuit, or by stable deactivation of the power conditioning or by opening of all equipment distribution and battery charge lines.Table 1 compares these main specifications.

R&D ACTIVITIES
In order to comply with the new passivation specifications and find suitable solutions for the upcoming missions, a set of workshops and R&D activities have been initiated and conducted in the past few years.First workshops were organised in 2013 (at CNES and at ESTEC) providing the opportunity for experts to share the first investigations and studies on the subject.But it also raised several open points in particular concerning the risk of battery breakup, the environment and behaviour of spacecraft after EoM, the long term behaviour of components and the interpretation of some requirements [7] [8].Following these events, some R&D studies have been initiated to better understand these open points and identify the most appropriate implementations for electrical passivation.The latest available results of these activities and the work still to be performed are presented below.

Environmental Impact on Power Systems After End-of-Life [9]
An ESA internal activity was carried out in 2014 with the goal to better understand the environmental effects in terms of thermal and radiative, which can then be used to better understand the type of degradation on the power subsystem of a satellite.An overview of the various environmental conditions which a battery or a PCDU may be susceptible to within 25 years after a 15 year operational life in LEO, MEO and GEO are hence presented.
For the thermal assessment, the following different assumptions were assessed with the goal to cover most of the existing earth orbiting missions and platforms: x Different orbits, LEO (600 km and 800km SSO), MEO and GEO; x Alternative configurations where the battery is of various sizes and is located inside or outside; x Different attitudes of the satellite such as the radiator pointing Nadir or towards the sun, or the radiator rotating in and out of direct sun; x A range for the thermo-optical properties of the radiators and panels for solar absorptivity and infrared emissivity based on literature and worst case extrapolations.

Figure 1: GEO hot case -Effect of Eclipse
In terms of maximum temperature, the hottest case identified was 106°C in GEO, with the radiator pointing towards the sun, and during the solar solstice where there is no eclipse (Figure 1).The minimum temperature in cold case was -167°C.
In LEO case, the maximum temperature was 82°C.The thermal results also indicate that by inducing a spin rate into a satellite the overall temperature range is reduced (see Figure 2).The battery configuration has also an impact.

Figure 2: LEO hot case -Effect of battery configuration and spacecraft rotation
For the PCDU the minimum temperature was -162°C and the maximum was 56°C.
For the values provided, generally, worst case assumptions were considered and hence it is expected that the majority of satellites will fall within these temperature boundaries.
A radiation analysis was conducted for three common Lithium-Ion battery types (ABSL 18650HC, Saft VES16 and VL48E) for each of the orbits.A simplified geometric model for the various batteries were identified and then using the Geant4 Radiation Analysis for Space (GRAS) tool [15], it was possible to estimate the radiation dose in each of the battery cores for a total lifetime in-orbit of 40 years, which assumes 15 years of operational lifetime and 25 years during the disposal phase (see Table 2).The doses to be encountered by the bulk battery over the 40 year period are manageable (< 200 kRad for the total battery).However, for the outermost layers of the battery, the doses can be as high as 600 kRad.This should not be an issue considering that typically the cells are tolerant to at least 1 MRad.But these values do need to be considered for any potential cell balancing circuit and/or by-pass switch that may be integrated.

Orbit
For PCDU components, the total dose depends on the shielding and is according to Figure 5.
In addition simulations assessed the meteoroid and space debris flux for the three orbits, and the method to do so has been presented, from which it is possible, for a given design, to identify the minimum size and the number of particles which will penetrate the wall of a satellite or sub-system and possibly damage the battery or PCDU (see Figure 3 below).

Figure 3: Example of critical meteoroid and debris fluxes for various orbits
Oxidisation, plasmas and charging were also briefly assessed but their impact was considered less significant.
It has to be noted that these simulations are limited by the assumptions that were taken, and indeed for such a study, a large number of assumptions were required.In order to identify boundary conditions some unlikely extreme case assumptions have also been considered.So the results have to be considered with critical thinking but provided a good basis for the follow on activities described below.
A more in-depth overview of the thermal and radiative analysis are available in reference document [9].

GSTP -Spacecraft Power System Passivation at End of Mission [10]
The objective of this activity is to study, implement and evaluate the most adequate means to ensure a proper and reliable spacecraft power system passivation at end of mission.
The main tasks performed in Phase 1 are: -Simulations of environmental conditions (mainly temperature and radiations) for real existing platforms for LEO, MEO and GEO mission after end of mission.-Study of battery safety, and its dependence on battery conditions (SoC, temperature) after end of mission.-Study of possible passivation devices and assessment of long term performance of components under harsh environment.-Review of potential implementations and recommendations.
In order to assess realistic and representative scenarios faced by the satellites at EoM, dedicated thermal and radiation analyses were done on real existing spacecraft platforms for LEO, MEO and GEO missions.The achieved simulation results were compared and combined to those achieved in the previous activity ( §3.1 [9]).The main focus of the environmental simulations were to assess thermal and radiative conditions into which the battery and the passivation device (e.g.located in the PCDU) are expected to be exposed after end of mission.The environmental conditions for the battery were simulated in two spacecraft configurations: a) battery mounted inside the spacecraft and, b) outside the spacecraft.
The temperature ranges obtained in the various simulation results are summarized in Figure 4.It has to be highlighted that some simulations considered extreme worst cases such as sun constantly facing the same radiator, heat pipe failure or MLI completely torn.It also considered current existing platforms, knowing that the configuration of future platforms could be improved to reduce the temperature range to a more reasonable level.Thereby the temperature range could be reduced to for example [-100°C to +100°C] or even [-50°C to +80°C], which makes easier to guarantee the battery safety and the passivation device long term performance.

Figure 5 -Radiations for various orbits
The study of the battery safety was focused on various Li-ion batteries from Saft and ABSL.Battery conditions, in particular State of Charge (SoC) and temperature, were recognised to have a significant impact on the battery safety.The available information about battery performance in various conditions were collected and investigated.The most disastrous phenomenon is the thermal runaway, which may occur in a battery submitted to high temperature (induced by environment or by hazard such as overcharge, shortcircuit or damage), and which may lead to battery breakup [12] [13].Typical behaviour is shown in Figure 6. Figure 7 -Thermal runaway vs SoC (source [13]) Figure 7 shows the dependency of the thermal runaway phenomenon on the SoC for new cells.For aged cells thermal runaway starts at slightly higher temperature.
It has been identified that although some battery cells are equipped with various protections which limit the risk, the speed of the thermal runaway reaction may be too high for the protections to react in time in some cases and the risk of breakup cannot be completely excluded.
Recommendations about battery conditions after end of life to reduce the risk of battery breakup were given as follows: • Discharge the battery as low as possible after EoM (at least 50% SoC but lower is better).
• Prevent recharging of the battery after passivation, and in particular avoid overcharging.
• The cumulated radiation doses should not exceed certain limits regarding Li-ion cells themselves but also electronics (if any in the battery).
• The passivation device shall sustain the harsh environment it is exposed to after passivation to guarantee safe conditions for the battery.
Possible components that could be used for passivation device implementation have been studied, focusing on their ability to sustain long lifetime and harsh environment.The following components have been assessed: semiconductors (MOSFET, diode), relay, bypass switch and cable cutter.
Semiconductors have the advantage to be compact and often easier to accommodate but the main drawback is that their performance is not very well known beyond 20 years, in particular if temperature and radiation conditions become extreme.Relays are electro-mechanical devices and seem more robust to extreme conditions and to maintain passivation for a long time.The drawback is that they are less compact and their current/voltage ratings can be limited.
Concerning by-pass switches (currently used for battery cell by-pass) it is very robust but bulky, expensive and their voltage capability is not demonstrated above about 5V.
Finally cable cutters are also very robust but bulky, not space qualified for activation after a long time and can produce unwanted short-circuits inside the harness during activation.
A large number (27) of potential implementation solutions were studied: • solutions at spacecraft level such as adapting the spacecraft configuration or attitude (e.g.spinning) after disposal to protect the battery from the harsh environment, battery containment for small spacecraft, SA mispointing, software patch, decrease of battery charge voltage/current,… disconnection or short-circuit via various devices, overcharge, overdischarge, use of internal protections.
• solutions at solar array level such as disconnection or short-circuit via various devices.
• solutions at bus level such as short-circuit of the main bus via various devices.
The optimal solution may be a combination of two or more different single solutions.These solutions were ranked according 25 weighted factors related to performance, compliance with requirements, impact on design and on mission.The most promising solutions according to this ranking are: • Battery disconnection by relay or by-pass switch and discharge by resistor.
• Disconnection of solar array by relays.
• Short-circuit of solar array by relays via diodes.
In addition the following options were also identified as promising when combined with other solutions or in particular cases: • adapting the spacecraft configuration or attitude (e.g.spinning) after disposal, decrease of battery charge voltage/current via dedicated levels, over-discharge the battery until it transforms to a pure resistance.
• battery containment for small spacecraft such as cubesat.
• for spacecraft already equipped with batteries with bypass switches, these switches can be used to disconnect the battery cells (row after row) with minor impact on the design.
A set of recommendations were proposed and are summarized below: • Perform thermal and radiation analyses after disposal to verify that the battery and passivation device stay inside acceptable ranges in worst case conditions.Avoid high temperature and high radiations.
• For the components used for the passivation device, privilege (electro-)mechanical devices such as relays or by-pass switches which are more robust than semiconductors with respect to long life time and harsh environment.However semiconductors could be used in LEO missions for which the total duration from launch to re-entry is short.
• Regarding battery safety, as detailed above, it is particularly recommended to discharge the battery as low as possible and to avoid high temperature.
Phase 2 of the study is ongoing and is expected to: 1. Provide a "toolbox" document describing in detail the most interesting passivation solutions including the operations.
2. Evaluate and test some components (relay, by-pass switch, Mosfet, diode) that could be used for the passivation device, in particular with respect to extended ratings and/or lifetime.After a preliminary evaluation with various component manufacturers, it appears that: • for relays, they are already qualified to be activated until EoM (at the time of passivation).After passivation, they only need to stay in the same stable position (without being activated again), which is a priori not a problem for extended lifetime.Space grade relays are in hermetic package filled with gas (e.g.nitrogen), which can leak with time leading to low gas pressure.This is not a problem provided that the voltage is not above the critical threshold according to the Paschen curve (typically 200-300V for air).Also relays are not sensitive to radiations and their temperature range rating is quite wide (from -65°C to 125°C).If needed the temperature range could probably be extended to <-100°C to 175°C, which is to be confirmed by tests.
• for semiconductors (Mosfets, diodes), as there is no data results for lifetime beyond 20 years, accelerated life tests and cycling tests are necessary to know if they could be used up to 40 years or even longer.
• for by-pass switches (currently used for battery cell by-pass at low voltage below 5V), their capability to be used at higher voltage to short or open circuit battery lines, solar array lines or main bus needs to be evaluated and tested.

TRP -Battery Passivation [11]
As already explained in the previous section, the battery is considered to be the most dangerous part of the EPS in terms of potential debris generation.A main topic of discussion nowadays is about the battery safety after EoM, following off nominal environmental or failure conditions and subsequent battery abuse in space.Passivation of the battery is believed to be the solution in mitigating such potential explosion risks.One way to achieve passivation is to deplete the spacecraft battery.However if the latter is to be implemented a very careful assessment of the behaviour of the battery at such conditions should be made.Such an assessment can be very complex considering that temperature, radiation, SoC and aging of the battery could play a role among other parameters on the risk and possibility of battery explosion.The actual probability of a thermal runaway leading to a cell explosion is impossible to assess without testing.The ESA TRP objective, performed in collaboration with Airbus DS, SAFT, ABSL and CEA, is to understand and demonstrate through testing the behaviour of a spacecraft lithium-ion battery, under extreme conditions, which the battery can experience after EoM or during/after passivation if any.Simulation results performed in the GSTP study have been used as an input to the test plan for this TRP.The Li-ion battery safety assessment has been summarized, listing all the issues that can arise during the satellite lifetime.The impact of different parameters such as aging, SoC, temperature, radiation or micrometeoroids will be analysed and tested.Both fresh and aged battery cells used in spacecraft batteries will be tested in order to investigate the impact of the aging during LEO and GEO missions under potential off nominal conditions in space that the battery might experience.
The tests foreseen in this TRP are: x External short-circuit; x Internal short-circuit; x Over-charge; x Over-discharge; x Accelerating Rate Calorimetry (ARC) test; x Over-temperature test; x Micrometeoroids.

Figure 8 -18650 cell after thermal runaway
Cells from the two main battery manufacturers in Europe, ABSL and SAFT, will be used for testing including ABSL18650-HC, -HCM, -NL and SAFT VES16, VES140, VES180.
At the time of writing, some tests have already been performed on the VES140 cell.The approach followed in this study is to assess first the impact of different parameters on one cell model and then, depending on the results, identify the most important and refine the test plan for the subsequent models to be tested afterwards.
One of the most interesting results so far are the ARC tests performed on new VES140 cells at different SOC.ARC testing has confirmed that self-heating onset temperature and self-heating rate is a function of the stored electrical energy stored as chemical potential energy within the cell.100°C for new VES140 cells at 50% SOC that is reduced down to 68°C when the cell is fully charged.In both cases the thermal runaway temperature is around 130°C.It is important to clarify that a cell will not automatically go into thermal runaway once it reaches the onset temperature.It means that an exothermal reaction starts, that can potentially lead to a thermal runaway if the cell continues to be heated.Thus, it is of major importance the thermal control design of the spacecraft and its potential degradation after EoM.

Figure 10 -Heat rate during the ARC test on a VES140 cell at BOL and at 50% SOC
Once the thermal runaway starts, it has been observed that the security mechanism is correctly activated (leak before burst) and the cell opens on the positive side at 150°C, which slightly reduces the temperature.However, if the temperature of the environment continues to increase after that, even if the cell is open, and the fast generation of gases can lead to the expulsion of the windings, generating therefore some debris that could be fatal for the battery and the spacecraft.This has been observed on some samples, that experienced a new reaction at 170°C, expulsing the windings.

Figure 11 -VES140 cell sample after the ARC test with the positive side opened
For now, the main outcome of this study is that environment temperature is key to guarantee the safety of in-flight batteries.Assessments of battery temperatures after the EoM should be performed in order to evaluate the risks of experiencing thermal runaways, especially for the GEO satellites, that will last longer than LEO.The study is currently going through all the other tests, the results so far are very promising and will give a broader and clearer perspective of battery safety on spacecraft.

CleanSat activities
In addition some small activities related to electrical passivation were conducted in the frame of the ESA CleanSat programme, where the goal is to support new developments for space debris mitigation.These activities were jointly managed by the 3 main European large space system integrators (Airbus DS, TAS and OHB) and were occasionally followed by other observers.So it was also a forum to share information among the main European industrial actors.This approach aims at defining harmonised requirements agreed among all the stakeholders (Agency, integrators and suppliers) and a consolidated preliminary design to prepare the technology maturation in GSTP as of 2017.

Battery safety [16]
This study, carried out by ABSL, looked at analysing the safety of Li-ion batteries in LEO, MEO and GEO, with a focus on end of life.Assessments were performed on the risk of thermal runaway occurring, based in differing battery factors, such as temperature and state of charge.The study provided guidelines for the battery conditions to be achieved at the end of life through passivation, as well as highlighting future tests that should be performed to further the understanding on battery safety.Lastly, extra tests relating to battery passivation were proposed for future battery developments.

Solar array disconnection [17]
This study, carried out by Leonardo, investigated different options for isolation or shunting of the solar array in the PCDU.The priority was put in finding a common solution covering the needs of different markets including LEO, MEO and GEO.A trade-off was performed taking also into account the company heritage and a couple of options were identified to perform a preliminary design and a development roadmap.The selected concept was to short-circuit each solar array section by a relay (or 2 for redundancy) and it would be implemented in dedicated modules to be included in the PCDU between solar array interface and SAR modules.

Passivation of solar array in PCDU [18]
Thales Alenia Space Belgium proposed a different approach targeting LEO platforms market which is also the main focus of the CleanSat programme.Therefore the study focused on finding an optimal solution for this market where MPPT architectures are more and more common.The selected concept was to implement an isolated DC/DC converter for the solar array regulator (SAR) and use the galvanic isolation of the transformer to achieve the passivation.This concept has the advantage to offer a real physical and robust separation between solar array and main bus.

IMPLEMENTATION ON REAL MISSIONS
New spacecraft under development are currently implementing electrical passivation solutions taking into account the conclusions of the studies.And in many cases there is no much to adapt to implement an adequate electrical passivation.
For example Sentinel-2C and -2D spacecraft (LEO sunsynchronous orbit 786km, 28V unregulated battery bus, prime contractor Airbus DS) will implement a disconnection of the battery by relays and depletion resistors to fully discharge the battery down to 0V (see Figure 12).There was already a quad of relays between battery and main bus on Sentinel-2A and -2B models but the in-flight OFF commands were missing.So the adaptation was to add these OFF commands (direct high level priority commands from ground).In addition, to achieve full battery passivation, depletion resistors in series with arming straps (to avoid battery depletion during AIT) were also added.The depletion resistors dissipate only a few watts maximum and ensure a full depletion of the battery within 1 month (TBC).Once the battery voltage reaches about 4V (0.5V/cell), copper dendrites start to develop inside the cells, which shortcircuit the battery irreversibly.

Figure 12 -Sentinel 2 C/D electrical passivation concept
To consolidate the design an environmental analysis during the disposal phase has been performed for the battery and the PCDU.Also a detailed procedure relates all the operations to be performed at end of mission, including switch off of units, battery discharge, battery isolation by direct commands from ground, confirmation by direct status, etc.Other earth observation satellites such as Jason-CS/Sentinel-6 and others in preparation will adopt a similar design.
For GEO commercial platforms such as E3000 or Alphabus, the battery by-pass switches can be used at end of mission to disconnect the battery cells after having discharged them as low as possible.
As mentioned in the above paragraphs new developments are also foreseen for future platforms.

PERSPECTIVES FOR THE FUTURE
It is expected that more and more earth orbiting spacecraft will implement electrical passivation from now on.As the risk of battery break-up after EoM cannot be completely excluded, a dedicated passivation function is necessary.
In order to optimise the designs, the main activities foreseen to fill the knowledge gaps are: • tests on batteries (cells and modules) to assess their safety during the disposal phase: via the ongoing TRP activity ( §3.3) and/or if necessary future activity ( §3.4.1) • tests on components used for passivation to assess their robustness under extreme conditions and/or extended lifetime: via the ongoing GSTP activity, phase 2 ( §3.2) • development of optimal integrated designs and operations to achieve passivation: via the implementation on ongoing/future projects ( §4) or future development activities ( §3.4.2, §3.4.3)

CONCLUSION
The activities related to spacecraft electrical passivation conducted these last years within ESA and the European space industry have been presented.The applicable specifications have been clarified by new guidelines.
Various R&D studies led to a better understanding of the environmental impact, the battery safety and the robustness of components during the spacecraft disposal phase.Most promising passivation methods and recommendations have been proposed.The conclusions of these studies are now being taken into account for the implementation of electrical passivation on new spacecraft.Finally some studies are still ongoing or in preparation to further characterize the battery safety and optimise the passivation designs.

Figure 4 -
Figure 4 -Temperature range for battery or PCDU Radiation doses for LEO, MEO and GEO missions after end of life were also simulated.Radiation depth curves for the 3 specified environments after 40 years (15 years operational phase + 25 years disposal phase) are shown in Figure5.The maximum radiation total dose depends on the orbit, on the shielding and on the duration considered.For the battery cells it has been computed from less than 10 krad (LEO case) to 57 Mrad (MEO case with and equivalent aluminium shielding of 1.5mm from the battery case and spacecraft).For the PCDU components, it has been computed from less than 5 krad to 100 krad.

Figure 9 -
Figure 9 -ARC test result on a VES140 cell at BOL and at 50% SOC First results show an onset temperature around 90-