PASSIVATION STRATEGIES ON BOARD AIRBUS DS LEO PCDUS

Having in mind the increasing amount of spacecraft in orbit, the number of space debris becomes a growing issue. Regarding the space regions around the Earth to be protected, one of them is the Low Earth Orbit (LEO) one, for satellites with altitudes lower than 2000km. Even if the number of incidents in orbit caused by the spacecraft battery is very low when looking at the total number of satellite breakup events (around 3,6% – none of them were equipped with Li-Ion batteries) the uncontrolled nature of such events and their dramatic potential consequences make necessary a proper treatment, in the form of countermeasures that are fully justified taking into account the limited impact in mass and cost on the PCDU. This paper deals with the different strategies followed in the Airbus DS LEO PCDUs regarding the implementation of the passivation function in several LEO missions with different architectures (DET and MPPT solar array power conditioning). In the selection of the solution implemented in the frame of every mission, a key driver is the degree of advance in the test performed over flight representative battery modules regarding their safe behavior when deeply depleted after a long period in orbit with the passivation applied over the spacecraft.

Even if the number of incidents in orbit caused by the spacecraft battery is very low when looking at the total number of satellite breakup events (around 3,6%none of them were equipped with Li-Ion batteries) the uncontrolled nature of such events and their dramatic potential consequences make necessary a proper treatment, in the form of countermeasures that are fully justified taking into account the limited impact in mass and cost on the PCDU.This paper deals with the different strategies followed in the Airbus DS LEO PCDUs regarding the implementation of the passivation function in several LEO missions with different architectures (DET and MPPT solar array power conditioning).In the selection of the solution implemented in the frame of every mission, a key driver is the degree of advance in the test performed over flight representative battery modules regarding their safe behavior when deeply depleted after a long period in orbit with the passivation applied over the spacecraft.

BACKGROUND
In general terms, "passivation" refers to deplete or make safe the remaining on board sources of energy in a controlled sequence.
Several more or less recent normative are making an effort to regulate this aspect of the spacecraft design for the new missions to come or in course of development, [1] Most of these documents require either spacecraft deorbiting in 25 years or "parking" above 2000 km for more than 100 years.This 25 years period is in line with the requirements asking for 25 years of operative passivation in orbit, even if none of the standards require a fail free passivation electronics behavior.As an alternative to this, it is contemplated the possibility to perform a spacecraft de-orbit with a controlled atmospheric re-entry.

PASSIVATION CONSIDERATIONS
Several alternatives are possible to passivate the spacecraft after mission completion, but most of the cases the requirement specifications ask for one of the following strategies: x Battery disconnection.
x Solar Array Disconnection.
x Solar Array and Battery Disconnection.
In addition, the following considerations are to be taken into account, most of the times also reflected in the PCDU specifications particular of a given mission: x Passivation activation must be one failure tolerant regarding its unintentional activation, both regarding: o Passivation Control electronics, and o Power Components involved x The passivation function is allowed to fail in passivating the spacecraft, i.e. it is not required to implement a one failure tolerant electronics regarding this aspect of its performance.x In most cases passivation must be reversible by design, at least down to the moment on which the spacecraft energy sources are no longer available, and/or the satellite On-Board Computer (OBC) is no longer operative.x And, of course, passivation must be able to operate for the 25 years in orbit, having in mind that most of the time the Satellite Thermal control Subsystem will not be available.The satellite and on-board electronics will experience temperatures in excess of those normally required for this type of equipment, typically lower than the minimum start-up temperature and -many times -lower than the minimum qualification temperatures for some electronic and electromechanical components and/or state of the art associated manufacturing processes.
To complete the scenario, a deep-enough knowledge does not exist about how the batteries will behave in this situation of extreme environmental temperatures, and how safe they will be even if we apply correctly the passivation measures.Activities are ongoing to know more about this aspect of the design.

DET AND MPPT
Even if LEO missions share the same Electrical Power Subsystem (EPS) concept, the so called battery follower bus, the passivation detailed implementation strategy is also driven by the mission specific solar array conditioning baseline.In the following this paper presents the Airbus DS practical implementations in a wide range of LEO missions, covering solar array power management based on DET, MPPT and B2R.Separate sections will be devoted to every spacecraft solar array management concept.

DET: LEO PCDU EVO CASE
The LEO PCDU EVO is the Airbus DS new generation of Power Conditioning and Distribution Unit designed for Low Earth Orbit applications, for spacecraft powers in the range from some hundreds of Watts up to 3kW.It comes to substitute the previous AS250 PCDU, with more than 12 flight models in the last 10 years, some of them currently in orbit, some of them under FM manufacturing [5].
The PCDU design for this product line implements a Direct Energy Transfer scheme based on S3R cells [3].These are reliable by design (one failure tolerant) with respect to the loss of the power available from any solar array section.The PCDU implements the M+1 concept (one extra section) with two main functionalities under MEA control: x To be able to feed the bus with the power coming from a section whose S3R cell failed in open circuit in the power path to the main bus, or x To handle the power from a solar array section whose S3R cell failed in open circuit in the shunt power path, in case the instantaneous bus consumption is below the power provided by this section.
Nominal S3R cells 1 to 6 are connected to the M+1 section by a pair of power diodes in series as can be seen on Figure 1.The same diodes mentioned before are used to connect the S3R cells to the electronics in charge of passivating the solar array.
Passivation is exercised by a pair of electromechanical power relays in series (to be one failure tolerant w.r.t. a failure leading to the contacts of one relay stuck to on position).Moreover, the activation of the passivation is executed in two steps, Arming + Firing.It is reversible as long as there is sufficient energy available in the spacecraft battery to operate and command the spacecraft avionics.
The passivation relays are physically implemented in the Battery module to optimize the use of the available volume in the unit.

Figure 1. LEO PCDU EVO Solar Array Passivation
The passivation is activated in two steps and through two different command sources: o First, an ARM command is executed, to enable the function to actuate.This is a High Voltage / High Power Command (HV-HPC) direct With this design any single failure either in the HV-HPC generation or in the 1553 interface will not activate the passivation.Now a sequence of internal processes takes place inside PCDU to go to passivated state.They are depicted in Figure 2.

B2R: HP PCDU CASE
The High Power PCDU (HP PCDU) developed by Airbus DS uses solar array regulators in buck/boost (B2R) configuration with Maximum Power Point Tracking.The selected topology allows operating the solar array in a wide voltage range, with input voltages higher or lower than the main bus (battery follower) voltage, whilst providing high conversion efficiency.Thus it removes the limitation of input voltage by the main bus existing in systems with a single buck or a single boost stage.When the solar array voltage is similar to the main bus voltage, the B2R operates intermittently in buck or bust mode, with phases of direct energy transfer in between.To improve the overall system efficiency, the B2R has an internal auxiliary power supply, which is supplying the regulator only during the sunlit part of the orbit, controlled by the solar array voltage.
Redundancy in solar array regulation is achieved by an N+1 concept, i.e. by isolating a failed converter from solar array and bus and by a reconnection of the affected solar array section to the redundant converter [6].In the HP PCDU, the EOL passivation electronics disable the power transfer from the solar array to the main bus, while the battery remains connected to the main bus.
Two independent signals are used to activate the passivation process, each received by a relay: x Passivation Arming.
x Passivation Confirmation.
The Arming relays are controlled by direct High Power Commands (HPC) while the 'confirmation' switches are activated by MIL-1553 command, so a small driver is needed.All relays are 'latching' as their status needs to be unchanged when the battery is fully discharged after the SA has been passivated.
In order to provide additional operational safety, the Passivation Confirmation is made by two independent MIL-1553 commands, which both have to be received by the PCDU in the right sequence in order to activate the passivation relay.The relays are connected in series thus are 'one failure tolerant' w.r.t.unintended activation.In this way, the B2R MPPT modules can be disabled only after receiving an Arm and both Confirmation commands, so no single failure leads to unintended disabling of all SARs.

Figure 5. AS400 PCDU Passivation control strategy
The passivation signal generated in this way switches off the B2R auxiliary supplies, thus inhibiting the energy transfer from the solar array to the battery and the main bus.Physically, the passivation relays are located in the Battery module 6 MPPT: SENTINEL-2 C&D AND JASON (SENTINEL-6) PCDU CASES

Initial Concept
The PCDU design for these two missions Sentinel-2 and JASON is mainly a reuse of the MPPT-based in-orbit Sentinel-2A PCDU.The only difference is the number of MPPT modules required for each spacecraft, as two modules are needed for Sentinel-2C PCDU and four modules for JASON (Sentinel-6) PCDU.While the original Sentinel-2A mission developed before the implementation of the LOS laws did not incorporate any passivation electronics, Sentinel-2C and Sentinel-6 require this function and the related hardware adaptation.
At the beginning the proposed approach was based on pulling down the MEA signal at the end of the satellite operational life.As the MEA signal is a triple redundant majority voted reliable signal, the proposed approach was to act independently on each MEA branch by means of a small latching relay, TL26 type, when required to passivate the spacecraft.
One relay was devoted to each MEA branch, in this way a single failure in one of the relays leading to the loss of one MEA branch is equivalent -from the final effect point of view -to losing one out of three of the MEA branches, which is an already existing failure scenario, self-compensated by the existing design.An arming stage relay, also TL26 type, upstream the MEA branches passivation execution relays, forces the passivation to affect "simultaneously" to the three MEA branches, preventing bus transients that may happen in case the three MEA branches would be passivated (pulled to zero) sequentially.To achieve this, the passivation arming relay must be the last to be closed.Refer to figure 6 for further details.

Figure 6. Initial passivation concept for Sentinel-2 MPPT-based missions.
The proposed architecture implements the following failure tolerance concept: x Passivation will not be executed after a single failure in the passivation relays: two barriers must be closed to exercise the passivation.In particular, the failure in short circuit between the relay contacts and return terminal of the relay coil, would only pull to zero as much as one of the three MEA branches, but not the reliable MEA signal.x The passivation function can be lost after a single failure (e.g.failure in permanent open condition of the arming relay).This is not against the existing passivation requirements, as was already mentioned in previous paragrahs.
Figure 7 summarizes which would be the PCDU MPPT function behavior in sunlight & eclipse conditions once the passivation function was activated.In the drawing, APR stands for Array Power Regulator, i.e., the power converters in charge of extracting the power from the solar array, either in conductance or MPPT mode as a function of the spacecraft overall energy balance.

Final Implementation
According to the evolution in time of the EPS customer preferred implementation, for Jason (and Sentinel-2C & D) mission the depletion of the flight batteries is considered a must, but not necessarily the isolation of the solar array power, based on the ISO "Space Systems, Space Debris Mitigation Requirements" document, ISO 24113, whose requirement 6.2.2.3 states that "a spacecraft or launch vehicle orbital stage shall permanently deplete or make safe all remaining onboard sources of stored energy".In view of above considerations, and taking advantage of the existing battery interface electromechanical relays, the final solution adopted for these programs is conceptually depicted in Figure 8.

Figure 8. JASON and Sentinel-2 C/D passivation approach
Once the Satellite has reached the end of mission, the passivation process is followed in three steps: 1. Establish a controlled low SOC for the battery (by means programing a special low End-of-Charge (EOC) level).

Command Battery switches to open. This
enables controlled battery discharge with a fixed built-in leakage (resistors in red in figure 8 above).This is done through flight HPC commands.3. Entering into passivation phase.
Both Jason and Sentinel-2 C/D share the same architecture, but exhibit some differences regarding battery switch arrangement.A node of the battery switch is always made with two EL-215 relays in parallel, but while the Sentinel-2 C/D battery switch has a 4 nodes quad series-parallel configuration, the Jason one is made with 5 nodes in parallel.Apart from this detail, the performance of the passivation function has no difference.
The quad arrangement of resistors are sized as to provide a slow battery discharge rate leading to a current that can be accommodated in the satellite energy budget in case of unexpected connection.Regarding the Off (battery relay opening) command, an independent command is devoted to each node of two relays in parallel, so switching off (relay opening) is sequential and opportunity exist to reverse the passivation action.

THE GRACE FOLLOW-ON PCDU CASE
Being a successor of the GRACE mission launched in 2002 the GRACE FOLLOW-ON (GRACE-FO) PCDU implements an electrically "quiet" bus with negative bus voltage [7].Solar Array conditioning is provided by MPPT in a two-out-of-three redundancy configuration.
As a major part of the electrical PCDU design was based on previous heritage designs such as e.g. the SWARM PCDUs, the selection of an implementation concept for the passivation function was strongly influenced by boundary conditions of the heritage design.
The concept finally chosen for GRACE-FO is based on pulling the failure tolerant MEA signal downstream the majority voter to a saturation level which sets the power provided by the solar array regulators to zero.Battery discharge is then done by the internal loads of the satellite.
The MEA pulldown is implemented by a series of two latching relays, each switchable by a dedicated discrete HPC-command, i.e. again following two-step logic with: x Passivation Arming x Passivation Confirmation The status of the relays can be monitored by telemetry and discrete Disarm commands are available for resetting the passivation as long as the satellite can be commanded.
As in the other concepts presented herein, this passivation method is single-failure tolerant w.r.t.unintended activation but may be lost with one single failure.

CONSIDERATIONS ON EXTENDED PASSIVATION TEMPERATURE RANGE
As commented at the beginning of the paper, the satellite and on-board electronics will experienceonce the spacecraft was passivated -temperatures in excess of those normally required for this type of equipment, typically lower than the minimum start-up temperature and -many times -lower than the minimum qualification temperatures for some electronic and electromechanical components and/or state of the art associated manufacturing processes.
In the frame of LEO PCDU EVO program it is under agreement process to perform a set of complementary tests to gain confidence on the behaviour of the critical electronic components for the passivation function in the above mentioned extreme operational conditions.
Disposal phase temperatures are calculated to be in the range [-90°C; +60°C], understood as unit TRP (Temperature Reference Point) levels.
Diodes and relays are very strong and normally qualified for wide temperature ranges.PCB technologies are potentially more fragile.For this activity, it is deemed sufficient to make On/ Off cycles at hot and cold temperatures.The total number of On/Off cycles is very important.Eventually this number could be reduced considering that: x After some years in disposal phase the solar array and the battery will be to some extent degraded in performances w.r.t.initial ones.x Also, the amplitude of temperature during an orbital cycling is usually lower than the difference between the minimum and maximum temperature in steady state.
Accelerated On/Off cycling can be made in order to reduce the tests duration: a mixed cycling with steady state temperature combined with On/Off accelerated cycling can be performed, see Figure 9.
A setup will be generated to test the passivation relevant components in the closest possible scenario to the real operational one.The following relevant components are identified: x Passivation power relays & free-wheeling coils diodes.
x Power Schottky series diodes.
x Shunt power resistors.
x Solar array interface connectors.
x Mechanical connections from the PCBs to main bus.
The setup, see Figure 10, will take into account the different worst case maximum currents circulating through every above mentioned item involved in the passivation, in particular: x The maximum short circuit current of one solar array section for connector pins, current measurement shunt and Schottky diodes.x The overall solar array panel current through the passivation relays and mechanical connections from the PCBs to the main bus bar.

CONCLUSIONS
Several strategies for spacecraft EOL passivation have been presented in this paper, all of them are implemented on board Airbus DS PCDUs developed for LEO applications.Practical cases presented cover a wide power range from a few hundreds of Watts to more than 7kW, and consider all the solar array conditioning techniques available today in the market, namely: x Maximum Power Point Tracking, either based on conventional step down buck type derived power converters or B2R (buck / boost) power conversion stages.x Direct Energy Transfer, based in the wellknown Sequential Switching Shunt Regulator principle.
The real mission cases considered show a wide variety of implementations either oriented to Battery or Solar Array disconnection.The variety of solutions is driven by two factors: x Passivation is a "relatively new" functionality that, to some extent, is going in advance with respect to the necessary knowledge on how batteries behave when exposed to the extreme environment of a passivated spacecraft without active thermal control.x The translation of the passivation requirements (as written in the standards mentioned in section 1 of this paper) into specific requirements in the PCDU specifications is subject to different interpretations that at the end lead to significantly different hardware implementations.
One of the difficulties is the fact that satellite and onboard electronics (both components and processes) will experience temperatures in excess of those normally required for this type of equipment, typically lower than the minimum start-up temperature and -many timeslower than their minimum qualification temperatures.

Figure 2 .
Figure 2. LEO PCDU EVO Passivation steps.To reverse passivation is required a careful sequence of operations to prevent from stressing the passivation function electronics and the rest of the PCDU hardware.Passivation reverse sequence is detailed in the following diagram.

Figure 7 .
Figure 7. APR behavior in sunlight & eclipse while passivated

Table 1 .
Summary of passivation implementation strategies