POWER SUBSYSTEM APPROACH FOR THE EUROPA MISSION

NASA is planning to launch a spacecraft on a mission to the Jovian moon Europa, in order to conduct a detailed reconnaissance and investigation of its habitability. The spacecraft would orbit Jupiter and perform a detailed science investigation of Europa, utilizing a number of science instruments including an ice-penetrating radar to determine the icy shell thickness and presence of subsurface oceans. The spacecraft would be exposed to harsh radiation and extreme temperature environments. To meet mission objectives, the spacecraft power subsystem is being architected and designed to operate efficiently, and with a high degree of reliability. 1. EUROPA MISSION OVERVIEW The planned Europa mission’s main focus is to execute an in-depth science investigation of Jupiter’s icy moon Europa shown in Fig. 1 [1]. The moon has shown evidence of a liquid water ocean underneath the unknown thickness of icy surface. The ocean could provide an environment suitable for life due its interaction with a volcanic seafloor. Figure 1: Cutaway diagram of Europa's interior. Artwork credit: Michael Carroll The combination of harsh radiation, low temperature (30 K) environments, and distance from the sun (5 AU to 5.5 AU) creates challenges on design and implementation of the spacecraft and instrument hardware. The mission design team is expending great efforts to minimize the amount of total dose radiation the flight system would accumulate and maximize science data return. The NASA-selected instruments intend to characterize Europa by producing high-resolution images and surface composition maps. An ice-penetrating radar intends to determine the crust thickness, and a magnetometer would measure the magnetic field strength and direction to further help scientists determine ocean depth and salinity. A thermal instrument would be used to identify warmer water that could have erupted through the crust, while other instruments would help detect water and particles in the moon’s atmosphere. The nine NASA-selected instruments that would be used for the Europa mission are the following [2]: 1) Plasma Instrument for Magnetic Sounding (PIMS) 2) Interior Characterization of Europa using Magnetometry (ICEMAG) 3) Mapping Imaging Spectrometer for Europa (MISE) 4) Europa Imaging System (EIS) 5) Radar for Europa Assessment and Sounding: Ocean to Near-surface (REASON) 6) Europa Thermal Emission Imaging System (ETHEMIS) 7) Mass Spectrometer for Planetary Exploration/Europa (MASPEX) 8) Ultraviolet Spectrograph/Europa (UVS) 9) Surface Dust Mass Analyser (SUDA) 2. POWER SUBSYSTEM ARCHITECTURE The power subsystem architecture design approach involves implementing a robust single-fault tolerant design with small fault containment regions, based on a similar approach used for the Cassini mission to Saturn. The design has focused on three main areas: the baseline solar arrays, power management electronics, and batteries as shown in Fig 2. DOI: 10.1051/ , 71613004 16 E3S Web of Conferences e3sconf/201 ESPC 2016 13004 (2017) © The Authors, published by EDP Sciences. This is an open access article distributed under the terms of the Creative Commons Attribution License 4.0 (http://creativecommons.org/licenses/by/4.0/). Figure 2. Baseline Power Subsystem Architecture.


EUROPA MISSION OVERVIEW
The planned Europa mission's main focus is to execute an in-depth science investigation of Jupiter's icy moon Europa shown in Fig. 1 [1].The moon has shown evidence of a liquid water ocean underneath the unknown thickness of icy surface.The ocean could provide an environment suitable for life due its interaction with a volcanic seafloor.Artwork credit: Michael Carroll The combination of harsh radiation, low temperature (30 K) environments, and distance from the sun (5 AU to 5.5 AU) creates challenges on design and implementation of the spacecraft and instrument hardware.The mission design team is expending great efforts to minimize the amount of total dose radiation the flight system would accumulate and maximize science data return.
The NASA-selected instruments intend to characterize Europa by producing high-resolution images and surface composition maps.An ice-penetrating radar intends to determine the crust thickness, and a magnetometer would measure the magnetic field strength and direction to further help scientists determine ocean depth and salinity.A thermal instrument would be used to identify warmer water that could have erupted through the crust, while other instruments would help detect water and particles in the moon's atmosphere.

POWER SUBSYSTEM ARCHITECTURE
The power subsystem architecture design approach involves implementing a robust single-fault tolerant design with small fault containment regions, based on a similar approach used for the Cassini mission to Saturn.The design has focused on three main areas: the baseline solar arrays, power management electronics, and batteries as shown in

Power Source
The solar array substrates, materials, and components are being tested under the relevant environmental conditions to characterize their performance and reliability in the Jovian environment.The primary challenges for photovoltaic operation at Jupiter are the extremely high radiation from both electrons and protons, extremely low temperatures (30 K), and lowirradiance low-temperature (LILT) solar cell performance.Also, mission design requirements dictate that the solar array mass and size constraints are of critical importance.
The solar array string design and layout has been adjusted to match the capability of the radiation-hard electronics.The number of cells in series was set by the topology of the power management electronics to deliver the most power at the end of the mission in the most severe environment.The challenge was to obtain enough voltage for the power management electronics early in the mission, during the inner solar system cruise, and then still produce efficient power at the end of mission.The power management electronics was designed to deliver close to the maximum power available from the solar array at the end of mission in a robust fault-tolerant architecture.The power management electronics has two primary functions, power control and power distribution.

Power Electronics
The baseline power control design operates near the maximum power point of the solar array throughout the Jovian tour based on solar cell telemetry and modelling.Power control electronics can charge the battery after a flyby operating near the I-V (current-voltage) curve maximum power point without collapsing the solar array voltage.The design is single fault tolerant.Power bus voltage and solar array voltage set points are controlled via commands.Power control uses an N+K architecture for the number of power stages, where N is number required for the mission and K is the number of additional stages provided for redundancy, as shown in Fig. 3.The command and telemetry interface to the power management electronics is block redundant.

Figure 3. Power Regulation Function FCRs.
The power distribution electronics are designed with internal housekeeping power that provide independent functional slices that can be utilized throughout the spacecraft.The power distribution function incorporates a resettable circuit breaker power switch to separate the fault containment region for each load interface.The power switch is part of the load fault containment region as shown in Fig. 4 and is fail-safe off.Redundant functions on the spacecraft are powered by another power switch in a separate fault containment region.Each power switch has a block redundant command and telemetry interface to maintain the loadlevel fault containment region.

Energy Storage
The preliminary battery architecture uses high specific energy small 18650-size lithium-ion cells, to capitalize on their internal safety functions, high capacity, and excellent cell-to-cell reproducibility.Utilizing such a format is advantageous, since the approach does not Each of these system engineering domains develops formal requirements for the products (hardware, procedures, algorithms, software, etc.) developed by the domain.Where appropriate, requirements are linked to domains above (parents) and domains below (children).
When parent or child link exists, system engineers on both ends of the link must agree and concur on the requirements and links.
Where coordination between subsystems is needed to achieve desired flight system functionality, such as solar array deployment, each of the involved subsystems will have requirement(s) linked to a common parent requirement in the flight system domain.There are no direct links between requirements in different subsystems.
Within a subsystem, system engineers may decompose requirements into finer detail.Within the power subsystem for example, requirements exist at the following levels: subsystem, assembly, slice (board), and field-programmable gate array (FPGA).
During the early phases of the project, system engineering for the Europa power subsystem is primarily concerned with three topics: • definition of power subsystem functionality, • determination of required power subsystem capabilities, and • design of interfaces, both within and external to the power subsystem.
The set of power subsystem requirements is the formal agreement between the power subsystem domain and the flight system domain.Requirements for the power subsystem are being developed and maintained in the Rational Dynamic Object Requirements System (DOORS) Next Generation web-based software tool.
Later, as the Project and subsystems proceed into implementation phases, the attention of power subsystem engineers would shift into V&V activities.
Verification involves the formal check that the delivered power subsystem products meet all their requirements.
Validation is a check to ensure that the power subsystem would meet the project and mission objectives, when operated in the context of the other subsystems, the flight system, and the mission system.

Power Subsystem Functionality
The Europa Power Subsystem has the following major functions: • Power generation, • Energy storage, • Power conditioning, • Power distribution, • Safety inhibits for radio frequency (RF) transmitters, propulsion, and deployments, • Detection and response to under-voltage conditions, and • Response to "dead bus" conditions.
The major internal interfaces within the power subsystem are: • Solar array power interface to power electronics, provided by a solar array, comprised of approximately ten panels arranged into two five-panel wings.Each wing is mounted on a single-axis gimbal to facilitate sun-pointing the wing.
Energy storage is necessary on the spacecraft to power the flight system and the payload equipment during times where the electrical load power exceeds the power generation capability of the solar array and during eclipse and launch periods.The baseline power subsystem contains lithium-ion batteries to provide energy storage.
Power conditioning is needed to match the variable voltage output of the solar array to approximately the fixed voltage of the power bus and battery.
The power distribution function provides switched power to electrical loads in the flight system and payload.The power distribution function provides controlled voltage ramp to the load (soft-start) and resettable over-current protection.
The power subsystem electronics detects separation of launch vehicle break-wire interfaces.The interfaces convert to "open-circuit" when the spacecraft separates from the launch vehicle.Once an open-circuit condition is detected, the flight software may activate power distribution to RF transmitters.Protected propulsion and deployment busses originating in the power subsystem electronics may also be energized.
Flight software (FSW) running on the Command and Data Handling (C&DH) computer commands the power subsystem via the engineering communication bus.This bus, based on MIL-STD-1553, is also used by the FSW to collect power subsystem telemetry.
The power subsystem electronics also detects the presence of under-voltage (UV) conditions.Upon detection of UV, the power subsystem electronics will remove power to non-critical loads, and make telemetry available to the FSW.The power subsystem is designed to recover from a "dead bus" condition, where the battery is completely discharged.This could be due to a fault that points the solar array off-sun for an extended period of time.
The power subsystem electronics also contain umbilical interfaces that pass-through launch vehicle wiring and terminate in ground support equipment (GSE) at the launch site.These interfaces provide a means to power the flight system and payloads and charge the battery.Certain telemetry functions related to battery safety are available to GSE even when the spacecraft is powered off.
The power generation and energy storage functions of the power subsystem need to be sized adequately to perform the mission, without being oversized and providing a mass penalty.Power subsystem engineers use JPL-developed modelling software and work closely with flight system engineers to predict the performance of the solar array and batteries over the mission timeline.

KEY AND DRIVING REQUIREMENTS
Key requirements have a significant impact or high sensitivity on the mission's ability to meet negotiated success criteria; these requirements are mission critical and essential for the overall science objectives.
Driving requirements are those deemed particularly difficult and the likelihood of needing additional resources to meet the requirement is significant, as assessed by the requirement implementer.This set defines the system architecture and has the most impact on the design and implementation.
A summary of the key and driving requirements are summarized below.

Lifetime and Performance in the Jovian Environment
The spacecraft would be exposed to the high-energy radiation and extreme cold thermal cycles in the Jovian environment.The power subsystem would be required to perform its critical functions during and after the environmental exposure that significantly impact its performance and lifetime.The spacecraft provides a radiation-shielded enclosure that houses sensitive electronics reducing the ionization radiation levels.
Although the power electronics are located inside the enclosure, parts qualified for the environment, including transient effects, are not always available, driving evaluation and testing of electronic devices.The accumulated radiation environment inside the enclosure is 150 krad (Si); however, the power electronics are required to meet a radiation design factor of 2, or 300 krad (Si).The solar array and battery are outside the enclosure, where the radiation environment is predicted to be 3.0 Mrad (Si), and are required to operate reliably at distances of greater than 5 AU.Similar to the electronic devices, the solar cell technologies will undergo a qualification process.

Fault Tolerant Mission Critical Functions
In order to meet the science objectives, all mission critical functions need to be single fault tolerant to provide a robust and resilient design.
The power subsystem consists of the following mission  These will be designed such that a single failure can be tolerated and contained within the defined fault containment boundaries preventing fault propagation.Lower-level fault containment with N+1 redundancy minimizes power consumption while providing resiliency and robustness in the design.This primarily drives design implementation complexity.

Power Subsystem Sizing (Consumption and Load Profile)
Power and energy demands from the spacecraft loads are the key drivers for the solar array and battery sizing.
As solar array and battery power demands increase, the power electronics needs to be capable of processing and managing it.As the payload science instrument designs mature, their power demand typically increases and drives mass and cost higher for all hardware elements.At distances greater than 5 AU, the limited sunlight received by the solar array would be more than 25 times less than that observed at 1 AU.Due to this limitation in power availability, the low power consumption requirements imposed on the power electronics is very challenging to meet.

Planetary Protection Category III Rating [3]
A Category III classification rating ensures rigorous planetary protection and contamination control requirements are implemented, to extensively lower the probability of contaminating the icy moon with microbes carried from Earth.The bioburden reduction level required prior to launch is stringent and challenging to meet.All power hardware materials and components will be subjected to approved sterilization methods that are currently being developed by the project and the subsystem leads.The approved methods include dry heat microbial reduction and vapor hydrogen peroxide treatment for surfaces only; radiation dosage of ~10 Mrad is under evaluation by the project as an alternative approach for other components.These requirements drive cost impacts taking into account fabrication phases, sterilization approaches for each hardware assembly, and vendor conformance to these requirements

Europa Power Electronics
The primary focus of the power electronics is to provide a robust, highly reliable and efficient power management and distribution system within the expected harsh conditions.In order to meet these criteria, the power electronics have been designed to minimize both power consumption and physical size while providing more visibility and control to the power bus distribution than the systems implemented on previous Class A missions.
The power subsystem is designed to be capable of managing the spacecraft bus while powered by the solar array and battery simultaneously.The Europa Power Electronics Assembly (PCDA) is comprised of three slices, shown in Fig. 2: 1. Array and Battery Interface Slice (ABIS) -one slice per assembly, 2. Power Bus Controller (PBC) Slice -two slices per assembly, and 3. Power Switch Slice (PSS) -up to six slices per assembly.

ABIS and PBC Overview
The primary function of the ABIS is to provide the interface between the solar array and the battery power to the spacecraft golden node power bus.A step down power converter is used as the interface between the solar array and the spacecraft power bus.The power converter output voltage is an adjustable voltage controlled by the redundant PBC.The battery interface is a direct connection to the spacecraft bus.The power converter majority votes the control signals from the redundant PBCs, and its local control to adjust the output voltage to regulate the spacecraft power bus and limit the battery charge current to ensure battery health.
The ABIS also provides the spacecraft power bus interface for the other slices in the power electronics assemblies.The ABIS provides one of three safety inhibit functions to meet safety requirements.The safety inhibit function interrupts the current path to the propulsion and deployment buses which are inhibited by launch vehicle break-wires.For each of the power interfaces, the ABIS provides current telemetry sensors that are sent to the PBC for measurement and digital telemetry.
The PBC slice primary function is to send the control signals to the ABIS power converter to regulate the spacecraft power bus and maintain the charge rate of the battery.A PBC slice contains a FPGA, SRAM memory, analog to digital converter to report analog telemetry as digital telemetry, multiple multiplexers to cycle through all the telemetry channels, independent housekeeping power converters, and a current source circuit which provides a test current to measure Platinum Resistance Thermometer (PRTs) exist throughout the power electronic assemblies.Each PBC continuously monitor the power bus and battery charge current and determines the proper voltage set point of the power converter to either charge or discharge the battery based on a commanded voltage and current set point.Due to the expected harsh environment, two identical PBC slices are provided for redundancy, which result in two independent bus regulation measurements and two control signals routed to the ABIS.The ABIS majority votes these two signals along with a local measurement to determine the correct bus voltage regulation point.
The PBC also measures multiple telemetry inputs (voltages, currents, and temperatures) and reports the information to the flight system through a 1553 digital telemetry interface.The PBC provides the detection of the spacecraft break-wire interfaces and sends the commanded control signals for the inhibited power busses (propulsion and deployment busses).The PBC also measures the bus voltage for the purpose of determining the under-voltage threshold.If the bus voltage falls below a hardwired threshold, the PBC will send a discrete signal to all PSS slices to initiate their predetermined under voltage protocol to recover the bus voltage.

PSS Overview
The primary function of the PSS slice is to provide the redundant, fail safe off, load switches for spacecraft loads.A single PSS slice contains two FPGAs for command redundancy, two independent housekeeping power supplies, high and low side switches of which individual current telemetry is reported.The design of the PSS ensures that the switches are individually redundantly commanded, which is single fault tolerant.Two FPGAs on the PSS allow switches to have specific behaviors under certain conditions, such as under voltage conditions or critical paired loads.The PSS communicates with the PBCs on a dedicated serial communication bus separate from the spacecraft engineering communication bus to ensure that a single failure will not stop the execution of a switch command.Switch status and telemetry are reported by both FPGAs through digital telemetry to the PBCs and to the flight system via engineering communication bus when requested.

BATTERIES
The preliminary architecture for the Europa mission is to use a battery design consisting of high specific energy, small 18650-size lithium-ion cells, to capitalize on their internal safety functions, high capacity, and excellent cell-to-cell reproducibility.Utilizing such a format is advantageous since the approach does not require individual cell monitoring and balancing circuitry.The power subsystem is currently evaluating potential cell chemistries which can provide the desired performance to meet the challenging mission requirements, including (i) tolerance to high levels of radiation, (ii) efficient operation over a wide temperature range, and (iii) excellent storage life characteristics to survive the long cruise period (over 6.5 years).
Due to the strong magnetic field of Jupiter, energetic particles are captured from the solar wind, primarily electrons and protons, creating intense radiation belts that surround the planet.There is a concern that lithiumion chemistries might degrade under such harsh radiation environments, since they contain organic electrolyte solutions, polymer binders and separators, which may lead to performance loss and potentially premature cell failure.To address this concern, studies subjected the following commercial lithium-ion cells to high levels of γ-radiation using a 60 Co source: • large format LiNiCoO 2 -based, • large format LiNiCoAlO 2 -based [4], and • LiCoO 2 -based [5].
With regard to the large format cells, both 7 Ah prismatic cells and 9 Ah cylindrical cells were demonstrated to be tolerant to cumulative levels as high as 25 Mrad, with less than 10% permanent capacity loss observed, some of which may be attributed to the cycling and storage associated with the characterization testing.In a similar study, the Sony 18650-size lithiumion cells were demonstrated to be tolerant to radiation levels as high as 18 Mrad, displaying 4% to 6% capacity loss upon exposure.A comparable study on recently developed commercially available high specific energy 18650-size li-ion cells was conducted on Panasonic NCR-A and NCR-B cell [6].Minimal capacity fade and impedance growth was observed with the cells after being subjected to cumulative γ-radiation levels of 18 Mrad from a 60 Co source.After completing the radiation testing, these cells also displayed good performance when subsequently cycled at full depth of discharge (DOD) at ambient temperatures using C/2 charge and discharge rates over the voltage range of 3.0 V to 4.10 V (over > 700 cycles completed for each cell type).More recent studies have been devoted to evaluating the radiation tolerance of other candidate commercially available 18650-size high specific energy cells.
Another key requirement is that the spacecraft battery delivers a long mission life (> 11 years) while meeting the power and energy demands over a wide temperature range.Given that there would be a long cruise period (over 6.5 years) prior to reaching the Jovian orbital insertion (JOI) event, it is essential to properly maintain the battery during this time to preserve the health to meet end of life requirements.This can be achieved by operating the battery during cruise at a partial state-ofcharge (SOC) and at moderate to low temperatures.For the Europa mission, various candidate high specific energy 18650-size lithium-ion cells are being characterized for storage characteristics over a range of temperatures [7].These tests involve storing the cells on the spacecraft power bus at a partial state of charge at a fixed potential to mimic the spacecraft environment.
To evaluate their performance, capacity and impedance are measured periodically to determine the degradation rates of various cell chemistries.In addition to cell level testing, complementary 8-cell string (connected in series) level tests have been implemented, in which individual cell voltages are monitored throughout the testing.There is some concern that the cell voltage dispersion amongst individual cells within a string can diverge with time, leading to poor performance and the possibility of overcharging the cells.Although only six months of storage time have been completed on the 8cell modules to-date, minimal increase in the cell voltage dispersion has been observed amongst all cell chemistries evaluated.Furthermore, minimal cell voltage dispersion was also observed with time when modules were subjected to 100% depth-of-discharge (DOD) cycle life testing at 20 o C. As illustrated in Fig. 6, when the open circuit potentials of the eight cells comprising one of the modules evaluated are measured after completing the charge period, very little change in voltage dispersion is observed as a function of cycle life.
In addition to long-term storage at moderate temperature, evaluations were conducted for short duration and high temperature storage testing on cells maintained at a high state-of-charge to simulate the conditions on the launch pad prior to launch.In summary, these tests are essential to enable proper end of life performance projections and appropriate battery sizing.

SOLAR ARRAY
The Europa solar array baseline design is comprised of two deployable solar array wings, one on each side of the spacecraft x-axis.The wings are single-axis gimballed to allow the sun incidence angle to be adjusted independently of the spacecraft pitch axis.Each wing is comprised of five solar panels, where each panel has a total area of approximately 9 m 2 .The active solar array area, i.e. the total surface area available to be populated with coverglass interconnected cells (CICs), is 87 m 2 .The array delivers power to the spacecraft throughout all mission phases when sunlight is available to the solar array.The environmental conditions driving the size of the array are 5.The Europa project is currently testing ZTJ bare cells and CICs under mission-relevant laboratory conditions of irradiance, temperature, and radiation dose.Fig. 7 shows a typical example of LILT illuminated currentvoltage (LIV) sweep data taken on bare ZTJ cells at beginning of life (BOL) prior to irradiation, as well as after exposure to a 2e15 1 MeV e -/cm 2 radiation dose.
The LILT LIV sweeps were obtained at a cell temperature of -140 o C, and at a 5.5 AU irradiance, using an AM0-calibrated 2-zone solar simulator.This type of measurement will be performed over a test matrix of multiple irradiances, temperatures, radiation doses, and results will be used in making data-driven predictions of the array performance in the flight environment.As a second example, Fig. 8 shows the measured LILT average maximum power (Pmp) remaining after radiation, as a fraction of the preradiation power, for various 1MeV electron irradiation doses.The solar simulator test conditions were once again 5.5 AU, -140 o C; however, in this case the test articles were 12 ZTJ CICs with 0.012 in.thick coverglass rather than bare cells.The error bars represent the standard deviation in the measurements at each fluence.In addition to measured data, also shown in Fig. 7 is an exponential least-squares fit to the maximum power (Pmp) remaining fraction, per Eq.1: (1) where α and κ are fit parameters, and f is the applied 1MeV electron exposure fluence.

SUMMARY
As described, the Europa mission baseline power subsystem architecture design approach has focused on three areas: solar arrays, power management electronics, and batteries.The power subsystem architecture has been designed to meet a number of challenging requirements, including high levels of ionizing radiation, extreme temperatures, and low solar irradiance.Furthermore, the architecture is a robust, single fault tolerant design with high reliability.The power subsystem architecture provides efficient delivery of power to loads with small fault containment regions.The fault containment regions of the solar array and battery are at the string level.The fault containment region of the power control is N+K.The fault containment of power distribution is at the load level with a block redundant command and telemetry path.

ACKNOWLEDGEMENT
The work described here was carried out at the Jet Propulsion Laboratory, California Institute of Technology, under contract with the National Aeronautics and Space Administration (NASA).

Figure 6 .
Figure 6.End of charge open circuit cell potentials of an 8-cell Li-ion cell pack during 100% DOD cycle life testing at +20 o C.
5 AU, -140 o C at the end of mission, after including the effect of radiation and all other degradation effects.The CICs are based on SolAero ZTJ solar cells with Qioptiq CMG coverglass, DC93-500 transparent adhesive, and silver-clad molybdenum interconnects.All CICs are screened under low-irradiance room temperature (LIRT) conditions of 5.5 AU, 28 o C which eliminates almost all the CICs that would experience performance degradation under LILT flight conditions.All series strings on the array have the same length, and each string is outfitted with a blocking diode.The minimum acceptable string length is driven by Venus fly-by conditions at 0.6 AU, whereas the maximum string length is driven by Jupiter end-ofeclipse conditions at 5.5 AU.Each panel is outfitted with two PRT temperature sensors and two CIC sensors for in-flight I-V sweep measurements.

Figure 8 .
Figure 8. ZTJ CIC remaining power fraction at LILT (5.5AU, -140 o C) as a function of applied radiation dose.

. POWER SUBSYSTEM SYSTEM ENGINEERING 3.1 System Engineering Context, Requirements and Verification and Validation (V&V)
navigation, and control, avionics, mechanical, thermal, and propulsion.