ESA GNC Conference Papers Repository

For large constellations comprising several hundred satellites, the risk of double failure will no longer be extremely improbable. Today a configuration where only two reaction wheels out of four remain functional (in a 3-for-4 redundancy scheme), means a complete loss of attitude control, especially when the bus does not have a chemical reaction control system to fall back to. The resulting inability to perform deorbiting operations would leave a derelict satellite at the mission altitude of the constellation, becoming a permanent collision hazard. Avoiding this risk today for sustainable space development calls for adding a redundant wheel to the avionics design, or deorbiting the satellite after the first failure. To address this, Airbus DS has developed a new de-orbiting mode called CONDOR (CONtingency DeORbiting) which recovers sufficient controllability to effectively de-orbit the spacecraft using only two functional RWs. The use case is here the ARROW platform, which serves as the generic avionics architecture for constellations and small sat programs, but the mode could be extended to any spacecraft with a magnetic control capability. The main design principle consists in completing the partial loss of controllability (along the normal to the controllability plane of the two remaining RWs) with magnetic control. As magnetic control authority is generally far below that of reaction wheels, the direction of the magnetic field in the satellite’s frame must be optimized. Along with the need to maintain thrust attitude while protecting the field of view of at least one star tracker against blinding or obstruction at all times, this leads to an over-constrained attitude guidance problem. Using an innovative autonomous potential-based guidance function with a very robust obstacle avoidance feature, we have extensively consolidated the feasibility of guaranteeing 3-axis attitude controllability during the thrust phase, allowing the spacecraft to perform de-orbiting even after a dual RW failure.