SIST EN 16603-70-11:2015
(Main)Space engineering - Space segment operability
Space engineering - Space segment operability
This Standard contains provisions for the design of onboard functions for unmanned space segments in order to ensure that the space segment can be operated inflight in any nominal or predefined contingency situation.
The requirements in this Standard are grouped in two clauses, containing general operability requirements and detailed operability requirements, respectively. The general operability requirements can be applied to all missions, whilst the detailed operability requirements are only applicable if the corresponding onboard function is implemented.
The operability of the space segment to meet missionspecific requirements is outside the scope of this standard.
To support the users of this Standard in tailoring the requirements to the needs of their particular mission, Annex B contains a table that indicates, for each requirement, the potential impact of its omission.
This standard may be tailored for the specific characteristics and constraints of a space project, in conformance with ECSS-S-ST-00.
Raumfahrttechnik - Raumsegment-Bedienbarkeit
Ingénierie spatiale - Opérabilité du segment spatial
Vesoljska tehnika - Obratovalnost vesoljskega segmenta
Ta standard vsebuje določbe za zasnovo funkcij na plovilih v okviru vesoljskih segmentov brez posadke, da bi se zagotovilo, da se lahko vesoljski segment upravlja med poletom v katerem koli nominalnem ali vnaprej določenem primeru nepredvidenih dogodkov. Zahteve iz tega standarda so razdeljene na dve točki, ki vsebujeta splošne zahteve glede obratovalnosti in podrobne zahteve glede obratovalnosti. Splošne zahteve glede obratovalnosti se lahko uporabljajo za vse misije, podrobne zahteve glede obratovalnosti pa veljajo le, če se izvede ustrezna funkcija na plovilu. Obratovalnost vesoljskega segmenta, da se izpolnijo zahteve, specifične za misijo, je zunaj področja uporabe tega standarda. Dodatek B v podporo uporabnikom tega standarda pri prilagajanju zahtev potrebam njihove določene misije vsebuje preglednico, ki za vsako zahtevo navaja morebitni učinek njenega neizpolnjevanja. Ta standard se lahko prilagodi posameznim lastnostim in omejitvam vesoljskega projekta v skladu s standardom ECSS-S-ST-00.
General Information
Standards Content (Sample)
SLOVENSKI STANDARD
SIST EN 16603-70-11:2015
01-april-2015
Vesoljska tehnika - Obratovalnost vesoljskega segmenta
Space engineering - Space segment operability
Raumfahrttechnik - Raumsegment-Bedienbarkeit
Ingénierie spatiale - Opérabilité du segment spatial
Ta slovenski standard je istoveten z: EN 16603-70-11:2015
ICS:
49.140 Vesoljski sistemi in operacije Space systems and
operations
SIST EN 16603-70-11:2015 en
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
---------------------- Page: 1 ----------------------
SIST EN 16603-70-11:2015
---------------------- Page: 2 ----------------------
SIST EN 16603-70-11:2015
EUROPEAN STANDARD
EN 16603-70-11
NORME EUROPÉENNE
EUROPÄISCHE NORM
January 2015
ICS 49.140
English version
Space engineering - Space segment operability
Ingénierie spatiale - Opérabilité du segment spatial Raumfahrttechnik - Raumsegment-Bedienbarkeit
This European Standard was approved by CEN on 24 November 2014.
CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving
this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning
such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN and CENELEC
member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by translation
under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC Management Centre
has the same status as the official versions.
CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece,
Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia,
Slovenia, Spain, Sweden, Switzerland, Turkey and United Kingdom.
CEN-CENELEC Management Centre:
Avenue Marnix 17, B-1000 Brussels
© 2015 CEN/CENELEC All rights of exploitation in any form and by any means reserved Ref. No. EN 16603-70-11:2015 E
worldwide for CEN national Members and for CENELEC
Members.
---------------------- Page: 3 ----------------------
SIST EN 16603-70-11:2015
EN 16603-70-11:2015 (E)
Table of contents
Foreword . 5
Introduction . 5
1 Scope . 7
2 Normative references . 8
3 Terms, definitions and abbreviated terms . 9
3.1 Terms from other standards . 9
3.2 Terms specific to the present standard . 9
3.3 Abbreviated terms. 14
3.4 Conventions. 14
4 General requirements. 15
4.1 Introduction . 15
4.2 Observability . 15
4.3 Commandability . 15
4.4 Compatibility . 16
4.5 Safety and fault tolerance . 16
4.6 Flexibility . 17
4.7 Testability . 18
4.8 Deactivation . 18
5 Detailed requirements . 19
5.1 Introduction . 19
5.2 Mission-level . 19
5.2.1 Security . 19
5.2.2 Control functions . 20
5.2.3 Uplink and downlink . 20
5.3 Telemetry . 21
5.3.1 Telemetry design . 21
5.3.2 Diagnostic mode . 23
5.4 Datation and synchronization . 24
5.5 Telecommanding . 25
2
---------------------- Page: 4 ----------------------
SIST EN 16603-70-11:2015
EN 16603-70-11:2015 (E)
5.5.1 Telecommand design . 25
5.5.2 Critical telecommands . 27
5.5.3 Telecommand transmission and distribution. 27
5.5.4 Telecommand verification . 28
5.6 Configuration management . 29
5.6.1 Modes . 29
5.6.2 On-board configuration handling . 30
5.7 On-board autonomy . 31
5.7.1 Introduction . 31
5.7.2 General autonomy. 31
5.7.3 Autonomy for execution of nominal mission operations . 32
5.7.4 Autonomy for mission data management . 33
5.7.5 On-board fault management . 33
5.8 Requirements specific to the telemetry and telecommand packet utilization
standard . 38
5.8.1 Application process and service design . 38
5.8.2 Statistical data reporting . 39
5.8.3 Memory management . 40
5.8.4 Function management . 41
5.8.5 On-board operations scheduling . 41
5.8.6 On-board monitoring . 42
5.8.7 Large data transfer . 44
5.8.8 Telemetry generation and forwarding . 44
5.8.9 On-board storage and retrieval . 44
5.8.10 On-board traffic management . 46
5.8.11 On-board operations procedures . 46
5.8.12 Event-to-action coupling . 47
5.9 Equipment- and subsystem-specific . 47
5.9.1 On-board processors and software . 47
5.9.2 Power supply and consumption. 49
5.9.3 Telemetry, tracking and command (TT&C) . 49
5.9.4 Attitude and orbit control . 50
5.9.5 Mechanisms . 50
5.9.6 Thermal control . 51
5.9.7 Payload . 51
Annex A (informative) Mission constants . 52
Annex B (informative) Tailoring guide . 54
3
---------------------- Page: 5 ----------------------
SIST EN 16603-70-11:2015
EN 16603-70-11:2015 (E)
Bibliography . 75
Tables
Table 5-1: Mission execution autonomy levels . 32
Table 5-2: Mission execution autonomy levels . 33
Table 5-3: Mission execution autonomy levels . 34
Table B-1 : Tailoring guide . 55
4
---------------------- Page: 6 ----------------------
SIST EN 16603-70-11:2015
EN 16603-70-11:2015 (E)
Foreword
This document (EN 16603-70-11:2015) has been prepared by Technical
Committee CEN/CLC/TC 5 “Space”, the secretariat of which is held by DIN.
This standard (EN 16603-70-11:2015) originates from ECSS-E-ST-70-11C.
This European Standard shall be given the status of a national standard, either
by publication of an identical text or by endorsement, at the latest by July 2015,
and conflicting national standards shall be withdrawn at the latest by July 2015.
Attention is drawn to the possibility that some of the elements of this document
may be the subject of patent rights. CEN [and/or CENELEC] shall not be held
responsible for identifying any or all such patent rights.
This document has been prepared under a mandate given to CEN by the
European Commission and the European Free Trade Association.
This document has been developed to cover specifically space systems and has
therefore precedence over any EN covering the same scope but with a wider
domain of applicability (e.g. : aerospace).
According to the CEN-CENELEC Internal Regulations, the national standards
organizations of the following countries are bound to implement this European
Standard: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic,
Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France,
Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania,
Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and the United
Kingdom.
5
---------------------- Page: 7 ----------------------
SIST EN 16603-70-11:2015
EN 16603-70-11:2015 (E)
Introduction
The operability of the space segment has an impact on total life cycle cost
inasmuch as increased operability can increase development costs, but certainly
decreases operations and maintenance costs. Therefore, the adoption of specific
operability goals for a given mission is decided by careful balancing of costs,
risks, and schedules for both the development and the operations and
maintenance phases.
The objective of this standard is to define operability requirements that:
• ensure that the space segment can be operated in a safe and cost-effective
manner;
• facilitate the tasks of preparation for, and execution and evaluation of,
space segment check-out and mission operations activities;
• facilitate the tasks of space segment suppliers when preparing a proposal
in response to a request for proposal (RFP).
6
---------------------- Page: 8 ----------------------
SIST EN 16603-70-11:2015
EN 16603-70-11:2015 (E)
1
Scope
This Standard contains provisions for the design of on-board functions for
unmanned space segments in order to ensure that the space segment can be
operated in-flight in any nominal or predefined contingency situation.
The requirements in this Standard are grouped in two clauses, containing
general operability requirements and detailed operability requirements,
respectively. The general operability requirements can be applied to all
missions, whilst the detailed operability requirements are only applicable if the
corresponding on-board function is implemented.
The operability of the space segment to meet mission-specific requirements is
outside the scope of this standard.
To support the users of this Standard in tailoring the requirements to the needs
of their particular mission, Annex B contains a table that indicates, for each
requirement, the potential impact of its omission.
This standard may be tailored for the specific characteristics and constraints of a
space project, in conformance with ECSS-S-ST-00.
7
---------------------- Page: 9 ----------------------
SIST EN 16603-70-11:2015
EN 16603-70-11:2015 (E)
2
Normative references
The following normative documents contain provisions which, through
reference in this text, constitute provisions of this ECSS Standard. For dated
references, subsequent amendments to, or revisions of any of these
publications, do not apply. However, parties to agreements based on this ECSS
Standard are encouraged to investigate the possibility of applying the most
recent editions of the normative documents indicated below. For undated
references the latest edition of the publication referred to applies.
EN reference Reference in text Title
EN 16601-00-01 ECSS-S-ST-00-01 ECSS system – Glossary of terms
EN 16603-50-03 ECSS-E-ST-50-03 Space engineering – Space data links – Telemetry
transfer frame protocol
EN 16603-50-04 ECSS-E-ST-50-04 Space engineering – Space data links – Telecommand
protocols, synchronization and channel coding
EN 16603-70-41 ECSS-E-ST-70-41 Space engineering – Telemetry and telecommand
packet utilization
8
---------------------- Page: 10 ----------------------
SIST EN 16603-70-11:2015
EN 16603-70-11:2015 (E)
3
Terms, definitions and abbreviated terms
3.1 Terms from other standards
For the purpose of this Standard, the terms and definitions from
ECSS-S-ST-00-01 apply.
3.2 Terms specific to the present standard
3.2.1 Categories of operability
3.2.1.1 commandability
provision of adequate control functions to configure the on-board systems for
the execution of nominal mission operations, failure detection, identification,
isolation, diagnosis and recovery, and maintenance operations
3.2.1.2 compatibility
ability of two or more systems or components to perform their specified
functions without interference
3.2.1.3 deactivation
capability to undertake planned operations to terminate the mission at the end
of its useful lifetime
NOTE Terminate can mean to deactivate the spacecraft, to
de-orbit it, or both.
3.2.1.4 flexibility
capability to configure and make optimum use of existing on-board functions,
the capacity of the space-Earth communications links, and any redundancy
built into the design in order to meet the reliability targets
3.2.1.5 observability
availability to the ground segment and to on-board functions of information on
the status, configuration and performance of the space segment
3.2.1.6 testability
capability to test the on-board functions of the space segment including those
that are “off-line”
NOTE “Off-line” means functions that do not form part of
the current operational configuration.
9
---------------------- Page: 11 ----------------------
SIST EN 16603-70-11:2015
EN 16603-70-11:2015 (E)
3.2.2 Terms pertaining to critical functions
3.2.2.1 commandable vital function
vital function that is commandable by high-priority commands without the
involvement of on-board software
3.2.2.2 high priority command
pulse command that is routed directly to hardware by means of an on-board
command pulse distribution unit (CPDU)
3.2.2.3 high priority telemetry
telemetry that enables a reliable determination of the current status of vital
on-board equipment and which is available under all circumstances
NOTE High priority telemetry can be managed by a
mechanism that is independent of the one used for
standard housekeeping telemetry and normally
without any microprocessor involvement.
3.2.2.4 locally-critical function
function that, when executed in the wrong context (e.g. at the wrong time), can
cause temporary or permanent degradation of the associated local functions,
but does not compromise higher level functionality
3.2.2.5 mission-critical function
function that, when executed in the wrong context (e.g. at the wrong time), or
wrongly executed, can cause permanent mission degradation
3.2.2.6 permanent degradation of space segment function
situation where a given on-board function cannot be achieved either on the
nominal or on any redundant chain for the remainder of the mission lifetime
3.2.2.7 permanent mission degradation
situation where space segment functions or performances affecting mission
product generation or primary mission objectives cannot be achieved either on
the nominal or on any redundant chain for the remainder of the mission
lifetime
3.2.2.8 temporary degradation of space segment function
situation where a given on-board function cannot be achieved either on the
nominal or on any redundant chain for a limited period of time
3.2.2.9 temporary mission degradation
situation where space segment functions or performance affecting mission
product generation or primary mission objectives cannot be achieved either on
the nominal or on any redundant chain for a limited period of time
NOTE For example, a mission outage following transition
to survival mode.
3.2.2.10 vital function
function that is essential to mission success and that can cause permanent
mission degradation if not executed when it should be, or wrongly executed, or
executed in the wrong context
10
---------------------- Page: 12 ----------------------
SIST EN 16603-70-11:2015
EN 16603-70-11:2015 (E)
3.2.2.11 vital telecommand
telecommand that activates a commandable vital function
3.2.3 Other terms
3.2.3.1 application process
on-board entity capable of generating telemetry source data and receiving
telecommand data
3.2.3.2 authorization
right of an authenticated entity to perform a function or access a data item or
data stream
3.2.3.3 chain
set of hardware or software units that operate together to achieve a given
function
NOTE For example, an attitude and orbit control
subsystem (AOCS) processor and its software and
a set of AOCS sensors and actuators together
constitute an AOCS chain.
3.2.3.4 confidentiality
property that information is not made available or disclosed to unauthorized
individuals, entities or processes
3.2.3.5 control function
mechanism to maintain a parameter or a set of parameters within specified
limits
NOTE A control function normally consists of a set of
measurements and responses (commands) related
according to a function, algorithm, or set of rules.
3.2.3.6 data integrity
property that the data has not been altered or destroyed in an unauthorized
manner
3.2.3.7 data origin authentication
corroboration that the source of the data received is as claimed
3.2.3.8 datation
attachment of time information to telemetry data
NOTE This includes payload measurement data.
3.2.3.9 device telecommand
telecommand that is routed to and executed by on-board hardware
NOTE For example, a relay switching telecommand, a
telecommand to load an on-board register.
3.2.3.10 housekeeping telemetry
telemetry provided for the purposes of monitoring the health and functioning
of the space segment
11
---------------------- Page: 13 ----------------------
SIST EN 16603-70-11:2015
EN 16603-70-11:2015 (E)
3.2.3.11 loss of mission
state where the ground segment can no longer control the space segment (e.g.
due to loss of contact), or where the space segment can no longer achieve the
mission goals (e.g. due to anomalies)
3.2.3.12 memory
on-board data storage area
NOTE 1 This includes main memory and storage memory.
NOTE 2 Examples of memory are disk, tape, and
bubble-memory.
3.2.3.13 mode
operational state of a spacecraft, subsystem or payload in which certain
functions can be performed
3.2.3.14 mode transition
transition between two operational modes
3.2.3.15 on-board autonomy
capability of the space segment to manage nominal or contingency operations
without ground segment intervention for a given period of time
3.2.3.16 on-board monitoring
on-board application of checking functions to a set of on-board parameters in
conformance with predefined criteria
NOTE Monitoring functions include limit-checking,
expected-value-checking and delta-checking.
3.2.3.17 on-board operations procedure
monitoring and control procedure that is stored on-board and whose activation
is under ground segment control
3.2.3.18 on-board operations schedule
on-board facility for storing and releasing telecommands that were loaded in
advance from the ground
NOTE In its simplest form, the on-board operations
schedule stores time-tagged telecommands loaded
from the ground and releases them to the
destination application process when their
on-board time is reached.
3.2.3.19 operability
capability of the space segment to be operated by the ground segment during
the complete mission lifetime, whilst optimizing the use of resources and
maximizing the quality, quantity, and availability (or timeliness of delivery) of
mission products, without compromising space segment safety
12
---------------------- Page: 14 ----------------------
SIST EN 16603-70-11:2015
EN 16603-70-11:2015 (E)
3.2.3.20 operations
activities undertaken by the ground and space segments in order to ensure the
timely provision of mission products or services, recover from on-board
contingencies, carry out routine maintenance activities and manage on-board
resources in order to maximize the provision of mission products or services
and the mission lifetime
3.2.3.21 parameter
lowest level of elementary data item on-board
3.2.3.22 parameter validity
condition that defines whether the interpretation of a telemetry parameter is
reliable and meaningful
NOTE The angular output of a gyro only has a valid
engineering meaning if the power to the gyro is
“on”, while at other times the output is random.
Such a parameter is deemed conditionally valid,
with its validity determined from the power status.
3.2.3.23 peer-entity authentication
corroboration that a peer entity in an association is the one claimed
3.2.3.24 safe state
safe condition for a system, subsystem or payload
3.2.3.25 space segment status
information from which the operational status of the space segment is assessed
and the criteria driving operational decisions are determined
3.2.3.26 survival mode
configuration of a spacecraft in which it can remain safely without ground
segment intervention for a specified period
3.2.3.27 telecommand function
operationally self-contained control action initiated by telecommand that can
comprise or invoke one or more lower level control actions
13
---------------------- Page: 15 ----------------------
SIST EN 16603-70-11:2015
EN 16603-70-11:2015 (E)
3.3 Abbreviated terms
For the purpose of this Standard, the abbreviated terms from ECSS-S-ST-00-01
and the following apply:
Abbreviation Meaning
attitude and orbit control subsystem
AOCS
application process identifier
APID
command pulse distribution unit
CPDU
central processor unit
CPU
cyclic redundancy check
CRC
electrically erasable programmable read-only memory
EEPROM
failure detection, isolation and recovery
FDIR
global positioning system
GPS
input/output
I/O
identifier
ID
multiplexed access point
MAP
on-board time
OBT
random access memory
RAM
radio frequency
RF
radio frequency interference
RFI
request for proposal
RFP
telemetry, tracking and command
TT&C
universal time coordinated
UTC
3.4 Conventions
Some requirements introduce quantities for which values cannot be defined
across the board, but only on a mission-by-mission basis (e.g. time intervals or
response times). These are termed mission constants and are identified within
this Standard in angular brackets.
NOTE For example,
Example values are indicated in some cases. These mission constants are
summarized in Annex A.
14
---------------------- Page: 16 ----------------------
SIST EN 16603-70-11:2015
EN 16603-70-11:2015 (E)
4
General requirements
4.1 Introduction
This clause contains general (high-level) requirements that pertain to the
different categories of operability identified in clause 3.2.1. The requirements
can be applied to missions of all classes (e.g. science, telecommunications or
Earth observation) and orbit-type (e.g. geostationary, low-Earth orbiting or
interplanetary).
4.2 Observability
a. The space segment shall provide visibility of its internal status,
configuration and performance to the ground segment in conformance
with the level of detail and the time delays specified for all routine and
specified contingency operations, including subsequent diagnostic
activities.
NOTE 1 For detailed operability requirements reflecting
these objectives, refer to clause 5.2.
NOTE 2 Specified contingency operations are derived
during the failure analysis performed in the
mission development process (e.g. the failure
modes, effects and criticality analysis (FMECA).
4.3 Commandability
a. The control functions (telecommands) provided at each level of the
system hierarchy shall be capable of achieving the mission objectives
under all specified circumstances.
NOTE 1 This can include the use of redundant equipment
to meet the overall system reliability requirements.
NOTE 2 Detailed operability requirements reflecting these
objectives appear in clause 5.5.
15
---------------------- Page: 17 ----------------------
SIST EN 16603-70-11:2015
EN 16603-70-11:2015 (E)
4.4 Compatibility
a. The space segment shall conform to all on-board design standards
specified for the mission in order to ensure compatibility with the
specified ground systems.
b. The space segment design shall be such that its operation is not
constrained by, nor adversely constrains, the availability or capacity of
the space-Earth communications links.
4.5 Safety and fault tolerance
a. No single command function executed at the wrong time or in the wrong
configuration shall lead to the loss of the mission.
NOTE For a mission-critical command function, this can
be ensured by the provision of two independent
commands, both to be executed (e.g. ARM and
FIRE).
b. Except for explicitly agreed single point failures, the capability shall be
provided to recover all on-board functions after a single failure within a
specific function.
NOTE The impact of several non-correlated failures
occurring at the same time has to be assessed at
mission-level.
c. No single unintentional ground command or failure in one space
segment element shall cause a failure in another space segment element.
d. The design of the space segment failure detection, isolation and recovery
(FDIR) function shall be such that all anticipated on-board failures can be
overcome either by autonomous on-board action or by clear,
unambiguous and timely notification of the problem to the ground
segment.
e. The FDIR design shall ensure that the space segment is safe without
ground segment intervention for the specified duration in the presence of
a single failure.
f. No reconfiguration of the spacecraft shall lead to a configuration where
new single point failures are introduced.
NOTE With the exception of reconfigurations that are
triggered on-board as the result of genuine
failures.
16
--------------
...
SLOVENSKI STANDARD
kSIST FprEN 16603-70-11:2014
01-oktober-2014
Vesoljska tehnika - Obratovalnost vesoljskega segmenta
Space engineering - Space segment operability
Raumfahrttechnik - Raumsegment-Bedienbarkeit
Ingénierie spatiale - Opérabilité du segment spatial
Ta slovenski standard je istoveten z: FprEN 16603-70-11
ICS:
49.140 Vesoljski sistemi in operacije Space systems and
operations
kSIST FprEN 16603-70-11:2014 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
---------------------- Page: 1 ----------------------
kSIST FprEN 16603-70-11:2014
---------------------- Page: 2 ----------------------
kSIST FprEN 16603-70-11:2014
EUROPEAN STANDARD
FINAL DRAFT
FprEN 16603-70-11
NORME EUROPÉENNE
EUROPÄISCHE NORM
May 2014
ICS 49.140
English version
Space engineering - Space segment operability
Ingénierie spatiale - Opérabilité du segment spatial Raumfahrttechnik - Raumsegment-Bedienbarkeit
This draft European Standard is submitted to CEN members for unique acceptance procedure. It has been drawn up by the Technical
Committee CEN/CLC/TC 5.
If this draft becomes a European Standard, CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal
Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration.
This draft European Standard was established by CEN and CENELEC in three official versions (English, French, German). A version in any
other language made by translation under the responsibility of a CEN and CENELEC member into its own language and notified to the
CEN-CENELEC Management Centre has the same status as the official versions.
CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece,
Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia,
Slovenia, Spain, Sweden, Switzerland, Turkey and United Kingdom.
Recipients of this draft are invited to submit, with their comments, notification of any relevant patent rights of which they are aware and to
provide supporting documentation.
Warning : This document is not a European Standard. It is distributed for review and comments. It is subject to change without notice and
shall not be referred to as a European Standard.
CEN-CENELEC Management Centre:
Avenue Marnix 17, B-1000 Brussels
© 2014 CEN/CENELEC All rights of exploitation in any form and by any means reserved Ref. No. FprEN 16603-70-11:2014 E
worldwide for CEN national Members and for CENELEC
Members.
---------------------- Page: 3 ----------------------
kSIST FprEN 16603-70-11:2014
FprEN 16603-70-11:2014 (E)
Table of contents
Foreword . 5
Introduction . 6
1 Scope . 7
2 Normative references . 8
3 Terms, definitions and abbreviated terms . 9
3.1 Terms from other standards . 9
3.2 Terms specific to the present standard . 9
3.3 Abbreviated terms. 14
3.4 Conventions. 14
4 General requirements. 15
4.1 Introduction . 15
4.2 Observability . 15
4.3 Commandability . 15
4.4 Compatibility . 16
4.5 Safety and fault tolerance . 16
4.6 Flexibility . 17
4.7 Testability . 18
4.8 Deactivation . 18
5 Detailed requirements . 19
5.1 Introduction . 19
5.2 Mission-level . 19
5.2.1 Security . 19
5.2.2 Control functions . 20
5.2.3 Uplink and downlink . 20
5.3 Telemetry . 21
5.3.1 Telemetry design . 21
5.3.2 Diagnostic mode . 23
5.4 Datation and synchronization . 24
5.5 Telecommanding . 25
2
---------------------- Page: 4 ----------------------
kSIST FprEN 16603-70-11:2014
FprEN 16603-70-11:2014 (E)
5.5.1 Telecommand design . 25
5.5.2 Critical telecommands . 27
5.5.3 Telecommand transmission and distribution. 27
5.5.4 Telecommand verification . 28
5.6 Configuration management . 29
5.6.1 Modes . 29
5.6.2 On-board configuration handling . 30
5.7 On-board autonomy . 31
5.7.1 Introduction . 31
5.7.2 General autonomy. 31
5.7.3 Autonomy for execution of nominal mission operations . 32
5.7.4 Autonomy for mission data management . 33
5.7.5 On-board fault management . 33
5.8 Requirements specific to the telemetry and telecommand packet utilization
standard . 38
5.8.1 Application process and service design . 38
5.8.2 Statistical data reporting . 39
5.8.3 Memory management . 40
5.8.4 Function management . 41
5.8.5 On-board operations scheduling . 41
5.8.6 On-board monitoring . 42
5.8.7 Large data transfer . 44
5.8.8 Telemetry generation and forwarding . 44
5.8.9 On-board storage and retrieval . 44
5.8.10 On-board traffic management . 46
5.8.11 On-board operations procedures . 46
5.8.12 Event-to-action coupling . 47
5.9 Equipment- and subsystem-specific . 47
5.9.1 On-board processors and software . 47
5.9.2 Power supply and consumption. 49
5.9.3 Telemetry, tracking and command (TT&C) . 49
5.9.4 Attitude and orbit control . 50
5.9.5 Mechanisms . 50
5.9.6 Thermal control . 51
5.9.7 Payload . 51
Annex A (informative) Mission constants . 52
Annex B (informative) Tailoring guide . 54
3
---------------------- Page: 5 ----------------------
kSIST FprEN 16603-70-11:2014
FprEN 16603-70-11:2014 (E)
Bibliography . 75
Tables
Table 5-1: Mission execution autonomy levels . 32
Table 5-2: Mission execution autonomy levels . 33
Table 5-3: Mission execution autonomy levels . 34
Table B-1 : Tailoring guide . 55
4
---------------------- Page: 6 ----------------------
kSIST FprEN 16603-70-11:2014
FprEN 16603-70-11:2014 (E)
Foreword
This document (FprEN 16603-70-11:2014) has been prepared by Technical
Committee CEN/CLC/TC 5 “Space”, the secretariat of which is held by DIN
(Germany).
This document (FprEN 16603-70-11:2014) originates from ECSS-E-ST-70-11C.
This document is currently submitted to the Unique Acceptance Procedure.
This document has been developed to cover specifically space systems and will
the-refore have precedence over any EN covering the same scope but with a
wider do-main of applicability (e.g. : aerospace).
5
---------------------- Page: 7 ----------------------
kSIST FprEN 16603-70-11:2014
FprEN 16603-70-11:2014 (E)
Introduction
The operability of the space segment has an impact on total life cycle cost
inasmuch as increased operability can increase development costs, but certainly
decreases operations and maintenance costs. Therefore, the adoption of specific
operability goals for a given mission is decided by careful balancing of costs,
risks, and schedules for both the development and the operations and
maintenance phases.
The objective of this standard is to define operability requirements that:
• ensure that the space segment can be operated in a safe and cost-effective
manner;
• facilitate the tasks of preparation for, and execution and evaluation of,
space segment check-out and mission operations activities;
• facilitate the tasks of space segment suppliers when preparing a proposal
in response to a request for proposal (RFP).
6
---------------------- Page: 8 ----------------------
kSIST FprEN 16603-70-11:2014
FprEN 16603-70-11:2014 (E)
1
Scope
This Standard contains provisions for the design of on-board functions for
unmanned space segments in order to ensure that the space segment can be
operated in-flight in any nominal or predefined contingency situation.
The requirements in this Standard are grouped in two clauses, containing
general operability requirements and detailed operability requirements,
respectively. The general operability requirements can be applied to all
missions, whilst the detailed operability requirements are only applicable if the
corresponding on-board function is implemented.
The operability of the space segment to meet mission-specific requirements is
outside the scope of this standard.
To support the users of this Standard in tailoring the requirements to the needs
of their particular mission, Annex B contains a table that indicates, for each
requirement, the potential impact of its omission.
This standard may be tailored for the specific characteristics and constraints of a
space project, in conformance with ECSS-S-ST-00.
7
---------------------- Page: 9 ----------------------
kSIST FprEN 16603-70-11:2014
FprEN 16603-70-11:2014 (E)
2
Normative references
The following normative documents contain provisions which, through
reference in this text, constitute provisions of this ECSS Standard. For dated
references, subsequent amendments to, or revisions of any of these
publications, do not apply. However, parties to agreements based on this ECSS
Standard are encouraged to investigate the possibility of applying the most
recent editions of the normative documents indicated below. For undated
references the latest edition of the publication referred to applies.
EN reference Reference in text Title
EN 16601-00-01 ECSS-S-ST-00-01 ECSS system – Glossary of terms
EN 16603-50-03 ECSS-E-ST-50-03 Space engineering – Space data links – Telemetry
transfer frame protocol
EN 16603-50-04 ECSS-E-ST-50-04 Space engineering – Space data links – Telecommand
protocols, synchronization and channel coding
EN 16603-70-41 ECSS-E-ST-70-41 Space engineering – Telemetry and telecommand
packet utilization
8
---------------------- Page: 10 ----------------------
kSIST FprEN 16603-70-11:2014
FprEN 16603-70-11:2014 (E)
3
Terms, definitions and abbreviated terms
3.1 Terms from other standards
For the purpose of this Standard, the terms and definitions from
ECSS-S-ST-00-01 apply.
3.2 Terms specific to the present standard
3.2.1 Categories of operability
3.2.1.1 commandability
provision of adequate control functions to configure the on-board systems for
the execution of nominal mission operations, failure detection, identification,
isolation, diagnosis and recovery, and maintenance operations
3.2.1.2 compatibility
ability of two or more systems or components to perform their specified
functions without interference
3.2.1.3 deactivation
capability to undertake planned operations to terminate the mission at the end
of its useful lifetime
NOTE Terminate can mean to deactivate the spacecraft, to
de-orbit it, or both.
3.2.1.4 flexibility
capability to configure and make optimum use of existing on-board functions,
the capacity of the space-Earth communications links, and any redundancy
built into the design in order to meet the reliability targets
3.2.1.5 observability
availability to the ground segment and to on-board functions of information on
the status, configuration and performance of the space segment
3.2.1.6 testability
capability to test the on-board functions of the space segment including those
that are “off-line”
NOTE “Off-line” means functions that do not form part of
the current operational configuration.
9
---------------------- Page: 11 ----------------------
kSIST FprEN 16603-70-11:2014
FprEN 16603-70-11:2014 (E)
3.2.2 Terms pertaining to critical functions
3.2.2.1 commandable vital function
vital function that is commandable by high-priority commands without the
involvement of on-board software
3.2.2.2 high priority command
pulse command that is routed directly to hardware by means of an on-board
command pulse distribution unit (CPDU)
3.2.2.3 high priority telemetry
telemetry that enables a reliable determination of the current status of vital
on-board equipment and which is available under all circumstances
NOTE High priority telemetry can be managed by a
mechanism that is independent of the one used for
standard housekeeping telemetry and normally
without any microprocessor involvement.
3.2.2.4 locally-critical function
function that, when executed in the wrong context (e.g. at the wrong time), can
cause temporary or permanent degradation of the associated local functions,
but does not compromise higher level functionality
3.2.2.5 mission-critical function
function that, when executed in the wrong context (e.g. at the wrong time), or
wrongly executed, can cause permanent mission degradation
3.2.2.6 permanent degradation of space segment function
situation where a given on-board function cannot be achieved either on the
nominal or on any redundant chain for the remainder of the mission lifetime
3.2.2.7 permanent mission degradation
situation where space segment functions or performances affecting mission
product generation or primary mission objectives cannot be achieved either on
the nominal or on any redundant chain for the remainder of the mission
lifetime
3.2.2.8 temporary degradation of space segment function
situation where a given on-board function cannot be achieved either on the
nominal or on any redundant chain for a limited period of time
3.2.2.9 temporary mission degradation
situation where space segment functions or performance affecting mission
product generation or primary mission objectives cannot be achieved either on
the nominal or on any redundant chain for a limited period of time
NOTE For example, a mission outage following transition
to survival mode.
3.2.2.10 vital function
function that is essential to mission success and that can cause permanent
mission degradation if not executed when it should be, or wrongly executed, or
executed in the wrong context
10
---------------------- Page: 12 ----------------------
kSIST FprEN 16603-70-11:2014
FprEN 16603-70-11:2014 (E)
3.2.2.11 vital telecommand
telecommand that activates a commandable vital function
3.2.3 Other terms
3.2.3.1 application process
on-board entity capable of generating telemetry source data and receiving
telecommand data
3.2.3.2 authorization
right of an authenticated entity to perform a function or access a data item or
data stream
3.2.3.3 chain
set of hardware or software units that operate together to achieve a given
function
NOTE For example, an attitude and orbit control
subsystem (AOCS) processor and its software and
a set of AOCS sensors and actuators together
constitute an AOCS chain.
3.2.3.4 confidentiality
property that information is not made available or disclosed to unauthorized
individuals, entities or processes
3.2.3.5 control function
mechanism to maintain a parameter or a set of parameters within specified
limits
NOTE A control function normally consists of a set of
measurements and responses (commands) related
according to a function, algorithm, or set of rules.
3.2.3.6 data integrity
property that the data has not been altered or destroyed in an unauthorized
manner
3.2.3.7 data origin authentication
corroboration that the source of the data received is as claimed
3.2.3.8 datation
attachment of time information to telemetry data
NOTE This includes payload measurement data.
3.2.3.9 device telecommand
telecommand that is routed to and executed by on-board hardware
NOTE For example, a relay switching telecommand, a
telecommand to load an on-board register.
3.2.3.10 housekeeping telemetry
telemetry provided for the purposes of monitoring the health and functioning
of the space segment
11
---------------------- Page: 13 ----------------------
kSIST FprEN 16603-70-11:2014
FprEN 16603-70-11:2014 (E)
3.2.3.11 loss of mission
state where the ground segment can no longer control the space segment (e.g.
due to loss of contact), or where the space segment can no longer achieve the
mission goals (e.g. due to anomalies)
3.2.3.12 memory
on-board data storage area
NOTE 1 This includes main memory and storage memory.
NOTE 2 Examples of memory are disk, tape, and
bubble-memory.
3.2.3.13 mode
operational state of a spacecraft, subsystem or payload in which certain
functions can be performed
3.2.3.14 mode transition
transition between two operational modes
3.2.3.15 on-board autonomy
capability of the space segment to manage nominal or contingency operations
without ground segment intervention for a given period of time
3.2.3.16 on-board monitoring
on-board application of checking functions to a set of on-board parameters in
conformance with predefined criteria
NOTE Monitoring functions include limit-checking,
expected-value-checking and delta-checking.
3.2.3.17 on-board operations procedure
monitoring and control procedure that is stored on-board and whose activation
is under ground segment control
3.2.3.18 on-board operations schedule
on-board facility for storing and releasing telecommands that were loaded in
advance from the ground
NOTE In its simplest form, the on-board operations
schedule stores time-tagged telecommands loaded
from the ground and releases them to the
destination application process when their
on-board time is reached.
3.2.3.19 operability
capability of the space segment to be operated by the ground segment during
the complete mission lifetime, whilst optimizing the use of resources and
maximizing the quality, quantity, and availability (or timeliness of delivery) of
mission products, without compromising space segment safety
12
---------------------- Page: 14 ----------------------
kSIST FprEN 16603-70-11:2014
FprEN 16603-70-11:2014 (E)
3.2.3.20 operations
activities undertaken by the ground and space segments in order to ensure the
timely provision of mission products or services, recover from on-board
contingencies, carry out routine maintenance activities and manage on-board
resources in order to maximize the provision of mission products or services
and the mission lifetime
3.2.3.21 parameter
lowest level of elementary data item on-board
3.2.3.22 parameter validity
condition that defines whether the interpretation of a telemetry parameter is
reliable and meaningful
NOTE The angular output of a gyro only has a valid
engineering meaning if the power to the gyro is
“on”, while at other times the output is random.
Such a parameter is deemed conditionally valid,
with its validity determined from the power status.
3.2.3.23 peer-entity authentication
corroboration that a peer entity in an association is the one claimed
3.2.3.24 safe state
safe condition for a system, subsystem or payload
3.2.3.25 space segment status
information from which the operational status of the space segment is assessed
and the criteria driving operational decisions are determined
3.2.3.26 survival mode
configuration of a spacecraft in which it can remain safely without ground
segment intervention for a specified period
3.2.3.27 telecommand function
operationally self-contained control action initiated by telecommand that can
comprise or invoke one or more lower level control actions
13
---------------------- Page: 15 ----------------------
kSIST FprEN 16603-70-11:2014
FprEN 16603-70-11:2014 (E)
3.3 Abbreviated terms
For the purpose of this Standard, the abbreviated terms from ECSS-S-ST-00-01
and the following apply:
Abbreviation Meaning
attitude and orbit control subsystem
AOCS
application process identifier
APID
command pulse distribution unit
CPDU
central processor unit
CPU
cyclic redundancy check
CRC
electrically erasable programmable read-only memory
EEPROM
failure detection, isolation and recovery
FDIR
global positioning system
GPS
input/output
I/O
identifier
ID
multiplexed access point
MAP
on-board time
OBT
random access memory
RAM
radio frequency
RF
radio frequency interference
RFI
request for proposal
RFP
telemetry, tracking and command
TT&C
universal time coordinated
UTC
3.4 Conventions
Some requirements introduce quantities for which values cannot be defined
across the board, but only on a mission-by-mission basis (e.g. time intervals or
response times). These are termed mission constants and are identified within
this Standard in angular brackets.
NOTE For example,
Example values are indicated in some cases. These mission constants are
summarized in Annex A.
14
---------------------- Page: 16 ----------------------
kSIST FprEN 16603-70-11:2014
FprEN 16603-70-11:2014 (E)
4
General requirements
4.1 Introduction
This clause contains general (high-level) requirements that pertain to the
different categories of operability identified in clause 3.2.1. The requirements
can be applied to missions of all classes (e.g. science, telecommunications or
Earth observation) and orbit-type (e.g. geostationary, low-Earth orbiting or
interplanetary).
4.2 Observability
a. The space segment shall provide visibility of its internal status,
configuration and performance to the ground segment in conformance
with the level of detail and the time delays specified for all routine and
specified contingency operations, including subsequent diagnostic
activities.
NOTE 1 For detailed operability requirements reflecting
these objectives, refer to clause 5.2.
NOTE 2 Specified contingency operations are derived
during the failure analysis performed in the
mission development process (e.g. the failure
modes, effects and criticality analysis (FMECA).
4.3 Commandability
a. The control functions (telecommands) provided at each level of the
system hierarchy shall be capable of achieving the mission objectives
under all specified circumstances.
NOTE 1 This can include the use of redundant equipment
to meet the overall system reliability requirements.
NOTE 2 Detailed operability requirements reflecting these
objectives appear in clause 5.5.
15
---------------------- Page: 17 ----------------------
kSIST FprEN 16603-70-11:2014
FprEN 16603-70-11:2014 (E)
4.4 Compatibility
a. The space segment shall conform to all on-board design standards
specified for the mission in order to ensure compatibility with the
specified ground systems.
b. The space segment design shall be such that its operation is not
constrained by, nor adversely constrains, the availability or capacity of
the space-Earth communications links.
4.5 Safety and fault tolerance
a. No single command function executed at the wrong time or in the wrong
configuration shall lead to the loss of the mission.
NOTE For a mission-critical command function, this can
be ensured by the provision of two independent
commands, both to be executed (e.g. ARM and
FIRE).
b. Except for explicitly agreed single point failures, the capability shall be
provided to recover all on-board functions after a single failure within a
specific function.
NOTE The impact of several non-correlated failures
occurring at the same time has to be assessed at
mission-level.
c. No single unintentional ground command or failure in one space
segment element shall cause a failure in another space segment element.
d. The design of the space segment failure detection, isolation and recovery
(FDIR) function shall be such that all anticipated on-board failures can be
overcome either by autonomous on-board action or by clear,
unambiguous and timely notification of the problem to the ground
segment.
e. The FDIR design shall ensure that the space segment is safe without
ground segment intervention for the specified duration in the presence of
a single failure.
f. No reconfiguration of the spacecraft shall lead to a configuration where
new single point failures are introduced.
NOTE With the exception of reconfigurations that are
triggered on-board as the result of genuine
failures.
16
---------------------- Page: 18 ----------------------
kSIST FprEN 16603-70-11:2014
FprEN 16603-70-11:2014 (E)
4.6 Flexibility
a. All authorized combinations of prime and redundant equipment shall
exhibit the same operational characteristics.
NOTE 1 This requirement does not prevent a change of
calibration data, but it precludes different
operational procedures.
NOTE 2 This does not include any reduced redundancy
that exists following a failure.
b. The capability shall be provided for the ground segment to allocate
which of t
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.