© ESO 2021

1. Introduction

We first describe the planned voyage of Solar Orbiter around the Sun, with its passengers, the ten scientific instruments. This allows us to describe the context and the challenging requirements of the mission design. We then go on to describe the various spacecraft subsystems and the design solutions that met each challenge, notably the thermal control system. Finally, we include specific considerations for two system-level activities that were key drivers in the overall design and that guarantee scientific performance: electromagnetic compatibility and contamination control.

2. Launch and trajectory

The Solar Orbiter mission is designed to provide unique observations of the Sun and its environment from the inner reaches of the Solar System (Müller et al. 2020). The scientific requirements to achieve this led to a set of trajectory design stipulations:

– Spend a significant time below 0.4 AU while passing over active solar regions and perform in-situ observations on a trajectory with a perihelion below 0.3 AU.

– Spend at least five consecutive days at solar latitudes above 25° to perform in-situ observations, and reach an inclination larger than 30° with respect to the solar equator to remotely observe the polar regions of the Sun.

– Traverse the range 1.0 AU−0.3 AU for a comprehensive characterisation of the inner heliosphere.

– Nominal mission duration of at least 7 years.

– Corollary to the above requirements, provide co-rotation with features on the surface of the Sun for as far as possible, given that the Sun equator rotates with a period of 24.47 days.

Further definition of the orbit takes into account the technological limitations in spacecraft design available at the start of the project:

– A perihelion distance not closer than 0.28 AU, limited by the temperature of the Solar Array, which reuses technology of ESA’s BepiColombo mission around planet Mercury.

– Limit aphelion to less than 1.48 AU in order to limit the size of the Solar Array.

– Minimise the distance from the spacecraft to Earth, so as to optimise scientific data return over the complete mission given existing technology for the antennas, transponders, and modulation schemes.

– When approaching gravity assist manoeuvres (GAM), avoid solar superior conjunctions, which prevent communication with and the command of the spacecraft.

– Minimise onboard fuel consumption by only using gravity assist to perform orbital manoeuvres, for which the only relevant planetary bodies providing a significant trajectory change are Earth and Venus.

– Limit GAM to altitudes above 350 km, such as to safely avoid orbit perturbations by Earth or Venus atmospheres, accounting also for navigational accuracy. Small ΔV corrections (1−3 m s⁻¹) will be performed to this end.

– Launch opportunities over at least 14 day periods, so as to accommodate potential short launch delays.

An extensive search for spacecraft trajectories and launch opportunities was performed, leading to the identification of a handful of feasible solutions to the above constraints. A detailed assessment by ESA and the scientific community led to the selection of trajectories with a launch opportunity each day from February 5 to 26, 2020.

The Solar Orbiter spacecraft, with a mass of 1750 kg when fully fuelled, was launched on a direct escape trajectory by an Atlas V 411 from Space Launch Complex 41 at the Kennedy Space Center in Florida. Figure 1 shows the launch vehicle in an exploded view with its core stage, single solid rocket motor and Centaur cryogenic upper stage and Solar Orbiter sitting under the 4 m-diameter fairing. The ascent took the launch composite on a southerly trajectory over the Atlantic (first firing of the Centaur stage), passing over South Africa, before moving northeast over the Indian ocean (second firing of Centaur) for a separation west of Australia.

Fig. 1. Atlas V 411 Launch Vehicle.

Completion of the onboard automatic sequence following separation and first acquisition of telemetry signals was done over Australia by the ESA New Norcia station (Fig. 2). These included the full initialisation of the communications system, the priming of the chemical propulsion system, the orientation of the spacecraft towards the Sun, and the deployment of the solar arrays.

Fig. 2. Ground track following injection.

The Earth escape trajectory has a significant excess velocity (V∞≈5.6 km s⁻¹). While separation is performed near the inner van Allen radiation belt, the spacecraft crosses the geostationary orbit after just a few hours and the orbit of the Moon less than 24 h after launch. The trajectory is a delayed (i.e. the spacecraft trails the Earth) and direct transfer to Venus.

In the first months in orbit, until mid-June 2020, the spacecraft and payload are commissioned. There are three major phases that follow: cruise-, nominal-, and extended phase. All instruments will be collecting data from the end of the commissioning phase, but the perihelion during cruise phase is suboptimal.

The spacecraft will complete more than one full rotation about the Sun, with a perihelion at 0.513 AU, before encountering Venus for the first time after 324 days. A second Venus encounter 225 days later, and an Earth GAM 659 days into the flight are required to complete the cruise phase in November 2021. Then, the spacecraft will initiate its first operational orbit with a perihelion at 0.321 AU which is passed on March 26, 2022. By the end of the nominal mission phase (NMP) on December 24, 2026, the spacecraft will have performed 12 revolutions around the Sun. It will then enter the extended mission phase (EMP), which is characterised by large solar inclinations (up to 33°) but less severe thermal environment by increasing the perihelion up to 0.33 AU (Fig. 3). For more details on operations and on the Science Ground Segment, see Sanchez et al. (in prep.). For details on the Science Activity Plan during the entire mission, see Zouganelis et al. (2020).

Fig. 3. Evolution of latitude and distance to the Sun during the entire mission.

The end of the mission is currently planned for July 2030. It is envisaged that at that time the spacecraft will still have sufficient onboard reserves to further continue the mission, should this be decided. At the actual end of the mission, the trajectory will be slightly changed to break the resonance with Venus, thereby precluding any future potential return to Earth or Mars, followed by passivation of onboard batteries and venting of fuel tank residuals.

3. The payload complement

Solar Orbiter carries a comprehensive complement of ten science instruments (see Fig. 4). These are categorised into two types: four in-situ and six remote-sensing instruments. The in-situ instruments measure the conditions around the spacecraft, and so they are accommodated on the outside of the spacecraft and can generally remain in the shadow of the heat shield. The instruments carrying detectors in the visible, UV, and X-ray wavelengths measure what is happening at large distances away from the spacecraft. Doors in the heat shield let sunlight into the internally mounted instruments while the wide-field camera, SoloHI (heliospheric imager; Howard et al. 2020), looks out from the side of the heat shield but is not pointed directly at the Sun. For more details on the instruments, see Müller et al. (2020).

Fig. 4. Solar Orbiter spacecraft and instruments.

The total mass of the instruments is 209 kg and the average power allocated for their operation is 245 W as shown in Table 1.

The highly elliptical orbit of the spacecraft around the Sun has a period of about six months. The in-situ instruments will be capturing data throughout the complete orbit. For the remote-sensing instruments, during each orbit there will be three ‘remote-sensing windows’, that is, three ten-day periods during which the instruments will acquire data from the southern solar hemisphere, from the equator, and from the northern solar hemisphere (see Fig. 5).

Fig. 5. Three remote-sensing windows of the NMP.

4. Spacecraft design

The spacecraft forms the backbone of the Solar Orbiter mission, enabling the scientific instruments to acquire data from the Sun. It provides functions and capabilities for the integration and handling of the equipment during the assembly, integration, and verification (AIV) phase. By design, the spacecraft must be compatible with the various environments experienced throughout the life cycle of the mission: on-ground activities, transport, installation onto the launcher vehicle, the launch until separation, the near-earth environment, and the deep-space environment. Finally, it must be compatible with the ground communication infrastructure (radio communication) and operational procedures (telecommands and telemetry) to conduct in-orbit operations.

The Solar Orbiter spacecraft has been designed to be fully operational when close to the Sun (0.28 AU) or when further away than the earth (1.2 AU). It provides a stable and safe platform in terms of both overall pointing to the Sun, even in the case of anomalies, and communication with the Earth; for this, it implements redundancy and a comprehensive system for failure detection, identification, and recovery (FDIR). In order to minimise noise or undesired effects on the scientific instruments, stringent requirements have been implemented for molecular and particulate contamination, for electric and magnetic fields, and for instrument alignment. The following sections present the key design drive and challenges encountered in the design of the spacecraft subsystems.

4.1. Structure, alignment, and pointing

There are two main drivers for structure. Firstly, the platform structure must accommodate and maintain the integrity of the instruments and spacecraft subsystems through the launch phase. Secondly, once this phase is completed, only minutes into the flight, the structure must maintain the dimensional stability of the various instruments during the rest of the mission. When in orbit, due to the variation in distance to the Sun, platform temperatures vary significantly, which was taken into account when designing and studying the alignment of instruments. This is most important during the remote-science operational windows, from 0.28 to 0.65 AU, for which the key alignment requirements are relevant. These requirements are expressed as angular distortion indicators ‘line of sight’ (LoS) and ‘along line of sight’ (ALoS); see Fig. 6.

Fig. 6. Typical alignment LOS and ALOS definitions.

Figure 7 shows the location of the internal remote-sensing instruments on the payload panel (−Y panel, or MY, in the spacecraft coordinate system). The two critical design requirements applicable to the remote-sensing instruments are the stand-alone instrument alignment and the co-alignment of the Extreme Ultraviolet Imager (EUI; Rochus et al. 2020), Polarimetric and Helioseismic Imager (PHI, Solanki et al. 2020) and the Extreme UV Imaging Spectrometer (SPICE, SPICE Consortium 2020) relative to each other (see also Auchère et al. 2020). The stand-alone instrument requirement for LoS absolute pointing error (APE) is 210″, and the co-alignment requirement is 120″. EUI, PHI, and Metis (the visible and UV coronagraph; Antonucci et al. 2020) are mounted on the same panel (−Y), while SPICE is on a separate panel (+Z). Metis, also a remote-sensing instrument on the −Y panel, is treated separately as it is a chronograph for which the spacecraft must be oriented pointing to the centre of the Sun.

Fig. 7. MY payload panel instruments. From left to right: PHI (Solanki et al. 2020), Metis (Antonucci et al. 2020), EUI (Rochus et al. 2020), STIX (X-ray spectrometer/telescope Krucker et al. 2020), and SPICE (SPICE Consortium 2020). We note that SPICE resides on a separate Pz panel.

On the other side, the in-situ instruments do not require such stringent distortion alignment performance as that of the remote-sensing instruments. As an example, many of the in-situ instruments have an alignment budget of up to 1°.

4.1.1. Alignment contributions

The system alignment budget considers many contributors. The APE is a primary requirement that dominates the instrument accuracy and includes influences from ground knowledge, attitude and orbit control system (AOCS), gravity release, launch slip, moisture release, and thermoelastic distortion (TED), and measurement accuracy terms.

The ground knowledge, that is, information from the measurements taken during verification before launch, is determined from laser tracker measurements of mounted mirror cubes that can be individually measured to approximately 3″. Typical measurement accuracy between two theodolites and a two-mirror cube system is of the order of 14″. Knowledge on the ground has two parts: the internal instrument misalignment relative to the instrument interface, which is generally small in comparison to the instrument interface alignment requirements (typically 30″); and the platform distortion, which is measured between the instrument interface and a reference on the spacecraft. The following paragraphs focus on the development of the latter.

Misalignments within the AOCS units, such as for example the star trackers, contribute to the APE and can be measured on ground. Four other terms (gravity and moisture release, launch slip, and TED) happen during flight. Of these four terms, only TED is constantly modulated by the distance to the Sun, whereas the other three can be considered as a one-time offset from the ground measurement. Moisture release and TED are similar in that they provide a distortion within the platform structure due to moisture and temperature variations from what was measured when the structure was first assembled. Gravity, moisture release, and TED have sign dependency, while AOCS misalignments are random noise terms, and are accounted for as root-sum-square additions.

– Gravity release is determined from analysis and tests, defining the relaxation in the structure from the 1 g measurements on the ground to 0 g in space.

– Launch slip originates from the fact that no structure is perfect and contains many bolted joints that are subject to micro-slip during the harsh vibration environment during launch to space. The slip manifests as small angular changes at the instrument interfaces with respect to the ground measurements. The launch slip estimation considers the alignment checks performed before and after vibration testing carried out on the flight model (FM) spacecraft. Vibration testing includes sine and acoustic environments and pyrotechnic shocks.

– The level of moisture desorption on Solar Orbiter is quite low due to the limited areas of carbon structure.

– TED makes up a major part of the system alignment budget (Fig. 8).

Fig. 8. Thermal distortion at 0.28 AU. Upper panel: thermal map. Lower panels: distortion.

4.1.2. Alignment considerations during design and build

During spacecraft design, materials are checked for compatibility with alignment requirements. Thermal distortion properties (i.e. coefficient of thermal expansion (CTE) and isotropy) and the temperature ranges within the platform are used to assess compatibility with remote-sensing instrument requirements. The temperature ranges within the spacecraft are relatively small given the large variation of distance to the Sun. This is due to the thermal protection offered by the heat shield, allowing the structure to be manufactured by conventional means, such as aluminium sandwich panels. It is noteworthy that the central tube at the core of the spacecraft is made of a carbon composite, but is sufficiently far away from the panels hosting the remote-sensing instruments and the star trackers to have a limited effect on TED.

The primary pointing knowledge for the spacecraft relies on the star tracker. During the design phase it was shown that the star trackers had to be mounted on the remote-sensing panel (−Y) to minimise the gravity release and the TED. Once this design was implemented, the analysis of all alignment budgets was iterated until confirmation that the requirements could be met.

As the various instruments are integrated with the spacecraft, a local distortion of the interface is induced due to mechanical attachment issues, geometric tolerances, and gravity. The true static alignment of the instruments can only be measured on the completely assembled spacecraft, under Earth’s gravity and at room temperature.

Therefore, once an initial measurement is made with the payload panel integrated with the spacecraft, if there is any need to make small angular corrections, this generally can only be done with the payload panel removed from the spacecraft. For the remote-sensing high-resolution instruments the yaw adjustment is via pin-and-slots at the instrument interface; pitch adjustment is via application of local mechanical shimming. Adjustments are made with the payload panel removed from the spacecraft on a relatively stiff fixture. The instruments have to be optically measured whilst the payload panel is mounted onto this fixture, before and after shimming to measure the delta adjustments. The payload panel is then put back onto the spacecraft, where a final re-measurement confirms sufficient compensation. Additionally, this approach has been used to compensate predicted effects throughout the mission, biassing the ground-based adjustment to get the best fit for the mean science window orbital conditions.

4.1.3. Alignment performance verification

The verification of alignment requirements is based on measuring small angular differences between reference optical cubes with highly accurate theodolites. The cubes are placed at key locations on the instruments and the structure. Measurements are repeated before and after each major handling or testing operation in order to quantify the stability of the structure prior to launch. Moisture, TED, and gravity effects are evaluated with finite element models (FEMs) that have been correlated specifically.

In particular, a structural and thermal model (STM) of the complete spacecraft was built and used to correlate the thermal model and to provide detailed TED data. The STM had photogrammetric targets (see Fig. 9) to optically measure small local distortion, and was placed in a thermal chamber at temperatures above and below the spacecraft integration temperature.

Fig. 9. Photogrammetric displacement measurement. Measurement on the STM spacecraft for the MY payload panel.

The gravity terms can be initially estimated from measurements of the structure in different orientations. The FEM of the structure estimates the 1 g gravity loss in space, which is then used in the system budgets. This information is then summed for each of the terms contributing to the budget.

Once the FM spacecraft was built and tested for thermal and mechanical environments, all terms discussed above were determined, and the final co-alignment of EUI-PHI-SPICE could be plotted in terms of predicted field of view (FoV) overlap (Fig. 10). The upper panels of Fig. 10 show the undistorted FoVs for PHI, EUI, and SPICE. Each of the FoVs is superimposed on a perfect centre and EUI has registration bars within the FoV of the other instruments by design. The lower panel of Fig. 10 includes the complete system budget offset, which was applied to each of the instruments. This evaluation also takes due account of each instrument relative to the measured alignment of the star tracker. Knowledge for how the star tracker distorts is also relevant for the AOCS operation.

Fig. 10. Field of view overlap for high-resolution instruments: PHI, EUI, SPICE, and Metis. Top panel: zero distortion, bottom panel: system budgets applied from 0.28 AU assessment.

Figure 10 shows that the alignment requirements are met. At system level with all terms included, all instruments distort less than 210″ and the relative co-alignment of PHI–EUI–SPICE is also within 120″ for all remote-sensing science operation windows from 0.28 to 0.65 AU.

4.2. Thermal control

The challenge for the thermal control system is to withstand the high temperatures generated by the solar flux, while providing an adequate operational temperature for instruments and subsystems. At perihelion, Solar Orbiter receives a solar flux of about 17.5 kW m⁻², which is about 13 solar constants. The main feature of the thermal control system is a Sun-pointed, flat heat shield that limits the thermal load on the great majority of the spacecraft (Fig. 11). Thus, all internal and most of the external components are shielded from direct solar illumination.

Fig. 11. Solar orbiter heat shield. We note the doors in front of the heat-shield feedthrough apertures, and the SWA-PAS and SWA-HIS feedthroughs indicated by a red arrow.

Outside of the protective shadow cast by the heat shield, and with their own design provisions, there are the following appendages: solar array wings; high- and medium-gain antennae (HGA and MGA); antennae of the Radio and Plasma Waves instrument (RPW; Maksimovic et al. 2020); and remote-sensing instruments requiring a direct view of the Sun when a dedicated door is opened.

The surfaces of these protruding appendages reflect part of the incident solar flux and emit infrared (IR) flux onto the spacecraft walls, which must also evacuate the heat generated by all its electronics units. Lastly, during manoeuvres at solar distances greater than 0.95 AU the spacecraft must cope with direct Sun illumination from any direction in the XZ plane.

4.2.1. Design of the heat shield

The heat shield is sized to create a shadow of 8° half-cone, considering safe mode events with spacecraft off-pointing up to 6.5° from the Sun centre. Despite receiving about 110 kW of heating power from the Sun at perihelion, the shield limits the heat flux to the main body to within ±15 W throughout the mission in order to enable the platform radiators to reject internal heat. A stable thermal environment is attained by isolating the heat shield by a series of discrete mounting blades (for conductive heat transfer) and using multi-layer insulation (MLI) for radiative heat transfer. Table 2 shows key temperatures and heat flux data. The main elements of the heat shield are, roughly from top to bottom: high-temperature MLI (HTMLI); mounting blades called star brackets and Ti Blades; low-temperature MLI (LTMLI); a support panel; a series of feedthrough tubes and doors to protect the aperture of the remote-sensing instruments; and corner cut-outs.

The top layer of the HTMLI is a titanium foil that is 50 μm in thickness and is coated in black using a process called Co-Blast, which was newly developed for this application. The black coating, commercially named EnbioBlack, has an α/ε (ratio of thermal absorptivity over IR emissivity) of about 1.1, and is able to withstand temperatures in excess of 500°C. The rest of the HTMLI is composed of 18 Ti dimpled layers (each 10 μm in thickness) as internal foils, and the bottom Ti layer (25 μm in thickness) facing the LTMLI.

The design features two physical barriers separated by a gap of 245 mm wide, which allows lateral rejection of IR radiation to deep space. The HTMLI is supported by ten Ti Star Brackets, thus-named because of their shape, using metallic velcros riveted directly on the brackets arms. The Star Brackets provide the first gap between barriers, and are mechanically screwed onto the support panel and thermally insulated by special washers (see Fig. 12).

Fig. 12. View from underneath the heat shield, showing the “Star brackets”.

The main structural element is the support panel (2.94 m × 2.27 m, 54 mm thick): a sandwich panel made of aluminium alloy honeycomb and two skins that was specially developed for this mission. The skins are composed of six plies (each of 0.67 mm in thickness) of quasi-isotropic layup of carbon laminates. The composition and layup of the skins were selected to optimise the thermal load uniformity, thus reducing the thermo-elastic distortion of the platform, which is necessary for tight co-alignment of instrument feedthrough tubes. The support panel is attached to the main structure by ten Ti blades, which are very thin (about 1.5 mm) to minimise the conductive heat flux to the spacecraft.

In order to not exceed its qualification limit of 160°C, the support panel is wrapped by LTMLI, which is attached by means of non-metallic velcros glued to the skins. These LTMLI are composed of 28 layers of double aluminised embossed Upilex. The LTMLI blankets facing the HTMLI have the external layer aluminised to maximise heat rejection to space through the main lateral gap. The LTMLI blankets facing the platform and on the lateral sides have a black Kapton external layer; this is to avoid high temperatures on the MLI layers during the manoeuvres above 0.95 AU. Finally, the central part of the support panel facing the platform is not covered by LTMLI, and radiates the heat absorbed by the feedthrough tubes.

The heat shield provides apertures through which some remote-sensing instruments can observe the Sun. The apertures are created by titanium feedthrough tubes mounted on the support panel. The tubes are wide enough to cater for the unobstructed FoV of the instruments and take into account the thermo-elastic distortions of the platform panel, the support panel, and the feedthrough tubes themselves. The diameter was otherwise minimised to limit absorbed solar input. There are eight feedthrough tubes in total for the five internal remote-sensing instruments (we note that some of the instruments have more than one observing channel). Each feedthrough consists of a titanium cylindrical hollow structure with a diffuse coating for compatibility with high temperatures. The internal and external surfaces of the feedthrough tubes are black coated by a novel plasma vacuum deposited process of AlTiN. The coating has an α/ε of about 1.2, and is able to withstand high temperatures. A black coating was applied on the internal sides to reduce excess stray light seen by the instruments, and to the external sides to maximize heat rejection. Despite their low thermal conductivity, the titanium feed-trough tubes will still reach relatively high temperatures (220°C at the support panel interfaces). Therefore, to avoid exceeding its maximum qualification limit of 160°C, the support panel is thermally insulated from the hotter feedthrough tubes by means of very thin and long Ti washers. Finally, in order to verify compatibility with flight conditions, the thermo-optical properties were tested with UV and particles at high temperature. The heat absorbed from the incoming solar flux is radiated to space laterally through the main heat shield gap.

Each aperture at the top, facing the Sun, is protected by a circular door that swivels around a driving shaft moved by a dedicated motor. The doors are intended to be open throughout the majority of the mission to allow the instrument to perform science observations. The motors are installed on the heat-shield support panel to benefit from the more benign thermal environment.

The two corner cut-outs for the SWA-PAS and SWA-HIS instruments (SWA: Solar Wind Analyser) are mounted on two corners of the support panel. Each cut-out is a monolithic titanium piece consisting of an ‘L’-shaped plate with an average wall thickness of 3 mm, flat inner surfaces in the higher half, and stepped surfaces in the lower half. To minimise the impact of the very hot corner SWA feedthroughs that reach temperatures around 330°C on the support panel interfaces, the corner cut-outs are insulated with Ti thermal washers or ten polymer washers.

4.2.2. The Stood-Off Radiator Assembly

Dissipating the heat from and controlling the temperature of the science instruments integrated inside the main spacecraft body posed a significant technological, design, and verification challenge. This function is performed by a dedicated and novel thermal subsystem named the Stood-Off Radiator Assembly (SORA). The payload radiators are located on the −Y and +Z panels of the spacecraft (see Fig. 13). The −Y panel is in view of the solar array wing, which reaches high temperatures around perihelion creating an IR environment, that is, deviating from a typical deep space environment. The location of radiators was optimised for this IR flux. The payload radiator system is composed of the following elements:

Fig. 13. Stood-off radiator assemblies.

– Flexible thermal links: Thermal straps are used to provide good thermal contact between hot elements and cold fingers. A high strap flexibility is desirable to mechanically decouple the instruments from the radiator and the spacecraft panel. In other words, the instrument mounts onto the spacecraft are isostatic, making the design tolerant to any distortions in the panel beneath. The straps are made from highly flexible sheets of annealed pyrolitic graphite (APG), covered by a vacuum deposited aluminium polyimide (VDA Kapton) sleeve, and coupled with a Chotherm thermal filler on both ends, that is, to the instrument and to the radiator.

– Rigid thermal links: As the Metis instrument has flexible straps on the payload side of the element interface, the link between the element and the radiator is made by rigid thermal-conduction bars. The bars are made of APG encapsulated in Al 6061-T4. To reduce parasitic radiative exchange between the conduction bar and the spacecraft cavity, both the end fittings and the bars are covered with VDA Kapton.

– Stood-off radiator panels: The radiator panels are stood-off from the spacecraft panel in order to thermally isolate the radiator from the panel; avoid cold areas on the spacecraft panel beneath the payload units, therefore minimising thermoelastic distortion of this panel; and reduce parasitic heat leaks to the radiator leading to a smaller radiator surface area. Most panels are made from Al 6082-T6 with a thickness of 3 mm, plus stiffening webs as required. However, higher heat spreading is required for the very cold EUI cold element (CE; removing heat from the sensor heads) and SPICE CE radiators, and so these are made of APG enclosed with Al 6061-T4. The APG panels provide a similar heat-spreading capability to that of heat pipes, while being compatible with the instrument operating temperatures. Finally, MLI is installed on the inner side of the radiator to avoid parasitic radiative exchange with the spacecraft panel.

– Stood-off radiator panel thermo-optical finish: All the stood-off radiators on the −Y panel are coated with Enbio’s Solar White. This coating has a higher IR emissivity than OSRs. The thermal input on the −Y panel is due to reflections from appendages and not to direct solar illumination, and so the white coating is more efficient for heat dissipation. On the contrary, for the SPICE CE, radiator OSRs are used because this radiator is located on the +Z panel and therefore receives direct solar flux during orbital manoeuvres.

– SORA heat pipes: The hot and/or medium temperature elements of two instruments (PHI and EUI) need higher heat dissipation. Therefore, Al 6063-T5 surface-mounted heat pipes with ammonia (as its working fluid) are installed to reinforce heat transport from the thermal interface of these elements towards the corresponding radiator surface.

– Isostatic mounts: Isostatic mounts support the radiator panels and some of the heat pipe sections at a distance from the platform structure. These mounts feature thin cross-section blades made of glass fibre reinforced plastic (GFRP), which reduce the conductive coupling between radiator and structure. Moreover, to reduce radiative coupling the mounts are wrapped with VDA Kapton.

4.2.3. Platform thermal control

The stable and relatively benign thermal environment provided by the heat shield make it possible to primarily rely on common passive means for the platform thermal control: MLI blankets, radiator surfaces, paints or coatings, thermal fillers, and electrical heaters controlled by thermistors. These techniques are well known and increase the system reliability. However, their apparent simplicity may be deceptive when implemented on such a demanding mission.

The highest temperatures are reached at and around perihelion (0.28 AU at the nearest throughout the mission). The solar array (SA) is completely exposed to Sun illumination, and to sustain the incoming flux the solar cells are arranged in rows interspersed with OSR tiles. There are also OSRs close to the SA panel edges. Thermal shields coated with Enbio Solar Black are implemented on the Sun-pointing edge of the SA to reduce the temperature of the solar cells. The SA yokes are also equipped with thermal shields coated in black and with OSRs in some locations. The design of shields and surfaces (OSR or black) copes with the thermal input, but also controls the amount and direction of stray light towards the instruments.

Thermal blankets are used on all external panels to sustain solar heating during manoeuvres and radiative heat loss to space. The external layers of these MLIs are coated with black Kapton, the intermediate layers are made of Mylar with Dacron spacers, and the most internal layers are made of embossed VDA Upilex. The heat generated within the spacecraft is rejected by external radiator surfaces installed on the +Y, −Y, and +Z panels. These are made of small OSR mirror tiles, which are not exposed to the solar flux throughout the majority of the mission life time. External equipment like the Fine Sun Sensors (FSSs), the Star Trackers (STRs), and the bracket of the SWA-PAS instrument have radiators made with OSRs or white coating. On the +Z panel, where the highly dissipating communication equipment is installed, ammonia heat pipes transport and spread the thermal energy towards the radiators.

The fourth side of the spacecraft (−Z plane), where the Antenna Reflector Assembly (ARA) of the HGA shines at about 400°C, additional layers of double VDA Upilex are applied to deal with the significantly hotter environment. For the same reason, there are no radiators on this side. The thermal design concept of the ARA is purely passive. Its function is to minimise the RF pointing errors by reducing the temperature gradients across the ARA, while keeping the maximum temperatures as low as possible. The ARA is coated with Enbio Solar Black. The frame and the antenna boom are protected by a black titanium thermal shield that spreads the incoming heat flux and keeps the temperature gradients low. Also in this area, the MLI protecting the thruster brackets are HTMLI built with 12 dimpled Ti layers external to another set of 12 layers of embossed Upilex.

Magnetically compensated (see EMC section below) electrical heaters control temperatures during all mission phases. Each of the 104 main and 104 redundant heater lines is controlled by the spacecraft central software. The temperature at the reference points is monitored using the median voting temperature of three sensors (thermistors), and is maintained within desired limits by the heaters. Several other thermistors are used to monitor the temperatures of the units that do not need any heating. The remote interface unit (RIU) controls and reads out all 418 onboard thermistors. Last but not least, the instrument boom is designed to operate at extremely low temperatures and therefore does not need heaters, except for the boom hinges, and only during deployment. The boom is covered with black Kapton MLI.

4.3. Attitude and Orbit Control System (AOCS)

Solar Orbiter is an interplanetary mission that will use GAMs to change the orbital parameters. To change the orbit and reduce fuel consumption, the pointing accuracy of the thrust vector is a design driver for the AOCS architecture. Another driver is the long time periods without communication with Earth, during which potential permanent damage can occur if Sun pointing is not tightly maintained. These constraints are compounded with the challenging operational, accuracy, and electro-magnetic cleanliness requirements necessary for the performance of instruments. Overall, the AOCS architectural design is driven by the need to maximise autonomy and robustness. These constraints and design drivers have been translated into the following primary requirements:

– Sun protection: Following any platform failure when the craft is near perihelion, the AOCS ensures that the maximum off-pointing from the Sun is ≤6.5° from the Sun line, and that any off-pointing event ≥2.3° lasts for ≤50 s.

– Autonomy: Following any major failure, the ground activities necessary to restore nominal operations should be short. Thus, in any such event, reaction wheel control is autonomously restored. This has the added advantage of reducing propellant consumption.

– Autonomy: Fine pointing performance is autonomously maintained for up to 24 h in case of star tracker unavailability. This provides robustness against solar flares.

– Science performance: The main spacecraft pointing requirements, which meet the needs of the scientific instruments are: the relative pointing error (RPE) ≤1″ over 10 s, the absolute pointing error (APE) ≤2′, and the pointing drift error (PDE) ≤1′ over 10 days, considering 10 s integration windows

In order to ensure a fully integrated AOCS with the rest of the spacecraft architecture, as it was developed and verified at a dedicated company, the functional architecture of the AOCS has been organised into a core AOCS element and a non-core AOCS element. The core AOCS exercises the algorithms processing AOCS sensors and generating demands for the actuators; it additionally runs all necessary computations to handle commands received from the non-core AOCS. The core AOCS mode architecture comprises four active modes and one initial stand-by mode. The core AOCS cannot initiate any autonomous mode transitions, as these are commanded either from the ground or from the non-core AOCS. The non-core AOCS is a functional wrapper of the core AOCS. It performs the management of the AOCS equipment (e.g., activation or deactivation) and provides the data interface between the core AOCS and the AOCS equipment. It also interfaces with other spacecraft systems, notably the Data Handling System.

4.3.1. AOCS sensors and actuators

As far as was possible, technology or product heritage led to the selection of the following AOCS sensors: (a) two Inertial Measurement Units (IMU) were used in cold redundancy. The prime unit comprises four independent high-performance gyroscopes in tetrahedron configuration used in hot redundancy providing inertial rate data, and four independent accelerometer channels used in hot redundancy providing integrated velocity data. The nominal unit also includes four accelerometer channels used during Δ − V manoeuvres. The more limited, redundant unit comprises four independent gyro channels only used in hot redundancy; (b) two star trackers used in cold redundancy provide three-axis attitude data in the form of a quaternion. The data are fused with the IMU data to provide very low short-term noise pointing and robustness against star tracker failure or temporary unavailability; (c) two pairs of FSS used in cold redundancy provide direct two-axis measurements of the Sun direction.

The architecture relies on a pure-torque thruster configuration coupled with a thruster controller algorithm, which can deliver pure force in the commanded direction with the following force and torque actuators:

– Four independent Reaction Wheel Assemblies (RWA), each with its dedicated drive electronics unit, used in hot redundancy delivering low-torque, low-noise three-axis control. Each RWA is mounted on elastomer dampers to control and minimise microvibration coupling with the instruments, but degrading the RPE performance. In order to isolate the magnetic footprint of magnetic materials within the RWA from the in-situ instruments, the RWAs are fitted inside μ-metal shield enclosures.

– Two independent branches of nine 10 N bi-propellant thrusters, which are part of the Chemical Propulsion System (CPS), with the thrusters in each branch used in hot redundancy, are used for three-axis pure-torque control, for reaction wheel off-load, and for Δ − V manoeuvres.

4.3.2. Attitude and Orbit Control System (AOCS) architecture

An important element of the functional architecture is the management of AOCS modes and TM/TC (telemetry and telecommand). AOCS mode transitions autonomously decided onboard (i.e. not initiated by the ground operations team) are managed mainly by system control; there are a few exceptions managed by the non-core AOCS via a common command interface to the AOCS core functions. The AOCS mode architecture foresees a number of dual-purpose modes, which are used for both nominal and safe operations.

– The Sun Acquisition and Survival mode (SASM) drives the initial Sun acquisition immediately after launcher separation. It is also the lowest level system survival mode when the FDIR triggers fail-safe alarms. Other than for the initial Sun acquisition, the SASM is fully autonomous and does not require any ground support. The SASM uses thrusters for angular rate damping. For Sun search and acquisition, Sun pointing, and attitude estimation, the SASM fuses data from the FSS and the IMU gyroscopes. Once the Sun pointing is achieved, the RWAs are switched ON for a check-out before transition to Wheel Safe mode is executed by system control or from the ground team. To conclude the recovery, rotation about the Sun-line in Earth-strobing is performed to establish Earth communication via the MGA in case there are RWA anomalies.

– The Wheel Safe mode (WSM) maintains Sun-pointing and is a transition mode between SASM and Normal Control mode. It also represents the second level system survival mode, and is fully autonomous. The WSM uses the same estimation scheme as SASM. Reaction wheels provide attitude control, whereas thrusters are only used for wheel momentum management in order to reduce fuel consumption. The AOCS dual-purpose mode to maintain Sun pointing mode on wheels in preparation for transition to NCM and second level of system survival mode represents the second contingency stage. When executed as part of the contingency operations, this mode is fully autonomous and does not require any ground support. Sun pointing based on two-axis control of sunline with FSS and rate control on third axis (around sunline). The rotation about the sunline controlled by command from system control serves two purposes: Earth strobing to establish Earth communication via the MGA in case of failed autonomous transition to NCM or Star tracker strobing to facilitate star acquisition if planet occultation occurs during LEOP. A cluster of at least three reactions wheels provides full three-axis control torque. Wheel momentum management is performed using thrusters. This is controlled by command from the non-core AOCS or from the ground. STR checkout functionality during contingency operations. This is controlled by command from system control. Transition from WSM to NCM is by command from system control or from the ground. WSM can be entered also from SBM and NCM by command from system control or from the ground. We note that the transition from NCM to WSM will be removed in the future.

– Both SASM and WSM foresee an Earth strobing sub-mode, which is entered in situations where autonomous transitions to either WSM or NCM cannot be performed. In strobing mode, the spacecraft rotates around the Sun-line in order to restore the MGA link with ground.

– The Nominal Control mode (NCM) is the main mode for Solar Orbiter supporting both the cruise phase and mission science operations. Attitude estimation is realised by data-fusion of gyro and Star tracker measurements (gyro–stellar estimator) and reaction wheels are used for three-axis control. Guidance is based on attitude profiles uploaded from the ground. Commanded reference profiles are uploaded to the spacecraft in the form of Chebyshev polynomials and periodic sine/cosine expansion parameters fitted to the desired guidance profile. The NCM can also act as System Safe mode and is autonomously reached as part of the spacecraft recovery after a failure when star trackers and reaction wheels are deemed again operational.

– The Orbit Control mode (OCM) presents a similar architecture to NCM plus the capability of performing ΔV manoeuvres using thrusters. The OCM is also used for Earth flyby, where increased torque capacity provided by the thrusters is required.

4.4. Autonomy

Direct commands from the ground are not anticipated to be the nominal commanding approach on Solar Orbiter due to the response time of the Spacecraft when in orbit around the Sun. The spacecraft performs its required functions through the use of its onboard commanding functionality that allows routine operations to continue autonomously, even during solar conjunctions, for up to 76 days.

Not to be confused with AOCS modes, the spacecraft has a number of modes, notably Survival, Safe, and Operational. Survival mode is the ultimate fall-back state and is the first mode entered following triggering of a fail-safe monitor. Together with Safe mode (described below), the aim is to maximise the availability of platform resources to support failure investigations. The spacecraft is placed in a safe state which can be maintained autonomously for as long as is necessary to identify and recover the failure. All equipment that is not essential to survival (e.g., science payload, but not the mass memory) is switched off in order to maximise the ability to recover the spacecraft. Survival mode is supported by two AOCS modes: SASM and WSM.

Safe mode is an intermediate mode in returning to Operational mode and differs from Survival mode only in the AOCS mode that is used: NCM. Safe mode is the highest autonomously achieved spacecraft state that the system can achieve following entry to Survival mode and its function is to maximise the availability of platform resources to anomaly investigation and return to nominal operations. In this mode the spacecraft is under full three-axis control.

Operational mode performs GAMs and payload operations. Accordingly, it is used for the majority of the mission starting from the cruise phase. Two AOCS modes support the Operational mode: Normal Control mode and Orbit Control mode.

Autonomy used for normal operations is based on the use of the Mission Timeline (MTL), the TC Sequence Files (immediate and delayed), which are a collection of discrete activities with one commanding file per activity. These TC Sequence Files will be triggered from the MTL, and by On Board Control Procedures (OBCPs) for payload operations for nominal commanding.

The MTL will be provided with 255 sub-schedules. In the event that any failure necessitates a halt to nominal commanding, a transition to survival mode will be performed to ensure spacecraft safety; in doing so, the MTL is emptied and it is ensured that commanding is not restarted in an unknown way. Also, the backup MTL will be loaded. If there is no risk of conflict between the scheduled operations and the recovery action, the scheduled operations are left to continue in parallel with the recovery action, even though this may lead to acquisition of some unconfigured science data.

An important science requirement on Solar Orbiter is the tracking of the solar surface features as they evolve in time. Because the motion of the features cannot be modelled onboard, and in order for the remote-sensing instruments to keep them within their field of view, ground intervention is necessary. Onboard, quick-look data will be generated for the ground to analyse the motion of the features. This data set has the form of guidance segments, and is small enough to be downlinked in one pass over the ground antenna. Then ground control transmits attitude segments, one for each day of the science window.

4.5. Failure Detection, Isolation, and Recovery

4.5.1. Approach and requirements

The goal of Failure Detection, Isolation, and Recovery (FDIR) is to continue in Operational mode for as long as possible when it is safe to do so. It also safeguards the spacecraft and instruments, entering in Safe or Survival mode when needed. This entails two complementary approaches:

– Fail-operational approach: scheduled operations continue during and after failure handling (e.g., using redundant units).

– Fail-safe approach: scheduled operations stop, for example in the case of major failures of the on-board computer, AOCS functional failures, main electrical bus under-voltage, and so on.

The following system requirements define the on-board FDIR architecture:

– After detecting a failure, the system keeps generating mission products thanks to the built-in redundancy.

– Anomalies are resolved at the lowest possible level of the system hierarchy, for example unit-level before subsystem-level.

– The FDIR functions are intrinsically fail-safe.

– In order to continue with nominal operations during solar conjunctions, the spacecraft is autonomous for up to 76 days without ground contact. This requirement is applicable for recoverable failures that do not stop the on-board schedules.

– For recoverable failures that stop the on-board schedules, i.e. major system failures, the spacecraft can be in safe mode for at least 76 days without ground contact.

The system-level FDIR concept relies upon tolerance to failures, redundancy architecture, and component quality of the subsystems. The FDIR implementation ensures robustness of the spacecraft to single failures. For platform functions, this means that a single failure is safely recovered, either by autonomous switching of the failed unit to a redundant unit, or by switching to a mode that keeps the spacecraft in a safe state until the failure can be recovered from the ground.

In order to avoid the loss of platform functions, a tailored redundancy concept is implemented such that a single failure does not cause a loss of essential platform functions. Therefore, all units have to be independent of their redundant alternatives. The redundancy principles can be characterised as follows:

– Hot redundancy is provided for vital spacecraft functions like power generation, On-Board Time, telecommand decoding, S-band telecommand reception, high-priority commanding function, and reconfiguration function in order to provide redundant resources without the need for specific configuration commands.

– Cold redundancy (e.g., operation of one unit out of two available ones at a time) is provided for other hardware units, such as for example the Processor Module, RIU, and so on.

– Cross-strapping is implemented as necessary to fulfil reliability requirements and to support operational backup configurations to be used in failure cases at subsystem level. A high number of cross-strapping functions are implemented in the platform, which avoid the need for a switch-over of the complete chain. Therefore, in the case of a single failure, only one unit has to be taken from the redundant side. The cross-strapping functions are designed such that a single failure does not block a specific nominal and redundant function.

4.5.2. Failure Detection, Isolation, and Recovery architecture

FDIR is hierarchically implemented, dealing with failures at the lowest possible level. There are four levels of autonomous FDIR (numbered 1−4) and one level of ground FDIR (level 5), see Table 3. The FDIR functionality uses the notion of a Spacecraft Configuration Vector (SCV), which contains the status and health information for each equipment. The Central Software (CSW) of the on-board computer (OBC) uses the SCV at system initialisation –whether autonomously or from the ground– to determine the spacecraft configuration. The different values of health for each individual unit provide additional flexibility; in particular for staggered FDIR, where specific recoveries with different criticality can be attempted and unit health is decremented before declaring it failed. Therefore, the spacecraft FDIR architecture is able to cope with multiple failures in independent entities during a reconfiguration by ensuring that an already failed unit is not re-selected.

The FDIR design principles are as follows:

– FDIR has both a functional sequence monitoring that is hard-coded in the CSW, and cyclic monitors that are implemented via Packet Utilisation Standard (PUS) services. Hard-coded monitors in the CSW are also defined for the time critical AOCS fail-safe monitors that ensure protection from Sun illumination. This concept uses appropriate monitoring to determine whether or not a unit is functioning correctly or whether or not an individual parameter is out of limit.

– The applicability of monitors is managed on board by use of validity parameters set and cleared by the CSW. Additionally, an enable/disable status is provided for each monitor, which can be set from the ground using the standard PUS Service 12 functionality. Grouping of individual PUS Service 12 parameter monitoring can also be performed using the private PUS Functional Monitoring Service 142.

– Multiple reconfigurations arising from a single failure are prevented by tuning PUS Service 12 monitors complemented by the use of PUS Service 142.

– For the AOCS fail-safe monitors, the recovery is performed by software transitions to SASM followed by a deferred reboot, thus ensuring that the spacecraft is protected from the Sun.

– When the spacecraft safety cannot be guaranteed by a local reconfiguration or when the redundancy is lost (i.e. both redundant units are detected as failed), the FDIR triggered recovery will enter into Survival mode. Survival mode will be the result of FDIR levels 3 or 4 recoveries. The spacecraft is designed to autonomously recover in a staged recovery sequence:

– Ensure stable Sun pointing attitude so that the spacecraft is not directly illuminated by the Sun (with the exception of the thermal heat shield and spacecraft appendages); this Sun protection is driven by several system-level requirements that define the maximum allowed off-pointing, and the corresponding FDIR implementation of FDIR is done via several hard-coded monitors.

– Transfer control to the reaction wheels autonomously.

– On-board autonomous recovery of three-axis stabilised attitude control and establish Earth link.

– Ensure ground can recover the spacecraft communication link if on-board autonomous recovery of a permanent communication link is unsuccessful by establishing robust Earth link strategy via the MGA Earth strobing.

– The spacecraft recovery from critical on-board anomalies is performed through the execution of two main system modes, Survival and Safe modes.

– A so-called last-chance configuration is an SCV stored in the CSW image that is used in the event of repeated FDIR triggers (false triggers or real failures), representing a known final state from which the ground operator can attempt a recovery. The last chance configuration generally consists of the B-side unit selection. Where possible, all potential failure sources are isolated, and the spacecraft operates in a stripped down configuration, with a minimum set of active equipment. All other equipment is switched off or isolated, eliminating as many error sources as possible. The Safe-Guard Memory (SGM) is not used in order to eliminate profiles or other configuration parameters as the source of the error (with a limited set of exceptions). Instead, the spacecraft is configured with a set of default parameters stored in the CSW image in the Processor Module EEPROM. In order to ensure that the last chance configuration is maintained, the FDIR is disabled. The AOCS remains in SASM in order to ensure a safe Sun-pointing.

Finally, the spacecraft FDIR is not designed to cope with double failures, such as:

– Consecutive failures in one independent entity (e.g., a single equipment and/or functional chain).

– Failures in different independent entities, and sufficiently close in time.

4.6. Communications subsystem

The communications subsystem on Solar Orbiter provides reliable two-way communication links at distances up to 2 AU and guarantees communication with the ground during the entire mission lifetime. To fulfil this goal, the communication subsystem is composed of a two-axis steerable high-gain antenna (HGA), a one-axis steerable medium-gain antenna (MGA), two fixed low-gain antennas (LGAs), and a Comms Module, comprising the following main pieces of equipment: two X-band deep-space transponders (DSTs), each one including one TX module for downlink output generation and one RX module for uplink signal reception; two travelling wave tube amplifier (TWTA) assemblies providing 73 W RF power; and one RF distribution assembly (RFDA) comprising wave guide elements and five wave guide switches (WGS); see Fig. 14. Main antenna performances are summarised in Table 4.

Fig. 14. Solar Orbiter communication antennas.

The ground stations assigned to the Solar Orbiter mission are: Malargue (Argentina, 35 m), which is the main station for all mission phases, Cebreros (Spain, 35 m), which is the back-up station, and New Norcia (Australia, NNO-01 35 m station and the NNO-02 WBU 0.7 m and NBU 4.5 m) used during LEOP first acquisition.

Depending on the mission phases, the COMMS subsystem will be configured to use the following antenna configurations: the two LGAs providing links during LEOP and the near-Earth commissioning phase, the HGA providing links during cruise phase, planetary fly-bys, and during the nominal mission phase and extended mission phase, and the MGA, as backup for the HGA, being deployed automatically when the spacecraft goes into Safe mode. Both the HGA and the MGA are launched in a stowed configuration and their deployment is controlled from the ground as part of their commissioning.

The Solar Orbiter Communications subsystem is derived from the successful Bepi Colombo design that implemented for the first time the CCSDS (Consultative Committee for Space Data Systems) recommended pseudo noise (PN) regenerative ranging with residual carrier telemetry modulation schemes like NRZ-L/PSK/PM or SP-L/PM. In order to provide the required mission science data return, and because of the bandwidth limitation of the SP-L/PM modulation, Gaussian minimum shift keying (GMSK) modulation has been included in the Solar Orbiter DST design allowing increased telemetry data rates up to 1 Mbps while NRZ-L/PSK/PM and SP-L/PM are kept for lower data rates. The analysis of telemetry data rate variability versus spacecraft distance from earth calculated for the February 2020 baseline launch date (Fig. 15) shows that when using only SPL/PM, the maximum data rate would have otherwise been limited to about 312 kbps for Turbo 1/2 and 155 kbps for Turbo 1/4.

Fig. 15. Telemetry data rate variability vs. spacecraft distance from the Earth.

The Solar Orbiter Communications subsystem also implements a ‘semaphores’ signalling system that allows the spacecraft status to be detected in the case of major on-board anomalies. In such cases, the spacecraft software points the Solar Orbiter heat shield towards the Sun, commands the MGA to an angle where the Earth is supposed to be, and transmits a carrier-only signal plus a combination of DDOR (Delta Differential One-way Ranging) tones. A slow rotation (0.03875 deg s⁻¹) around the X-axis then starts making the MGA pattern strobe towards the Earth for a certain period of time (Fig. 16). The RF signal received at the ground station allows the operators to detect the anomaly, given that the expected telemetry data stream would not be received but would be replaced by the carrier plus the DDOR tones.

Fig. 16. MGA Earth Strobing Motion.

As Solar Orbiter will reach distances up to 0.28 AU from the Sun, a key feature of the communication subsystem antennas is the capability to withstand temperatures up to 600 deg Celsius. Also in this case, heritage from Bepi Colombo antenna design and technologies has been applied in order to reduce cost and risks. Most antenna elements were manufactured mainly in titanium. The HGA main dish, for instance, was manufactured by hot pressing a titanium plate (Fig. 17).

Fig. 17. Solar Orbiter HGA manufacturing (photos courtesy Afflerbach GmbH and Sener).

Last but not least, as with all deep space missions, Solar Orbiter has a severely power-limited data downlink, which means that optimising the science data return of the mission within the given constraints is of utmost importance. The Solar Orbiter mission operations centre has consequently optimised the concept, technique, and duration of the required ranging transmissions to improve the return of science data while meeting the orbit determination requirements for flying the mission through multiple planetary gravity assists.

4.7. Data Handling Subsystem

The Solar Orbiter Data Handling Subsystem (DHS) provides key processing and operational functionality to all the spacecraft subsystems. The key elements of the DHS are the CSW, the solid state mass memory (SSMM), and the RUI. Their functions are as follows:

– The CSW hosted by the OBC coordinates all key functionalities of the spacecraft. The CSW manages attitude and orbit control, thermal control, power, payload control, rata routing, and platform data storage, along with commandability, observability, and failure handling for the entire spacecraft. The OBC also manages the time synchronisation between various units of the spacecraft.

– The SSMM hosts the SpaceWire (SpW) router network interfacing with all ten payloads and managing science and non-science data throughput.

– The RIU provides the interface between the OBC and specialist electronics without Milbus 1553 interface, such as for example analogue acquisitions (FSS, thermistors, pressure transducers, potentiometers, strain gauges, etc.) and the chemical propulsion system control.

4.7.1. OBC architecture

Data processing is handled by a cold redundant pair of processor modules based on a SPARC central processing unit (CPU) core. These processing modules handle the initialisation and CSW boot; execution of the CSW supported by the hardware-dependant software and the operating system; the interruption management; and error detection and alarm signal generation. They also provide memory in the form of 8 Mbps of EDAC (error detection and correction) protected SRAM (static random access memory), 4 Mbps of EEPROM (electrically erasable programmable read-only memory), and 32 kbps of Boot PROM (programmable read-only memory).

The OBC provides the following input and output functions to interface with different units on the spacecraft:

– Two MIL-STD-1553 busses to the RIU and other 1553B compatible units.

– Internal on-board data handling bus for thermistor and analogue acquisitions.

– Two UART (universal asynchronous receiver-transmitter) interfaces (standby processor module).

– Six spacewire interfaces (TTR-A, TTR-B, MM-A, MM-B, SSMM-A and B). We note the external SpW link to SSMM B is multiplexed and also provides an output for EGSE.

– Two packetwire receive interfaces (TTR-A, TTR-B to receive TCs from the TC decoder).

The on-board time management function provides the time reference for all spacecraft on-board activities including time-tagged command scheduling and telemetry packet time stamping (both instrument data and housekeeping telemetry). This time will also be distributed to any on-board equipment where a time reference is used. The spacecraft central software together with the SSMM SpW network supports inter-instrument communication (IIC) by passing specific data between the instruments accurately based on the time reference. The IIC implementation is novel to Solar Orbiter wherein instruments autonomously plan their observations based on specific input from other instruments.

The OBC supports interfaces to two specific types of memory units to support mission operations: the on-board mass memory (OMM) and the safeguard memory (SGM). The OBC FDIR concept is managed by the reconfiguration electronics (RE) which is programmable hardware that resides in the hot redundant TTRM boards. The RE is responsible for issuing reconfiguration command sequences in case there is an alarm situation. The CSW which is resident in the processor module manages the FDIR (see dedicated section above) and the spacecraft modes, controls all OBC functions, manages all subsystem configurations through implemented autonomy and by providing interface to the ground, and encodes telemetry for observability.

4.7.2. SSMM architecture

The multi-user SSMM simultaneously manages data exchange flows with three types of external sources and destinations, namely payload instruments (P/L), the OBC, and transfer frame generators (TFGs). Data are exchanged as CCSDS packets that can be either TC (from OBC; to SSMM, and to P/Ls) or TM (from P/Ls and OBC; to TFGs and OBC). Any external physical communication layer, with P/Ls, OBC, and TFGs, is based on the SW link. Each TM or TC CCSDS data packet is transferred as the cargo of a SW packet.

The SSMM hardware architecture consists of: nominal and redundant processor (supervisor) modules, managing all the SSMM operations; nominal and redundant input modules (behaving as packet store recorders); nominal and redundant output modules (behaving as packet store players); a memory array of three memory modules; nominal and redundant DC/DC converter modules for nominal/redundant supervisor modules; and nominal and redundant DC/DC converter modules for the memory array and the I/O modules.

The mass memory is composed of three memory modules with a 32 GiB capacity each. Each module is organised in 32 rows, or partitions, and 11 columns. Eight columns are used for data storage and two store the Reed-Solomon check bits; one column is spare and is used for redundancy. Each column is 16 bits wide and physically divided into an 8-bit ‘odd’ part and an 8-bit ‘even’ part. The Reed-Solomon check bits allow the correction of an incorrect byte in the data word of 8 bytes. The ASW resident in the SSMM SV module manages the hardware elements that perform all the file management tasks, running of the SpW links, and the command and control of SSMM itself.

4.7.3. Architecture of the remote interface unit

The RIU architecture comprises the following modules:

– Two OBC interface modules or control boards (CTR) nominally used in cold redundancy. Each CTR (A/B) interfaces a redundant MIL-STD-1553 bus and is in charge of the control of the standard interface modules (STDs) and propulsion interface modules.

– Standard interface modules communicate with the CTRs and are in charge of the acquisition of telemetry signals and supporting the generation of SHP and EHP pulse signals.

– Propulsion control modules.

– Thruster latch valve drivers that are powered from a dedicated LCL (a SHP generated by the OBC CPDUs is able to close all TLVs of a branch simultaneously).

5. Electromagnetic compatibility and electrostatic charging

The ability of the spacecraft to operate properly in the relevant electromagnetic spectrum was especially challenging in the development of the spacecraft and its various components. The possible emissions, susceptibilities, and coupling paths to be considered are as manifold as the wide range of frequencies, from DC to 20 GHz and the large spread of power levels over more than 18 mag.

Design began by taking into account electromagnetic compatibility (EMC) aspects related to safety of personnel and equipment, especially during the launcher and launch site activities. For example, the spacecraft emissions inside the receiver frequency bands of the launch vehicle have been verified not only at unit level, but also at system level with the assembled spacecraft in the launch configuration.

On the spacecraft platform, the communication transponder is sensitive to electromagnetic fields in X-band and it is also an active emitter. With the large distance to Earth, the powerful transmitter generates high field levels at about 8.4 GHz, also outside the main beam. As a consequence, the RPW-ANT pre-amplifiers have been qualified for field levels up to 316 V m⁻¹. The radio receiver also has to be very sensitive, which meant that we had to verify emissions of any other platform equipment or instrument placed at less than one metre distance down to a level of 8 dB(μV m⁻¹) at (7172 ± 10) MHz for internal units. With very low measurement bandwidth of 1 Hz it was possible to reduce the noise floor to about 10 to 15 dB(μV m⁻¹). Lower levels, or more representative bandwidth, require receivers dedicated to the specific frequency range, such as the spacecraft receiver itself. Compatibility at the sensitivity level of the spacecraft receiver was consequently verified at system level with the assembled spacecraft in an extensive EMC and RF auto-compatibility test campaign. This included verification of the spacecraft operation with the transmitter on and the HGA pointing to the edge of the heat shield, which was considered a worst-case scenario for the field levels on the spacecraft body.

The scientific payload suite on the Solar Orbiter spacecraft contains several instruments, which are sensitive to electric fields, magnetic fields, or even both: three electric field antennas (RPW-ANT) on −Y, +Y, and +Z panels (Maksimovic et al. 2020); one search coil magnetometer with three axes (RPW-SCM) on the instrument boom (Maksimovic et al. 2020); two fluxgate magnetometers with triaxial sensor heads (MAG-IBS and MAG-OBS) on the instrument boom (Horbury et al. 2020); and several particle detectors: two electron and ion detectors (EPD-STEP) on the −Y panel (EPD; energetic particle detector Rodríguez-Pacheco et al. 2020), two electrostatic analyser heads (SWA-EAS) at the tip of the instrument boom, a heavy ion sensor (SWA-HIS) on the corner of +X, +Z, −Y panels; and a proton and α-particle spectrometer (SWA-PAS) at the corner of the +X, −Z, −Y panels.

The needs of these payload instruments can be classified into three major domains: electromagnetic cleanliness, magnetic cleanliness, and electrostatic cleanliness, which were discussed extensively in a dedicated EMC working group throughout the development phases (Pudney et al. 2019). We address these domains in the following sections. The electromagnetic cleanliness requirements are often verified by a combination of tests and analyses. Not all operations from platform equipment and payload instruments are compliant, especially not at all times (see Walsh et al. 2020 for the coordinated operations of the in-situ payload). However, for science operations, a separation into EMC- and magnetically quiet periods and remote sensing windows has been adopted. After a preliminary operation plan is established prior to launch, which is based on results from unit and system level tests, this will be refined further during near-Earth commissioning activities and the following cruise phase.

5.1. Magnetic cleanliness

The fluxgate magnetometers of the MAG instrument (Horbury et al. 2020) are sensitive to static magnetic fields and time-varying fields up to about 64 Hz, which are measured in the time domain. For the static field offset caused by the spacecraft, the goal for the limit is 10 nT at the location of MAG-OBS. For the evaluation of the time-varying emissions in the time domain, several criteria have been established for various band-limited timescales and for two different types of spacecraft emissions. These emissions can be either transients lasting less than 1 s, such as step functions, which should remain below 1 nT, or periodic variations lasting between 1 s and 1/64 s, which should remain below 10 pT.

Measurement in the time domain allows us, in principle, to remove well-known and deterministic signals due to operations of other platform equipment and payload instruments. Therefore, such operations are time-tagged with a precision better than 1 s and reported by telemetry. Examples are the rotational speed of the reaction wheels and the operation of the filter wheels on EUI.

The RPW-SCM measures time-varying fields up to about 1 MHz. The instrument is most sensitive around its two resonance frequencies of about 100 kHz and 3 kHz. At 3 kHz, other emissions are required to remain below −40 dBpT. The sensitivity degrades at lower frequencies, and at 2 Hz it is around +40 dBpT, where there is some overlap with the MAG sensitive frequency range. The verification of emissions from other platform equipment and payload instruments at unit and system level therefore started at 10 Hz.

The sensitivity of these instruments is below the noise floors typically present on the surface of Earth. Placing these instruments on an instrument boom at some distance from other platform equipment and payload instruments allows toleration of emissions up to levels that become verifiable on the ground. This is achieved by measuring at close distances with acceptable signal-to-noise ratio. For the MAG requirements, a dual magnetometer setup was employed, where two measurement magnetometers at different distances to the device under test (DUT) are used to cancel variations of the ambient noise. This was efficient with measurement magnetometers in close vicinity to each other, typically 20 cm, with good alignment of their axes. However, care has to be taken to consider also any field possibly related to the DUT at the more distant measurement magnetometer. The results obtained at close distances to a DUT can then be compared to the sensitivity of the on-board instruments. Assuming a magnetic dipole at the source would give theoretically an inverse cubic distance law for such comparison (Junge & Marliani 2011). However, in practice, an inverse square law appeared to be a better fit with measurement results in the RPW-SCM frequency range. For MAG frequencies, this was relaxed to an inverse power law with an exponent of 2.5. The results of these preliminary experiments were used to further improve the measurement technique for future projects by using eight or more magnetometers around the DUT and separating inner and outer sources of the measured field (Trenkel et al. 2019).

For static magnetic field emissions, equivalent magnetic dipole moments were derived from unit-level test results (Carrubba et al. 2014) that have been shown to generate a similar field as the DUT itself. These individual moments were combined in an extensive magnetic budget. The superposition of the magnetic field due to the various equivalent magnetic dipoles then allowed static magnetic fields around the spacecraft to be predicted, including integration of the magnetic field inside the FoVs of the different particle sensors.

In many cases, DUTs also underwent a demagnetisation procedure. To avoid later changes to their magnetisation, a controlled access zone (CAZ) was maintained around the spacecraft, where magnetic field levels of tools and personnel was monitored (see also under the contamination control section below).

Last but not least, several instruments on Solar Orbiter are located together on a single instrument boom, namely MAG, RPW-SCM, and SWA-EAS. This required verification of the inter-instrument compatibility in a dedicated test campaign. Sufficiently low noise levels on Earth were found only at Physikalische Technische Bundesanstalt (PTB) in their core facility for ‘metrology of ultra-low magnetic fields’ in Berlin. The inner dimensions of the facility were just sufficient to put a representative boom mock-up including harness with models of RPW-SCM, MAGOBS, and SWA-EAS.

The on-ground verification was completed with a system-level test at the IABG test centre in Germany, in their magnetic field simulation facility (MFSA) with unpowered and powered spacecraft focusing on MAG compatibility and in a shielded EMC chamber for RPW-SCM compatibility. The results allowed us to refine analyses and to further constrain the expected emissions in flight. In particular, the applied magnetic shielding on the reaction wheels proved to be more efficient than expected from unit-level tests (Pudney et al. 2016). This served as an important input to consolidate the initial operation planning and to gain confidence in flight performances.

5.2. Electric cleanliness

The three antennas of RPW-ANT are sensitive between about 1 Hz and 20 MHz. Emissions from other platforms, equipment, and payload instruments are in principle required to remain as low as 8.2 dBuV m⁻¹ at 100 Hz. Verification started typically at 10 kHz due to equipment availability at the beginning of qualification tests.

In a dedicated test campaign at Intespace in Toulouse, particular attention was paid to verify inter-instrument compatibility between RPW-ANT and SWA-EAS as both in-situ plasma measurement instruments are supposed to operate in parallel.

At the system-level, from an EMC auto-compatibility test campaign in a dedicated test, data were not only acquired with external antennas and measurement receivers, but also via on-board RPW-ANT pre-amplifiers and MEB using short dummy antennas. However, the data from onboard antennas was evaluated later offline. The residual noise from the ambient environment and setup of the electrical ground support equipment (EGSE) was especially challenging. We found that real-time data assessment and early attention to EMC performance of EGSE equipment could provide potential for future improvements. One of the externally used antennas was RPW-ANT QM, whose performance inside the IABG EMC chamber was measured in a dedicated test to allow traceability to tests of RPW-ANT at unit level. The extensive amount of test results provided valuable information on the shielding performance, which allowed us to reduce the number of expected narrow-band emission lines in flight. With the resulting consolidation of operation planning, this provided confidence in flight performances.

5.3. Electrostatic cleanliness

The RPW and SWA-EAS packages will respectively measure the DC electric field and the bulk properties of the solar wind electrons down to 1 eV with 10% resolution and 10° angular resolution. Both packages will operate during the science nominal phase between 0.28 AU and 0.8 AU. In these conditions and more specifically at the perihelion, of high scientific interest, the spacecraft surfaces will be exposed to large UV fluxes, hot electrons (10−100 eV), and hot solar wind plasma fluxes that are about ten times greater than at 1 A, generating a dense secondary electron and photoelectron cloud which will contaminate low-energy electron measurements.

In addition, because of shielding and spacecraft pointing constraints, a significant part of the spacecraft surface will remain permanently in shadow and ion wake, generating differential charging of surfaces as well as large temperature gradients affecting material conductivity, which will perturb both the surrounding electric field and low-energy electrons trajectories. In order to meet the science requirements of both instruments, fully conductive surface materials were required on the instruments and platform.

Exceptionally, dielectric surfaces had to be accepted, with the condition that electrostatic perturbations (1 V equipotential) remained below one-tenth of the Debye length from the spacecraft surface (1 m) and within an exclusion zone defined by the spacecraft body and geometric blockage of solar arrays. For the latter to be ensured, a thorough modelling of the spacecraft was carried out including a representative plasma environment at perihelion (from Helios data, S. Stverak, priv. comm.) and accurate surface material properties (from experimental characterisation Polsak et al. 2019).

Eventually, even though the utmost care was taken to ensure electrostatic cleanliness, this full spacecraft model including all known sources of perturbations will be necessary in order to remove any spacecraft-induced field in RPW DC measurements as well as to correct the electron moments and retrieve non-perturbed electron distributions from EAS. This model will be a precious tool for enhancing further Solar Orbiter science return for field and particle measurements.

6. Contamination control and purging

A critical aspect in ensuring the expected performance of the scientific instruments on board Solar Orbiter is to safeguard them, both on-ground and in orbit, from the potentially detrimental effects of contamination and humidity. Many of the scientific instruments on board Solar Orbiter are sensitive to molecular contamination, for example due to transmission losses of optical surfaces or impact on surface temperatures caused by changes in thermo-optical properties, and particulate contamination, as it may cause for example stray light in optical systems. A dedicated contamination control programme was therefore implemented throughout all phases of development. A Solar Orbiter contamination-control committee, consisting of Airbus, ESA and instrument cleanliness experts, was set up to provide dedicated advice on contamination control topics.

Particle fall out (PFO) and molecular organic contamination (MOC) monitoring were implemented together with regular inspections during all AIT phases up to a few days prior to launch. Cleaning of external surfaces was performed on a regular basis to limit the built up of particle contamination levels. In addition to the individual covers for most spacecraft external instruments, dedicated heat shield covers were developed to protect the heat shield from particle fall out, as this was the top facing surface during most of the AIT flow. The spacecraft was also covered with antistatic foils whenever activities allowed. The Metis and SoloHi instruments are highly sensitive to particle contamination due to their stringent stray light requirements and are protected by a flight cap and door system respectively, which, besides a final functional verification check on the ground, will only be opened in flight.

All AIT activities on the Solar Orbiter spacecraft, from its assembly through to the environmental testing campaign, took place in an ISO8 environment. For the majority of the final preparation activities at the launch site, the spacecraft was kept in an ISO7 laminar flow environment to ensure the highest level of surface cleanliness prior to launch. Final spacecraft particle tape lift and molecular contamination wipe sampling were performed a few days before launch, with the spacecraft inside the launcher fairing and installed on top of the Atlas V launch vehicle. The final spacecraft external particle obscuration levels before flight were below 156 ppm and the final MOC levels below 70 ng cm⁻² and therefore fully within the requirements of < 300 ppm and < 1000 ng cm⁻² respectively.

The main mechanism of in-flight MOC is the outgassing of organic molecules from non-metallic materials and subsequent condensation on other, especially colder surfaces. An extensive regime of flight hardware bake outs, monitored with quartz crystal micro-balances (QCMs), was applied to the Solar Orbiter flight hardware to significantly reduce the outgassing potential of organic materials, in addition to selecting materials compliant with outgassing limits defined in ECSS-Q-ST-70-02C. The QCM determines the quantity of deposited outgassing compounds by registering the change in the natural frequency of its exposed crystal surface due to the mass increase. As organic materials generally have a relatively high outgassing rate at the start of the bake out that tails off as the bake out duration increases, the mass deposition rate on a isothermal QCM was used to confirm when a linear outgassing rate had been reached (as from that point, extending the bake out duration would have minimal added benefit).

An in-flight MOC prediction was performed using the SYSTEMA-outgassing software tool to estimate the end-of-life contamination depositions on MOC-sensitive spacecraft and instrument surfaces. SYSTEMA models the fluxes of outgassing products by Monte Carlo ray-tracing and the evolution of contaminant deposition on surfaces (in ng cm⁻²) using a residence-time-based emission and re-emission model.

6.1. Controlling contamination during the thermal vacuum test

As the in-flight MOC prediction showed a peak of outgassing products during the first days after launch, the Solar Orbiter thermal vacuum test (TVAC) was considered to pose a significant molecular contamination risk, especially during warm up of the cryogenic shroud after the test. It was therefore decided to monitor the MOC deposition levels inside the thermal vacuum chamber in real time using a temperature-controlled QCM, a thermally passive QCM, and a residual gas analyser (mass spectrometer). The thermally passive QCM was directly facing the spacecraft and, with its temperature being representative of the spacecraft external surface temperature, it provided a good real-time indication of the MOC levels on the spacecraft external surfaces throughout TVAC. The thermally controlled QCM was kept at −75°C to avoid condensation of the most volatile contaminants. A thermogravimetric analysis (TGA) was performed on the thermally controlled QCM after each hot test phase by slowly heating the crystal (1°C min⁻¹). This process provides insight into the deposited contaminants, and re-evaporation peaks as a function of temperature can be observed. Although the outgassing rates during TVAC were more benign than predicted by the in-flight MOC model, they were still considered significant with an estimated average of 18−20 mg h⁻¹. A MOC release phase was performed at the end of the test to evaporate the majority of contaminants captured by the cryogenic shrouds in a controlled way and reduce residual MOC levels on spacecraft surfaces. The MOC release phase consisted of a 36 h warm up and dwell at 20°C of the cryogenic shrouds, as the TGAs had indicated the vast majority of the contaminants would evaporate below that temperature while still in high vacuum. While the thermally passive QCM indicated MOC build up on spacecraft external surfaces above 1 μg cm⁻² prior to the MOC release phase, the MOC witness plates analysed by Fourier transfer infrared spectroscopy after TVAC showed MOC levels of 70−80 ng cm⁻² confirming the successful execution of the MOC release phase (see Fig. 18).

Fig. 18. Spacecraft thermal vacuum test QCM temperature and frequency data.

6.2. Nitrogen purging

A nitrogen gas purge system was implemented on the spacecraft to protect eight of Solar Orbiter’s ten instruments against contamination and humidity resulting from ingress of environmental air from the moment of instrument integration up to the disconnect just after lift-off. The purge system consisted of a purge cart supplying high-purity nitrogen, connected to one of three spacecraft purge inlets, and titanium manifold inside the spacecraft, which distributed the purge gas to the various instrument inlets (Fig. 19). Orifices inside the manifold immediately upstream of the instrument inlets were sized such that by applying an overpressure between 150 and 250 mbar at the spacecraft purge inlets, each instrument would be provided with its required purge gas flow rate. The total average gas volume purged through all instruments combined was approximately 400 L h⁻¹.

Fig. 19. Solar Orbiter purge system schematic (courtesy of Airbus).

The stringent requirements on maximum purge outage durations, purge outage recovery times, and maximum allowable pressure variations required detailed planning of integration and testing sequences, in particular when transitions between different spacecraft purge inlets were involved. The driver for the maximum pressure variation across an instrument was the extremely thin foils inside the EUI instrument, requiring any pressure transient to remain below 30 mbar min⁻¹. Dedicated tests and analyses of the pressure response of the purge cart were performed to confirm the pressure variation requirement would not be breached at cabin depressurisation and re-pressurisation during air transport to the launch site.

The maximum allowable purge outage duration was 30 min during the majority of the integration, test, and launch campaign phases. After removal of the instrument red tag covers prior to spacecraft encapsulation under the launcher fairing, a zero purge outage requirement became applicable for the SWA instrument if no temporary bagging was in place. As the final flight purge configuration after installation to the launcher included a short purge outage, dedicated temporary covers were installed on the three SWA instrument sensors prior to fairing encapsulation and were removed through mission unique openings in the fairing after flight purge installation on the launcher.

7. Summary

After the successful three-month launch campaign at Cape Canaveral, in excellent cooperation with NASA who provide the launch operations facilities and services, the Solar Orbiter spacecraft was successfully launched on 10 February 2020 at 4:03 UTC. The commissioning phase successfully concluded with the ESA mission commissioning results review in June 2020. The ESA project team handed over the mission to the mission control team at that point, to start the scientific operations and reap the benefits for many years to come.

Acknowledgments

Solar Orbiter is a space mission of international collaboration between ESA and NASA, with instruments being provided by national agencies of ESA member states, ESA and NASA. The spacecraft has been developed by Airbus, leading a large group of European companies from most ESA member states. Over the nine-year development, thousands of people have contributed to the reading of the mission for its launch and early operations. Solar Orbiter is being operated by ESA from the European Space Operations Centre (ESOC) in Darmstadt, Germany. Science operations are carried out at ESA’s European Space Astronomy Centre (ESAC) in Villafranca del Castillo, Spain.

References

All Tables

All Figures

	Fig. 1. Atlas V 411 Launch Vehicle.
In the text

	Fig. 2. Ground track following injection.
In the text

	Fig. 3. Evolution of latitude and distance to the Sun during the entire mission.
In the text

	Fig. 4. Solar Orbiter spacecraft and instruments.
In the text

	Fig. 5. Three remote-sensing windows of the NMP.
In the text

	Fig. 6. Typical alignment LOS and ALOS definitions.
In the text

	Fig. 7. MY payload panel instruments. From left to right: PHI (Solanki et al. 2020), Metis (Antonucci et al. 2020), EUI (Rochus et al. 2020), STIX (X-ray spectrometer/telescope Krucker et al. 2020), and SPICE (SPICE Consortium 2020). We note that SPICE resides on a separate Pz panel.
In the text

	Fig. 8. Thermal distortion at 0.28 AU. Upper panel: thermal map. Lower panels: distortion.
In the text

	Fig. 9. Photogrammetric displacement measurement. Measurement on the STM spacecraft for the MY payload panel.
In the text

	Fig. 10. Field of view overlap for high-resolution instruments: PHI, EUI, SPICE, and Metis. Top panel: zero distortion, bottom panel: system budgets applied from 0.28 AU assessment.
In the text

	Fig. 11. Solar orbiter heat shield. We note the doors in front of the heat-shield feedthrough apertures, and the SWA-PAS and SWA-HIS feedthroughs indicated by a red arrow.
In the text

	Fig. 12. View from underneath the heat shield, showing the “Star brackets”.
In the text

	Fig. 13. Stood-off radiator assemblies.
In the text

	Fig. 14. Solar Orbiter communication antennas.
In the text

	Fig. 15. Telemetry data rate variability vs. spacecraft distance from the Earth.
In the text

	Fig. 16. MGA Earth Strobing Motion.
In the text

	Fig. 17. Solar Orbiter HGA manufacturing (photos courtesy Afflerbach GmbH and Sener).
In the text

	Fig. 18. Spacecraft thermal vacuum test QCM temperature and frequency data.
In the text

	Fig. 19. Solar Orbiter purge system schematic (courtesy of Airbus).
In the text