Autonomous Attitude Determination andControl System for the Ørsted Satellite�

1996 IEEE Aerospace Application Conference. Colorado February 4-11 1996.

Thomas Bak, Rafał Wisniewski, Mogens BlankeDepartment of Control Engineering

Aalborg UniversityDK-9220 Aalborg Ø, Denmarkftb,raf,blankeg@control.auc.dk

Abstract — The Ørsted satellite mission imposescomparatively high requirements on autonomy ofthe attitude control system. Cost requirements, onthe other hand, impose simple hardware and cheapactuators in form of magnetorquer coils. These con-flicting requirements are fulfilled through develop-ment of novel attitude and control algorithms andwide on-board autonomy. The entire control and at-titude determination system has the ability to recon-figure in real time, based on mission phase and con-tingency operation requirements.

Attitude determination embraces three differentstrategies, dependent on the availability of atti-tude sensors. Possible sensor faults are detectedand a control system supervisor autonomouslyreconfigures attitude determination.

Estimated satellite attitude and angular velocity areused in the attitude controller. Control tasks varywith the mission phase. Initially, after release fromthe launch vehicle, the angular velocity is con-trolled. In subsequent mission phases, the satelliteis three-axis stabilized.

The main contributions are development of novelalgorithms for attitude control applying magnetictorquing, attitude determination schemes based onthe geomagnetic field measurements, and integra-tion into a supervisory control architecture. Thesalient feature of this system is fault tolerant au-tonomous operation with a minimum of hardwareredundancy.�Work supported by the Ørsted Satellite Project.

1 INTRODUCTION

The Ørsted satellite is scheduled to be launched by aDelta II launch vehicle in March 1997 into a 450 �850 km orbit with a 96 degree inclination. Ørsted, a60 kg auxiliary payload, is the first Danish satellite,developed by a consortium of Danish research insti-tutes and space industries. The two primary scienceobjectives of the mission are to measure the main ge-omagnetic field and study its interaction with the so-lar wind plasma.

Low-cost launch opportunities and technologicaladvancements make small satellites interesting fordoing space experiments within an affordable costand schedule envelope.

Motivated by cost and schedule only one ground sta-tion is planned for the Ørsted mission and with a po-lar orbit ground contact is limited. Functionality tra-ditionally implemented on ground stations thereforehas to be transfered to the space segment.

Another design constraint has been imposed by theuse of cost-effective simple sensors, actuators anda low level of hardware redundancy on the satelliteplatform.

Previous solutions to similar attitude determinationand control problems [8, 10] have focused on theproblems separately, and have not considered auton-omy.

This paper discusses a combined attitude determina-tion and control system design. New fault-tolerantcontrol and estimation strategies are applied and in-tegrated with a control supervisor providing an au-

Star ImagerCSC Magnetometer

Scalar magnetometer

MagnetorquersCharged particle detectorSolar panelsSun sensorGPS receiverOn board computersElectronics

6m

2m

Figure 1: The Ørsted satellite in the configurationwith boom deployed.

tonomous control system.

Attitude determination is based on a gyro-less con-figuration with a star imager as the primary instru-ment. Fault tolerance is obtained, though attitudedetermination based on high precision magnetome-ter and coarse sun sensor measurements that arecombined in a filter.

Active detumbling and three-axis stabilization ofthe satellite are achieved using magnetorquers. Theinherent nonlinear nature of the magnetic controlproblem is overcome using new nonlinear controlalgorithms.

2 ACS OVERALL SYSTEM DESIGN

Cost, weight and simplicity are key factors in the de-sign of a small satellite mission. This has led to aconfiguration of the Attitude Control System (ACS)with a limited number of sensors, simple actuatorsand an emphasis on control system autonomy.

Autonomy

A philosophy for the development of fault-tolerantcontol has been adopted in the design of the Ørstedsatellite ACS [2]. Autonomy is achieved throughdevelopment of attitude determination and controlalgorithms that are reconfigurable in real time. Thismakes it possible to accommodate changed missionphases, faults, and contingencies. An on-board su-pervisor [3] monitors the spacecraft status and re-configures ACS algorithms accordingly, to optimizethe performance of the system.

All on-board autonomous transitions can becontrolled through up-linked time-tagged telecom-mands. Further operational flexibility is providedby allowing adjustments of flight software byupload as a last resort.

Operational Modes

Satellite operational modes with boom deploymentstatus as the most significant, lead to a high level di-vision of the ACS operation, as summarized in Ta-ble 1.

Table 1: Overall modes of operation

Mode CharacteristicsRatedetumbling

Released from launcher, kinetic en-ergy is dumped and the satellite is sta-bilized relative to the local geomag-netic field. Attitude rate is obtainedfrom the magnetometer.

Angledetumbling

The satellite is three-axis stabilized,zenith pointing and prepared forboom deployment. Attitude is ob-tained from the magnetometer and thesun sensor.

Scienceobservation

After boom deployment the satelliteis three-axis stabilized, zenith point-ing with yaw reference. The mag-netic contamination of science instru-ments is minimized. Attitude is ob-tained from the star imager, the mag-netometer, and the sun sensor.

Invertedboom

The satellite attitude is acquired froman attitude with the boom pointingtowards Earth. Attitude is obtainedfrom the magnetometer and the sunsensor.

Most important attitude and rate requirements areassociated with the science observation mode. Inthis mode the requirements on attitude determina-tion is 2 deg (RMS) in pitch, roll and 4 deg (RMS)in yaw. The error in rate estimates should be be-low 0.01 deg/minute (RMS). The ACS is requiredto maintain the satellite attitude with an accuracy of10 deg (RMS) in pitch/roll and 20 deg (RMS) rela-tive to a given yaw set-point. The angular velocityis required below 10 deg/minute (RMS).

ACS Architecture

ACS operational modes are reflected in the chosenarchitecture as illustrated in Figure 2.

Attitudedetermination

Attitudecontrol

Partial hardware redundancy

Secondaryoperation

Magneto-meter

Sunsensor

Starimager

Rateestimation

Normaloperation

Ratedetumbling

Angledetumbling

Scienceobservation

Invertedboom

GPSreceiver

Magne-torquers

Figure 2: ACS system architecture. Shaded area in-dicates software modules.

A concept for attitude control has been proposedbased on magnetorquers as the only active torquesource. The attitude control algorithms rely on atti-tude (quaternion) and angular velocity information.This information is provided by attitude determina-tion based on a combination of available sensor in-puts.

Attitude Sensors

Four basic sensors are available for attitude determi-nation.

Magnetometer — The magnetic field is measuredwith an accuracy of 1.5 nT (RMS) using a three-axis Compact Spherical Coil (CSC) fluxgate magne-tometer [11]. The magnetometer is situated on theboom six meters from the satellite main body. Be-fore boom deployment the magnetometer is homedinside the satellite main body. Saturation in the mag-netometer is avoided by careful design of the controlcycle.

Star Imager (SIM) — Satellite attitude estimates areprovided by a Charged Coupled Device (CCD) cam-era system [9], with an angular resolution of 20arc seconds. Attitude information is only availablewhen:� Satellite attitude is within the operational cone

for the SIM.� Angular velocity is less than 10 deg/minute.� Boom is deployed.

Global PositioningSystem (GPS) Receiver — Time,local position and velocity estimates are obtainedfrom a GPS receiver. Position estimates are pro-vided with an accuracy of 100 m (2 dRMS) and ve-locity with 0.2 m/s (RMS).

Sun sensor — The sun incident angles are obtainedfrom detector units mounted on the surface of thesatellite, keeping antennas and mechanisms out ofthe field of view. The sun incident angle is de-tectable in a range �89.0 deg by each detector. Theset of sensors hence provide near 4� steradian cov-erage.

The magnetometer, SIM, and GPS receiver are usedfor science objectives while the sun sensor has beenadded solely for attitude determination purposes.

Actuators

Magnetic torquing is achieved using three perpen-dicular sets of redundant electromagnetic air coredcoils. The coils are mounted on the x, y and zfacets of the satellite main body. A maximum dipolestrength of 20 Am2 has been chosen. The magnetor-quer coils are integrated into the spacecraft structureoptimizing the coil cross-sectional area and the mo-

ment to mass ratio.

Implementation

The flight software has been implemented as an em-bedded real-time system on an Intel 80C186 basedhardware platform using the Ada language. An ACSelectronics box controls ACS sensors and actuators.

The on-board ACS software has been designed us-ing a Hard Real Time - Hierarchical Object Oriented(HRT-HOOD) design method [4, 7] to ensure maxi-mum reliability and robustness of the software.

3 DESIGN FOR AUTONOMY AND FAULT

TOLERANCE

The overall philosophy for dependability of theØrsted satellite was:� The satellite is not required to be failsafe.� Performance degradation can be tolerated as

the consequence of a fault.� Hardware redundancy can only be accepted forvery few key components.

A systematic technique for fault handling design hasbeen employed. The design strategy has been thatsimple faults should be accommodated to the extentpossible, and should not lead to failure at a missionlevel.

Design of attitude determination and control hasbeen done with careful consideration to fault scenar-ios. Starting with an analysis of failure modes andeffects analysis (FMEA), fault effects were catego-rized according to their criticality, and remedy ac-tions planned for each mission critical fault in theACS.

The result was a specification of the set of faultswhich should be detected and accommodated bythe attitude control system and a specification ofthe necessary interface between the ACS and on-board satellite supervisor. The result has also beena design process where requirements to operationalmodes and fault accommodation were considered asan entirety, to give a solid basis for an integrated de-sign. Implementation has been made as a three layermodel [3]:

� ACS supervisor with state event logics to de-scribe operational mode.� Fault condition layer with detectors and effec-tors for, e.g., reconfiguration or other remedyactions.� ACS layer with sensor validity check, attitudedetermination, attitude control, and actuatorcommand modules.

Resistance against faults are obtained at both a com-ponent level and at the subsystem level within theACS. The analysis identified one of the missionthreats as a fault the drive electronics to a magne-torquer coil. The result could be maximum current,zero current or even reverse sign current (due to theparticular electronics design). This would lead totumbling of the satellite - and possibly to an invertedboom condition – with temporary loss of high ca-pacity radio link to ground. As a consequence ofthe FMEA and an assessment of possible remedy ac-tions, it was decided to duplicate coil drivers and tosplit each coil in two parallel sections (no penalty inweight or power).

Part of the fault handling is dedicated the dupli-cate components. Faults in these components aremainly dealt with at a component level. Faultsin non-duplicated sensors are detected using ana-lytic redundancy methods based on different sen-sors. One example is on-line test of SIM measure-ments against estimated attitude from magnetome-ter and sun sensor data. Performance of critical soft-ware algorithms is also supervised by dedicated de-tectors. As an example attitude control is only al-lowed to use an attitude estimate from the secondaryattitude determination when the residual is withinaccepted limits in mean and standard deviation.

Fault handling at the attitude control system level re-quires a combined design of attitude determinationand control. Faults at this level are unavailabilityof primary sensors or actuators. Accommodation offaults at this level will usually require reconfigura-tion in both attitude determination and control. Theresult of the analysis has been the operational modespreviously described in Table 1.

The design of attitude control and determination isdetailed below.

4 ATTITUDE CONTROL

The interaction between the Earth’s magnetic fieldand the magnetic moment generated by magnetor-quer coils constitutes the actuation principle. Thecontrol action is inherently nonlinear and difficult touse since the control torque can only be generatedperpendicular to the geomagnetic field vector. Thishas been a serious obstacle for using magnetorquerbased control.

Dependent on the mission phase four separate atti-tude controllers have been developed� The rate detumbling controller.� The angle detumbling controller.� The science observation controller.� The inverted boom controller.

Rate Detumbling Control

The objective of the rate detumbling controller is togenerate a magnetic moment, such that the kineticenergy of the satellite is dissipated and it is turnedin the direction of the local geomagnetic field vector.The influence of the gravity gradient on the satellitein a boom stowed configuration is negligible.

The kinetic energy, Ek, of the rotary motion is:Ek = 12Tcw I cw; (1)

where cw is the satellite angular velocity with re-spect to an inertial coordinate system, I is the inertiatensor.

Lyapunov theory has been applied in [14] to provethat Ek is dissipated if the following control law isimplemented: m = �k _B; (2)

wherem is the magnetic moment,B is the local ge-omagnetic field vector, and k is a positive constant(control gain).

This controller does not ensure directional control,however. To establish radio contact with the groundstation in Denmark, a modified control principle hasbeen proposed. The rate detumbling controller is al-tered such that the z-principal axis (in boom direc-tion) of the satellite tracks the inverse direction of

the geomagnetic field. This is achieved by adding aconstant term to the control law in Eq. (2):m = �k _B�mconst; (3)

where mconst = [0 0 mconst]T . Now the satelliteacts like a compass needle which tends to align withthe local geomagnetic field, while adequate angularvelocity damping is retained.

The algorithm for the rate detumbling controller hasbeen verified by simulations. The control coeffi-cients, that is the gain, k, and the bias magnetic mo-ment, mconst was found empirically. The best per-formance was reached for k = 5 � 106 Am2s/T andmconst = �3 Am2. Figure 3 shows simulation re-sults for initial values of the satellite angular veloc-itycw(t0) = [0:10 0:10 0:09]T rad/s.

cWcwxcWcwycWcwz

0 1000 2000 3000 4000 5000 6000-0.2

-0.1

0

0.1

0.2

time [sec]

Satellite anqular velocity w.r.t. World CS (one orbit simulation) [rad/sec]

0 2000 4000 6000 8000 10000 12000 14000 16000 180000

50

100

150

200

time [sec]

Inclination between z-principal axis and local B-field (3 orbits simulation) [deg]

Figure 3: Rate detumbling simulation. Satellitetracks the inverse geomagnetic field.

The first plot depicts the satellite velocity withrespect to the inertial coordinate system. Afterthe first orbit the angular velocity is decreased to[0:0006 0:0033 0:0001]T rad/s. The second plotshows the time history of satellite attitude. Thesatellite tracks the inverse direction of the geomag-netic field. The inclination angle between the z-principal axis and the local geomagnetic field is in-fluenced by the increased of the geomagnetic fieldrate over equator. This phenomena is depicted bypeaks of the inclination angle at 6300 s, 9300 s,12300 s, 15300 s.

Angle Detumbling Control

A sliding mode controller is implemented for theØrsted satellite during angle detumbling. Nonlinearcontrol methods are applied, since the motion of atumbling satellite cannot be considered as rotation inthe neighbourhood of a reference. The satellite an-gular velocity with respect to the local orbit coordi-nate system, co, and the vector component of theattitude quaternion, coqy, are used by the controller.The objective is to three-axis stabilize the satellite inthe local orbit coordinate system. The final attitudeis such that the z-principal axis points at zenith (ie.boom points away from the Earth).

The design strategy consists of two steps: slidingmanifold choice and sliding condition design (see[15]). The sliding manifold is a 5th dimensionalplane, S, in 6th dimensional space.S = fcoq;co : s = 0gs = I co +�qcoq; (4)

where �q is a positive definite matrix (a design pa-rameter). The choice of the sliding manifold is suchthat the satellite is stable on it. In other words thesatellite attitude and velocity converge to the desiredvalues if the satellite motion is constrained to lie onthe sliding manifold.

The problem in hand is to find the magnetic moment,m, such that the satellite trajectory converges to thesliding manifold, plane S. This approach is calledsliding condition design and leads to the control lawrepresenting the cross product between the local ge-omagnetic field vector and the sliding variable, s,defined in Eq. (4):m = (�s s)� cBjcBj ; (5)

where �s is a controller gain matrix.

The controller parameters have been found empiri-cally: �s = 3 � 106 E�, and �q = 2 � 10�3 E. Thematrices�q and�s have been selected as a tradeoffbetween robust properties of the system and accu-racy of convergence.yA quaternion, �q, consists of the vector and the scalarpart �q = [qT q4]T :�E is the 3x3 identity matrix

The angle detumbling controller has been evaluatedby simulation for various values of initial attitudeand velocity. Figure 4 illustrates the results for theangle detumbling. The 24h time history of pitch, rolland yaw (fixed Euler angles) is presented in plot a).The region from 4 to 9 orbits was chosen to illus-trate the steady state performance in plots b) to d).It is concluded that the Euler angles converge to thereference within the specified range of�10 deg after3 orbits. The pitch convergence error of 2 deg am-plitude is due to influence of the orbit eccentricity,in other words periodic variation of the orbital ve-locity. The coupling between pitch and roll, yaw in-troduces certain perturbations of roll, yaw from thereference. The yaw error can be as large as 4 deg,see plot d), in the intervals when the x-componentof the the geomagnetic field is largest.

pitch

roll

yaw

4 6 8−4

−2

0

2

4b) pitch [deg]

orbits4 6 8

−4

−2

0

2

4c) roll [deg]

orbits4 6 8

−5

0

5

d) yaw [deg]

orbits

0 1 2 3 4 5 6 7 8 9 10

−150

−100

−50

0

50

100

150

orbits

a) pitch, roll, yaw [deg]

Figure 4: Angle detumbling simulation. Conver-gence within required�10 deg is reached after 3 or-bits.

Science Observation Control

The aim of the science observation control is toprovide three-axis stabilization of the satellite afterboom deployment. Design of the science observa-tion controller is based on a linear approach since thesatellite trajectory remains in a neighbourhood of areference, due to the influence of the conservativeforces of the gravity gradient and the gyro-effect ow-ing to the rotation of the satellite around the Earth.

The observation that the geomagnetic field in a near

polar orbit is approximately periodic with periodT = 2�=!o (!o is the orbital rate) can be used inthe design of a constant gain controller.

The linearized equations of motion are symbolicallygiven by (for more details see [14]):ddt " ��q # = A " ��q # +B(t)� ; (6)

where A, B(t) are the system and the control ma-trices, �, �q are respectively the angular velocityand the attitude deviation from the reference, and �is the desired control torque. The correspondancebetween the desired control torque and the magneticmoment, m, is given by:m = � � cBjcBj : (7)

The method consists of finding time invariant coun-terpart of the system in Eq. (6). This is done by av-eraging of components of the matrix B(t) over oneorbit (see [10]):B = 1T Z To B(t)dt: (8)

Now, standard linear control methods may be ap-plied for finding controller gain. Linear quadraticoptimal (LQ) controller is implemented for the sci-ence observation mode. Weighting matricesQc, forstate, andRc, for control, have been chosen so thatthe closed loop time constants of the Ørsted satellitemotion are slow compared with the orbital period.In this way the average model in Eq. 8 is not vio-lated. Q = "8 � 106E 00 30E# ; R = 2:5EInverted Boom Control

The inverted boom controller is activated when thesatellite boom is detected to point towards earth. Po-sitions with the boom either up or down are naturallystable equilibria of the satellite motion. The objec-tive of the inverted boom controller is to make theboom upside-down equilibrium unstable.

The control gain implemented in the science obser-vation controller is too small to turn the satellite to

the upright position. Therefore, the controller gainis increased by a factor of k = k0. If the boom isdetected to be upright, the coefficient k is exponen-tially decreased to k = 1. This simple procedure hasbeen proven to be globally stable [13].

In addition to theoretical analysis, simulation testshave been carried out. Results for the inverted boomcontrol and the science observation control are de-picted in Figures 5 and 6. It is shown that the satel-lite is retrieved from the upside down equilibriumin plot a) of Figure 5. It is shown that the satellitetrajectory is within required operational envelope.Difficulties with yaw control are due to small mo-ments of inertia about the z-pricipal axis comparingwith moments of inertia about the x- and the y- axes.Slight corrections of pitch and roll introduce a largedeviation of yaw. The time history of the factor k isshown in Figure 6, k converges to 1 and the scienceobservation control takes over.

pitch

roll

yaw

0 1 2 3 4 5 6 7 8 9

−150

−100

−50

0

50

100

150

orbits

a) pitch, roll, yaw [deg]

10 12 14−4

−2

0

2

4b) pitch [deg]

orbits10 12 14

−4

−2

0

2

4c) roll [deg]

orbits10 12 14

−15

−10

−5

0

5

10

15d) yaw [deg]

orbits

Figure 5: Simulation of inverted boom and scienceobservation control. After only 4 orbits satellite tra-jectory is within required operational envelope.

5 ATTITUDE DETERMINATION

The objective of attitude determination is to produceestimates of the satellite angular rate and attitude forthe control laws described previously.

The on-board attitude determination process in-cludes generation of� Satellite position vector.

0 2 4 6 8 10 12 141

1.5

2

2.5

3

orbits

fact

or k

Inverted Boom Control Science Observation Control

Figure 6: Factor k converges from k0 = 3 forinverted boom control to 1 for science observationcontrol.� Local Sun line vector.� Local geomagnetic field vector.� Attitude estimate state vector.

To encompass all mission phases three different atti-tude determination schemes have been implemented� Rate estimation.� Normal operation state estimation.� Secondary operation state estimation.

The result is an attitude determination concept as il-lustrated in Figure 7.

Magnetometer

GPS receiver Orbit model

Sun sensor

Sun model Field model

Star imagerNormal

operation

Secondaryoperation

Rateestimation

Magnetic fieldmeasurement

Position, velocitymeasurement

Compute satelliteorbit position

Sun positionmeasurement

Compute localsun line vector

Compute localgeomagnetic field

vector

Inertial attitudemeasurement

Comp. angularvelocity, attitude

Compute angularvelocity, attitude

Comp. B-fieldderivative

Figure 7: Attitude determination conceptual dia-gram.

Should a temporary (or permanent) loss of a sen-

sor occur, attitude determination is autonomouslyreconfigured. In case of a SIM problem a magne-tometer, sun sensor combination is used for attitudedetermination.

On-Board Models

Orbit Propagation Model — GPS fault tolerance isachieved using a modified Kepler orbit model. Per-tubations due to the J2 potential of the Earth’s grav-itational field and aerodynamics drag are included.The model is dynamically updated from GPS re-ceiver samples of position and velocity (nominallyevery 60 seconds).

Over a period of 10 orbits without GPS data themodel maintains sufficient accuracy (< 25 km po-sition error) for attitude determination. Update ofmodel parameters from ground is possible to accom-modate possible GPS failure.

Reference Field Model — The geomagnetic field inthe local orbit coordinates is computed as a func-tion of the estimated position. An 8th-degree modelbased on Goddard coefficients updated to epoch1996y is used.

Sun line Model — A simple Kepler model is used indescribing the Earth orbit motion. From the Earthposition the Sun vector in the local orbit coordinatesis derived.

Rate Estimation

The rate detumbling control law is based on thederivative of the magnetic field, _B. From magne-tometer readings it is a simple matter to synthesizefield rates using a filter as described in [1].

Magnetometer failure makes attitude stabilizationimpossible as the magnetometer is the only attitudesource in this phase. This is, however, acceptable asa magnetometer failure cause a loss of the sciencemission anyway.yProvided by T. Risbo, Copenhagen University andR.A. Langel NASA Goddard Spaceflight Center.

Normal Operation

The SIM attitude quaternion, �qsim, is computedfrom star observations and is hence given relative toinertial coordinates.

Composed with an inertial-to-orbit quaternion fromthe orbit model the SIM attitude is rotated to the lo-cal orbit coordinates. The angular velocity (cw) iseasily found through composition of the SIM atti-tude quaternion and its derivative:"cw0 # = 2d�qsimdt �q�sim ; (9)

where � indicates the quaternion conjugate, and isthe quaternion product as defined in [8].

During angle detumbling and when SIM is out of op-eration, secondary operation attitude determinationis used.

Secondary Operation

The magnetometer and sun sensor are the only avail-able attitude sensors in this attitude determinationmode. Eclipse periods and sun sensor failure callsfor an algorithm capable of estimating attitude andangular velocity based on magnetometer measure-ments only.

One single magnetometer measurement providesonly two-axes attitude information and a sequenceof measurements therefore has to be used in a re-cursive filter. Since the relationship between vectormeasurements and the quaternion is non-linear, anextended Kalman filter (EKF) has been employed.Similar problems have been treated in [8, 12].

A traditional discrete/continuous filter structure hasbeen adopted with an alternating state/covariancepropagation and measurement update.

State/Covariance Propagation — The state propa-gation part of the EKF is based on the nonlineardynamic/kinematic equations for the gravity gradi-ent stabilized rigid spacecraft. As no rate gyros areavailable, the angular velocity needs to be propa-gated via integration of the dynamic equations, andthe spacecraft state therefore includes the angularrates. For simplicity, no error source modeling has

been augmented to the state vector, and the 7th ordersuboptimal filter is therefore based on the followingestimation state vector:x = " co �qcw# : (10)

The unity norm constraints on the quaternion resultsin singularity of the estimation error covariance ma-trix,P. The singularity is avoided assuming that thetrue quaternion co�q is expressed as the product of theestimated quaternion and the quaternion estimationerror: co�q = co��q co �q : (11)

Most likely ��q corresponds to small rotations and�q4 �= 1. The interest is hence in the three vec-tor components (�q) of the quaternion. The resultis a six-dimensional non-redundant estimation errorvector: �x = " co�q�cw# : (12)

Using Eq. (12) the 6�6 P can be propagated in theusual discrete time form [6].

Measurement Update — Both magnetometer andsun sensor measurements z are modeled accordingto the following equation:z = T A(co �q�) oM ; (13)

whereT is a misalignment matrix, oM is the modelvectors in local orbit coordinates, and A(co�q�) is anattitude matrix based on the time updated attitude es-timate co �q�.

The innovation �, is formed as the vector differencebetween z and the actual measurement. The sensormeasurements are assumed to be scalar and uncor-related.

Based on the multiplicative approach in Eq. (11)the linearized measurement model is found and theKalman gain (K) calculations, covariance and angu-lar velocity updates follow typical EKF algorithms.The quaternion update follows�q+ = � �q+ �q� ; (14)

where � �q+ is the renormalizedz quaternion obtainedfrom �x+ = " �q+�cw# = K� : (15)

The quaternion �q+ is used by the attitude controller.

The update in Eqs. (14) and (15) preserves quater-nion normalization and obeys quaternion algebra.

Filter Setup — In the current EKF design zero meanGaussian process and measurement noise is as-sumed. Based on a disturbance error analysis theprocess noise covariance was chosen as given be-low: QD = "Qquat 00 Qrate# (16)= "10�3E 00 10�6E# (17)

The magnetometer measurement noise is dominatedby field model errors while the Earth albedo andFOV limitations determine the Sun sensor measure-ment covariance:RD = "RSun 00 RMagn# (18)= "10�3E 00 1:2 10�9E# (19)

Note that the albedo is clearly not Gaussian, but tokeep the filter order low an assumed Gaussian dis-tribution is used.

The initial state estimate was set equal to the nom-inal nadir pointing attitude and the error covarianceto a large value.

The core in the EKF is an accurate dynamic model ofthe satellite. Moments of inertia are calibrated priorto launch with an accuracy of 0.5 % (3 sigma). Themajor disturbance is the aerodynamics disturbancetorque with a maximum of 1:2 10�3 Nm.

The lattice boom structure is inherently stiff. Tor-sional stiffness is high enough to ensure a rotationzSetting q4 = 1 and dividing the resultant quater-nion components by the square root of the sum of theirsquares.

of maximum 1 deg while bending effects are negli-gible.

Simulation

Truth Model — A truth model was used to generatesimulated sensor and attitude data. The truth modelincludes� Orbital dynamics.� Satellite dynamics.� Jacchia-Roberts atmospheric modeling.� 13th-degree geomagnetic field (Goddard coef-

ficients).� Random sensor noise and biases.� Sensor misalignment.

The modeling thereby provide relevant disturbancetorques and significant random as well as systematicerrors.

The effect of all modeled error sources was inves-tigated by comparing truth model quantities to thecorresponding estimates generated by the filter.

Results — An important feature of the attitude de-termination is the ability to estimate attitude basedon magnetometer and sun sensor data in case of SIMfailure. An interesting example is show in Figure 8.

Initial satellite attitude is offset 40 deg in pitch, rolland yaw. The filter converges based on magnetome-ter data, while final stabilization is achived in thesun-lit part of the orbit where sun sensor data isavailable (see plot a)). Having stabilized on an atti-tude estimate the standard deviation of the filter re-mains below 1.8 deg even during eclipse.

Other simulations and Monte-Carlo analysis showthat the secondary attitude determination is effec-tive, yielding accuracies of 2.0 deg (RMS) in atti-tude and 0.01 deg/s (RMS) in the angular velocity.The preciscion of the SIM based attitude determina-tion is dominated by the orbit model incaccuracies.The result is an attitude accuracy of 0.4 deg (RMS)and 0.001 deg/s.

The fault tolerance obtained by the combination ofSIM, magnetometer, and sun sensor based attitude

pitch

roll

yaw

2 2.5 3−2

−1

0

1

2b) pitch [deg]

orbits2 2.5 3

−1.5

−1

−0.5

0

0.5

1c) roll [deg]

orbits2 2.5 3

−2

−1

0

1

2

3 d) yaw [deg]

orbits

0 0.5 1 1.5 2 2.5 3−200

−100

0

100

200

orbits

a) pitch, roll, yaw [deg]

Figure 8: Secondary attitude determination attitudeerrors. Filter converges to attitude estimates <1.8deg (RMS). Bars at top of a) indicate Sun lit orbitparts.

determination is illustrated in the following section.

Implementation

The secondary attitude determination EKF employsthe square-root formulation which provides ade-quate covariance matrix precision with single pre-cision fixed-point arithmetic. The measurementupdate is done using Biermans Square Root Freesquare root observational update, and the covari-ance time update is based on Thorntons modifiedweighted Gram-Schmidt orthogonalization [5].

6 COMBINED ATTITUDE DETERMINATION

AND CONTROL

Numerous simulations have been run to test a widerange of attitude and fault conditions. As an exam-ple attitude control result for the science observationphase are shown in Figure 9.

The inital attitude is offset from local vertical by 40deg in pitch, roll and yaw. The SIM fails after twoorbits. In plot a) no on-board reconfiguration is per-formed and the satellite starts rotating about the z-axis. Plot b) shows the same situation with reconfig-uration of the atttiude determination. It is clear thatsatellite continues operation as if no faults had oc-cured.

0 0.5 1 1.5 2 2.5 3 3.5 4−200

−100

0

100

200

orbits

b) pitch, roll, yaw [deg]

pitch

roll

yaw

0 0.5 1 1.5 2 2.5 3 3.5 4−200

−100

0

100

200

orbits

a) pitch, roll, yaw [deg]

Figure 9: Combined atttitude control and determi-nation. SIM failure after 2 orbits. In plot a) no re-configuration is performed. In b) the attitude deter-mination is reconfigured.

This case clearly demonstrates the ability of theACS to reconfigure and adopt to fault situations.

7 CONCLUSION

This paper presented work on autonomous attitudecontrol system for the Ørsted satellite. The empha-sis was on the development of a fault tolerant atti-tude control system architecture. A set of algorithmsfor attitude determination and control was presentedcovering all satellite mission phases. Phase tran-sitions and sensor reconfigurations were done au-tonomously on-board. Fault tolerance and auton-omy was achieved at the expense of detailed analy-sis and simulation prior to launch and additional on-board processing.

A considerable part of this paper was devoted to thedevelopment of the control methods for the mag-netic actuated satellites. Linear and nonlinear meth-ods for three-axis stabilization of the satellite werepresented. The attitude determination was based onthe extended Kalman filter in combination with astar imager. Attitude determination and control wasintegrated with an control supervisor.

The ideas presented in the paper are applicable tosatellite missions, where autonomy of the on-boardsoftware plays an important role. The attitude and

control algorithms are applicable to magnetic actu-ated satellites with a limited number of attitude sen-sors.

REFERENCES

[1] T. Bak. Attitude Determination Methods. TechnicalReport Ørsted Project TN-151, Aalborg University, Mar.1994.

[2] M. Blanke. Aims and Tools in the Evolution of Fault-tolerant Control. In proc.: ESF COSY Workshop, Rome,Sept. 1995.

[3] S. A. Bøgh, R. Izadi-Zamanabadi, and M. Blanke. On-board Supervisor for the Ørsted Satellite Attitude Con-trol System. In proc.: 5th ESA workshop on Artificial In-teligence and Knowledge Based Systems for Space, Oct.1995.

[4] A. Burns and A. Wellings. HRT-HOOD, A Structured De-sign Method for Hard Real-time Systems. Real-Time Sys-tems Journal.

[5] M. S. Grewal and A. P. Andrews. Kalman Filtering, The-ory and Practice. Information and System Science Series.Prentice Hall, 1993.

[6] A. H. Jaswinski. Stochastic Processes and Filtering The-ory, volume 64 of Mathematics in science and engineer-ing. Academic Press, Inc., London, 1970.

[7] C. Jørgensen, G. Caspersen, and T. H. Puls. On-BoardSoftware Development Approach for the Oersted Satel-lite. In proc.: On-Board Data Management Symposium,1994.

[8] E. J. Lefferts, F. L. Markley, and M. D. Shuster. KalmanFiltering for Spacecraft Attitude Determination. Journalof Guidance and Control, 5(5):417–429, Sept. 1982.

[9] C. C. Liebe. Star Trackers for Attitude Determina-tion. IEEE Aerospace and Electronic Systems Magazine,10(6):10–16, June 1995.

[10] F. Martel, K. Parimal, and M. Psiaki. Active MagneticControl System for Gravity Gradient Stabilized Space-craft. In proc.: Annual AIAA/Utah State University Con-ference on Small Satellites, September 1988.

[11] O.V.Nielsen, B. Hernando, J. Petersen, and F. Primdahl.Miniaturisation of Low-Cost Metalic Glass Flux-GateSensors. Magnetism and Magnetic Materials, 83:404–406, 1990.

[12] M. L. Psiaki, F. Martel, and P. K. Pal. Three-Axis Atti-tude Determination via Kalman Filtering of Magnetome-ter Data. Journal of Guidance, Control and Dynamics,13(3):506–514, May 1990.

[13] R.Wisniewski and M.Blanke. Three-axis Satellite Atti-tude Control Based on Magnetic Torquing. Accepted for:13th IFAC World Congress, San Francisco, California,June 1996.

[14] R. Wisniewski. Attitude Control Methods. TechnicalReport Ørsted Project TN-232, Aalborg University, Nov.1994.

[15] R. Wisniewski. Nonlinear Control for Satellite Detum-bling Based on Magnetic Torquing. In proc.: Joint Ser-vices Data Exchange for Guidance, Navigation, and Con-trol, Arizona, 1994.

Thomas Bak received the M.S. degree in controlengineering from Department of Control Engineer-ing, Aalborg University, Denmark in 1993. He hassince been working with the Ørsted satellite projectas a member of the attitude control subsystem designteam. He is currently enrolled in the Ph.D. programin Electrical and Electronic Engineering at AalborgUniversity, Denmark. His research interests includeestimation theory, periodic observers and space-craft guidance, navigation and control systems.

Rafał Wisniewski received the M.S. degree in con-trol engineering from the Technical University ofSzczecin, Poland and Aalborg University, Denmarkin 1992. He is currently working on his Ph.D. de-gree at Aalborg University, Department of ControlEngineering. Furthermore, he is involved in the atti-tude and control system design for the Ørsted Satel-lite Project. His main research interest includesnonlinear and optimal control.

Mogens Blanke received his M.S. degree from theTechnical University of Denmark in 1974. He waswith the European Space Agency in 1975-76. He re-ceived the Ph.D. degree in 1982 in Automatic Con-trol. He was with Søren T. Lyngsø from 1985 to1990 when he was appointed the chair as profes-sor at Aalborg University. He is currently leading amajor research project in fault tolerant control andhas strong interests in dependable systems, space-craft attitude control, and general robust and non-linear control theory. He is Editor for Control Ap-plications for International Journal of Robust andNonlinear Control and has several other interna-tional positions in the science community. He hascontributed to the advance of applications and de-velopment of theory in nonlinear identification, shipmotion and propulsion systems control.