Safe at last

Rescuing Integral – the story so far

In 2020, the thrusters on ESA’s Integral spacecraft failed. To keep the scientific mission alive, the Integral team at ESA’s ESOC mission control centre quickly set to work developing a new series of specialised manoeuvres that would enable them to continue flying the spacecraft using only its reaction wheels – the rotating wheels inside a satellite that allow it to store and use angular momentum to change its orientation.

However, the spacecraft’s original ‘safe mode’ – the system that kicks in to switch off scientific instruments and rotate it to face the Sun to ensure its solar arrays are generating full power – relied on these thrusters to spin the spacecraft to safety in the event of an emergency.

This safe mode was triggered almost exactly one year later, in September 2021, when a charged particle struck a sensitive part of Integral’s electronics, disabling one of its reaction wheels and causing the spacecraft to spin away from the Sun.

Without thrusters though, the old safe mode could not recover the spacecraft, and the Integral team was left with just three hours to save the mission, or see it lost forever.

Safety, now in numbers

Following the success of their daring rescue attempt, the Integral team decided it was safer to disable the old safe mode entirely and focus on the development of a new safe mode that uses the reaction wheels rather than the thrusters to regain control and rotate the spacecraft back towards the Sun.

“The safe mode is a crucial part of any spacecraft mission,” says Integral Operations Manager, Richard Southworth. “This is likely the first time that an ESA mission has had to have its safe mode redesigned entirely while in orbit.”

But developing new systems for a 20-year-old spacecraft can be a challenge. The old safe mode was almost entirely based on hardware – which can’t be tinkered with after launch. Instead, the team had to develop an entirely new, software-based safe mode.

Originally, a dedicated, hardware system handled Integral’s rescue operations and directly controlled the thrusters when the safe mode was triggered. The team’s new approach listens for the alarm signal generated by this circuit but then re-routes it through the spacecraft’s primary ‘brain’ – the central on-board computer.

There, a newly developed algorithm receives the alert and determines how to control the reaction wheels to spin Integral to safely point towards the Sun.

This system was tested in flight for the first time on the real satellite on 2 March 2023, when Integral’s Flight Control Team deliberately rotated Integral away from the Sun and triggered the new safe mode, which successfully returned the spacecraft to its original safe orientation.

“Part of these tests involved making sure that the primary onboard computer can handle the new workload, as the 20-year-old computer was not designed to handle this extra effort,” says Jim Martin, who led the development of the new safe mode at ESOC.

“We closely monitored the computer’s vital signs during the operation to make sure that the new safe mode doesn’t impact any of the brain’s other duties, such as handling the science data gathered by Integral’s instruments.”

Three-wheel drive

Importantly, the new safe mode can rescue Integral even if one of its reaction wheels is disabled. To test this, the team rotated the spacecraft out of alignment in four different directions and tasked the new safe mode with using a different combination of three of Integral’s four reaction wheels to recover it each time.

The new safe mode has now been successfully implemented onboard Integral and will work to keep the space observatory safe as it continues to help scientists shed light on some of the Universe’s most exciting and energetic events, such as gamma-ray bursts, black holes and supernovae.

The Integral team presented the spacecraft’s third out-of-the-box solution in as many years at SpaceOps 2023, the world’s largest conference on spacecraft operations, in Dubai earlier this month.