ai-aerospace/ams_data_full_2000-2020 huggingface dataset:
Most of the time, MCS is pointed  at the limb (or horizon) of Mars to acquire the key observations of the Martian atmosphere. The location of the limb varies by ~2° due to the elliptical nature of the MRO orbit, but is centered on the elevation actuator position of 111.2°. Tied to the limb location is the space view (the third calibration point). It is 8.4° above the limb (or a nominal elevation angle of 102.8°).  Figure 1: Range of Elevation Actuator Operation When the elevation actuator  points between the limb and 250°, MCS is viewing the surface of Mars. In particular, at an angle of 180°, it is pointing in the nadir direction, the sub-spacecraft location.  Scanning is controlled by a series of tables (called SST—Scan Sequence Tables) that contain a list of  commands, each indicating the slew and observation duration. These are executed serially by the flight software. The most common scanning is a 35-second cycle that points at nadir for 4 seconds, moves to point at the limb for 16 seconds, then points at space for another 4 seconds before repeating. This  pattern was used to determine the lifetime requirement of 1.75M scan cycles. A second regularly used pattern is the blackbody scan. This scan starts at the space view (usually at the  end of a limb scan), moves to view the black body, returns to view space and finishes by slewing to nadir for the start of the next limb sequence. The high-resolution camera (HiRISE instrument on MRO) placed requirements on MCS, limiting the MCS  contribution to the spacecraft jitter that would interfere/blur the HiRISE images. In addition to the jitter requirements, a freeze command was implemented that would point MCS at a sun safe position on the limb during off-nadir HiRISE imaging. Mechanical Description of the MCS Instrument Key Design Requirements The critical design requirements pertaining to the anomaly were:  - Joint Life: The elevation drive shall survive 3.5M cycles:  This is double the nominal mission lifetime of  1.75M cycles to provide the appropriate margin (and to provide lifetime for an extended mission). This is a  significant driver for the design of the transmission and the selection of the lubrication. Pennzane 2000 [5] was chosen as lubricant because of its excellent life characteristics. The life test of a joint proved that transmission and lube could survive the required cycles without much degradation (see [6] and “Qualification Testing” below). Due to scanning limitations imposed since the actuator anomaly, the actual scanning cycles for the primary mission will be significantly lower.  - Pointing Accuracy: The drives must be able to position the instrument to within ±0.025 deg:  The step  rate was chosen to be 0.1 degree; the positioning thus has to be within ¼ step, which is well within a stepper actuator’s capabilities. During acceptance testing, all measured pointing accuracies were within ±0.015 deg for both drives over the entire range of motion. This level of accuracy is close to the pointing detection threshold of the detectors.  273
- Redundant Position Sensing: The joint shall incorporate two redundant diodes as position sensors. Diodes are incorporated in the joint drives at 0° and 105.7°. The diodes are regularly checked in-flight.  Neither has ever malfunctioned. - Position Holding: The drives shall hold their position when power is removed:  The actuator’s detent  torque, providing 18 in-lb (2 Nm) of holding torque, served as launch lock and holds the joint’s position  during observations. No drifting has ever been detected during sensing.  Mechanical Construction The following is a brief mechanical description of the instrument. A more detailed description of MCS can  be found in publication [6]. The completed instrument is shown in Figure 2. As can be seen, the entire  instrument is covered by thermal blankets.       Figure 2: The Completed MCS Instrument   Figure 3: Instrument without Blankets Figure 3 shows the instrument without its thermal blankets. It consists of an optical bench assembly, two  rotational drives that provide azimuth and elevation scanning capabilities, and a yoke-like structure that  serves as structural support for the upper part of the instrument. All motor control electronics resides on  three individual electronics boards located inside the yoke structure.  The optical bench is a thin walled rectangular structure, containing two telescope assemblies. One of the  telescope assemblies is depicted in Figure 4. The focal plane is at the inside surface of the hexagonal block at the upper right. A cross sectional view through the optical bench is shown in Figure 5: The incoming light passes through the baffle first. The beam is then relayed by a 3-mirror optical beam system  before reaching the detector arrays at the focal plane. The telescope’s control electronics is on two  electronics boards, one attached to the top, the other to the bottom of the optical bench. The solar calibration target is the bright plane that can be seen in Figure 3. It reflects indirect sunlight into the instrument. The black body calibration target is recessed in the yoke structure. The instrument can calibrate itself against the black body calibration target when the instrument is pointing straight down. Figure 4: One of two Telescope Assemblies 274
Figure 5: Cross Sectional view through the Optical Bench Joint Drives Both joint drives [7] combine an actuator and a twist cap section in a compact design. Their actuators are  identical but the output bearing configurations are different: The azimuth joint has a hub extension so that  its bearings could be spaced further apart; and it features dual duplex bearings. This enabled it to  withstand the more severe launch loads at the base of the instrument. To further increase the bearing’s  load capacity, all output bearings feature full compliment ball bearings, thus eliminating the usual bearing retainer (see “Keystoning Effects” below). A final difference is that the azimuth joint has the bearings in a  back-to-back configuration for stiffness, whereas the elevation joint has them aligned front-to-front,  enabling compliance to the third bearing at the other side of the optical bench. Fig. 6 depicts the azimuth  joint with its output bearings spaced further apart. An azimuth-type joint was used for the life test. The motor is a brushless stepper motor, having a step angle of 30 degrees. It has redundant windings  and detent capabilities. Its stall torque is 0.012 Nm. The transmission is comprised of a planetary gear stage, followed by a harmonic drive. The overall gear ratio is 297:1. The twist cap chamber contains six printed circuit flex cables in a clock spring arrangement, enabling the  electrical wiring to transition from the stationary to the rotating section. Each flex print has 14 electrical  traces for a total of 78 power and signal traces and 6 grounding traces.  Position Sensing There are two diode assemblies per joint, sensing the joint’s position at 0° and at 105.7° degrees. The 0°  position is used for re-initialization. The 105° position is between the limb and space views, and is  crossed twice every 35 seconds.  A disk (near item 5 in Fig. 6) normally blocks the light path between the light emitting diode (LED) and the  phototransistor. The disk has one slot, allowing diode light to pass through when the slot passes a  sensor. The slot size had to be made quite large (approx. 1-1/2mm) for sufficient light from the diode to  pass through. Therefore, the sensor is triggered for up to six steps during each diode passage.   During initialization, the 0-step is determined by scanning past the 0° diode first while recording all  positions the diode is triggered, then computing the center position. By evaluating the diode and knowing  which of the four motor phases corresponds to the computed center step, the controller can uniquely  determine the joint’s position. Subsequent position sensing only checks if the sensor is triggered when the software anticipates passing the previously determined center step of either diode. To save diode life,  the diodes are only turned on when the system expects to pass one of the sensors.  275
If the actual joint position  does not correspond to the commanded position (due to whatever causes the anomaly), the position error has to be at least 3 steps away from the commanded position to be detected by this sensor system, having a 6 step diode trigger window. A sensed error reading is recorded but not reported immediately, thus compli-cating the error analysis (see “Error Discussion” below) Error cancellation is also possible if a subsequent error is in the opposite direction. However, if the flight software detects an error, it will reinitialize (see below), even if a subsequent error (hysteresis effect), should cancel it out.         Figure 6: The Azimuth Actuator/Twist Cap Motor Control Micro-stepping motor control was implemented to reduce motor vibrations that otherwise would  propagate to other sections of the spacecraft, in particular to the highly sensitive HiRISE camera. The flight motor controller is a 4-phase micro-stepper controller: At low speeds, the motor driver ramps the currents in a quasi-sinusoidal fashion, rather than by discrete square waves. A complete sine wave  advances the motor by four cardinal steps. Hence, an electrical cycle is comprised of 4 phases. At higher speeds, the current input per motor step switches to fewer discrete micro steps. The number of micro steps diminishes to two with increasingly shorter step duration when the motor approaches full speed. For the error analyses, it is important to note that, if the energized motor functions as expected, it is in  sync (or in-phase) with the motor controller at nominally zero position errors. Should the motor loose steps, its speed most likely will drop to zero or it will automatically re-synchronize to the controller at a multiple of four steps from the commanded position. Since most of the measured position errors were four step errors, it follows that the system stops one control sequence away from the commanded position. This does not explain, however, the few other position errors for which telemetry indicated another step difference from the expected position, even some confirmed position overshoots. A mechanical cause, producing substantial overshoots, is highly unlikely.  Qualification Testing Common wisdom says: test what you fly, fly what you test. But reality is not that simple: A full instrument  qualification program was undertaken for MCS, as is customary for flight hardware, including a separate  life test for one drive joint. Both flight joints were independently acceptance tested as well. The purpose of  this section is not to give a full account of the test program, but to highlight some limitations the test  program faced, and the consequences this might have had for the anomaly and anomaly investigation. -Tests not done in zero-G : this was universally considered as acceptable. The issues were that the life  test had to be done with the joint axis aligned horizontally. Otherwise, the lube might have gravitated out  of the bearings and the flex tapes would have sagged and rubbed against the twist cap walls. 276
complement bearings, especially for dithering motions that rotate the bearing just by just a few degrees,  even if it means paying the mass penalty for going to a larger size bearing with a retainer.  For Diviner’s elevation drive, the remedy was to reduce the pre-load the inner bearing retainer ring exerts.  This was possible because this joint does not require the stiffness the azimuth joint needs. The Keystoning behavior noticed during the Diviner assembly was not noticed during the MCS assembly.  However without objective evidence that it is not present on the MCS elevation actuator, it is impossible  to say that the MCS actuator does not exhibit the same keystoning behavior. Actuator Pointing Error Detection and Response  Instrument Position Error Detection and Response Position errors occur when the MCS flight software (FSW) and the hardware disagree on the position of  an actuator. The position of the actuators is checked when passing through either of the diode locations. Position errors only occur while slewing, but a mis-pointing caused by a position error will persist (with the  same magnitude) until the actuator is re-initialized.  When the MCS FSW determines there is a position error, it sends an error message in the engineering  telemetry. After reporting a position error, the FSW re-initializes both actuators, removing any pointing  errors. While re-initializing the actuators, slewing is done at a very slow rate and errors are generally irrelevant since the FSW is searching for the diode. After a certain number of position errors, the instrument fault protection stows the instrument and waits for ground intervention.  The complexity is that the FSW does not report the error when it is detected; it is only reported at the end  of an SST (sequence of slews). Thus, the actual pointing error occurred at some point before the last diode crossing in the SST. This also means that if the position error occurred early in a long and complex scan pattern, the instrument will be mis-pointed until the end of the SST. Limb Validation of Pointing Without an absolute  position encoder, it is not possible to determine the size of a particular error.  However, the team has been able to use the  instrument data to  determine roughly how  many steps the instrument is out of position by looking  at the radiances when  pointed at the limb. This is  done by using channel A3 (core of the 15 micron band) and comparing the calibrated radiances of the limb views during the period around when the error is reported. We use limb view before the probable  slewing error, while the error is in effect, and after the actuator has been re-synchronized.                   Figure 8: Detection of Slew Errors at the Limb of Mars  Figure 8 shows an example analysis. For each observation, MCS acquires eight samples of the limb  (thus the clusters of 8 lines). The actual detector values are the + symbols, placed on an altitude scale  279
The next experiment was designed to better understand the error statistics and to obtain a larger  population of errors to examine for trends and correlations. The previous testing had generated 33 errors. The fault protection counter was increased to 50 and reduced scanning was resumed. MCS scanned for almost 3 days before generating the 51 errors and stowing. For sun safety, the scanning was pointed at the aft limb instead of the standard forward limb. This also changed the thermal environment of the elevation actuator. The time between errors varied from 2 minutes to 13 hours. The average was 1/hour (2/hour if the 13 hour gap was not counted). There was a hint that the frequency was increasing slightly towards the end of the 3 days. This run also had the first occurrence of an error immediately following the re-initialization of the previous error.  Azimuth Scanning Next, the investigation proceeded to attempt to isolate the error by performing extensive (and identical)  scanning in azimuth to see if errors would occur. This would either implicate or exonerate the shared components. The plan for test #8 was to scan for one orbit in elevation as usual and then slew in azimuth using the same scan pattern for the next orbit. Due to the control limitations of the instrument, an occasional slew in elevation would occur during the azimuth orbits to respond to freeze commands.  Figure 10: Error Rate in Late January Testing  The results are shown in Fig. 10, plotting the time of the error versus error number. The yellow crescents  are the orbits with azimuth scanning. All of the errors during the azimuth orbits are associated with elevation scans. Part way through, it was decided to proceed with the next test (test #9) and remove the last difference between the two actuators by overwriting the elevation slew table with the azimuth table.  A number of features appeared in the test. First, there were no position errors during azimuth scanning.  This implicates the drive electronics not shared by the actuators and the elevation actuator itself. During the analysis, it was discovered that on 5 occasions, a much larger error had occurred (they ranged from 2.6° to over 11°). All five errors were associated with slews going more than 10° below the limb. The  direction of all the errors was consistent with either stalling on a slew or many 4-step small errors on the way to 35° below the limb (~145° in elevation space).  The other trend noticed during these tests (shown in Fig. 10) is an increase in the error frequency. And  even more disconcerting, the rate of increase appears to accelerate. A careful analysis showed that the  282
increase in torque with applied voltage, this also indicates that there is probably ample torque margin  when most errors occur. - The errors appear to occur with any slew lengths. A rigorous exploration of slew length dependency was  not undertaken (ambiguities between slew lengths and error rates makes the existing data difficult to  interpret). Errors definitely occurred on both short slews and long slews (short slews are < 16° and do not  reach top speed). Several of the four errors definitely occurred on slews of ~8°. It is possible that errors  preferentially occur on long slews, but this probably only indicates that the error probability correlates with  the distance covered.  - It appears that at least one error can be associated with a slew in each direction. Also, at least one error  is an undershoot. There are four errors that (assuming the diodes can detect all combinations of a 4-step error) are overshoots. But without the exact knowledge when slew errors occurred, it is often not possible to determine the direction of slewing, nor whether the error was an overshoot or undershot. Figure 11: Blackbody then Limb Error Pattern  Error “Preconditioning” One peculiar pattern reoccurs frequently as position error: Many of the position errors are in the limb scan  sequence following a blackbody sequence. Figures 11 & 12 illustrate the pattern in two different ways. Due to crossing the diode in the blackbody sequence, and the fact that there is no error reported at the end of that SST, it follows that slewing to and from the black body (K and K -1 slews in Fig. 12), which are  unique to the blackbody sequence, do not generate the errors. Therefore, the error (if it occurs) is in A, B  or C. Slew B does not often occur (it is related to tracking the limb), thus, the error has to occur in either A  or C. Slews A and C are a very often occurring pair, occurring ~20 times more frequently than the blackbody pair. Approximately 70% of the total errors occurred in the A-C pair immediately after a black body scan, even though this combined pattern occurs in only 5% of the total slewing. Equally interesting is that 95% of the cases where the pointing error is known, it has the same sign. The cause of this preconditioning is not understood. Initially, 20% of the black body sequences  preconditioned an error. When the errors were the most frequent, all black body sequences preconditioned a position error. Extensive analysis of the MCS software, electronics and mechanical assembly, has failed to point out any reason for such a preconditioning to occur. 286
Current Status and Conclusions  Currently the instrument is producing ~90% of the expected science (including all of the atmospheric  science). Thus, it was decided to forego further experimentation with the flight instrument. It was  determined that the next testing would significantly risk the current actuator performance and would be  unlikely to shed any light on the cause or behavior of the anomaly. Instead, it was decided to run the instrument with some operational restrictions to gain as much science as possible through the end of the primary science phase (Dec. 2008). There are two operational restrictions: The first is to use the new SST tables developed during the investigation. The second is to limit scanning in elevation to no more  than 10° below the limb. This has prevented further errors. There is currently no identified root cause for the position errors. All conceived investigations with EM  hardware, life test actuator, or in-flight evaluations have failed to shed further light on the issue. Likewise, design reviews and theoretical studies have been exhausted without identifying an obvious root cause.  Figure 12: Slews Implicated in a Typical Position Error  While four potential root causes have not been completely eliminated, none appear to be the answer.  None of them matches all observed or anticipated behavior of the hardware. All have major issues that  would be sufficient to eliminate them from consideration. It also should be noted that none of the potential error sources could explain the probable overshoots. It  is very difficult to generate sufficient un-commanded movement in the motor to create a 4-step overshoot. While the motor controller could do so, the same software, firmware, and hardware are acting as motor  controller for both actuators. Thus if it generates overshoots, it would do so for both actuators. Detailed  independent reviews and extensive testing of the motor controller has not shown any propensity to  generate overshoots.  The remaining potential root causes are:  - Keystoning:  It has been demonstrated that keystoning produces position dependent behaviors. But it  only occurs at the output bearings (where the available torque is high) and could be expected to affect  287
Overview of Design The ISAD is partitioned into two sections, a front and a rear chamber. The front chamber is used to collect  bulk material acquired by scraping or digging, and transfer the soil overburden away from the main  trench. Up to 310 cm3 of loose material may be collected in the front chamber at a time. A Primary Blade  is attached to the front of the scoop that helps break up weak soil. The front chamber can also be used  for precision drop-off of bulk soil to science instruments located on the lander deck. A funnel feature  shown in Figure 2 channels acquired material into an 18.2-mm wide slot, improving the accuracy of  sample delivery. The funnel and scoop geometry were designed to maintain functionality at lander tilts of  up to 16° with respect to the local surface normal. The ISAD scoop and funnel feature are separate  components and are made of 7075-T73 aluminum with a hard coat clear anodize for abrasion and wear  resistance. This coating on the interior surfaces also reduces glare when viewing acquired samples with  the Robotic Arm Camera. A tungsten carbide secondary blade on the bottom side of the scoop provides a means of penetrating harder materials.   Motor Shield Scoop Primary Blade Knurled  Load PlateMotorRobotic Arm Interface Sample Transfer Plate Funnel Cutting BitPivot HousingDrive Component Housing Figure 1. Cutaway of ISAD Showing Internal Components  The rear chamber of the ISAD contains a high-speed rasp cutting tool for penetrating the surface of hard  icy soil, and acquiring the cuttings produced. Acquisition is accomplished by first preloading the ISAD scoop into the surface such that the spring-loaded cutting bit is forced into the scoop. A knurled contact  plate grips into the icy soil preventing motion of the scoop and RA during rasp operations. The rasp  cutting bit is then energized, resulting in rapid penetration of the surface, causing a plume of cuttings to  ballistically enter the rear chamber of the scoop.     The tungsten carbide cutting bit is 6.35 mm in diameter and protrudes from the rear chamber through a 7.9-mm slot when the tool is in free space. The rasp cutting bit is mounted to a pivoting housing, which  has a total stroke of 15°. Two hard stops prevent overtravel of this pivot housing. The “lower” hard stop  limits the depth of penetration of the rasp cutting bit. The “upper” hard stop is positioned in order to allow  the cutting bit to fully retract into the scoop. The pivot housing is spring loaded using a torsion spring. The torsion spring acts to force the cutting bit into the material, providing the necessary weight on bit of  approximately 6 N for penetration of icy soil.   291