April 2011 

NASA/TM-2011-217088 

NESC-RP-10-00628

 

A Summary of the Rendezvous, Proximity 

Operations, Docking, and Undocking (RPODU) 

Lessons Learned from the Defense Advanced 

Research Project Agency (DARPA) Orbital 

Express (OE) Demonstration System Mission 

Cornelius J. Dennehy/NESC 

Langley Research Center, Hampton, Virginia 

J. Russell Carpenter 

Goddard Space Flight Center, Greenbelt, Maryland 
NASA STI Program . . . in Profile

 Since its founding, NASA has been dedicated to 

the advancement of aeronautics and space science. 

The NASA scientific and technical information (STI) 

program plays a key part in helping NASA maintain 

this important role. 

 The NASA STI program operates under the 

auspices of the Agency Chief Information Officer. It 

collects, organizes, provides for archiving, and 

disseminates NASA’s STI. The NASA STI program 

provides access to the NASA Aeronautics and Space 

Database and its public interface, the NASA Technical 

Report Server, thus providing one of the largest 

collections of aeronautical and space science STI in 

the world. Results are published in both non-NASA 

channels and by NASA in the NASA STI Report 

Series, which includes the following report types: 

• TECHNICAL PUBLICATION. Reports of 

completed research or a major significant phase 

of research that present the results of NASA 

programs and include extensive data or 

theoretical analysis. Includes compilations of 

significant scientific and technical data and 

information deemed to be of continuing 

reference value. NASA counterpart of peerreviewed formal professional papers, but having 

less stringent limitations on manuscript length 

and extent of graphic presentations. 

• TECHNICAL MEMORANDUM. Scientific 

and technical findings that are preliminary or of 

specialized interest, e.g., quick release reports, 

working papers, and bibliographies that contain 

minimal annotation. Does not contain extensive 

analysis. 

• CONTRACTOR REPORT. Scientific and 

technical findings by NASA-sponsored 

contractors and grantees. 

• CONFERENCE PUBLICATION. Collected 

papers from scientific and technical 

conferences, symposia, seminars, or other 

meetings sponsored or co-sponsored by NASA. 

• SPECIAL PUBLICATION. Scientific, 

technical, or historical information from NASA 

programs, projects, and missions, often 

concerned with subjects having substantial 

public interest. 

• TECHNICAL TRANSLATION. Englishlanguage translations of foreign scientific and 

technical material pertinent to NASA’s mission. 

 Specialized services also include creating custom 

thesauri, building customized databases, and 

organizing and publishing research results. 

 For more information about the NASA STI 

program, see the following: 

• Access the NASA STI program home page at 

http://www.sti.nasa.gov

• E-mail your question via the Internet to 

help@sti.nasa.gov

• Fax your question to the NASA STI Help Desk 

at 443-757-5803 

• Phone the NASA STI Help Desk at 

443-757-5802 

• Write to: 

 NASA STI Help Desk 

 NASA Center for AeroSpace Information 

 7115 Standard Drive 

 Hanover, MD 21076-1320 
National Aeronautics and 

Space Administration 

Langley Research Center 

Hampton, Virginia 23681-2199 

April 2011 

NASA/TM-2011-217088 

NESC-RP-10-00628

 

A Summary of the Rendezvous, Proximity 

Operations, Docking, and Undocking (RPODU) 

Lessons Learned from the Defense Advanced 

Research Project Agency (DARPA) Orbital 

Express (OE) Demonstration System Mission 

Cornelius J. Dennehy/NESC 

Langley Research Center, Hampton, Virginia 

J. Russell Carpenter 

Goddard Space Flight Center, Greenbelt, Maryland 
Available from: 

NASA Center for AeroSpace Information 

7115 Standard Drive 

Hanover, MD 21076-1320 

443-757-5802 

The use of trademarks or names of manufacturers in the report is for accurate reporting and does not 

constitute an official endorsement, either expressed or implied, of such products or manufacturers by the 

National Aeronautics and Space Administration. 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

1 of 32 

NESC Request No.: 10-00628 

A Summary of the Rendezvous, Proximity Operations, 

Docking, and Undocking (RPODU) Lessons Learned from 

the Defense Advanced Research Project Agency (DARPA) 

Orbital Express (OE) Demonstration System Mission

April 4, 2011 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

2 of 32 

NESC Request No.: 10-00628 

 Report Approval and Revision History 

Approval and Document Revision History 

NOTE: This document was approved at the March 31, 2011, NRB. This document was 

submitted to the NESC Director on April 11, 2011, for configuration control. 

Approved: Original Signature on File 4/14/11 

 NESC Director Date 

Version Description of Revision Author Effective Date 

1.0 Initial Release Neil Dennehy, NASA 

Technical Fellow for 

Guidance, Navigation, 

and Control

4/4/11
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

3 of 32 

NESC Request No.: 10-00628 

Table of Contents 

Volume I: Consultation Report 

1.0 Authorization and Notification ........................................................................................... 4

2.0 Signature Page ...................................................................................................................... 5

3.0 Team List .............................................................................................................................. 6

4.0 Executive Summary ............................................................................................................. 7

5.0 Problem Description ............................................................................................................ 8

5.1 Orbital Express Background .................................................................................................. 8

5.2 Summary of the Driving OE Event ...................................................................................... 11

5.3 Relevance to Future Spaceflight RPODU System Design, Development, Test, and 

Operation Activities ............................................................................................................. 11

6.0 Data Analysis and Review ................................................................................................. 13

7.0 NESC Determinations ....................................................................................................... 15

7.1 Findings, Observations, and Lessons Learned ..................................................................... 15

7.2 NESC Recommendations..................................................................................................... 23

8.0 Alternate Viewpoints ......................................................................................................... 29

9.0 Other Deliverables ............................................................................................................. 29

10.0 Acronyms List .................................................................................................................... 30

11.0 References ........................................................................................................................... 30

List of Figures

Figure 5.1-1. OE AGN&C System Block Diagram (from ref.1) .................................................. 9

Figure 5.1-2. Effective Operational Ranges of the OE ARCSS (from ref. 2) ............................ 10

Figure 5.3-1. Some Examples of NASA’s RPODU Mission Applications in Human and 

Robotic Spaceflight ............................................................................................... 12
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

4 of 32 

NESC Request No.: 10-00628 

Volume I: Assessment Report 

1.0 Authorization and Notification 

The Guidance, Navigation, and Control (GN&C) Technical Discipline Team (TDT) sponsored 

Dr. J. Russell Carpenter, a Navigation and Rendezvous Subject Matter Expert (SME) from 

NASA’s Goddard Space Flight Center (GSFC), to provide support to the Defense Advanced 

Research Project Agency (DARPA) Orbital Express (OE) rendezvous and docking flight test that 

was conducted in 2007. When that DARPA OE mission was completed, Mr. Neil Dennehy, 

NASA Technical Fellow for GN&C, requested Dr. Carpenter document his findings (lessons 

learned) and recommendations for future rendezvous missions resulting from his OE support 

experience. This report captures lessons specifically from anomalies that occurred during one of 

OE’s unmated operations. It was anticipated the Constellation Program (CxP) Orion Project, 

NASA’s commercial crew and cargo partners, International Space Station (ISS) visiting vehicles, 

and any space vehicles performing rendezvous and docking would benefit from these findings, 

observations, lessons learned, and NESC recommendations. 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

5 of 32 

NESC Request No.: 10-00628 

2.0 Signature Page

Submitted by: 

Team Signature Page on File – 4/18/11 

Mr. Cornelius J. Dennehy Date 

Significant Contributor:

Dr. J. Russell Carpenter Date 

Signatories declare the findings and observations compiled in the report are factually based from 

data extracted from Program/Project documents, contractor reports, technical discussions, and 

open literature, and/or generated from independently conducted or observed tests, analyses, and 

inspections. 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

6 of 32 

NESC Request No.: 10-00628 

3.0 Team List 

Name Discipline Organization/Location

Core Team 

Neil Dennehy NASA Technical Fellow for GN&C GSFC 

Russell Carpenter 

Navigation and Rendezvous SME 

(Member of the NESC GN&C TDT) GSFC 

Administrative Support Personnel 

Patricia Pahlavani MTSO Program Analyst LaRC 

Christina Williams Technical Writer ATK/LaRC 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

7 of 32 

NESC Request No.: 10-00628 

4.0 Executive Summary 

Over the period from late calendar year (CY) 2005 through the middle of CY 2007, the NASA 

Engineering and Safety Center (NESC) Guidance Navigation and Control (GN&C) Technical 

Discipline Team (TDT) member, Dr. J. Russell Carpenter, provided specialized engineering 

technical support to the Defense Advanced Research Project Agency (DARPA) Orbital Express 

(OE) Demonstration System mission. In particular, Dr. Carpenter served as a member of the OE 

Independent Readiness Review Team (IRRT) that was led by Brigadier General (Retired) Peter 

Worden.

Dr. Carpenter, a NASA civil servant at NASA’s Goddard Space Flight Center (GSFC), is a 

senior navigation specialist. He had previously served as the Deputy Chairman on the Mishap 

Investigation Board (MIB) that convened in April 2005 to determine the causes and contributing 

factors relating to the NASA Demonstration of Autonomous Rendezvous Technology (DART) 

mission. In that role, Dr. Carpenter provided the necessary program-independent rendezvous 

and navigation engineering expertise needed by the DART MIB. His NESC-sponsored work as 

a member of the OE IRRT was a logical outgrowth of his DART MIB leadership. 

The OE IRRT was formed in late CY 2005 with the charter to independently identify, assess, and 

advise the DARPA Director (Dr. Tony Tether) on urgent issues that would impact the OE 

mission’s technical success, cost, and schedule. The IRRT was tasked to focus on developing 

recommendations for pragmatic solutions to issues that would minimize cost and schedule 

impacts, while increasing the probability of accomplishing the OE mission objectives. 

Following the OE launch, the IRRT activity was maintained with an augmented charter which 

included: reviewing the results from on-orbit operations; resolving on-orbit anomalies and 

recommending corrective actions; and providing guidance on the performance of on-orbit test 

scenarios. 

The driving events for this report were a sequence of navigation and sensor problems that 

occurred during one of OE’s unmated operations. Although OE successfully recovered from 

these anomalies, the DARPA Director suspended further unmated operations, and requested 

Dr. Carpenter to chair a review of the issues that led to these anomalies. This report captures 

findings, observations, lessons learned, and NESC recommendations that resulted from this 

review, as well as NESC's participation both in the recovery activities themselves, and more 

generally with the IRRT throughout the final 2 years of the OE Project.
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

8 of 32 

NESC Request No.: 10-00628 

5.0 Problem Description 

5.1 Orbital Express Background 

The purpose of the DARPA OE system was to demonstrate the operational utility, cost 

effectiveness, and technical feasibility of autonomous techniques for on-orbit satellite servicing.

A primary OE objective was to develop and demonstrate an on-orbit autonomous GN&C system 

that would provide the autonomous non-cooperative rendezvous, proximity operations, and 

capture functions and capabilities needed to support on-orbit satellite servicing.

The OE demonstration system consisted of two satellites, launched simultaneously on March 8, 

2007, aboard an Atlas V booster from the Cape Canaveral Air Force Base into a 492-km circular 

orbit at 46-degree inclination. The satellite that performed the servicing was designated as the 

autonomous space transfer and robotic orbiter (ASTRO). The next generation 

satellite/commodity spacecraft (NextSat/CSC) functioned as the satellite being serviced by 

ASTRO. The mission demonstrated autonomous rendezvous, proximity operations, and 

servicing, including transfers of hydrazine fuel, and battery and flight computer orbital 

replacement units. ASTRO was the active (chaser) vehicle with the NextSat/CSC as the passive 

(target) vehicle.

The block diagram of the OE autonomous GN&C (AGN&C) system is provided in Figure 5.1-1.

As described in Reference 1, the specific key features of the AGN&C system on-board the 

ASTRO spacecraft were: 

1. Fully-autonomous guidance software to perform demate, separation, departure, 

rendezvous, proximity operations, and capture. 

2. Fully-autonomous attitude software to orient the vehicle in required directions during 

each segment of approach and separation. 

3. Onboard guidance sequencer to progress through translation and pointing modes during 

approach and separation. 

4. Functionally-redundant rendezvous sensors to track the target from over 200 km to 

capture. 

5. Fully-autonomous navigation filters to sort and weight data from multiple sensor input 

sources.

6. Internal sanity checks and rendezvous abort capabilities if safety or hazard thresholds 

were exceeded. 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

9 of 32 

NESC Request No.: 10-00628 

Figure 5.1-1. OE AGN&C System Block Diagram (from ref.1) 

Many of the OE rendezvous, proximity operations, docking and undocking (RPODU) lessons 

learned reported in this paper were concerned with the suite of navigation sensors employed on 

the ASTRO spacecraft. Background information on these sensors will assist in understanding 

those sensor-related lessons learned.

The ASTRO spacecraft was equipped with an autonomous rendezvous and capture sensor system 

(ARCSS). A detailed ARCSS description is provided in Reference 2. The ARCSS consisted of 

five different sensors, which were mounted on a common optical bench. The ARCSS consists of 

three imaging sensors: 

1. Narrow field-of-view (NFoV) visible acquisition and tracking sensor, referred to as VS1. 

2. Mid-to short-range side field-of-view (WFoV) visible tracking sensor, referred to as VS2. 

3. Infrared (IR) sensor, referred to as IRS, for use during orbital “night” (eclipse) or periods 

of poor lighting conditions.

In addition to the visible and IR imaging sensors, the ARCSS included a precision laser 

rangefinder (LRF), which was used for mid-range target spacecraft tracking purposes. Lastly, 

the advanced video guidance sensor (AVGS) laser-based tracking system was employed to 

provide target attitude, range, and bearing during the chaser’s short-range proximity 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

10 of 32 

NESC Request No.: 10-00628 

maneuvering and docking operations that occurred in the last few hundred meters of flight down 

the approach corridor. The AVGS evolved from the video guidance sensor (VGS) technology 

developed by the NASA Marshall Space Flight Center (MSFC) in the mid 1990's and flown as a 

flight experiment on the space transportation system (STS)-87 and STS-95 Space Shuttle 

missions. The AVGS was designed to be an autonomous docking sensor using the same basic 

functional concept as the VGS, but with updated electronics, increased range, reduced mass, and 

improved dynamic tracking capability. The AVGS had previously flown on the DART 

spacecraft in CY 2005. 

The ARCSS system provided NextSat/CSC target spacecraft state information to the AGN&C 

flight software over a range from a hundred kilometers to close proximity/docking. The ARCSS 

sensors each have a different effective operational range. Together this sensor suite provided 

overlapping target range coverage as depicted in Figure 5.1-2.

Figure 5.1-2. Effective Operational Ranges of the OE ARCSS (from ref. 2) 

During May and June of 2007 after initial on-orbit system checkouts, the OE spacecraft 

conducted five unmated operations. The spacecraft conducted one additional long-range 

rendezvous demonstration in July 2007 as part of the decommissioning sequence.
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

11 of 32 

NESC Request No.: 10-00628 

The ASTRO spacecraft was decommissioned on July 20, 2007. The Next Sat/CSC spacecraft 

decommissioning occurred on July 21, 2007. References 3 and 4 discuss post-flight analysis of 

ARCSS and AVGS performance, respectively. References 5 and 6 provide detailed summaries 

of flight operations. 

5.2 Summary of the Driving OE Event 

During the second OE unmated operation, also known as Scenario 3-1, ASTRO “... was nearly 

crippled [sic] by a major failure in its sensor computer, which processes data gathered by the 

craft’s rendezvous instruments, including cameras, an advanced video guidance sensor and a 

laser rangefinder.”1

 With assistance from ground controllers, ASTRO eventually re-mated with 

NextSat. The contractor, with assistance from a panel of external experts chaired by the NESC 

representative, developed solutions and work-arounds for the problems ASTRO encountered, 

and OE performed its remaining unmated scenarios without significant further issues.

Section 6.0 of this report reviews and summarizes OE’s problems during Scenario 3-1. 

Reference 5 may be consulted for further details. Section 7.0 captures findings, observations, 

lessons learned, and NESC recommendations that resulted from the NESC's participation both in 

the recovery activities arising from the problems that occurred in Scenario 3-1, and with 

DARPA’s IRRT throughout the final 2 years of the OE Project. This report serves as an 

expedient means for concisely sharing, with the NASA GN&C community of practice (CoP), the 

engineering knowledge gained from OE's on-orbit spacecraft RPODU flight test experience. The 

report will be posted to the NASA Engineering Network (NEN) GN&C CoP website for future 

reference (https://nen.nasa.gov/web/gnc).

5.3 Relevance to Future Spaceflight RPODU System Design, Development, 

Test, and Operation Activities 

Space rendezvous subsystem technologies, and the systems engineering to effectively integrate 

them together, will be essential to execute future NASA human and robotic spaceflight missions. 

There will be a continued trend towards designing and developing autonomous rendezvous and 

docking systems to perform routine RPODU flight operations routinely, safely, efficiently, and 

affordably.

In the future, NASA will require GN&C capabilities for space rendezvous and docking to satisfy 

mission requirements for both crewed spacecraft (e.g., CxP Orion Crew Exploration Vehicle 

1 http://www.spaceflightnow.com/news/n0707/04orbitalexpress/, accessed July 5, 2007. “[N]early crippled” is an 

overstatement; the mission was able to use a backup sensor computer to recover from the anomaly, which was a due 

to a series of failures in the integrated sensor/computer subsystem. It should be noted that data from these 

subsystems was processed with a set of rules and monitored with respect to preset parameters. A number of these 

monitors had inappropriate values, and contributed to the series of failures that led to the anomaly. These issues 

were evident in other unmated operations, but did not have such negative outcomes. 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

12 of 32 

NESC Request No.: 10-00628 

(CEV) rendezvous with the ISS in Earth orbit, and CEV rendezvous with the Altair ascent stage 

in Lunar orbit) and robotic spacecraft (e.g., Mars sample return and other targets of scientific 

interest). In addition, the ISS will continue to host a number of different “visiting vehicles” that 

will have some form of RPODU GN&C interaction. It will be critical to ISS safety that GN&C 

engineers understand both the nominal RPODU operations and potential RPODU failure modes 

on these visiting vehicles. Figure 5.3-1 illustrates this wide range of RPODU mission 

applications. RPODU is also an enabling technology for crewed and robotic satellite servicing 

missions. 

Figure 5.3-1. Some Examples of NASA’s RPODU Mission Applications in Human and Robotic 

Spaceflight

Future RPODU capabilities will require a high degree of system engineering to successfully 

architect and integrate the various sensors, GN&C algorithms, autonomous software, 

mechanisms, actuators, and other subsystems into a spacecraft safely, efficiently, and affordably.

The engineering and economic tradeoffs between manual, automated, supervised autonomy, and 

fully autonomous RPODU systems will need to be investigated for each specific mission 

application. The use of common hardware and software system elements will need to be 

considered. Fully integrated RPODU systems, and their multiple spacecraft dynamic 

interactions, will be difficult to test on the ground. Non-operational space rendezvous and 

docking flight testing opportunities for future RPODU systems should be emphasized, but these 

will likely be limited in number and complexity. 

Planetary Sample 

Return

Rendezvous

JAXA HTV 

Rendezvous

with ISS

ESA ATV 

Rendezvous 

with ISS

Lunar Orbit 

Rendezvous 

Orion 

Rendezvous 

with ISS
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

13 of 32 

NESC Request No.: 10-00628 

Effectively addressing the autonomous RPODU problem will be a significant technical challenge 

involving complex, and sometimes hazardous, dynamic interactions across multiple spaceflight 

regimes. It should be recognized that DARPA’s RPODU technology and engineering interests 

have significant overlap with NASA activities. The key point is that the OE Demonstration 

System architecture, concept of operations, and GN&C design (i.e., RPODU sensors, algorithms, 

mechanisms, actuators) flight tested by the DARPA/industry OE team will likely have a strong 

and direct impact on NASA’s future GN&C system design and development activities for 

crewed and robotic spacecraft. It is advantageous for NASA to learn as much as possible from 

the DARPA OE GN&C design, development, and flight test experience. Capturing and 

disseminating OE lessons learned is an important step and allows NASA to leverage the 

significant DARPA investment in performing the OE orbital flight tests.

6.0 Data Analysis and Review 

This section reviews aspects of OE’s second unmated operation, Scenario 3-1, which are 

germane to NESC’s analyses. The source of the data presented is Reference 5. 

During Scenario 3-1, ASTRO had been intended to follow a similar profile to that used during its 

first unmated operation, during which it performed a successful in-plane circumnavigation of 

NextSat at an approximate radius of 10 meters. For Scenario 3-1, separation to 30 m was 

planned to extend the range over which OE's sensors would be demonstrated. As ASTRO 

returned from its planned maximum separation of 30 m to a 10 m standoff, the aforementioned 

sensor computer failure occurred2

. This failure was the proximate cause of the set of problems 

OE encountered in the operation. In response, ASTRO executed an abort procedure in which it 

flew through a pre-planned separation corridor, then retreated to a safe-hold station-keeping box 

120 m trailing NextSat. ARCSS data were lost due to the failure of the sensor computer, but 

AVGS continued tracking throughout the separation corridor. The trajectory ASTRO followed 

after departing the separation corridor exceeded AVGS visibility constraints, so no relative 

navigation data were available, and relative navigation accuracy began degrading. Once ARCSS 

was recovered using a backup sensor computer, data from the IR sensor became available as 

ASTRO neared the 120 m station-keep box. However, the navigation filter began rejecting this 

data, and ground operators elected to place ASTRO into coasting flight mode until the navigation 

problems could be resolved. While troubleshooting continued, ASTRO drifted without relative 

state measurements over the next day, eventually reaching approximately 2.5 km following 

NextSat, an estimate based on ASTRO's Global Positioning System (GPS) solutions and ground 

tracking of NextSat. 

2

 No root cause was identified for the failure of the sensor computer. Identical software was used for the remainder 

of the mission in a backup sensor computer. 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

14 of 32 

NESC Request No.: 10-00628 

At this point, ground operators attempted to arrest ASTRO’s drift rate. Unfortunately, data from 

ASTRO’s accelerometers was improperly processed by ASTRO’s software, leading to an 

anomalous burn3

. This anomaly corrupted the onboard navigation state, and put ASTRO onto a 

trajectory that repositioned it from 2.5 km following to what was eventually estimated to be 6 km 

ahead of NextSat. 

Over the next several days, ASTRO remained in coasting flight mode, while ground operators 

experimented with various navigation settings to overcome numerous flight conditions that 

significantly differed from pre-flight expectations. Sensor performance was one area of 

difficulty. Due to the abort, the geometry of the sun, Earth, and spacecraft were different from 

any configurations contemplated during pre-flight planning. In addition, the sun glare in 

particular was worse than any encountered in pre-flight testing. The sensors had furthermore not 

been calibrated under such stressful conditions, leading to numerous faulty observations being 

reported to the navigation filter. The navigation filter itself had never been tested under such 

stressful conditions, and its performance during the recovery phase of the scenario also led to a 

great deal of consternation on the part of the operators. Unfortunately, many of the sensors 

relied on feedback from the navigation filter for acquisition aiding, so the filter’s poor 

performance interfered with ability of the sensors to facilitate recovery from the abort. 

Eventually, operators found a configuration that would allow data from the IR sensor to be 

accepted by the navigation filter. Using this data, ASTRO maneuvered to within 2.5 km of 

NextSat, from which point LRF range data could be reliably acquired and processed. The 

successful processing of the combination of IR and LRF data by the navigation filter allowed an 

approach to 150 m. The subsequent trajectory was planned to ensure that AVGS data would be 

continuously available. With the AVGS continuing to meet performance expectations, and 

despite a thermal issue with one of the thrusters that nearly led to another abort, the recovery was 

completed eight days after the operation began. 

Prior to resumption of unmated operations, the DARPA Director requested the NESC to chair a 

review of the navigation and sensor problems OE experienced on Scenario 3-1. This review 

panel identified a set of liens against a return to unmated operations that the OE team 

successfully addressed. These liens primarily involved additional on-orbit sensor calibration, 

and navigation filter re-tuning. The panel identified additional deficiencies in the navigation 

filter design, but did not view correcting these as an imperative for a return to unmated 

operations. As References 5 and 6 describe, with these adjustments, OE resumed unmated 

operations and completed its mission successfully. 

3

 The software fault was associated with a unique untested system configuration that occurred as a result of the 

combination of the sensor computer reset and the type of ground-loaded burn that was used for the drift-stop 

maneuver. 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

15 of 32 

NESC Request No.: 10-00628 

7.0 NESC Determinations 

This section describes findings, observations, lessons learned, and NESC recommendations that 

resulted from the NESC’s participation in the recovery activities arising from the problems that 

occurred in Scenario 3-1, and with DARPA’s IRRT throughout the final 2 years of the OE 

Project.

7.1 Findings, Observations, and Lessons Learned 

The following findings are based on facts established during NESC’s involvement with the OE 

Project.

F-1. The autonomous abort to 120 m did not establish an adequately stable and safe 

standoff in the presence of degraded navigation, necessitating additional maneuvers 

that further degraded the navigation state.

As described previously, the original issue that began the series of events leading to the 

contingency during Scenario 3-1 was a re-boot of the computer that hosted the sensor 

processing software. OE’s flight software, performing as programmed for this 

circumstance, automatically triggered an autonomous abort. The intent of this abort was 

to place ASTRO at a stable stationkeeping point 120 m following NextSat, at the same 

orbital altitude and inclination. However, the stability of this type of stationkeeping 

declines as relative navigation accuracy degrades, and the particular contingency that 

initiated the abort had resulted in a loss of onboard relative navigation. Hence, the abort 

put ASTRO at risk of being unable to autonomously maintain a stable and safe separation 

from NextSat, necessitating additional ground intervention. With these actions, ground 

operators attempted to increase the margin of safety by allowing ASTRO to drift further 

from NextSat. As described previously, the drift rate that resulted was high enough to 

cause additional concern, and an attempted drift stop maneuver by ground operators 

triggered a latent defect in ASTRO’s flight software related to accelerometer processing, 

which further degraded relative navigation. The resulting decline in relative state 

knowledge significantly hampered ground operators’ situational awareness, and impeded 

subsequent recovery operations. 

F-2. The AVGS “spot” (acquisition) mode would likely have provided critical navigation 

measurements when the other sensors were unavailable. 

The AVGS provided range and angular position information, and relative attitude 

information, to about 200 m, when the AVGS retro-reflector targets were in the sensor’s 

field of view. AVGS is also capable of providing angular position information via its 

“spot” or “acquisition” mode, to about 2 km, based on whatever laser returns are 

available (multiple “spots” are centroided). This mode was successfully used in the 

DART mission. OE did not provide proper interfaces to AVGS to make use of the spot 

(acquisition) mode. Since AVGS was unaffected by the problems occurring with the 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

16 of 32 

NESC Request No.: 10-00628 

other relative navigation sensors, its ability to provide angular positions at ranges to 2 km 

would have proved valuable in the recovery from the contingency during Scenario 3-1. 

F-3. The navigation filter underestimated its uncertainty.

All successful rendezvous missions to date, including OE, have used a type of sequential 

navigation filter known as the extended Kalman filter (EKF). A primary advantage of 

this type of navigation algorithm is that it maintains an online, adaptive estimate of the 

uncertainty in its navigation state estimate. 

In OE’s case, the filter had intentionally been tuned in such a way that it typically 

underestimated this uncertainty (i.e., the filter was always “over-confident” about how 

well it was navigating). The rationale given for this tuning was that it was required for 

adequate performance in long-range rendezvous scenarios. Although pre-flight 

simulations had indicated this issue to a smaller degree, in-flight experience showed that 

the OE navigation filter often underestimated its uncertainty by an order of magnitude or 

more. Due to OE Project resource limitations, it was not deemed possible to make the 

types of changes to the filter that would have been required to remedy this issue. There 

were multiple consequences of this design, several of which are described in other section 

of this report.

The most fundamental consequence, improper weighting of sensor data, is the focus of 

this finding. One way to understand how the EKF uses its uncertainty estimates is by 

analogy to the methods historically used by sailors. A shipboard navigator maintains a 

track log that is updated regularly by a combination of dead reckoning and making fixes. 

A fix consists of observing a celestial object or a known landmark with an instrument that 

measures some component of the ship’s position. In between fixes, the navigator dead 

reckons the ship’s position by extrapolating from the previous fix using an estimate of the 

ship’s speed and heading. When updating the track with a new fix, the navigator judges 

the accuracy of the fix against the accuracy of the dead reckoning, accounting for 

uncertainty in tides and currents, compass errors, helm errors, etc., and makes an 

adjustment to the track log. 

There are no fundamental differences between the shipboard navigation described and the 

functioning of the EKF. If the EKF inaccurately estimates its uncertainty, then it will not 

be able to adequately “judge” how best to combine new observations from the sensors 

with its previously “dead reckoned” extrapolation track. If the EKF consistently 

overstates the accuracy of its estimates, then it will tend to undervalue the information 

provided by new sensor data, and get increasingly “locked in” to a track based on everolder information. 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

17 of 32 

NESC Request No.: 10-00628 

F-4. Pre-flight testing did not reveal the sensor and navigation issues that occurred in 

flight.

The OE Project determined it was infeasible for the spacecraft sensor suite and 

navigation software to be tested in a fully integrated, hardware-in-the-loop fashion.

Further, the facility used for testing the navigation cameras was unable to simulate the 

dynamic range and diversity of optical effects that might be expected to occur in space4

.

Although it is not possible to say definitively that such pre-flight testing would 

unequivocally have discovered the issues with the sensors, the navigation filter, and their 

interactions that led to the contingency during Scenario 3-1, such testing “as you fly” 

may have helped to detect them prior to flight. There was a Government facility available 

that could have assisted with this type of testing, which the OE Project elected not to 

utilize. 

F-5. Pre-flight navigation system stress testing did not account for extreme sensor data 

outliers.

The OE team performed a significant amount of software simulation prior to the mission, 

much of which included random noise and bias-like output perturbations to reasonably 

high-fidelity sensor models. However, the noise models generally assumed “wellbehaved” statistics (i.e., the distribution of the noise was assumed to be Gaussian). 

In flight, due to a variety of problems with the sensors, their outputs were different from 

what had been simulated. The laser range finder would occasionally report extreme 

outliers several kilometers out of family from the rest of its measurements, and the 

cameras often reported false targets resulting from misidentification of optical artifacts.

In effect, the sensor data that occurred in flight had a higher probability of occurring far 

from their mean values than the Gaussian distribution was capable of producing.

Subsequent consultation with the laser vendor revealed that the outliers were an expected 

feature of the sensor’s design. 

F-6. Testing of ground uplink abort commands did not reveal the issues that occurred in 

flight.

Late in the development program, the OE team added a capability to uplink ground 

initiated abort commands. Because these were not initially contemplated, the manner in 

which they had to be introduced required a re-initialization of the navigation filter. 

Critical to the anomaly that occurred in Scenario 3-1 is that some of the states in the 

navigation filter tracked the accumulated biases in the inertial measurement unit’s 

accelerometers. When the filter was reset, so were these states, which corrupted their 

4

 It is not clear that any existing facility can accurately model the full range of optical effects that occur in space. 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

18 of 32 

NESC Request No.: 10-00628 

estimate of the accelerometer bias. The navigation system could quickly recover from 

this condition, so long as a burn did not begin at the same time. However, if a burn did 

initiate concurrently, the system would try to correct the error in the navigation filter’s 

accelerometer bias state, which in flight was large immediately after a reset. 

In flight, this resulted in a larger than intended abort maneuver, which was also 

improperly directed. The difference between the flight occurrence of this issue and when 

this capability was tested on the ground pre-flight was the duration of the time that had 

elapsed prior to the reset. The reason the time elapsed was important was that over a 

short interval, the accelerometer bias does not accumulate to a large enough value to 

affect the burn. 

F-7. There was no consistently available and accurate backup to OE’s onboard 

navigation system.

Soon after OE lost its onboard navigation knowledge during Scenario 3-1, the ground 

operators realized that ground orbit determination solutions based on ranging data from 

the Air Force Satellite Control Network (AFSCN) stations would not be accurate enough 

to support recovery operations. As this eventuality had been contemplated prior to 

launch, OE had prior arrangements with the AFSCN imaging radar site operators to 

provide contingency support if needed. Unfortunately, due to maintenance at one of 

these facilities, the amount of tracking from these sites was limited. In addition, AFSCN 

were unable to provide a full state orbit determination solution. Nevertheless, the range 

estimates and other data the AFSCN provided proved to be invaluable in supporting the 

recovery from the contingency. 

The following observations are factors, events, or circumstances that the NESC team identified 

which did not contribute directly to the problems occurring during Scenario 3-1, but nonetheless, 

have the potential to cause or increase the severity of similar problems for future RPODU 

activities. 

O-1. Final approach along the radius and velocity vectors tended to cause unanticipated 

thruster duty cycles and subsequent over-heating.

As is typical for most rendezvous missions, during the final meters of the ASTRO’s 

approach to NextSat, ASTRO would fly through a conical corridor extending along 

NextSat’s docking axis. This trajectory segment would in general not correspond to any 

natural, coasting orbital motion, and hence would require more frequent thruster firings to 

maintain than had the rest of the rendezvous and proximity operations profile. 

Depending on the objectives of the current operation, sometimes NextSat would remain 

sun pointing during the approach, and sometimes NextSat would point along either its 

velocity or radius vectors. In the latter two cases, somewhat more frequent effort was 

required to fight against orbital mechanics to remain inside the corridor. 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

19 of 32 

NESC Request No.: 10-00628 

The thruster firing logic design was such that when small and frequent maneuvers were 

commanded, unexpected chattering would occur when the commanded thrust was larger 

than the minimum thruster firing allowed by the logic. In such cases, the subset of 

thrusters (usually only one) bearing the brunt of the duty cycle would approach its 

operating temperature limit. Consequently, during the last moments of the recovery from 

the Scenario 3-1 abort, one thruster was within a few degrees of reaching its temperature 

limit and thus triggering an abort. 

O-2. The process of dumping the onboard recorders and extracting the data from the 

downlinked files proved cumbersome during contingencies.

Real-time telemetry was stored by ground operators and was readily available for postprocessing and fact-finding during the trouble-shooting surrounding anomalies. 

However, the full telemetry set was only available during AFSCN contacts, and the 

Tracking and Data Relay Satellite System (TDRSS) coverage was not continuous, so that 

gaps existed in the real-time telemetry record. All of the data were stored in OE’s 

onboard recorders, but retrieving this data proved difficult. First, dumping the recorders 

required re-configuring the telemetry, which was not always feasible or advisable, due to 

other demands occurring during the anomaly (e.g., commanding and downlinking of 

situational awareness imagery). More significantly, once the data was downlinked, the 

process of extracting the guidance and relative navigation data occurred slower than realtime. These limitations conspired with the high tempo of contingency operations to 

effectively prevent the ground team from being able to make use of the data from the 

onboard recorders during trouble-shooting surrounding anomalies. 

O-3. Possible evidence of ASTRO absolute position radial biasing.

During the recovery from the Scenario 3-1 contingency, analysis of the real-time 

telemetry indicated the possible existence of radial biases in ASTRO’s absolute position.

Since no “truth” trajectory was available for comparison, this evidence was inconclusive. 

What was observed was that the differences between ASTRO’s GPS receiver’s position 

point solutions and the navigation filter’s estimate of ASTRO’s absolute position were 

biased by approximately 10 to 15 m when no other data were being processed by the 

navigation filter. Once the filter began to ingest data from the IR camera, the bias 

appeared to increase to approximately 20 to 30 m. The large number of gaps and a strong 

time-varying signature present in the data make these conclusions on the bias somewhat 

speculative. Nevertheless, it remains plausible that at OE’s altitude of approximately 

500 km, ionospheric biasing of the GPS measurements could have been present. 

O-4. Spacecraft collision was possibly prevented by the unintentional presence of out of 

plane motion.

When OE lost all navigation information during Scenario 3-1, ASTRO unintentionally 

passed from one side of NextSat to the other without real-time knowledge of ground 

operators. Although onboard navigation was not available during this time frame, later 

analysis of less accurate ground-based orbit determination solutions suggested that the 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

20 of 32 

NESC Request No.: 10-00628 

in-plane projection of ASTRO’s motion might have passed within 10 m or less of 

NextSat in the process of switching sides. Prior to this, as a consequence of an improper 

ground-initiated abort maneuver, several dozen meters of out of plane motion had 

unintentionally been introduced into ASTRO’s orbit relative to NextSat. The groundbased solutions suggest that, thanks to this unintentional out of plane maneuver, at the 

time when ASTRO’s in-plane motion was close to NextSat, it probably had a reasonably 

safe out-of-plane separation. 

O-5. The navigation filter’s model of how NextSat’s orbit propagated during sensor 

outages introduced significant relative state errors.

The navigation filter modeled NextSat’s orbit using a gravity model that only included 

central-body and equatorial oblateness terms. No atmospheric drag, solar radiation 

pressure, third-body gravity, or other perturbations were modeled. When relative 

measurements were available, pre-flight analysis had shown this model to be adequate for 

OE’s mission. However, such a model can be expected to introduce errors on the order 

of 10 to 20 km per day [ref. 7]5

, depending primarily on the atmospheric density. Since 

ASTRO’s orbit was constantly updated with GPS, this propagation error would directly 

contribute to errors in the relative state, when relative measurements were not available. 

Although such outages of relative measurements were never intended to occur, the 

contingency during Scenario 3-1 led to more than a day without any direct measurements 

of the relative state. In this circumstance, the OE ground team had to rely on infrequent 

updates by various ground tracking assets to maintain safe separations between the 

vehicles with ground-commanded thruster firings. 

O-6. The navigation filter’s relative state estimate was biased after long periods of anglesonly tracking.

During the unmated scenarios that extended beyond a few kilometers, it was typical that 

the only data type available to the navigation filter was angular position information, 

primarily from the IR camera. In these cases, the filter had to rely on a combination of 

fairly inaccurate target state propagation, and correlations between angular observables 

and actual range. Such correlations become evident to the navigation filter as relative 

motion normal to the line-of-sight to the target occurs. The biasing problem was clear to 

the OE ground operators, who could often observe laser rangefinder measurements that 

were a kilometer or more different from the navigation filter’s range estimate. At times, 

the ground operators had to restart the filter to enable it to ingest the laser rangefinder 

measurements, which operators had come to realize were indicating a more accurate 

representation of the true range. Such filter restarts had the potential to interfere with 

previously planned maneuvers. 

5

 The example quoted is for a low Earth orbit (LEO) satellite (LACE) at solar maximum, that used a higher-fidelity 

model than OE’s navigation filter used. 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

21 of 32 

NESC Request No.: 10-00628 

The following lessons learned summarize the knowledge or understanding that the Automated 

Rendezvous and Docking (AR&D) CoP has gained from the OE experience. 

LL-1. System designers and operators should be mindful of implicit assumptions 

concerning the availability of a navigation state. 

There were times during the recovery from the abort during Scenario 3-1 in which there 

was significant confusion among OE’s ground operators concerning ASTRO’s position 

relative to NextSat. After the anomalous drift stop maneuver, extended time was 

required to establish a coarse characterization as to whether ASTRO was leading or 

following NextSat. Once the recovery was underway and accurate navigation knowledge 

was restored, a member of the OE operations team, who had also been one of the 

principal system designers, made the off-hand comment that “Nav is really important”. 

This comment succinctly summarized a lesson that the OE team appear to have learned 

from their OE mission experience. These individuals gained a heightened appreciation of 

the degree to which at least some coarse knowledge of the navigation state may be taken 

for granted. Although NASA’s AR&D CoP includes navigation experts, such expertise 

can sometimes be compartmentalized, and even experienced experts can take situational 

awareness for granted. More generally, most people have never been caught at sea in a 

fog, or found themselves alone at the controls of an aircraft in instrument meteorological 

conditions, and hence have never truly experienced what it is like to lose the usual cues 

that lead to situational awareness. Such experiences reinforce that navigation should 

never be taken for granted. The OE operations team did have this experience when OE 

lost navigation information during the aforementioned contingency. 

LL-2. IR sensors can enhance system robustness to unanticipated lighting variations.

Prior to the abort in Scenario 3-1, many members of the OE team appeared to view the IR 

sensor as a secondary or supplemental sensor. The lesson learned was that because the 

IR sensor was less susceptible to unanticipated variations in lighting conditions, it 

provided a robust and capable alternative to sensors operating in the visible light band.

Although the OE IR camera was not without its problems (primarily associated with 

calibration; this topic is discussed further in the recommendations), it was the primary 

sensor through which the mission accomplished its recovery from the contingency. 

Furthermore, it was the sensor that most reliably tracked during a majority of the 

operations that occurred outside of AVGS range. 

LL-3. A coupling between sensor and navigation software is susceptible to mutually 

reinforcing problems.

The software controlling the OE sensor suite and the navigation filter software were 

tightly coupled in a number of ways that led to some of the problems that occurred during 

Scenario 3-1. This interdependence caused precipitous system performance degradation 

as the subsystem performance declined. The lesson learned was that tight coupling might 

reduce overall system robustness, since problems may mutually and negatively reinforce 

each other. 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

22 of 32 

NESC Request No.: 10-00628 

The navigation filter aided the sensor software with a target ephemeris message, and the 

sensor software aided the navigation filter with measurement validity information. This 

coupling, when it occurred in the presence of spurious sensor measurements, led to a 

feedback that prevented OE from recovering its navigation state, even when ground 

operators could see via downlink imagery that NextSat was in the sensors’ fields of view. 

The feedback began when optical artifacts (e.g., glints, glares, saturations, hot pixels) 

appeared in the sensors’ fields of view. Due to faulty target selection logic, these were at 

times reported as target tracks. The navigation filter would ingest these measurements, 

which resulted in biasing its state estimate, while at the same time decreasing the filter’s 

state uncertainty. The improper reduction in uncertainty occurred because the filter 

“believed” these were valid measurements on the basis of the measurement validity 

information from the sensor software. The filter would begin reporting biased target 

ephemerides to the sensor software, which prevented the sensor software from 

subsequently associating the image of NextSat with a successful target track. 

Another example was that some of the relative navigation sensors needed a range 

estimate seed to set operating parameters when acquiring NextSat. In some cases, this 

seed was to have been provided by other relative navigation sensors. When these other 

sensors had either spurious or no measurements, the range-estimate seed was not 

provided, which prevented acquisition with other sensors. In some cases, this 

significantly reduced the number of sensors operating at the same time. 

LL-4. To achieve an effective sensor calibration on-orbit, the target vehicle should not be 

present in the sensors’ fields of view, and possible sources of image corruption 

should be included.

Prior to commencing unmated operations, OE performed two sets of on-orbit sensor 

calibrations. Pre-flight calibration had been performed in a contractor facility prior to 

launch integration. However, the facility was unable to simulate the dynamic range and 

diversity of optical effects that might be expected to occur in space. The on-orbit 

calibrations consisted of demating ASTRO and NextSat using the robotic arm, moving 

NextSat while remaining on the arm, performing the calibration, and then remating. 

NextSat remained in the sensors’ fields of view during this procedure, and other bright 

objects (e.g., the Earth limb and the moon) were excluded from the fields of view.

This calibration procedure failed to reveal the optical artifacts that contributed to the loss 

of navigation during Scenario 3-1. Prior to initiating further unmated operations, the 

calibration procedure was repeated, but with the change that NextSat was moved out of 

the sensor field of view, and bright objects were imaged. This proved to be a more 

effective calibration procedure. The data from this calibration, in combination with the 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

23 of 32 

NESC Request No.: 10-00628 

data previously gathered during the aborted Scenario 3-1, allowed the OE ground team to 

retune the sensor software to remove a majority of the optical artifacts. 

LL-5. Situational awareness imagery can be critically important in aiding the ground 

operations team’s recovery from an abort, and since ground-based assets provide 

limited coverage, providing such data via the TDRSS should be a system capability.

As originally configured, OE was only capable of downlinking situational awareness 

imagery from its cameras via the AFSCN. In general, the AFSCN contacts were shorter 

and sparser than TDRSS contacts, but the TDRSS contacts had a lower bandwidth.

Despite the limited bandwidth of the TDRSS link, the OE team was able to reconfigure 

the telemetry during the contingency so that limited situational awareness imagery could 

be downlinked continuously during TDRSS contacts. This imagery was crucial to 

ground decision-making during the recovery operation. Unfortunately, at critical times, 

the availability of such telemetry to engineering support areas outside of the operations 

center was sometimes limited. 

LL-6. The navigation filter must be able to identify and screen out erroneous sensor data 

without affecting the filter’s processing of valid sensor data.

This capability depends on the filter’s accuracy in modeling the time-evolution of the 

navigation state vector, predicting the sensor measurements, and computing the statistics 

of the states and measurements. As mentioned previously, successful rendezvous 

missions to date, including OE, have used the EKF. A known attribute of such filters is 

that “... large values of the prediction residual relative to the prediction standard 

deviation may be an indication of bad tracking data and hence may be used to edit data 

from the solution” [ref. 8]6

. The efficacy of such editing is hindered when the filter does 

not accurately compute the aforementioned residual standard deviation. In OE’s case, the 

filter typically underestimated the residual standard deviation. For the reasons previously 

mentioned, the core of this issue was not addressed, but the mission was flown first 

without editing, and later with unusually large editing thresholds (i.e., roughly 

corresponding to ten or more standard deviations). When editing was disabled, the filter 

ingested spurious measurements that ultimately led to a total loss of onboard state 

knowledge. When editing was enabled with the large thresholds, filter performance also 

suffered, and periods of filter divergence sometimes occurred. 

7.2 NESC Recommendations 

The following recommendations were identified from the NESC’s findings, observations, and 

lessons learned. They are directed towards the development of future non-human rated RPODU 

missions7.

6

 The residual is the difference between the observed and expected measurement. 

7

 Reference 11 offers detailed recommendations concerning RPODU for piloted spacecraft based on Space Shuttle 

Program experiences. 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

24 of 32 

NESC Request No.: 10-00628 

R-1. Consider ground operators’ role in real-time reaction to autonomous aborts.

The overall success of OE’s RPODU operations is attributable to provisions in OE’s 

design that allowed ground operators to fully control the recovery from contingencies. 

The OE design avoided limitations that precluded ground intervention. In general, OE 

limited autonomous contingency responses to those cases when it was not practical for 

ground operators to intervene in a timeframe consistent with the mission’s operational 

tempo. OE’s operators could generally over-ride any autonomous abort response. Future 

missions should allow and encourage involvement from ground operators during aborts 

in similar fashion where feasible. Additionally, to avoid the problems OE experienced in 

Scenario 3-1, future RPODU missions should, where feasible, adopt the following 

strategies. 

a. Design autonomous contingency responses to rapidly place the vehicles into a 

stable, safe, coasting flight configuration. 

This will allow the ground sufficient time to recover the mission, without unduly 

stressing the ground operations tempo. Although OE used such a strategy in Scenario 

3-1 after the abort to 120 m proved unsustainable, it was a ground-commanded 

fallback action, not an autonomous response. 

b. Perform pre-flight systems engineering design activities that plan scenarios of 

how ground operators will interact with mission elements both onboard and on 

the ground to accommodate anomalies.

Such activities typically do not occur until pre-flight mission simulations and operator 

training exercises. Performing these activities during system design can identify 

design issues. 

R-2. Plan for the generation of independently derived “best-estimated” trajectories 

(BET’s).

Although true absolute and relative trajectories of RPODU missions can never be 

accurately known, it is generally possible to derive a post facto “best-estimate” of the full 

set of relevant trajectory parameters by combining available data in an estimation 

process. Cost and schedule constraints may drive missions not to implement a robust 

capability in this area. Due to a number of factors and circumstances previously 

described, OE’s ability to provide such data were limited. These limitations detracted 

from the assessment of OE’s readiness for resumption of unmated operations. To avoid 

such problems, future RPODU missions should, where feasible, plan for the following 

activities. 

a. Derive BET’s using a combination of onboard- and ground-based sensor data. 

b. Validate navigation subsystems by comparison to BET’s. 

c. Assess performance of navigation subsystems by comparison to BET’s. 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

25 of 32 

NESC Request No.: 10-00628 

d. Provide for the availability of BET’s within a timeframe consistent with 

supporting investigations associated with mishaps and recoveries from 

contingencies.

R-3. Seek to design sensor suites so that they perform their functions as independently 

from each other as possible. 

Because OE was designed with a navigation sensor suite that had a diversity of data 

types, and dissimilarly redundant components, it was able to recover from the 

unanticipated issues that led to the abort in Scenario 3-1. However, coupling between the 

sensors and the navigation filter allowed problems occurring in different sensors to 

negatively reinforce each other. 

R-4. Consider off-nominal conditions when planning sensor calibrations. 

Many of the issues that led to OE’s difficulties in Scenario 3-1 centered on sensor 

calibration issues that became evident during the ensuing off-nominal conditions. The 

following summarize how calibration practices OE adopted during its anomaly recovery 

could be applied in future RPODU missions. 

a. Calibrate sensors on-orbit, with and without targets in the field of view, during 

at least the initial mission checkout phase. 

b. Calibrate sensors on-orbit under all possible lighting conditions that might 

reasonably encountered, including off-nominal conditions that might occur due 

to contingencies. 

c. Calibrate sensors on-ground and on-orbit over their full range of specifications 

(e.g., expected range, relative attitude, field-of-view, and dynamics), and over a 

sufficient dynamic range to cover off-nominal lighting conditions (e.g., bloom 

and glint). 

R-5. Apply appropriate fidelity to pre-flight simulation and testing. 

As previously described, OE performed a significant amount of high-fidelity pre-flight 

testing, yet problems still occurred that were not discovered during testing. To better 

mitigate such risks, future RPODU missions should attempt to incorporate the following 

guidelines for pre-flight testing. 

a. Complete high-fidelity integrated simulations of GN&C algorithms using 

realistic mission profiles, which model the range of variation expected in the 

spaceflight environment, prior to the final implementation of the algorithms as 

flight software. 

This allows the opportunity for modification of the algorithms based on discoveries 

from the integrated simulations. If instead the flight software design has already been 

largely completed when such issues are discovered, then it becomes difficult to make 

significant changes. Cost and schedule pressure can result in less-than-ideal solutions 

to such problems. 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

26 of 32 

NESC Request No.: 10-00628 

b. Consult with sensor and actuator vendors to ensure that simulations model 

performance effects that might reasonably be expected to occur. 

Special attention should be given to discovering and modeling outliers, biases, nonGaussian noise characteristics, and other output features that might differ from 

GN&C system designers’ expectations. 

c. Derive performance estimates based on integrated GN&C simulations from 

statistically significant sets of simulation runs, and include confidence intervals 

or similar measures based on the data set size. 

d. Validate software-only GN&C simulations using closed-loop feedback from 

hardware-in-the-loop emulators. 

e. Conduct hardware-in-the-loop testing of the sensors, software, and actuators to 

verify the closed loop response of system interactions, and the overall system 

timing and latency.

Such tests should include stress cases, control mode transitions, and flight- or flightlike processors. 

f. Perform pre-flight testing with durations representative of flight operations in 

an effort to identify unanticipated failure modes that may only develop after 

such time intervals have elapsed. 

R-6. Consider anomaly resolution when deriving telemetry bandwidth and coverage 

requirements.

a. Consider anomaly characterization and resolution in the system design of the 

telemetry bandwidth and coverage. 

b. Design the onboard recorder with sufficient data downlink and archival 

capabilities to provide timely support for anomaly investigation. 

c. Ensure adequate bandwidth between ground facilities to retrieve anomaly data. 

R-7. Provide capabilities for ground operators’ situational awareness in system design.

a. Design diverse communications paths to deliver critical flight data to ground 

operators. 

Where feasible, including TDRS in the system design can facilitate optimized 

situational awareness and data gathering.

b. Include compressed low-resolution optical imagery as presented to optical 

sensors in the communications downlink.

c. If a separate situational awareness camera is used, then it should be mounted on 

the same navigation bench as the optical sensors. 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

27 of 32 

NESC Request No.: 10-00628 

R-8. When using AVGS or derivative sensors, fully utilize all capabilities of the system. 

a. Employ “spot mode” so as to receive bearing information when outside the 

range at which AVGS can provide a full set of range, bearing, and relative 

attitude measurements. 

b. Ensure that range seeds sent to the sensor have adequate precision. 

R-9. Include propulsion system constraints (e.g., temperature limits) in pre-flight 

analysis of non-coasting flight segments (e.g., the corridor approach used by OE). 

R-10. Implement robust strategies to ensure timely and effective communications 

concerning program status across program elements during all operational phases, 

including contingency response activities. 

R-11. Employ rendezvous navigation algorithms of sufficient fidelity to allow for the 

propagation of the target vehicle’s orbit over longer intervals than nominally 

planned.

This allows for support of contingency operations, since during such operations, the time 

over which such propagations may occur without any relative sensor updates may 

significantly exceed nominal expectations. 

R-12. Abort strategies should accommodate the loss or degradation of onboard 

navigation.

An example of such a strategy is to avoid introducing relative motion that re-intersects 

with the target vehicle’s orbit track (V-bar) at any point in subsequent orbits. Such a 

strategy is effective because small errors in relative orbit period arising from loss of 

navigation can result in such intersections violating close approach criteria. This strategy 

would also minimize the sensitivity of the abort to problems occurring from feedback 

control of the orbit that depends on accurate relative navigation data (e.g., such as 

ASTRO used for station-keeping 120 m following NextSat). 

R-13. Provide a robust method for ensuring timely availability of sufficiently accurate 

target vehicle orbit state information. 

Possible sources of information include: GPS on the target vehicle and a chaser-target 

communications link to relay the GPS data; wide field-of-view, long-range sensors that 

do not rely on precise pointing information to acquire the target (e.g., a rendezvous radar; 

ground-based relative orbit solutions based on sufficiently accurate ground-based 

tracking and/or TDRSS tracking); and a wide field-of-view transponder or beacon on the 

target vehicle. 

R-14. Utilize best practices for rendezvous navigation filter design. 

a. Maintain an accurate representation of the target-chaser relative state 

estimation errors, including an accurate variance-covariance matrix. 

This allows the filter to compute an appropriate gain matrix. It also aids the filter in 

appropriately editing unsuitable measurements. 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

28 of 32 

NESC Request No.: 10-00628 

b. Provide a capability for measurement underweighting that adapts to the current 

uncertainty in the filter’s state estimation error, as required to be consistent with 

the suboptimality of the navigation filter’s measurement update.

Effective means for accomplishing this have been found to include:

i. Modified second-order Gaussian state update method [ref. 9]; 

ii. Multiplicative adjustment of the mapping of the state error covariance matrix 

into the measurement subspace, which occurs within the computation of the 

residual covariance [ref. 12]; and

iii. Schmidt-Kalman state update [ref. 10] that utilizes the covariance matrix of 

“consider” parameters (i.e., states that the filter does not update, but for which 

it maintains a covariance). 

Multiplicative adjustment of the measurement noise covariance matrix within the 

computation of the residual covariance (the “bump up R” method [ref. 10]) has been 

found to be less effective, and is not recommended unless other methods are not 

feasible. 

c. Estimate states that model biases in sensor measurements and account for unmodeled accelerations. 

Gauss-Markov models for these biases have been found to be more effective than 

random constant or random walk models. Random constant models can become 

stale, and random walk models can overflow during long periods without 

measurement updates. 

d. Provide commands that allow for selective processing of individual measurement 

types. 

If the filter utilizes an automated residual edit process, then the recommended 

command capability should be able to override the residual edit test.

e. Maintain a backup ephemeris, unaltered by measurement updates since 

initialization, which can be used to restart the filter without uplink of a new state 

vector. 

f. Provide a capability for reinitializing the covariance matrix without altering the 

current state estimate. 

g. Ensure tuning parameters are uplinkable to the spacecraft, and capable of being 

introduced to the filter without loss of onboard navigation data. 

h. Provide flexibility to take advantage of sensors and sensor suites’ full capability 

over all operating ranges. 

R-15. Seek independent review by discipline expertise throughout the project life cycle. 

a. Proactively seek the advice and recommendations of independent rendezvous 

experts with experience in developing and operating rendezvous missions. 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

29 of 32 

NESC Request No.: 10-00628 

b. Maintain independent rendezvous expertise continuity throughout the project 

life cycle, particularly but not only at key milestone reviews. 

c. Engage independent rendezvous experts in the development of post-mission 

analysis studies and lessons learned activities. 

R-16. Use caution with angles-only rendezvous. 

a. Weigh the risks of angles-only rendezvous techniques against the cost of 

mitigating the constraints that preclude the use of active sensors. 

b. Study and incorporate lessons learned from the flight history of relevant 

missions. 

Some occurrences of angles-only rendezvous include the following: radar-fail cases on Gemini 

X, XI, and XII, STS-92, and some Soyuz missions; mishaps on Progress-Mir, Engineering Test 

Satellite (ETS)-VII, and DART; and during difficulties experienced by OE and Experimental 

Satellite System (XSS)-11. Reference 13 provides information on many of these missions. 

Reference 14 addresses the Gemini rendezvous experiences in particular. A summary of the 

Japanese ETS-VII rendezvous and docking technology in-space experiment results is given in 

Reference 15. The publically released overview of the DART mishap investigation results is 

provided in Reference 16. Lastly, Reference 17 describes how the XSS-11 mission demonstrated 

capabilities and technologies for autonomous rendezvous and proximity operations. 

R-17. Plan for post-mortem. 

a. Archive detailed post-flight analyses of rendezvous and proximity operations. 

A partial list of such activities includes: archival of flight data, both real-time 

telemetry and data from onboard recorders; determination of actual performance by 

comparison of flight data to post-facto best-estimated parameters; comparisons 

between predicted and actual performance; and archival and documentation of results 

in form and content suitable for varying levels of disclosure consistent with 

applicable laws, rules, and guidelines.

b. Plan to ensure data archives are readily available to support resolution of 

contingencies during operations. 

8.0 Alternate Viewpoints 

There were no alternate viewpoints expressed during this assessment. 

9.0 Other Deliverables 

There were no other deliverables for this assessment. 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

30 of 32 

NESC Request No.: 10-00628 

10.0 Acronyms List 

AGN&C Autonomous Guidance, Navigation and Control 

AR&D Automated Rendezvous and Docking 

ARCSS Autonomous Rendezvous and Capture Sensor System 

ASTRO Autonomous Space Transfer and Robotic Orbiter 

AVGS Advanced Video Guidance Sensor 

CEV Crew Exploration Vehicle 

CoP Community of Practice 

CY Calendar Year 

DARPA Defense Advanced Research Project Agency 

DART Demonstration of Autonomous Rendezvous Technology 

EKF Extended Kalman Filter 

GN&C Guidance, Navigation and Control 

GSFC Goddard Space Flight Center 

IR Infrared 

IRRT Independent Readiness Review Team 

ISS International Space Station 

LRF Laser Rangefinder 

MIB Mishap Investigation Board 

MSFC Marshall Space Flight Center 

NEN NASA Engineering Network 

Next/CSC Next Generation Satellite/Commodity Spacecraft 

NFoV Narrow field-of-view 

OE Orbital Express 

RPODU Rendezvous, Proximity Operations, Docking & Undocking 

TDT Technical Disciple Team 

VGS Video Guidance Sensor 

WFoV Wide Field-of-View 

11.0 References 

1) “Autonomous Rendezvous Guidance and Navigation for Orbital Express and Beyond”, Joseph 

W. Evans, Elfego Piñon III, and Tom A. Mulder, AAS Paper 06-194, 16th AAS/AIAA Space 

Flight Mechanics Conference, 22-26 January 2006, Tampa, Florida 

2) “GN&C Technology Demonstrated by the Orbital Express Autonomous Rendezvous and 

Capture Sensor System”, T. Weismuller and M. Leinz, AAS Paper 06-016, 29th Annual AAS 

Guidance and Control Conference, 4-8 February 2006, Breckenridge, Colorado
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

31 of 32 

NESC Request No.: 10-00628 

3) “Orbital Express Autonomous Rendezvous and Capture Sensor System (ARCSS) Flight Test 

Results”, Manny R. Leinz, et al., AAS Paper 07-408, 2007 AAS/AIAA Astrodynamics 

Specialists Conference, 19-23 August 2007, Mackinac Island, Michigan 

4) “Orbital Express Advanced Video Guidance Sensor: Ground Testing, Flight Results and 

Comparisons”, Robin M. Pinson, Richard T. Howard and Andrew F. Heaton, AIAA Paper 

2008-7318, 2008 AIAA/AAS Astrodynamics Specialists Conference and Exhibit, 18-21 

August 2008, Honolulu, Hawaii

5) “Orbital Express Autonomous Rendezvous and Capture Flight Operations – Part 1 of 2: 

Mission Description, AR&C Exercises 1, 2 and 3”, Tom A. Mulder, AAS Paper 08-209, 18th 

AAS/AIAA Space Flight Mechanics Meeting, 27-31 January 2008, Galveston, Texas 

6) “Orbital Express Autonomous Rendezvous and Capture Flight Operations – Part 2 of 2: 

AR&C Exercises 4, 5 and End-of-Life”, Tom A. Mulder, AIAA Paper 2008-6768, 2008 

AIAA/AAS Astrodynamics Specialists Conference and Exhibit, 18-21 August 2008, 

Honolulu, Hawaii 

7) Vallado, D. A. Fundamentals of Astrodynamics and Applications, 2nd ed., p. 661, Microcosm 

Press/Kluwar, 2001. 

8) Tapley, B.D., B.E. Schutz, and G.H. Born. Statistical Orbit Determination, p. 211, Elsevier, 

2004.

9) Jazinwski, A.H. Stochastic Processes and Filtering Theory, pp. 339-365, Academic Press, 

1970.

10) Brown, R.G. and P.Y.C. Hwang. Introduction to Random Signals and Applied Kalman 

Filtering, 2nd ed., pp. 393-398, Wiley, 1992. 

11) “Space Shuttle Rendezvous and Proximity Operations Experience Report,” John L. 

Goodman, JSC-49626, NASA Johnson Space Center, February 2003. 

12) “Underweighting Nonlinear Measurements,” Renato Zanetti, Kyle J. DeMars, and Robert H. 

Bishop, Journal of Guidance, Control and Dynamics Vol. 33, No. 5, pp. 1670-1675. 

13) “Navigation Technical History with Lessons Learned,” John L. Goodman, JSC-63653, 

NASA Johnson Space Center, April 2007. 
NASA Engineering and Safety Center 

Technical Assessment Report 

Document #: 

NESC-RP10-00628

Version: 

1.0

Title:

Orbital Express Rendezvous Lessons Learned 

Page #: 

32 of 32 

NESC Request No.: 10-00628 

14) “Summary of Gemini Rendezvous Experience”, Glynn S. Lunney, AIAA Paper 67-272, 

AIAA Flight Test, Simulation and Support Conference, Cocoa Beach, Florida, 6-8 February 

1967

15) M.Mokuno, I.Kawano, T.Kasai "Experimental Results of Autonomous Rendezvous Docking 

on Japanese ETS-VII Satellite", AAS-99-022, Proceedings of the 22nd Annual AAS 

Guidance and Control Conference, 3-7 February 1999, Breckenridge, Colorado.

16) “Overview of the DART Mishap Investigation Results (For Public Release)”,

http://www.nasa.gov/pdf/148072main_DART_mishap_overview.pdf, September 2005 

17) “XSS-11 Micro Satellite”, http://www.kirtland.af.mil/shared/media/document/AFD-070404-

108.pdf, December 2005 
REPORT DOCUMENTATION PAGE Form Approved

OMB No. 0704-0188

2. REPORT TYPE 

Technical Memorandum

 4. TITLE AND SUBTITLE

A Summary of the Rendezvous, Proximity Operations, Docking, and 

Undocking (RPODU) Lessons Learned from the Defense Advanced 

Research Project Agency (DARPA) Orbital Express (OE) Demonstration 

System Mission

5a. CONTRACT NUMBER

 6. AUTHOR(S)

Dennehy, Cornelius J.; Carpenter, J. Russell

 7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES)

NASA Langley Research Center

Hampton, VA 23681-2199

 9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES)

National Aeronautics and Space Administration

Washington, DC 20546-0001

 8. PERFORMING ORGANIZATION

 REPORT NUMBER

L-20025 NESC-RP-10-00628

10. SPONSOR/MONITOR'S ACRONYM(S)

NASA

13. SUPPLEMENTARY NOTES

12. DISTRIBUTION/AVAILABILITY STATEMENT

Unclassified - Unlimited

Subject Category 16-Space Transportation and Safety

Availability: NASA CASI (443) 757-5802

19a. NAME OF RESPONSIBLE PERSON

STI Help Desk (email: help@sti.nasa.gov)

14. ABSTRACT

The Guidance, Navigation, and Control (GN&C) Technical Discipline Team (TDT) sponsored Dr. J. Russell Carpenter, a 

Navigation and Rendezvous Subject Matter Expert (SME) from NASA's Goddard Space Flight Center (GSFC), to provide 

support to the Defense Advanced Research Project Agency (DARPA) Orbital Express (OE) rendezvous and docking flight test 

that was conducted in 2007. When that DARPA OE mission was completed, Mr. Neil Dennehy, NASA Technical Fellow for 

GN&C, requested Dr. Carpenter document his findings (lessons learned) and recommendations for future rendezvous missions 

resulting from his OE support experience. This report captures lessons specifically from anomalies that occurred during one of 

OE's unmated operations.

15. SUBJECT TERMS

Guidance, Navigation, and Control; Orbital Express; rendezvous and docking flight test; NASA Engineering and Safety 

Center

18. NUMBER

 OF 

 PAGES

37

19b. TELEPHONE NUMBER (Include area code)

(443) 757-5802

a. REPORT

U

c. THIS PAGE

U

b. ABSTRACT

U

17. LIMITATION OF 

 ABSTRACT

UU

Prescribed by ANSI Std. Z39.18

Standard Form 298 (Rev. 8-98)

3. DATES COVERED (From - To)

5b. GRANT NUMBER

5c. PROGRAM ELEMENT NUMBER

5d. PROJECT NUMBER

5e. TASK NUMBER

5f. WORK UNIT NUMBER

869021.03.07.01.03

11. SPONSOR/MONITOR'S REPORT

 NUMBER(S)

NASA/TM-2011-217088

16. SECURITY CLASSIFICATION OF:

The public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, 

gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this 

collection of information, including suggestions for reducing this burden, to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and 

Reports (0704-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person 

shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. PLEASE DO NOT RETURN YOUR FORM TO THE ABOVE ADDRESS.

1. REPORT DATE (DD-MM-YYYY)

01- 04 - 2011