Instrument Host Overview
 
========================
 
[From JONES&GIOVAGNOLI1997]:
 
The Huygens Probe is the ESA-provided element of the joint NASA/ESA
Cassini/Huygens mission to Saturn and Titan, the planet's largest
moon. The industrial Phase B activities began in January 1991 under
the leadership of Aerospatiale, the Huygens prime contractor.
 
The Probe was carried to Titan by the Cassini Saturn Orbiter. Huygens
was dormant during the interplanetary journey of 6.7 years, although
it was activated about every 6 months to verify and monitor its
health. It was released 22 days before the Titan encounter. The
Probe's aeroshell decelerated it in less than 3 min from the entry
speed of about 6 km/s to 400 m/s (Mach 1.5) by 150-180 km altitude.
From that point onwards, a pre-programmed sequence triggered parachute
deployment and heatshield ejection. The main part of the scientific
mission then started, lasting for the whole descent of 2-2.5 h. The
Huygens model philosophy was optimised to achieve the most complete
verification possible that the Probe system meets the mission
requirements within the cost envelope and the tight schedule
constraints imposed by the launch window. Four models were developed
at system level:
 
1. Structural, Thermal & Pyro Model (STPM): to qualify the Probe
design (including all mechanisms activated by pyrotechnic devices) for
all structural, mechanical and thermal requirements;
 
2. Electrical Model (EM): to verify the electrical performances of the
Probe and of the electrical/functional interfaces with the Orbiter;
 
3. Special Model (SM2): used for the balloon drop test in May 1995.
All the mechanisms and the descent control systems were
flight-standard;
 
4. Flight Model (FM).
 
Overall Configuration
---------------------
 
The Probe System comprises two principal elements:
 
1. the 318 kg Huygens Probe, which enters Titan's atmosphere after
  separating from the Saturn Orbiter;
 
2. the 30 kg Probe Support Equipment (PSE), which remains attached to
  the Orbiter after Probe separation.
 
 
The Probe consists of the Entry Assembly (ENA) cocooning the Descent
Module (DM). ENA provides Orbiter attachment, umbilical separation and
ejection, cruise and entry thermal protection, and entry deceleration
control. It is jettisoned after entry, releasing the Descent Module.
The DM comprises an aluminium shell and inner structure containing all
the experiments and Probe support subsystems, including the parachute
descent and spin control devices.
 
The PSE consists of:
 
1. four electronic boxes aboard the Orbiter: two Probe Support
  Avionics (PSA), a Receiver Front End (RFE) and a Receiver Ultra
  Stable Oscillator (RUSO);
 
2. the Spin Eject Device (SED);
 
3. the harness (including the umbilical connector) providing power and
  RF and data links between the PSA, Probe and Orbiter.
 
 
 
 
Front Shield Subsystem (FRSS)
-----------------------------
 
The 79 kg, 2.7 m diameter, 60 degree half-angle coni-spherical Front
Shield will decelerate the Probe in Titan's upper atmosphere from
about 6 km/s at entry to a velocity equivalent to about Mach 1.5 by
around 160 km altitude. Tiles of AQ60 ablative material, a felt of
silica fibres reinforced by phenolic resin, provide protection against
the 1 MW/m2 thermal flux. The shield is then jettisoned and the
Descent Control Subsystem (DCSS) is deployed to control the descent of
the DM to the surface.
The FRSS supporting structure is a CFRP honeycomb shell which also
provides some DM thermal protection during entry. The AQ60 tiles are
attached to the CFRP structure by adhesive CAF/730. Prosial, a
suspension of hollow silica spheres in silicon elastomer, is sprayed
directly on to the aluminium structure of the FRSS rear surfaces,
where fluxes are ten times lower.
 
Back Cover Subsystem (BCSS)
---------------------------
 
The Back Cover protects the DM during entry, ensures depressurisation
during launch and carries multi-layer insulation (MLI) for the cruise
and coast phases. As it does not have stringent aerothermodynamic
requirements, it is a stiffened aluminium shell of minimal mass (11.4
kg) protected by Prosial (5 kg). It includes: an access door for late
integration and forced-air ground cooling of the Probe; a break-out
patch through which the first (drogue) parachute is fired; a labyrinth
sealing joint with the Front Shield, providing a non-structural
thermal and particulate barrier.
 
Descent Control Subsystem (DCSS)
--------------------------------
 
The DCSS controls the descent rate to satisfy the scientific payload's
requirements, and the attitude to meet the requirements of the Probe-
Orhbiter RF data link and of the descent camera's image-taking.
The DCSS is activated nominally at Mach 1.5 and about 160 km altitude.
The sequence begins by firing the Parachute Deployment Device (PDD) to
eject the pilot 'chute pack through the Back Cover's break-out patch,
the attachment pins of which shear under the impact. The 2.59 m
diameter Disk Gap Band (DGB) pilot 'chute inflates 27 m behind the DM
and pulls the Back Cover away from the rest of the assembly. As it
goes, the Back Cover pulls the 8.30 m diameter DGB main parachute from
its container. This canopy inflates during the supersonic phase to
decelerate and stabilise the Probe through the transonic region. The
Front Shield is released at about Mach 0.6. In fact, the main
parachute is sized by the requirement to provide sufficient
deceleration to guarantee a positive separation of the Front Shield
from the Descent Module.
The main parachute is too large for a nominal descent time shorter
than 2.5 h, a constraint imposed by battery limitations, so it is
jettisoned and a 3.03 m diameter DGB stabilising parachute is
deployed. All parachutes are made of Kevlar lines and nylon fabric.
The main and stabiliser 'chutes are housed in a single canister on the
DM's top platform. Compatibility with the Probe's spin is ensured by
incorporating a swivel using redundant low-friction bearings in the
connecting riser of both the main and stabiliser 'chutes.
 
Separation Subsystem (SEPS)
---------------------------
 
SEPS provides: mechanical and electrical attachment to, and separation
from the Orbiter; the transition between the entry configuration
('cocoon') and the descent configuration (DM under parachute). The
three SEPS mechanisms are connected on one side to Huygens' Inner
Structure (ISTS) and on the other to the Orbiter's supporting struts.
As well as being the Probe-Orbiter structural load path, each SEPS
fitting incorporates a pyronut for Probe-Orbiter separation, a rod
cutter for Front Shield release and a rod cutter for Back Cover
release.
 
Within SEPS, the Spin Eject Device (SED) performs the mechanical
separation from the Orbiter:
 
- three stainless steel springs provide the separation force
- three guide devices, each with two axial rollers running along a
  T-profile helical track, ensure controlled ejection and spin, even
  in degraded cases such as high friction or a weak spring
- a carbon fibre ring accommodates the asymmetrical loads from the
  Orbiter truss and provides the necessary stiffness before and after
  separation
- three pyronuts provide the mechanical link before separation.
 
In addition, the Umbilical Separation Mechanism of three 19-pin
connectors, which provide Orbiter-Probe electrical links, is
disconnected by the SED.
 
Inner Structure Subsystem (ISTS)
--------------------------------
 
The ISTS provides mounting support for the Probe's payload and
subsystems. It is fully sealed except for a vent hole of about 6 cm2
on the top, and comprises:
 
- the 73 mm thick aluminium honeycomb sandwich Experiment Platform;
  supports the majority of the experiments and subsystems units,
  together with their associated harness
- the 25 mm thick aluminium honeycomb sandwich Top Platform; supports
  the Descent Control Subsystem and Probe RF antennas, and forms the
  DM's top external surface
- the After Cone and Fore Dome aluminium shells, linked by a central
  ring
- three radial titanium struts; interface with SEPS and ensure thermal
  decoupling, while three vertical titanium struts link the two
  platforms and transfer the main parachute deployment loads
- 36 spin vanes on the Fore Dome's periphery; provide spin control
  during descent
- the secondary structure; for mounting experiments and equipment.
 
Thermal Subsystem (THSS)
------------------------
 
While the PSE is thermally controlled by the Orbiter, the Probe's THSS
must maintain all experiments and subsystem units within their allowed
temperature ranges during all mission phases. In space, the THSS
partially insulates the Probe from the Orbiter and ensures only small
variations in the Probe's internal temperatures, despite the incident
solar flux varying from 3800 W/m2 (near Venus) to 17 W/m2 (approaching
Titan after 22 days of the coast phase following Orbiter separation).
Probe thermal control is achieved by:
- MLI surrounding all external areas, except for the small 'thermal
  window' of the Front Shield
- 35 Radioisotope Heater Units (RHUs) on the Experiment and Top
  Platforms continuously providing about 1 W each even when the Probe
  is dormant
- a white-painted 0.17 m2 thin aluminium sheet on the Front Shield's
  forward face acting as a controlled heat leak (about 8 W during
  cruise) to reduce sensitivity of thermal performances to MLI
  efficiency.
 
The MLI is burned and torn away during entry, leaving temperature
control to the AQ60 high-temperature tiles on the Front Shield's front
face, and to Prosial on the Front Shield's aft surface and on the Back
Cover.
During the descent phase, thermal control is provided by foam
insulation and gas-tight seals. Lightweight open-cell Basotect foam
covers the internal walls of DM's shells and Top Platform. This
prevents convection cooling by Titan's cold atmosphere (70 K at 45 km
altitude) and thermally decouples the units mounted on the Experiment
Platform from the cold aluminium shells. Gas-tight seals around all
elements protruding through the DM's shell minimise gas influx. In
fact, the DM is gas tight except for a single 6 cm2 hole in Top
Platform that equalises pressure during launch and descent to Titan's
surface.
 
Electrical Power Subsystem (EPSS)
=================================
 
Description
-----------
 
The EPSS consists of:
 
- Five batteries: Provide mission power from Orbiter separation until
  at least 30 min after arrival on Titan's surface. Each battery
  comprises two modules of 13 LiSO2 (7.6 Ah) cells in series.
- Power Conditioning & Distribution Unit (PCDU): Provides the power
  conditioning and distribution to the Probe's equipment and
  experiments via a regulated main bus, with protection to ensure
  uninterrupted operations even in the event of single failure inside
  or outside the PCDU.
  During the cruise phase, the Probe is powered by the Orbiter and the
  PCDU isolates the batteries. The five interface circuits connected
  to the Orbiter's Solid State Power Switches (SSPSs) provide Probe-
  Orbiter insulation and voltage adaptation between the SSPS output
  and the input of the PCDU's Battery Discharge Regulator (BDR)
  circuits. The BDRs condition the power from either the Orbiter or
  the batteries and generate the 28 V bus, controlled by a centralised
  Main Error Amplifier (MEA). The distribution is performed by active
  current limiters, with the current limitation adapted for each user
  and with ON/OFF switching capability. The Mission Timer, however, is
  supplied by three switchable battery voltage lines through series
  fuses or, when the PCDU is powered by the Orbiter, by dedicated
  output voltage lines of the Orbiter interface circuits.
  The PCDU also provides a protected +5 V supply used by the Pyro unit
  to generate the bi-level status telemetry of the selection relays
  and for the activation circuit that switches ON the Pyro unit's
  energy intercept relay.
- Pyro Unit (PYRO): Provides two redundant sets of 13 pyro lines,
  directly connected to the centre taps of two batteries (through
  protection devices), for activating pyro devices. Safety
  requirements are met by three independent levels of control relays
  in series in the Pyro Unit, as well as active switches and current
  limiters controlling the firing current. The three series relay
  levels are: energy intercept relay (activated by PCDU at the end of
  the coast phase); arming relays (activated by the arming timer
  hardware); selection relays (activated by Command and Data
  Management Unit, CDMU, software). In addition, safe/arm plugs are
  provided on the unit itself for ground operations.
 
Operational modes
-----------------
 
- Cruise phase: The EPSS is completely OFF over the whole cruise
  phase, except for periodic checkout operations. There is no power at
  the Orbiter interface and direct monitoring by the Orbiter allows
  verification that all the relays are open.
- Cruise phase checkout: The EPSS is powered by the Orbiter for cruise
  checkout operations. The 28 V bus is regulated by the EPSS BDRs
  associated with each Orbiter SSPS; a total of 210 W is available
  from the Orbiter and all the relays are open.
- Timer loading: Following the loading (from the Orbiter) of the
  correct coast time duration into the Mission Timer Unit, battery
  depassivation is performed to overcome any energy loss due to ageing
  during cruise. Before Probe separation, the EPSS timer relays are
  closed to supply the Mission Timer from the batteries and the
  Orbiter power is switched off.
- Coast phase: Only the Mission Timer is supplied by batteries through
  specific timer relays during the coast phase. The EPSS is OFF and
  all other relays are open.
- End of coast phase - Probe wake-up: At the end of the coast phase,
  the Mission Timer wakes the Probe by activating the EPSS. Input
  relays are closed and the current limiters powering the CDMU are
  automatically switched ON as soon as the 28 V bus reaches its
  nominal value (other current limiters are initially OFF at power
  up). The pyro energy intercept relay is also automatically switched
  on by a command from the PCDU.
- Entry and descent phases: All PCDU relays are closed and the total
  power (nominal 300 W, maximum 400 W) is available on the 28 V
  distribution outputs to subsystems and equipment. The Pyro Unit
  performs the selection and the firing of the squibs, activated by
  CDMU commands.
 
Command & Data Management Subsystems (CDMS)
===========================================
 
The data handling and processing functions are divided between the
Probe Support Equipment (PSE) on the Orbiter and the CDMUs (part of
the CDMS) in the Probe. The Probe Data Relay Subsystem (PDRS) provides
the RF link function for this purpose, together with the data handling
and communication function with the Orbiter's Control and Data
Subsystem (CDS) via a Bus Interface Unit (BIU). (During the ground
operations and cruise phase checkouts, the Orbiter-Probe RF link is
replaced by umbilical connections.)
The CDMS has two primary functions: autonomous control of Probe
operations after separation; management of data transfer from the
equipment, subsystems and experiments to the Probe transmitter for
relay to the Orbiter. For these functions, the CDMS uses the Probe
On-board Software (POSW), for which it provides the necessary
processing, storage and interface capabilities.
The driving requirement of the CDMS design is intrinsic single point
failure-tolerance. As a result of the highly specific Huygens mission
(limited duration and no access by telecommand after separation), a
very safe redundancy scheme has been selected. The CDMS comprises:
- two identical CDMUs
- a triply redundant Mission Timer Unit (MTU)
- two mechanical g-switches (backing up MTU)
- a triply redundant Central Acceleration Sensor Unit (CASU)
- two sets of two mechanical g-switches (backing up CASU)
- a Radial Acceleration Sensor Unit (RASU) with two accelerometers
- two Radar Altimeter proximity sensors, each comprising separate
  electronics, transmit antenna and receive antenna
The two CDMUs each execute their own POSW simultaneously and are
configured with hot redundancy (Chain A and Chain B). Each hardware
chain can run the mission independently. They are identical in almost
all respects; the following minor differences facilitate simultaneous
operations and capitalise on the redundancy:
- telemetry is transmitted at two different RF frequencies
- chain B telemetry is delayed by about 6 s to avoid loss of data
  should a temporary loss of the telemetry link occur (e.g. from an
  antenna misalignment as the Probe oscillates beneath the parachute).
Each CDMU chain incorporates a health check (called the Processor
Valid status) which is reported to the experiments in the Descent Data
Broadcasts (DDBs). A chain declares itself invalid when two bit errors
in the same memory word, an ADA exception or an under-voltage on the 5
V line occur within the CDMU.
 
Command and Data Management Unit (CDMU)
---------------------------------------
 
Each CDMU includes a MAS 281 16-bit 1750A micro-processor running at
10 MHz, with 64 kword PROM storing the POSW and 64 kword RAM used for
the POSW and other dynamic data when the CDMU is on. A Memory
Management Unit is implemented to provide memory flexibility and some
growth potential. Direct Memory Access (DMA) is provided to facilitate
data transfer between the memory and the input/output registers, thus
relieving the microprocessor of repetitive input/output tasks. The
RAM-stored program memory is protected against single error occurrence
by an Error Detection And Correction (EDAC) device, which detects and
corrects single bit errors and reports any double bit errors to the
Processor Valid function.
TM/TC management is based on an internal On-Board Data Handling (OBDH)
bus in order to standardise the internal interfaces, which are based
on the classical Central Terminal Unit (CTU) and Remote Terminal Units
(RTUs) approach.
In addition to conventional CDMS functions, the CDMUs implement the
following Huygens-specific functions:
- the arming timer function sends pyro and arming commands following a
  specific hardware-managed timeline, thus offering full decoupling
  from the POSW operation
- the Processor Valid signal is sent to experiments via the Descent
  Data Broadcast (DDB), indicating the health of the nominal CDMU
  (unit A)
- reprogrammability through the use of 16 kword of Electrically
  Erasable PROM (EEPROM), thus allowing patching of the POSW if
  necessary
- the EDAC error count reports on internal data transfers
- the capability, through specific 16 kword of RAM, to delay one
  telemetry chain.
 
Mission Timer Unit (MTU)
------------------------
 
The MTU is used to activate the Probe at the end of the coast phase.
To obtain a single point failure-free design, it is based on three
independent hot redundant timer circuits followed by two hot-redundant
command circuits. Two mechanical g-switches provide backup. MTU power
is supplied directly via three 65 V supply lines, one for each Timer
Board, from independent batteries. During the pre-separation
programming activities, when the Probe is still connected to the
Orbiter, all three Timers are programmed with the exact duration of
the coast phase via serial memory load interfaces from one of the two
CDMUs. Each of the three Timer Boards can be loaded independently from
either CDMU. The programmed values can be verified by the serial
telemetry channels. When programming is finished, the CDMUs and all
other Probe systems except the MTU are turned off and the Probe is
separated.
During the coast phase of about 22 days, the programmed Timer register
is decremented by a very precise clock signal. The MTU consumes about
300 mW during this period as only the necessary circuits (CMOS-based)
are powered. When the Command Board majority voting detects either
both g-switches active or at least two of the three 'time-out' signals
received, five High Level Commands (HLCs) are issued sequentially from
each Board to the PCDU in order to switch on both CDMUs. The timer
then returns to a standby mode.
The two g-switches, which ensure Probe wake-up in the event of
atmospheric entry without the time-out signal from any of the Timer
boards, are purely mechanical devices closed when deceleration reaches
5.5-6.5 g.
 
Central Acceleration Sensor Unit (CASU)
---------------------------------------
 
The CASU measures axial deceleration at the centre of the Experiment
Platform during entry. The signal is processed by the CDMU to
calculate the time for parachute deployment (T0). The CASU operates
within 0-10 g and uses a scale factor of 0.512 V/g. Its main building
blocks are:
1. Power circuit. Two hot-redundant input power lines make it single
   point failure-tolerant in both nominal and redundant power lines
2. Three accelerometer analogue signal conditioning blocks. A low-pass
   filter with a 2 Hz cutoff is used and the analogue output from each
   block is routed to both CDMUs. In addition, the design prevents
   failure propagation from one conditioning chain to the others, it
   withstands permanent short circuit conditions without any
   degradation, and it is single point failure-tolerant toward the
   input power supply line.
Back-up detection of T0 is performed separately for both CDMUs by two
pairs of mechanical g-switches in case the prime CASU system is
inoperative. The threshold values for each pair of g-switches are 5.5
g and 1.2 g.
 
Radial Acceleration Sensor Unit (RASU)
--------------------------------------
 
The RASU measures radial acceleration at the periphery of the
Experiment Platform. The signal is processed by the CDMU to provide
the Probe spin rate for insertion into the DDB distributed to
experiments. The RASU is designed to measure spin acceleration within
0-120 mg with a 41.67 V/g scale factor. The design is based on CASU's
but includes only two accelerometers.
 
Radar Altimeter Unit (RAU)
--------------------------
 
The RAU proximity sensor uses two totally redundant altimeters
operating with frequency-modulated carrier waves at 15.4 GHz and 15.8
GHz to measure altitude above Titan's surface, starting from about 25
km. Each of the four antennas (two per altimeter) is a planar slot
radiator array providing an antenna gain of 25 dB with a symmetrical
full beam width of 7.9 degrees. A continuous signal modulated in
frequency with a rising and falling ramp waveform is transmitted; the
received signal has a similar form, but delayed by the propagation
time. Hence the range to target is proportional (with a linear
frequency modulation ramp) to the instantaneous frequency shift
between the transmitted and received signals. Received signal data are
also provided to the Huygens Atmospheric Structure Instrument (HASI)
to establish Titan's surface roughness and topography.
 
Probe Data Relay Subsystem (PDRS)
=================================
 
The PDRS is Huygens' telecommunications subsystem, combining the
functions of RF link, data handling and communications with the
Orbiter. It transmits science and housekeeping data from the Probe to
the Orbiter's PSE, which are then relayed to the Orbiter CDS via a Bus
Interface Unit. In addition, the PDRS is responsible for TC
distribution from the Orbiter to the Probe by umbilical during the
ground and cruise checkouts. It comprises:
1. two hot-redundant S-band transmitters and two circularly polarised
   Probe Transmitting Antennas (PTAs) on the Probe
2. a Receiver Front End (RFE) unit (enclosing two Low Noise Amplifiers
   and a diplexer) and two Probe Support Avionics (PSA) units on the
   Orbiter.
The Orbiter's High Gain Antenna (HGA) acts as the PDRS receive
antenna. In addition, as part of the Doppler Wind Experiment (DWE),
two ultra stable oscillators are available as reference signal sources
to allow the accurate measurement of the Doppler shift in the Probe-
Orbiter RF link: the Transmitter Ultra Stable Oscillator (TUSO) on
Huygens and the Receiver Ultra Stable Oscillator (RUSO) on the
Orbiter.
The PDRS electrical architecture is fully channelised for redundancy,
except that TUSO and RUSO are connected to only one chain.
 
Probe Support Equipment (PSE)
-----------------------------
 
 Receiver Front End (RFE)
 ------------------------
 
The RFE comprises:
- two Low Noise Amplifiers (LNAs) linked to the Orbiter's HGA to
  amplify the acquired RF signal by 20 dB using two cascaded FET
  stages
- two RF inputs: one linked to the HGA, the other via a coupler and
  used during checkout to link a dedicated transmitter output (on the
  Probe) to the  RFE via the umbilical
- a pre-selection filter (coaxial cavity type with six poles)
- an isolator
- an output attenuator (fixed value)
In addition, owing to the HGA's shared use with the Orbiter, a band
pass filter (the TX filter) and a circulator protect the LNA chain B
by isolating the Orbiter's S-band transmissions and the Probe's S-band
reception, which both use the HGA. These two modes are mutually
exclusive.
 
 Probe Support Avionics (PSA)
 ----------------------------
 
The two RFE outputs are sent to the two PSAs, which perform detection,
acquisition (based on a 256-point Fast Fourier Transform algorithm),
tracking, signal demodulation and data handling & management. The PSA
data handling architecture is divided between analogue and digital
sections. The analogue section performs signal down-conversion from
S-band to the IF frequency. The IF signal is quantised and the samples
processed by the digital section. The digital section performs:
- the Digital Signal Processing (DSP) function - the signal
  acquisition and tracking task based on FFT analysis and frequency
  acquisition
- the Viterbi decoding of the digital signal and delivery of the
  decoded transfer frame to the data handling section at 8192 bit/s
- the data handling task, which consists of:
  - transforming the received transfer frame into a telemetry packet
  - generating internal PSA housekeeping data (including the
    synthesised frequency information) in a packet format
  - controlling and managing communications with the Orbiter CDS via a
    Bus Interface Unit
  - distributing the telecommands from the Orbiter BIU interface.
The digital section is composed of the following main modules:
- the receiver digital module, comprising the UT1750 microprocessor, 8
  kword RAM and 8 kword PROM, and the receiver signal processing ASIC
- the interface digital module, using GaAs devices for Numerically
  Controlled Oscillator (NCO) and Digital to Analogue Converter (DAC)
  functions
- the support interface circuitry module (SIC), which comprises: the 8
  kword EEPROM to memorise software patches; the 32 kword PROM
  containing the Support Avionics Software (SASW) and the testing,
  telecommand, telemetry and umbilical interfaces; the MAS 281
  microprocessor module used by the SASW
- the BIU module that controls communications between the PSA and the
  Orbiter's 1553 bus.
 
Probe Transmitting Terminal (PTT)
---------------------------------
 
The PTT comprises two transmitters and two Probe antennas. Each
transmitter includes Temperature Controlled Crystal Oscillator (TCXO)
synthesiser and BPSK modulator modules and a 10 W Power Amplifier
module using Automatic Level Control (ALC) for 40.2 dBm nominal output
power (end-of-life, worst-case, including ageing).
The reference oscillator for the Phase Locked Loop (PLL) synthesiser
is either an (internal) Voltage Controlled Crystal Oscillator (VCXO)
with a temperature compensating network or the (external) TUSO signal.
The selection between these reference sources is made before
separation from the Orbiter. The TUSO has priority unless a failure is
detected before separation.
The two transmitting antennas linked to the transmitters (dual chains
without cross-coupling) are quadrifilar helix designs. The four
spirals are fed at the bottom of the helix in phase quadrature. Left
Hand Circular Polarisation (LHCP) is used for signal transmission at
2040 MHz and Right Hand Circular Polarisation (RHCP) for transmission
at 2098 MHz. The minimum gain for the antennas, mounted on the Top
Platform, is 0.9 dB at all Probe-Orbiter aspect angles between +20
degrees and +60 degrees.
 
Probe data relay link budget
----------------------------
 
During Probe descent, starting from the time of atmospheric entry as
predicted from Orbiter trajectory and Probe separation
characteristics, the Orbiter HGA is controlled to track a fixed point
on Titan's surface - the nominal touchdown point. Orbiter movement
along its trajectory significantly reduces the 'space loss' due to
link distance during the Probe's 2-2.5 h descent. However, if Huygens
does not land at the nominal point, e.g. due to non-nominal entry
parameters or zonal winds, the gain from the reduced distance is
offset by the HGA's reduced gain from the off-axis angle of the Probe
with respect to the HGA's boresight axis.
The link budget worst cases occur at the beginning and end of mission.
The link design attempts to equalise the BOM/EOM signal level margins.
At BOM, the signal level is determined by the range, while the losses
owing to off-axis pointing is mainly due to HGA pointing error and
Probe delivery error (the additional dispersion arising from the entry
phase is relatively minor). At EOM, however, the signal level is
critically dependent on the descent duration: the off-axis pointing
losses due to the Probe's lateral drift in the assumed Titan wind
worsens with descent duration.
 
Software
========
 
Concept
-------
 
The Huygens software consists of that running in the Probe CDMS,
referred to as POSW, and that within the PSA on the Orbiter, referred
to as the Support Avionics Software (SASW). The POSW output telemetry
is relayed via the SASW and then Cassini's CDS to the ground. Two
copies of the data handling hardware (CDMU and PSA) run identical
copies of POSW and SASW.
The software is based on a top-down hierarchical and modular approach
using the Hierarchical Object-Oriented Design (HOOD) method and,
except for some specific low level modules, is coded in ADA. The
software consists, as much as possible, of a collation for synchronous
processes timed by a hardware reference clock (8 Hz repetition rate).
In order to avoid unpredictable behaviour, interrupt-driven activities
are minimised. Such a design also allows a better observability and
reliability of the software. Limited reprogramming accommodates
modifications and RAM failure recoveries.
The processes are designed to use data tables as much as possible.
Mission profile reconfiguration and experiment polling can therefore
be changed only by reprogramming these tables. This is possible via an
EEPROM. In order to avoid a RAM modification while the software is
running (which can lead to unpredictable behaviour and unnecessary
complexity), direct RAM patching is forbidden. The POSW communicates
with the SASW in different ways depending on mission phase. Before
Probe separation, the two software subsystems communicate via an
umbilical that provides both command and telemetry interfaces. Huygens
cannot be commanded after separation, and telemetry is transmitted to
the Orbiter via the PDRS RF link.
The overall operational philosophy is that the software runs the
nominal mission from power-up without checking its hardware
environment or the Probe's connection or disconnection. The specific
software actions or inhibitions required for ground or flight
check-out must therefore be invoked by special procedures, activated
by the delivery of specific telecommands to the software. To achieve
this autonomy, POSW's inflight modification is autonomously applied at
power-up by using a non-volatile EEPROM. At power-up, the POSW
validates the CDMU EEPROM structure and then applies any software
patches stored in the EEPROM before running the mission mode. If the
EEPROM proves to be invalid at start-up, no patches are applied and
the software continues based on the software in the CDMU ROM. A number
of other checks are also carried out at start-up (e.g. a DMA check and
a main ROM checksum), but the software will continue execution
attempts even if the start-up checks fail.
 
POSW functions
--------------
 
The POSW provides the following functions:
 
Probe Mission Management
 - detecting time T0 as entry begins, based on the Central
   Accelerometer Sensor Unit signals
 - forwarding commands at the correct times to the subsystems and
   experiments according to the pre-defined mission timeline
 - computation of the spacecraft dynamical state from sensor readings
 - sending Descent Data Broadcasts to the experiments
 
Telemetry Management
 - collecting and recording housekeeping data
 - generation of housekeeping packets from the housekeeping data
 - collecting experiment packets according to a pre-defined polling
   scheme
 - transmitting transfer frames to the PDRS
 
Telecommand Management
 - reception of TC packets from the PSE (only while attached to the
   Orbiter)
 - execution of commands related to these TC packets
 - forwarding of commands to the experiments
 
POSW operations
---------------
 
Control of the Probe, involving the activation and forwarding of
commands to experiments and subsystems, is driven by a pre-defined set
of tables, the Mission Timeline Tables (MTTs), that define the actions
to be performed as a function of time. The pre-T0 MTT is activated at
Probe wake-up, and controls the Probe until the post-T0 MTT is
activated by the POSW's detection of T0.
The experiments perform most of their activities autonomously based on
the mission phase data computed within the POSW and sent to all the
experiments every 2 s as a Data Descent Broadcast packet. The DDB
contains the time, spin rate (computed by the POSW from the RASU
signal or, in the event of failure, from a pre-defined look-up table)
and altitude (initially taken from a look-up table based on the time
elapsed since T0, but later by processing RAU data.
The telemetry management function involves the acquisition and
transmission of Probe telemetry as standard packets. Whether they are
housekeeping or experiment packets, they are all 126 bytes long and
forwarded to the SASW in the form of transfer frames comprising header
information followed by seven packets and then Reed-Solomon code
words, making a total frame size of 1024 bytes.
Housekeeping data are acquired from the subsystems (and from the
software itself) at different rates according to a pre-determined
packet layout, and are loaded into four packets every 16 s. One of the
packet types is buffered and issued 6.4 min later as 'History'
housekeeping.
Experiment data are acquired according to a pre-defined polling
strategy and  the resulting packets are loaded into the transfer
frames. The selection of an appropriate type of telemetry packet to
include in each of the frame's seven slots is managed by the polling
sequence mechanism on a major acquisition cycle of 16 s (equal to 128
Computer Unit Times) driven by the Polling Sequence Table (PST) and
the Experiment Polling Table (EPT). The PST defines if housekeeping or
experiment packets are to be included in the transfer frame currently
under construction. However, it does not select which experiment is to
be included. The EPT defines a prioritised scheme for the collection
of experiment data. The table is invoked whenever the PST requests
experiment data for the transfer frame and is read in a cyclical
manner. It consists of a sequential list of the Huygens experiments,
with the number of occurrences of each experiment in the table
providing the polling priority.
By this method, the CDMS and the POSW are protected against failure
modes in the experiments that could affect the data production rates.
Each experiment is guaranteed an opportunity to supply data at, as a
minimum, its nominal data rate. Furthermore, this polling scheme
automatically optimises the data return by reallocating the TM
resource in the absence of a 'packet ready' status flag from an
experiment when expected.
Three EPTs provide different polling priorities during the descent's
various stages, switching from one table to the next at a pre-set
time.
 
SASW functions
--------------
 
The SASW's main purpose is to provide communications between the
Orbiter and Probe. For the SASW, there is no difference between
receiving Probe telemetry via the umbilical or via the RF subsystem.
All the differences are handled by the PDRS receiver part of the PSA
equipment. The SASW provides the following functions:
Telecommand Management
 - reception of TC packets from the BIU interfacing with the Orbiter
   CDS
 - execution of commands related to these TC packets
 - forwarding TC packets to the CDMS (including experiment
   telecommands) while attached to the Orbiter
Telemetry Management
 - collecting PSE housekeeping data
 - transmitting PSE housekeeping packets and modified CDMS frames to
   the Orbiter via the BIU
 
SASW operations
---------------
 
Communication between the SASW and the Orbiter CDS is via a
MIL-STD-1553 bus using a BIU. Received telecommands are placed in BIU
memory for the SASW to read; the SASW places telemetry packets in BIU
memory for transmission by the BIU over the CDS bus. The SASW examines
any received telecommands to determine their destination address.
Those destined for the Probe (subsystems or experiments) are
transmitted over the umbilical TC link. Those for the PSA are handled
by the SASW.
The SASW handles the reception of Probe telemetry via a Frame Data
Interface (FDI). Telemetry from the Probe is transmitted to the SASW
either by the umbilical RF link when the probe is connected or by the
Probe Relay Link (PRL) after separation. The SASW also generates its
own telemetry in the form of housekeeping packets, containing PSA
status information, and status data collected from the PDRS subsystem.
 
 
[From LEBRETONETAL2005]:
 
Launch and Flight to Saturn
---------------------------
 
The Cassini-Huygens spacecraft was launched from Cape Canaveral
complex in Florida on 15 October 1997, with the probe mated onto the
side of the orbiter. In this configuration, the orbiter provided
electrical power to the probe through an umbilical connection.
Commands and data were also exchanged by this route. During the seven-
year journey to Saturn, the Huygens probe was subjected to 16
in-flight checkouts to monitor the health of its subsystems and
scientific instruments. During these in-flight tests, maintenance
performed and calibration data were obtained in preparation for the
mission at Titan. The special in-flight tests designed to characterize
the communication radio link between the probe and the orbiter were
especially important.
In the first link test in 2000, a flaw was discovered in the design of
the Huygens telemetry receiver on board the orbiter that would have
resulted in the loss of a large fraction of the Huygens probe's
scientific data during the actual mission at Titan. Originally the
Huygens mission was planned to be executed at the end of the first
orbit around Saturn. As a remedy to the radio receiver flaw, the first
two orbits of the original mission were redesigned into three shorter
orbits that enabled the Huygens mission to be carried out on the third
orbit. The re-designed orbiter trajectory provided a Doppler shift on
the probe-orbiter radio link that was compatible with the well-
characterized receiver performance and it also smoothly reconnected
with the already-designed post-Huygens orbiter four-year trajectory.
As a bonus, the new trajectory allowed early orbiter observations of
Titan's upper atmosphere in order to validate the so-called Titan
atmosphere engineering model well before the Huygens probe release. It
led to improvements in our knowledge of the structure and the
composition of the upper atmosphere; in particular, it provided better
constraints on the argon concentration and indicated that methane was
not present in sufficient quantity to affect the probe entry adversely
(that is, via excessive radiative heating). Indeed, the new mission
scenario led to the Huygens mission being completely successful. This
achievement was the culmination of more than 20 years of work and
shows that the in-flight rework of the mission was necessary and was
successfully implemented.
 
Probe release
-------------
 
In preparation for releasing the probe, the Cassini-Huygens spacecraft
had been set on a Titan-impact trajectory. Following its release, the
Huygens probe had no manoeuvring capability and had to function
autonomously. The Huygens release trajectory was achieved via a 'probe
targeting manoeuvre' with a speed adjustment of 12 m/s on 17 December
2004, followed by a 'probe targeting clean-up manoeuvre' on 23
December 2004. After the separation of the Huygens probe on 25
December at 02:00 UTC, Cassini performed an 'orbiter deflection
manoeuvre', so that it would not crash into Titan, and a 'clean-up
manoeuvre' for final adjustment of its trajectory. These were on 28
December 2004 and 03 January 2005 respectively and placed Cassini on
the correct trajectory for receiving data from the Huygens probe
during the descent. The responsibilities for meeting the probe's
trajectory requirements were shared between NASA/JPL and ESA. The
targeting of the probe, the NASA/JPL responsibility, was specified at
an altitude of 1,270 km, very close to the atmosphere's upper layer,
above which no significant drag was expected. From this point onward
ESA was responsible for the probe's trajectory.
The spring-loaded Huygens separation mechanism, called the Spin Eject
Device, had three points of attachment to the probe. It provided a
speed increment relative to the orbiter of 33 cm/s. The Spin Eject
Device also imparted to the probe an anti-clockwise spin of 7.5 r.p.m.
(when viewed from the orbiter). This provided inertial stability
during the ballistic trajectory and atmospheric entry.
 
Coast and probe 'wake up'
-------------------------
 
The Huygens probe was set on a ballistic trajectory that took a little
over 20 days. During this time, the probe was dormant, with only three
redundant timers counting down to a specific time programmed to end 4
h and 23 min before the predicted entry. At this time, battery power
was turned on and the on-board computers, their sensors
(accelerometers, and later in the descent the radar altimeters), and
the scientific instruments were energized according to the pre-
programmed sequence. The probe 'woke up' as planned, at 04:41:33 UTC
on 14 January 2005. The Huygens probe's receivers on board the Cassini
orbiter were powered on from 06:50:45 to 13:37:32 UTC. The Huygens
probe arrived at the 1,270 km interface altitude on the predicted
trajectory on 14 January 2005 at 09:05:53 UTC, just a few seconds
before the expected time.
 
Entry, descent and landing
--------------------------
 
The Huygens scientific mission proper took place during the entry,
descent, landing and post-landing phases. The descent of the probe
through Titan's atmosphere was controlled by parachutes. The
aerodynamic conditions under which the main parachute had to be
deployed were critical. The correct instant for parachute deployment
(mission time event, T0) was determined by the probe on-board
computers that processed the measurements from the accelerometers that
monitored the probe's deceleration. Pyrotechnic devices fired a mortar
that pulled out a pilot chute, which in turn removed the probe's back
cover and pulled out the main parachute. Then, 30 s later, the front
shield was released. It was expected that, by this time, the probe
would have stabilized under the main parachute. During the entry
phase, telemetry could not be transmitted by the probe until its back
cover was removed. Thus, a limited set of engineering housekeeping
data and the HASI science accelerometer data acquired during entry was
stored onboard the probe for transmission to the orbiter after the
radio link was established.
Post-flight data analysis showed that only one of the receivers
(channel B) was phase-locked and functioned properly. Channel A had an
anomaly that was later identified as being due to the unfortunate
omission of the telecommand to apply power to the ultra-stable
oscillator driving the channel A receiver. Subsequent on-board events
were determined by the on-board software that initiated a set of
commands at times all related to the moment the pilot chute was
released. These commands included switching on other instruments and
the replacement of the main parachute by a smaller 'stabiliser chute'
after 15 min, to ensure that the probe would reach the surface of
Titan within the designed duration of the mission (150 min maximum for
the descent under parachute). The actual duration of the descent
following the T0 event was 2 h 27 min 50 s. During the first part of
the descent, the probe followed the nominal time-based sequence with
the instrument operations defined by commands in the on-board mission
timeline. The later part of the descent sequence was optimized by
taking into account the altitude measurements provided by two
redundant radar altimeters. The altimeters were switched on 32 min
after T0 which corresponded to an altitude of around 60 km. They
provided altitude measurements to the on-board computers, which
filtered and compared the measurements to the predicted altitude, in
order to exclude erratic measurements at high altitude and to provide
reliable measured altitude information to the payload instruments.
This allowed for optimization of the measurements during the last part
of the descent. The DISR measurements sequence was adjusted to
measured altitude below 10 km and its lamp was switched on at 700 m
above the surface. The HASI and SSP instruments were set to their
proximity and surface modes at low altitude above the surface. The
probe landed safely with a vertical speed of about 5 m/s and continued
thereafter to transmit data for at least another 3 h 14 min, as
determined the detection and monitoring of the probe's 2.040-GHz
carrier signal by the Earth-based radio telescopes. Throughout this
time, Cassini was oriented to receive the two incoming radio signals
from the probe by continuously pointing its high gain antenna to the
predicted Huygens landing point. After listening for the longest
possible duration of the Huygens probe's visibility, the orbiter was
commanded to re-point its high gain antenna to Earth for transmission
of the stored Huygens telemetry data. At that time, Cassini was at a
distance of 1,207 million kilometres (8.07 AU) from the Earth (the
one-way light-time was 67 min 6 s).
The data were received by the ground stations of the NASA Deep Space
Network (DSN) and eventually delivered to the Huygens Probe Operations
Centre (HPOC) in ESA's European Space Operation Centre (ESOC,
Darmstadt, Germany) for science and engineering analysis. A 1-h margin
was built into the orbiter sequence to cope with uncertainties as to
when the orbiter would disappear below the horizon. As seen from the
probe landing site, the orbiter actually set below the horizon at
12:50:24 UTC. The probe's channel A carrier signal was still being
received on Earth by radio telescopes at the time of the planned
completion of the observations, at 16:00 UTC (Earth received time),
meaning that the probe was still operating at 14:53 UTC (Titan time).
Post-flight analysis of the probe telemetry data indicates that the
batteries probably became fully discharged at about 15:10 UTC, a mere
17 min after the Huygens radio signal was last verified on Earth. It
is thought that the probe continued to function until the batteries
were exhausted.
 
Trajectory reconstruction
-------------------------
 
The probe arrived at the 1,270 km interface altitude with the spin
imparted at separation in the anticlockwise direction. No significant
spin modification was observed during the entry. The spin decreased
more than expected under the main parachute and unexpectedly changed
direction after 10 min. The probe continued spinning in the unexpected
direction (clockwise) for the rest of the descent. No explanation was
found for this behaviour, which is still under investigation.
The determination of the landing site coordinates is a complex and
iterative task and requires several assumptions. At present, the best
estimate, based on the combined Descent Trajectory Working Group
(DTWG), DISR and DWE reconstruction, is a latitude of 10.3 degrees
(+-0.4 degrees) south and a longitude of 167.7 degrees (+-0.5 degrees)
 east.
 
Summary and discussion
----------------------
 
The probe and its scientific payload performed close to and sometimes
beyond expectations. The in-flight modifications of the Huygens part
of the mission, to cope with the receiver design flaw detected in
2000, was highly successful. The loss of data on channel A, due to a
telecommand omission, was largely compensated for by the flawless
transmission on channel B, with not a single bit missing until the
radio link signal-to-noise decreased below the design limit of 3.3 dB,
in the last 10 min of surface transmission, and the fact that the DWE
scientific objectives were largely recovered by using data from the
Earth-based radio telescope observations.
Deceleration and load levels measured during the hypersonic entry were
well within the expected limits and all prime systems worked well,
with no need to have recourse to the two back-up systems (g-switches)
that had also been activated. The parachute performance was within the
expected envelope, although the descent time, at slightly less than
2 h 28 min, was only just within the predicted envelope of 2 h 15 min
+- 15 min. The descent was rather smooth under the main parachute but
rougher than anticipated during the first hour under the last
parachute. A detailed profile of the atmosphere is being worked out
from the scientific measurements to allow the parachute performance to
be studied in detail.
An exciting scientific data set was returned by the Huygens probe,
offering a new view of Titan, which appears to have an extraordinarily
Earth-like meteorology, geology and fluvial activity (in which methane
would play the role of water on Earth). While many of Earth's familiar
geophysical processes appear to occur on Titan, the chemistry involved
is quite different. Instead of liquid water, Titan has liquid methane.
Instead of silicate rocks, Titan has frozen water ice. Instead of
dirt, Titan has hydrocarbon particles settling out of the atmosphere.
Titan is an extraordinary world having Earth-like geophysical
processes operating on exotic materials under very alien conditions.
The Huygens data set provides the ground-truth reference for the
interpretation of the remote observations of the Huygens landing site
by orbiter instruments, and more generally the global observations of
Titan. Future observations of the Huygens landing site by Cassini
should allow us to place the local Huygens maps into their global
context and are expected to tell us whether changes can be seen.
Probe-orbiter synergistic studies are a key aspect for achieving the
very ambitious Cassini-Huygens objectives at Titan.
 
Channel A anomaly
-----------------
 
The mission had two probe-orbiter radio link channels, which are
referred to as channels A and B. Both transmitters (onboard the probe)
and both receivers (onboard Cassini) were equipped with a temperature-
controlled crystal oscillator (TCXO) which provided sufficient
frequency stability (~10^-6) fot telemetry. One of the channels
(channel A) was additionally equipped with ultra-stable oscillators
(USOs) that were needed for the Doppler Wind Experiment (DWE), which
required a stable carrier frequency signal. As part of finalising the
Huygens probe's configuration for its mission, it had been decided to
use the channel A USOs instead of the TCXOs because the performance of
the USOs had been very satisfactory during the seven-year cruise.
The command to power on the USO on the receiver side was unfortunately
omitted. As a result, the Channel A receiver onboard Cassini did not
have a reference oscillator and was unable to lock on to the Huygens
signal. Consequently, the frequency measurements for the Doppler Wind
Experiment (DWE), together with the non-redundant telemetry data on
Channel A, were lost. The loss of the DWE data was, fortunately,
largely mitigated by the radio astronomy segment of the mission
consisting of a network of ground-based radio telescopes. The Channel
A carrier signal, driven by the probe's USO, was received by 15 radio
telescopes and tracked for post-flight data analysis. Real-time
Doppler tracking information was obtained through the two largest
telescopes of the network: the NRAO R. C. Byrd Green Bank Telescope
(West Virginia, USA) and the CSIRO Parkes Radio Telescope (New South
Wales, Australia). Both telescopes were equipped with NASA Deep Space
Network's Radio Science Receivers (RSR) operated by the Radio Science
Group of the Jet Propulsion Laboratory. In addition, the other 13
radio telescopes recorded the Channel A carrier signal for
non-real-time Doppler and VLBI analysis.
 
 
Huygens mission timeline on 14 January 2005
===========================================
 
Activity                             Time (UTC)   Mission time, t - t0
----------------------------------------------------------------------
Probe power-on                           04:41:18          -4:29:03
Probe support avionics power-on          06:50:45          -2:19:56
Arrival at interface altitude (1,270 km) 09:05:53          -0:04:28
t0 (start of the descent sequence)       09:10:21           0:00:00
Main parachute deployment                09:10:23           0:00:02
Heat shield separation                   09:10:53           0:00:32
Transmitter ON                           09:11:06           0:00:45
GCMS inlet cap jettison                  09:11:11           0:00:50
GCMS outlet cap jettison                 09:11:19           0:00:58
HASI boom deployment (latest)            09:11:23           0:01:02
DISR cover jettison                      09:11:27           0:01:06
ACP inlet cap jettison                   09:12:51           0:01:30
Stabilizer parachute deployment          09:25:21           0:15:00
Radar altimeter power-on                 09:42:17           0:31:56
DISR surface lamp on                     11:36:06           2:25:45
Surface impact                           11:38:11           2:27:50
End of Cassini-probe link                12:50:24           3:40:03
Probe support avionics power-off         13:37:32           4:27:11
Last channel A carrier signal reception ~14:53              5:42:39
 by Earth-based radio telescopes         16:00 (ERT)
----------------------------------------------------------------------
The second column gives the time in UTC (for the probe), while the
third column gives the time relative to t0, where t0 is the official
start of the descent associated with the pilot chute deployment event.