Instrument Host Overview ======================== [From JONES&GIOVAGNOLI1997]: The Huygens Probe is the ESA-provided element of the joint NASA/ESACassini/Huygens mission to Saturn and Titan, the planet's largestmoon. The industrial Phase B activities began in January 1991 underthe leadership of Aerospatiale, the Huygens prime contractor. The Probe was carried to Titan by the Cassini Saturn Orbiter. Huygenswas dormant during the interplanetary journey of 6.7 years, althoughit was activated about every 6 months to verify and monitor itshealth. It was released 22 days before the Titan encounter. TheProbe's aeroshell decelerated it in less than 3 min from the entryspeed of about 6 km/s to 400 m/s (Mach 1.5) by 150-180 km altitude.From that point onwards, a pre-programmed sequence triggered parachutedeployment and heatshield ejection. The main part of the scientificmission then started, lasting for the whole descent of 2-2.5 h. TheHuygens model philosophy was optimised to achieve the most completeverification possible that the Probe system meets the missionrequirements within the cost envelope and the tight scheduleconstraints imposed by the launch window. Four models were developedat system level: 1. Structural, Thermal & Pyro Model (STPM): to qualify the Probedesign (including all mechanisms activated by pyrotechnic devices) forall structural, mechanical and thermal requirements; 2. Electrical Model (EM): to verify the electrical performances of theProbe and of the electrical/functional interfaces with the Orbiter; 3. Special Model (SM2): used for the balloon drop test in May 1995.All the mechanisms and the descent control systems wereflight-standard; 4. Flight Model (FM). Overall Configuration--------------------- The Probe System comprises two principal elements: 1. the 318 kg Huygens Probe, which enters Titan's atmosphere after  separating from the Saturn Orbiter; 2. the 30 kg Probe Support Equipment (PSE), which remains attached to  the Orbiter after Probe separation.  The Probe consists of the Entry Assembly (ENA) cocooning the DescentModule (DM). ENA provides Orbiter attachment, umbilical separation andejection, cruise and entry thermal protection, and entry decelerationcontrol. It is jettisoned after entry, releasing the Descent Module.The DM comprises an aluminium shell and inner structure containing allthe experiments and Probe support subsystems, including the parachutedescent and spin control devices. The PSE consists of: 1. four electronic boxes aboard the Orbiter: two Probe Support  Avionics (PSA), a Receiver Front End (RFE) and a Receiver Ultra  Stable Oscillator (RUSO); 2. the Spin Eject Device (SED); 3. the harness (including the umbilical connector) providing power and  RF and data links between the PSA, Probe and Orbiter.    Front Shield Subsystem (FRSS)----------------------------- The 79 kg, 2.7 m diameter, 60 degree half-angle coni-spherical FrontShield will decelerate the Probe in Titan's upper atmosphere fromabout 6 km/s at entry to a velocity equivalent to about Mach 1.5 byaround 160 km altitude. Tiles of AQ60 ablative material, a felt ofsilica fibres reinforced by phenolic resin, provide protection againstthe 1 MW/m2 thermal flux. The shield is then jettisoned and theDescent Control Subsystem (DCSS) is deployed to control the descent ofthe DM to the surface.The FRSS supporting structure is a CFRP honeycomb shell which alsoprovides some DM thermal protection during entry. The AQ60 tiles areattached to the CFRP structure by adhesive CAF/730. Prosial, asuspension of hollow silica spheres in silicon elastomer, is sprayeddirectly on to the aluminium structure of the FRSS rear surfaces,where fluxes are ten times lower. Back Cover Subsystem (BCSS)--------------------------- The Back Cover protects the DM during entry, ensures depressurisationduring launch and carries multi-layer insulation (MLI) for the cruiseand coast phases. As it does not have stringent aerothermodynamicrequirements, it is a stiffened aluminium shell of minimal mass (11.4kg) protected by Prosial (5 kg). It includes: an access door for lateintegration and forced-air ground cooling of the Probe; a break-outpatch through which the first (drogue) parachute is fired; a labyrinthsealing joint with the Front Shield, providing a non-structuralthermal and particulate barrier. Descent Control Subsystem (DCSS)-------------------------------- The DCSS controls the descent rate to satisfy the scientific payload'srequirements, and the attitude to meet the requirements of the Probe-Orhbiter RF data link and of the descent camera's image-taking.The DCSS is activated nominally at Mach 1.5 and about 160 km altitude.The sequence begins by firing the Parachute Deployment Device (PDD) toeject the pilot 'chute pack through the Back Cover's break-out patch,the attachment pins of which shear under the impact. The 2.59 mdiameter Disk Gap Band (DGB) pilot 'chute inflates 27 m behind the DMand pulls the Back Cover away from the rest of the assembly. As itgoes, the Back Cover pulls the 8.30 m diameter DGB main parachute fromits container. This canopy inflates during the supersonic phase todecelerate and stabilise the Probe through the transonic region. TheFront Shield is released at about Mach 0.6. In fact, the mainparachute is sized by the requirement to provide sufficientdeceleration to guarantee a positive separation of the Front Shieldfrom the Descent Module.The main parachute is too large for a nominal descent time shorterthan 2.5 h, a constraint imposed by battery limitations, so it isjettisoned and a 3.03 m diameter DGB stabilising parachute isdeployed. All parachutes are made of Kevlar lines and nylon fabric.The main and stabiliser 'chutes are housed in a single canister on theDM's top platform. Compatibility with the Probe's spin is ensured byincorporating a swivel using redundant low-friction bearings in theconnecting riser of both the main and stabiliser 'chutes. Separation Subsystem (SEPS)--------------------------- SEPS provides: mechanical and electrical attachment to, and separationfrom the Orbiter; the transition between the entry configuration('cocoon') and the descent configuration (DM under parachute). Thethree SEPS mechanisms are connected on one side to Huygens' InnerStructure (ISTS) and on the other to the Orbiter's supporting struts.As well as being the Probe-Orbiter structural load path, each SEPSfitting incorporates a pyronut for Probe-Orbiter separation, a rodcutter for Front Shield release and a rod cutter for Back Coverrelease. Within SEPS, the Spin Eject Device (SED) performs the mechanicalseparation from the Orbiter: - three stainless steel springs provide the separation force- three guide devices, each with two axial rollers running along a  T-profile helical track, ensure controlled ejection and spin, even  in degraded cases such as high friction or a weak spring- a carbon fibre ring accommodates the asymmetrical loads from the  Orbiter truss and provides the necessary stiffness before and after  separation- three pyronuts provide the mechanical link before separation. In addition, the Umbilical Separation Mechanism of three 19-pinconnectors, which provide Orbiter-Probe electrical links, isdisconnected by the SED. Inner Structure Subsystem (ISTS)-------------------------------- The ISTS provides mounting support for the Probe's payload andsubsystems. It is fully sealed except for a vent hole of about 6 cm2on the top, and comprises: - the 73 mm thick aluminium honeycomb sandwich Experiment Platform;  supports the majority of the experiments and subsystems units,  together with their associated harness- the 25 mm thick aluminium honeycomb sandwich Top Platform; supports  the Descent Control Subsystem and Probe RF antennas, and forms the  DM's top external surface- the After Cone and Fore Dome aluminium shells, linked by a central  ring- three radial titanium struts; interface with SEPS and ensure thermal  decoupling, while three vertical titanium struts link the two  platforms and transfer the main parachute deployment loads- 36 spin vanes on the Fore Dome's periphery; provide spin control  during descent- the secondary structure; for mounting experiments and equipment. Thermal Subsystem (THSS)------------------------ While the PSE is thermally controlled by the Orbiter, the Probe's THSSmust maintain all experiments and subsystem units within their allowedtemperature ranges during all mission phases. In space, the THSSpartially insulates the Probe from the Orbiter and ensures only smallvariations in the Probe's internal temperatures, despite the incidentsolar flux varying from 3800 W/m2 (near Venus) to 17 W/m2 (approachingTitan after 22 days of the coast phase following Orbiter separation).Probe thermal control is achieved by:- MLI surrounding all external areas, except for the small 'thermal  window' of the Front Shield- 35 Radioisotope Heater Units (RHUs) on the Experiment and Top  Platforms continuously providing about 1 W each even when the Probe  is dormant- a white-painted 0.17 m2 thin aluminium sheet on the Front Shield's  forward face acting as a controlled heat leak (about 8 W during  cruise) to reduce sensitivity of thermal performances to MLI  efficiency. The MLI is burned and torn away during entry, leaving temperaturecontrol to the AQ60 high-temperature tiles on the Front Shield's frontface, and to Prosial on the Front Shield's aft surface and on the BackCover.During the descent phase, thermal control is provided by foaminsulation and gas-tight seals. Lightweight open-cell Basotect foamcovers the internal walls of DM's shells and Top Platform. Thisprevents convection cooling by Titan's cold atmosphere (70 K at 45 kmaltitude) and thermally decouples the units mounted on the ExperimentPlatform from the cold aluminium shells. Gas-tight seals around allelements protruding through the DM's shell minimise gas influx. Infact, the DM is gas tight except for a single 6 cm2 hole in TopPlatform that equalises pressure during launch and descent to Titan'ssurface. Electrical Power Subsystem (EPSS)================================= Description----------- The EPSS consists of: - Five batteries: Provide mission power from Orbiter separation until  at least 30 min after arrival on Titan's surface. Each battery  comprises two modules of 13 LiSO2 (7.6 Ah) cells in series.- Power Conditioning & Distribution Unit (PCDU): Provides the power  conditioning and distribution to the Probe's equipment and  experiments via a regulated main bus, with protection to ensure  uninterrupted operations even in the event of single failure inside  or outside the PCDU.  During the cruise phase, the Probe is powered by the Orbiter and the  PCDU isolates the batteries. The five interface circuits connected  to the Orbiter's Solid State Power Switches (SSPSs) provide Probe-  Orbiter insulation and voltage adaptation between the SSPS output  and the input of the PCDU's Battery Discharge Regulator (BDR)  circuits. The BDRs condition the power from either the Orbiter or  the batteries and generate the 28 V bus, controlled by a centralised  Main Error Amplifier (MEA). The distribution is performed by active  current limiters, with the current limitation adapted for each user  and with ON/OFF switching capability. The Mission Timer, however, is  supplied by three switchable battery voltage lines through series  fuses or, when the PCDU is powered by the Orbiter, by dedicated  output voltage lines of the Orbiter interface circuits.  The PCDU also provides a protected +5 V supply used by the Pyro unit  to generate the bi-level status telemetry of the selection relays  and for the activation circuit that switches ON the Pyro unit's  energy intercept relay.- Pyro Unit (PYRO): Provides two redundant sets of 13 pyro lines,  directly connected to the centre taps of two batteries (through  protection devices), for activating pyro devices. Safety  requirements are met by three independent levels of control relays  in series in the Pyro Unit, as well as active switches and current  limiters controlling the firing current. The three series relay  levels are: energy intercept relay (activated by PCDU at the end of  the coast phase); arming relays (activated by the arming timer  hardware); selection relays (activated by Command and Data  Management Unit, CDMU, software). In addition, safe/arm plugs are  provided on the unit itself for ground operations. Operational modes----------------- - Cruise phase: The EPSS is completely OFF over the whole cruise  phase, except for periodic checkout operations. There is no power at  the Orbiter interface and direct monitoring by the Orbiter allows  verification that all the relays are open.- Cruise phase checkout: The EPSS is powered by the Orbiter for cruise  checkout operations. The 28 V bus is regulated by the EPSS BDRs  associated with each Orbiter SSPS; a total of 210 W is available  from the Orbiter and all the relays are open.- Timer loading: Following the loading (from the Orbiter) of the  correct coast time duration into the Mission Timer Unit, battery  depassivation is performed to overcome any energy loss due to ageing  during cruise. Before Probe separation, the EPSS timer relays are  closed to supply the Mission Timer from the batteries and the  Orbiter power is switched off.- Coast phase: Only the Mission Timer is supplied by batteries through  specific timer relays during the coast phase. The EPSS is OFF and  all other relays are open.- End of coast phase - Probe wake-up: At the end of the coast phase,  the Mission Timer wakes the Probe by activating the EPSS. Input  relays are closed and the current limiters powering the CDMU are  automatically switched ON as soon as the 28 V bus reaches its  nominal value (other current limiters are initially OFF at power  up). The pyro energy intercept relay is also automatically switched  on by a command from the PCDU.- Entry and descent phases: All PCDU relays are closed and the total  power (nominal 300 W, maximum 400 W) is available on the 28 V  distribution outputs to subsystems and equipment. The Pyro Unit  performs the selection and the firing of the squibs, activated by  CDMU commands. Command & Data Management Subsystems (CDMS)=========================================== The data handling and processing functions are divided between theProbe Support Equipment (PSE) on the Orbiter and the CDMUs (part ofthe CDMS) in the Probe. The Probe Data Relay Subsystem (PDRS) providesthe RF link function for this purpose, together with the data handlingand communication function with the Orbiter's Control and DataSubsystem (CDS) via a Bus Interface Unit (BIU). (During the groundoperations and cruise phase checkouts, the Orbiter-Probe RF link isreplaced by umbilical connections.)The CDMS has two primary functions: autonomous control of Probeoperations after separation; management of data transfer from theequipment, subsystems and experiments to the Probe transmitter forrelay to the Orbiter. For these functions, the CDMS uses the ProbeOn-board Software (POSW), for which it provides the necessaryprocessing, storage and interface capabilities.The driving requirement of the CDMS design is intrinsic single pointfailure-tolerance. As a result of the highly specific Huygens mission(limited duration and no access by telecommand after separation), avery safe redundancy scheme has been selected. The CDMS comprises:- two identical CDMUs- a triply redundant Mission Timer Unit (MTU)- two mechanical g-switches (backing up MTU)- a triply redundant Central Acceleration Sensor Unit (CASU)- two sets of two mechanical g-switches (backing up CASU)- a Radial Acceleration Sensor Unit (RASU) with two accelerometers- two Radar Altimeter proximity sensors, each comprising separate  electronics, transmit antenna and receive antennaThe two CDMUs each execute their own POSW simultaneously and areconfigured with hot redundancy (Chain A and Chain B). Each hardwarechain can run the mission independently. They are identical in almostall respects; the following minor differences facilitate simultaneousoperations and capitalise on the redundancy:- telemetry is transmitted at two different RF frequencies- chain B telemetry is delayed by about 6 s to avoid loss of data  should a temporary loss of the telemetry link occur (e.g. from an  antenna misalignment as the Probe oscillates beneath the parachute).Each CDMU chain incorporates a health check (called the ProcessorValid status) which is reported to the experiments in the Descent DataBroadcasts (DDBs). A chain declares itself invalid when two bit errorsin the same memory word, an ADA exception or an under-voltage on the 5V line occur within the CDMU. Command and Data Management Unit (CDMU)--------------------------------------- Each CDMU includes a MAS 281 16-bit 1750A micro-processor running at10 MHz, with 64 kword PROM storing the POSW and 64 kword RAM used forthe POSW and other dynamic data when the CDMU is on. A MemoryManagement Unit is implemented to provide memory flexibility and somegrowth potential. Direct Memory Access (DMA) is provided to facilitatedata transfer between the memory and the input/output registers, thusrelieving the microprocessor of repetitive input/output tasks. TheRAM-stored program memory is protected against single error occurrenceby an Error Detection And Correction (EDAC) device, which detects andcorrects single bit errors and reports any double bit errors to theProcessor Valid function.TM/TC management is based on an internal On-Board Data Handling (OBDH)bus in order to standardise the internal interfaces, which are basedon the classical Central Terminal Unit (CTU) and Remote Terminal Units(RTUs) approach.In addition to conventional CDMS functions, the CDMUs implement thefollowing Huygens-specific functions:- the arming timer function sends pyro and arming commands following a  specific hardware-managed timeline, thus offering full decoupling  from the POSW operation- the Processor Valid signal is sent to experiments via the Descent  Data Broadcast (DDB), indicating the health of the nominal CDMU  (unit A)- reprogrammability through the use of 16 kword of Electrically  Erasable PROM (EEPROM), thus allowing patching of the POSW if  necessary- the EDAC error count reports on internal data transfers- the capability, through specific 16 kword of RAM, to delay one  telemetry chain. Mission Timer Unit (MTU)------------------------ The MTU is used to activate the Probe at the end of the coast phase.To obtain a single point failure-free design, it is based on threeindependent hot redundant timer circuits followed by two hot-redundantcommand circuits. Two mechanical g-switches provide backup. MTU poweris supplied directly via three 65 V supply lines, one for each TimerBoard, from independent batteries. During the pre-separationprogramming activities, when the Probe is still connected to theOrbiter, all three Timers are programmed with the exact duration ofthe coast phase via serial memory load interfaces from one of the twoCDMUs. Each of the three Timer Boards can be loaded independently fromeither CDMU. The programmed values can be verified by the serialtelemetry channels. When programming is finished, the CDMUs and allother Probe systems except the MTU are turned off and the Probe isseparated.During the coast phase of about 22 days, the programmed Timer registeris decremented by a very precise clock signal. The MTU consumes about300 mW during this period as only the necessary circuits (CMOS-based)are powered. When the Command Board majority voting detects eitherboth g-switches active or at least two of the three 'time-out' signalsreceived, five High Level Commands (HLCs) are issued sequentially fromeach Board to the PCDU in order to switch on both CDMUs. The timerthen returns to a standby mode.The two g-switches, which ensure Probe wake-up in the event ofatmospheric entry without the time-out signal from any of the Timerboards, are purely mechanical devices closed when deceleration reaches5.5-6.5 g. Central Acceleration Sensor Unit (CASU)--------------------------------------- The CASU measures axial deceleration at the centre of the ExperimentPlatform during entry. The signal is processed by the CDMU tocalculate the time for parachute deployment (T0). The CASU operateswithin 0-10 g and uses a scale factor of 0.512 V/g. Its main buildingblocks are:1. Power circuit. Two hot-redundant input power lines make it single   point failure-tolerant in both nominal and redundant power lines2. Three accelerometer analogue signal conditioning blocks. A low-pass   filter with a 2 Hz cutoff is used and the analogue output from each   block is routed to both CDMUs. In addition, the design prevents   failure propagation from one conditioning chain to the others, it   withstands permanent short circuit conditions without any   degradation, and it is single point failure-tolerant toward the   input power supply line.Back-up detection of T0 is performed separately for both CDMUs by twopairs of mechanical g-switches in case the prime CASU system isinoperative. The threshold values for each pair of g-switches are 5.5g and 1.2 g. Radial Acceleration Sensor Unit (RASU)-------------------------------------- The RASU measures radial acceleration at the periphery of theExperiment Platform. The signal is processed by the CDMU to providethe Probe spin rate for insertion into the DDB distributed toexperiments. The RASU is designed to measure spin acceleration within0-120 mg with a 41.67 V/g scale factor. The design is based on CASU'sbut includes only two accelerometers. Radar Altimeter Unit (RAU)-------------------------- The RAU proximity sensor uses two totally redundant altimetersoperating with frequency-modulated carrier waves at 15.4 GHz and 15.8GHz to measure altitude above Titan's surface, starting from about 25km. Each of the four antennas (two per altimeter) is a planar slotradiator array providing an antenna gain of 25 dB with a symmetricalfull beam width of 7.9 degrees. A continuous signal modulated infrequency with a rising and falling ramp waveform is transmitted; thereceived signal has a similar form, but delayed by the propagationtime. Hence the range to target is proportional (with a linearfrequency modulation ramp) to the instantaneous frequency shiftbetween the transmitted and received signals. Received signal data arealso provided to the Huygens Atmospheric Structure Instrument (HASI)to establish Titan's surface roughness and topography. Probe Data Relay Subsystem (PDRS)================================= The PDRS is Huygens' telecommunications subsystem, combining thefunctions of RF link, data handling and communications with theOrbiter. It transmits science and housekeeping data from the Probe tothe Orbiter's PSE, which are then relayed to the Orbiter CDS via a BusInterface Unit. In addition, the PDRS is responsible for TCdistribution from the Orbiter to the Probe by umbilical during theground and cruise checkouts. It comprises:1. two hot-redundant S-band transmitters and two circularly polarised   Probe Transmitting Antennas (PTAs) on the Probe2. a Receiver Front End (RFE) unit (enclosing two Low Noise Amplifiers   and a diplexer) and two Probe Support Avionics (PSA) units on the   Orbiter.The Orbiter's High Gain Antenna (HGA) acts as the PDRS receiveantenna. In addition, as part of the Doppler Wind Experiment (DWE),two ultra stable oscillators are available as reference signal sourcesto allow the accurate measurement of the Doppler shift in the Probe-Orbiter RF link: the Transmitter Ultra Stable Oscillator (TUSO) onHuygens and the Receiver Ultra Stable Oscillator (RUSO) on theOrbiter.The PDRS electrical architecture is fully channelised for redundancy,except that TUSO and RUSO are connected to only one chain. Probe Support Equipment (PSE)-----------------------------  Receiver Front End (RFE) ------------------------ The RFE comprises:- two Low Noise Amplifiers (LNAs) linked to the Orbiter's HGA to  amplify the acquired RF signal by 20 dB using two cascaded FET  stages- two RF inputs: one linked to the HGA, the other via a coupler and  used during checkout to link a dedicated transmitter output (on the  Probe) to the  RFE via the umbilical- a pre-selection filter (coaxial cavity type with six poles)- an isolator- an output attenuator (fixed value)In addition, owing to the HGA's shared use with the Orbiter, a bandpass filter (the TX filter) and a circulator protect the LNA chain Bby isolating the Orbiter's S-band transmissions and the Probe's S-bandreception, which both use the HGA. These two modes are mutuallyexclusive.  Probe Support Avionics (PSA) ---------------------------- The two RFE outputs are sent to the two PSAs, which perform detection,acquisition (based on a 256-point Fast Fourier Transform algorithm),tracking, signal demodulation and data handling & management. The PSAdata handling architecture is divided between analogue and digitalsections. The analogue section performs signal down-conversion fromS-band to the IF frequency. The IF signal is quantised and the samplesprocessed by the digital section. The digital section performs:- the Digital Signal Processing (DSP) function - the signal  acquisition and tracking task based on FFT analysis and frequency  acquisition- the Viterbi decoding of the digital signal and delivery of the  decoded transfer frame to the data handling section at 8192 bit/s- the data handling task, which consists of:  - transforming the received transfer frame into a telemetry packet  - generating internal PSA housekeeping data (including the    synthesised frequency information) in a packet format  - controlling and managing communications with the Orbiter CDS via a    Bus Interface Unit  - distributing the telecommands from the Orbiter BIU interface.The digital section is composed of the following main modules:- the receiver digital module, comprising the UT1750 microprocessor, 8  kword RAM and 8 kword PROM, and the receiver signal processing ASIC- the interface digital module, using GaAs devices for Numerically  Controlled Oscillator (NCO) and Digital to Analogue Converter (DAC)  functions- the support interface circuitry module (SIC), which comprises: the 8  kword EEPROM to memorise software patches; the 32 kword PROM  containing the Support Avionics Software (SASW) and the testing,  telecommand, telemetry and umbilical interfaces; the MAS 281  microprocessor module used by the SASW- the BIU module that controls communications between the PSA and the  Orbiter's 1553 bus. Probe Transmitting Terminal (PTT)--------------------------------- The PTT comprises two transmitters and two Probe antennas. Eachtransmitter includes Temperature Controlled Crystal Oscillator (TCXO)synthesiser and BPSK modulator modules and a 10 W Power Amplifiermodule using Automatic Level Control (ALC) for 40.2 dBm nominal outputpower (end-of-life, worst-case, including ageing).The reference oscillator for the Phase Locked Loop (PLL) synthesiseris either an (internal) Voltage Controlled Crystal Oscillator (VCXO)with a temperature compensating network or the (external) TUSO signal.The selection between these reference sources is made beforeseparation from the Orbiter. The TUSO has priority unless a failure isdetected before separation.The two transmitting antennas linked to the transmitters (dual chainswithout cross-coupling) are quadrifilar helix designs. The fourspirals are fed at the bottom of the helix in phase quadrature. LeftHand Circular Polarisation (LHCP) is used for signal transmission at2040 MHz and Right Hand Circular Polarisation (RHCP) for transmissionat 2098 MHz. The minimum gain for the antennas, mounted on the TopPlatform, is 0.9 dB at all Probe-Orbiter aspect angles between +20degrees and +60 degrees. Probe data relay link budget---------------------------- During Probe descent, starting from the time of atmospheric entry aspredicted from Orbiter trajectory and Probe separationcharacteristics, the Orbiter HGA is controlled to track a fixed pointon Titan's surface - the nominal touchdown point. Orbiter movementalong its trajectory significantly reduces the 'space loss' due tolink distance during the Probe's 2-2.5 h descent. However, if Huygensdoes not land at the nominal point, e.g. due to non-nominal entryparameters or zonal winds, the gain from the reduced distance isoffset by the HGA's reduced gain from the off-axis angle of the Probewith respect to the HGA's boresight axis.The link budget worst cases occur at the beginning and end of mission.The link design attempts to equalise the BOM/EOM signal level margins.At BOM, the signal level is determined by the range, while the lossesowing to off-axis pointing is mainly due to HGA pointing error andProbe delivery error (the additional dispersion arising from the entryphase is relatively minor). At EOM, however, the signal level iscritically dependent on the descent duration: the off-axis pointinglosses due to the Probe's lateral drift in the assumed Titan windworsens with descent duration. Software======== Concept------- The Huygens software consists of that running in the Probe CDMS,referred to as POSW, and that within the PSA on the Orbiter, referredto as the Support Avionics Software (SASW). The POSW output telemetryis relayed via the SASW and then Cassini's CDS to the ground. Twocopies of the data handling hardware (CDMU and PSA) run identicalcopies of POSW and SASW.The software is based on a top-down hierarchical and modular approachusing the Hierarchical Object-Oriented Design (HOOD) method and,except for some specific low level modules, is coded in ADA. Thesoftware consists, as much as possible, of a collation for synchronousprocesses timed by a hardware reference clock (8 Hz repetition rate).In order to avoid unpredictable behaviour, interrupt-driven activitiesare minimised. Such a design also allows a better observability andreliability of the software. Limited reprogramming accommodatesmodifications and RAM failure recoveries.The processes are designed to use data tables as much as possible.Mission profile reconfiguration and experiment polling can thereforebe changed only by reprogramming these tables. This is possible via anEEPROM. In order to avoid a RAM modification while the software isrunning (which can lead to unpredictable behaviour and unnecessarycomplexity), direct RAM patching is forbidden. The POSW communicateswith the SASW in different ways depending on mission phase. BeforeProbe separation, the two software subsystems communicate via anumbilical that provides both command and telemetry interfaces. Huygenscannot be commanded after separation, and telemetry is transmitted tothe Orbiter via the PDRS RF link.The overall operational philosophy is that the software runs thenominal mission from power-up without checking its hardwareenvironment or the Probe's connection or disconnection. The specificsoftware actions or inhibitions required for ground or flightcheck-out must therefore be invoked by special procedures, activatedby the delivery of specific telecommands to the software. To achievethis autonomy, POSW's inflight modification is autonomously applied atpower-up by using a non-volatile EEPROM. At power-up, the POSWvalidates the CDMU EEPROM structure and then applies any softwarepatches stored in the EEPROM before running the mission mode. If theEEPROM proves to be invalid at start-up, no patches are applied andthe software continues based on the software in the CDMU ROM. A numberof other checks are also carried out at start-up (e.g. a DMA check anda main ROM checksum), but the software will continue executionattempts even if the start-up checks fail. POSW functions-------------- The POSW provides the following functions: Probe Mission Management - detecting time T0 as entry begins, based on the Central   Accelerometer Sensor Unit signals - forwarding commands at the correct times to the subsystems and   experiments according to the pre-defined mission timeline - computation of the spacecraft dynamical state from sensor readings - sending Descent Data Broadcasts to the experiments Telemetry Management - collecting and recording housekeeping data - generation of housekeeping packets from the housekeeping data - collecting experiment packets according to a pre-defined polling   scheme - transmitting transfer frames to the PDRS Telecommand Management - reception of TC packets from the PSE (only while attached to the   Orbiter) - execution of commands related to these TC packets - forwarding of commands to the experiments POSW operations--------------- Control of the Probe, involving the activation and forwarding ofcommands to experiments and subsystems, is driven by a pre-defined setof tables, the Mission Timeline Tables (MTTs), that define the actionsto be performed as a function of time. The pre-T0 MTT is activated atProbe wake-up, and controls the Probe until the post-T0 MTT isactivated by the POSW's detection of T0.The experiments perform most of their activities autonomously based onthe mission phase data computed within the POSW and sent to all theexperiments every 2 s as a Data Descent Broadcast packet. The DDBcontains the time, spin rate (computed by the POSW from the RASUsignal or, in the event of failure, from a pre-defined look-up table)and altitude (initially taken from a look-up table based on the timeelapsed since T0, but later by processing RAU data.The telemetry management function involves the acquisition andtransmission of Probe telemetry as standard packets. Whether they arehousekeeping or experiment packets, they are all 126 bytes long andforwarded to the SASW in the form of transfer frames comprising headerinformation followed by seven packets and then Reed-Solomon codewords, making a total frame size of 1024 bytes.Housekeeping data are acquired from the subsystems (and from thesoftware itself) at different rates according to a pre-determinedpacket layout, and are loaded into four packets every 16 s. One of thepacket types is buffered and issued 6.4 min later as 'History'housekeeping.Experiment data are acquired according to a pre-defined pollingstrategy and  the resulting packets are loaded into the transferframes. The selection of an appropriate type of telemetry packet toinclude in each of the frame's seven slots is managed by the pollingsequence mechanism on a major acquisition cycle of 16 s (equal to 128Computer Unit Times) driven by the Polling Sequence Table (PST) andthe Experiment Polling Table (EPT). The PST defines if housekeeping orexperiment packets are to be included in the transfer frame currentlyunder construction. However, it does not select which experiment is tobe included. The EPT defines a prioritised scheme for the collectionof experiment data. The table is invoked whenever the PST requestsexperiment data for the transfer frame and is read in a cyclicalmanner. It consists of a sequential list of the Huygens experiments,with the number of occurrences of each experiment in the tableproviding the polling priority.By this method, the CDMS and the POSW are protected against failuremodes in the experiments that could affect the data production rates.Each experiment is guaranteed an opportunity to supply data at, as aminimum, its nominal data rate. Furthermore, this polling schemeautomatically optimises the data return by reallocating the TMresource in the absence of a 'packet ready' status flag from anexperiment when expected.Three EPTs provide different polling priorities during the descent'svarious stages, switching from one table to the next at a pre-settime. SASW functions-------------- The SASW's main purpose is to provide communications between theOrbiter and Probe. For the SASW, there is no difference betweenreceiving Probe telemetry via the umbilical or via the RF subsystem.All the differences are handled by the PDRS receiver part of the PSAequipment. The SASW provides the following functions:Telecommand Management - reception of TC packets from the BIU interfacing with the Orbiter   CDS - execution of commands related to these TC packets - forwarding TC packets to the CDMS (including experiment   telecommands) while attached to the OrbiterTelemetry Management - collecting PSE housekeeping data - transmitting PSE housekeeping packets and modified CDMS frames to   the Orbiter via the BIU SASW operations--------------- Communication between the SASW and the Orbiter CDS is via aMIL-STD-1553 bus using a BIU. Received telecommands are placed in BIUmemory for the SASW to read; the SASW places telemetry packets in BIUmemory for transmission by the BIU over the CDS bus. The SASW examinesany received telecommands to determine their destination address.Those destined for the Probe (subsystems or experiments) aretransmitted over the umbilical TC link. Those for the PSA are handledby the SASW.The SASW handles the reception of Probe telemetry via a Frame DataInterface (FDI). Telemetry from the Probe is transmitted to the SASWeither by the umbilical RF link when the probe is connected or by theProbe Relay Link (PRL) after separation. The SASW also generates itsown telemetry in the form of housekeeping packets, containing PSAstatus information, and status data collected from the PDRS subsystem.  [From LEBRETONETAL2005]: Launch and Flight to Saturn--------------------------- The Cassini-Huygens spacecraft was launched from Cape Canaveralcomplex in Florida on 15 October 1997, with the probe mated onto theside of the orbiter. In this configuration, the orbiter providedelectrical power to the probe through an umbilical connection.Commands and data were also exchanged by this route. During the seven-year journey to Saturn, the Huygens probe was subjected to 16in-flight checkouts to monitor the health of its subsystems andscientific instruments. During these in-flight tests, maintenanceperformed and calibration data were obtained in preparation for themission at Titan. The special in-flight tests designed to characterizethe communication radio link between the probe and the orbiter wereespecially important.In the first link test in 2000, a flaw was discovered in the design ofthe Huygens telemetry receiver on board the orbiter that would haveresulted in the loss of a large fraction of the Huygens probe'sscientific data during the actual mission at Titan. Originally theHuygens mission was planned to be executed at the end of the firstorbit around Saturn. As a remedy to the radio receiver flaw, the firsttwo orbits of the original mission were redesigned into three shorterorbits that enabled the Huygens mission to be carried out on the thirdorbit. The re-designed orbiter trajectory provided a Doppler shift onthe probe-orbiter radio link that was compatible with the well-characterized receiver performance and it also smoothly reconnectedwith the already-designed post-Huygens orbiter four-year trajectory.As a bonus, the new trajectory allowed early orbiter observations ofTitan's upper atmosphere in order to validate the so-called Titanatmosphere engineering model well before the Huygens probe release. Itled to improvements in our knowledge of the structure and thecomposition of the upper atmosphere; in particular, it provided betterconstraints on the argon concentration and indicated that methane wasnot present in sufficient quantity to affect the probe entry adversely(that is, via excessive radiative heating). Indeed, the new missionscenario led to the Huygens mission being completely successful. Thisachievement was the culmination of more than 20 years of work andshows that the in-flight rework of the mission was necessary and wassuccessfully implemented. Probe release------------- In preparation for releasing the probe, the Cassini-Huygens spacecrafthad been set on a Titan-impact trajectory. Following its release, theHuygens probe had no manoeuvring capability and had to functionautonomously. The Huygens release trajectory was achieved via a 'probetargeting manoeuvre' with a speed adjustment of 12 m/s on 17 December2004, followed by a 'probe targeting clean-up manoeuvre' on 23December 2004. After the separation of the Huygens probe on 25December at 02:00 UTC, Cassini performed an 'orbiter deflectionmanoeuvre', so that it would not crash into Titan, and a 'clean-upmanoeuvre' for final adjustment of its trajectory. These were on 28December 2004 and 03 January 2005 respectively and placed Cassini onthe correct trajectory for receiving data from the Huygens probeduring the descent. The responsibilities for meeting the probe'strajectory requirements were shared between NASA/JPL and ESA. Thetargeting of the probe, the NASA/JPL responsibility, was specified atan altitude of 1,270 km, very close to the atmosphere's upper layer,above which no significant drag was expected. From this point onwardESA was responsible for the probe's trajectory.The spring-loaded Huygens separation mechanism, called the Spin EjectDevice, had three points of attachment to the probe. It provided aspeed increment relative to the orbiter of 33 cm/s. The Spin EjectDevice also imparted to the probe an anti-clockwise spin of 7.5 r.p.m.(when viewed from the orbiter). This provided inertial stabilityduring the ballistic trajectory and atmospheric entry. Coast and probe 'wake up'------------------------- The Huygens probe was set on a ballistic trajectory that took a littleover 20 days. During this time, the probe was dormant, with only threeredundant timers counting down to a specific time programmed to end 4h and 23 min before the predicted entry. At this time, battery powerwas turned on and the on-board computers, their sensors(accelerometers, and later in the descent the radar altimeters), andthe scientific instruments were energized according to the pre-programmed sequence. The probe 'woke up' as planned, at 04:41:33 UTCon 14 January 2005. The Huygens probe's receivers on board the Cassiniorbiter were powered on from 06:50:45 to 13:37:32 UTC. The Huygensprobe arrived at the 1,270 km interface altitude on the predictedtrajectory on 14 January 2005 at 09:05:53 UTC, just a few secondsbefore the expected time. Entry, descent and landing-------------------------- The Huygens scientific mission proper took place during the entry,descent, landing and post-landing phases. The descent of the probethrough Titan's atmosphere was controlled by parachutes. Theaerodynamic conditions under which the main parachute had to bedeployed were critical. The correct instant for parachute deployment(mission time event, T0) was determined by the probe on-boardcomputers that processed the measurements from the accelerometers thatmonitored the probe's deceleration. Pyrotechnic devices fired a mortarthat pulled out a pilot chute, which in turn removed the probe's backcover and pulled out the main parachute. Then, 30 s later, the frontshield was released. It was expected that, by this time, the probewould have stabilized under the main parachute. During the entryphase, telemetry could not be transmitted by the probe until its backcover was removed. Thus, a limited set of engineering housekeepingdata and the HASI science accelerometer data acquired during entry wasstored onboard the probe for transmission to the orbiter after theradio link was established.Post-flight data analysis showed that only one of the receivers(channel B) was phase-locked and functioned properly. Channel A had ananomaly that was later identified as being due to the unfortunateomission of the telecommand to apply power to the ultra-stableoscillator driving the channel A receiver. Subsequent on-board eventswere determined by the on-board software that initiated a set ofcommands at times all related to the moment the pilot chute wasreleased. These commands included switching on other instruments andthe replacement of the main parachute by a smaller 'stabiliser chute'after 15 min, to ensure that the probe would reach the surface ofTitan within the designed duration of the mission (150 min maximum forthe descent under parachute). The actual duration of the descentfollowing the T0 event was 2 h 27 min 50 s. During the first part ofthe descent, the probe followed the nominal time-based sequence withthe instrument operations defined by commands in the on-board missiontimeline. The later part of the descent sequence was optimized bytaking into account the altitude measurements provided by tworedundant radar altimeters. The altimeters were switched on 32 minafter T0 which corresponded to an altitude of around 60 km. Theyprovided altitude measurements to the on-board computers, whichfiltered and compared the measurements to the predicted altitude, inorder to exclude erratic measurements at high altitude and to providereliable measured altitude information to the payload instruments.This allowed for optimization of the measurements during the last partof the descent. The DISR measurements sequence was adjusted tomeasured altitude below 10 km and its lamp was switched on at 700 mabove the surface. The HASI and SSP instruments were set to theirproximity and surface modes at low altitude above the surface. Theprobe landed safely with a vertical speed of about 5 m/s and continuedthereafter to transmit data for at least another 3 h 14 min, asdetermined the detection and monitoring of the probe's 2.040-GHzcarrier signal by the Earth-based radio telescopes. Throughout thistime, Cassini was oriented to receive the two incoming radio signalsfrom the probe by continuously pointing its high gain antenna to thepredicted Huygens landing point. After listening for the longestpossible duration of the Huygens probe's visibility, the orbiter wascommanded to re-point its high gain antenna to Earth for transmissionof the stored Huygens telemetry data. At that time, Cassini was at adistance of 1,207 million kilometres (8.07 AU) from the Earth (theone-way light-time was 67 min 6 s).The data were received by the ground stations of the NASA Deep SpaceNetwork (DSN) and eventually delivered to the Huygens Probe OperationsCentre (HPOC) in ESA's European Space Operation Centre (ESOC,Darmstadt, Germany) for science and engineering analysis. A 1-h marginwas built into the orbiter sequence to cope with uncertainties as towhen the orbiter would disappear below the horizon. As seen from theprobe landing site, the orbiter actually set below the horizon at12:50:24 UTC. The probe's channel A carrier signal was still beingreceived on Earth by radio telescopes at the time of the plannedcompletion of the observations, at 16:00 UTC (Earth received time),meaning that the probe was still operating at 14:53 UTC (Titan time).Post-flight analysis of the probe telemetry data indicates that thebatteries probably became fully discharged at about 15:10 UTC, a mere17 min after the Huygens radio signal was last verified on Earth. Itis thought that the probe continued to function until the batterieswere exhausted. Trajectory reconstruction------------------------- The probe arrived at the 1,270 km interface altitude with the spinimparted at separation in the anticlockwise direction. No significantspin modification was observed during the entry. The spin decreasedmore than expected under the main parachute and unexpectedly changeddirection after 10 min. The probe continued spinning in the unexpecteddirection (clockwise) for the rest of the descent. No explanation wasfound for this behaviour, which is still under investigation.The determination of the landing site coordinates is a complex anditerative task and requires several assumptions. At present, the bestestimate, based on the combined Descent Trajectory Working Group(DTWG), DISR and DWE reconstruction, is a latitude of 10.3 degrees(+-0.4 degrees) south and a longitude of 167.7 degrees (+-0.5 degrees) east. Summary and discussion---------------------- The probe and its scientific payload performed close to and sometimesbeyond expectations. The in-flight modifications of the Huygens partof the mission, to cope with the receiver design flaw detected in2000, was highly successful. The loss of data on channel A, due to atelecommand omission, was largely compensated for by the flawlesstransmission on channel B, with not a single bit missing until theradio link signal-to-noise decreased below the design limit of 3.3 dB,in the last 10 min of surface transmission, and the fact that the DWEscientific objectives were largely recovered by using data from theEarth-based radio telescope observations.Deceleration and load levels measured during the hypersonic entry werewell within the expected limits and all prime systems worked well,with no need to have recourse to the two back-up systems (g-switches)that had also been activated. The parachute performance was within theexpected envelope, although the descent time, at slightly less than2 h 28 min, was only just within the predicted envelope of 2 h 15 min+- 15 min. The descent was rather smooth under the main parachute butrougher than anticipated during the first hour under the lastparachute. A detailed profile of the atmosphere is being worked outfrom the scientific measurements to allow the parachute performance tobe studied in detail.An exciting scientific data set was returned by the Huygens probe,offering a new view of Titan, which appears to have an extraordinarilyEarth-like meteorology, geology and fluvial activity (in which methanewould play the role of water on Earth). While many of Earth's familiargeophysical processes appear to occur on Titan, the chemistry involvedis quite different. Instead of liquid water, Titan has liquid methane.Instead of silicate rocks, Titan has frozen water ice. Instead ofdirt, Titan has hydrocarbon particles settling out of the atmosphere.Titan is an extraordinary world having Earth-like geophysicalprocesses operating on exotic materials under very alien conditions.The Huygens data set provides the ground-truth reference for theinterpretation of the remote observations of the Huygens landing siteby orbiter instruments, and more generally the global observations ofTitan. Future observations of the Huygens landing site by Cassinishould allow us to place the local Huygens maps into their globalcontext and are expected to tell us whether changes can be seen.Probe-orbiter synergistic studies are a key aspect for achieving thevery ambitious Cassini-Huygens objectives at Titan. Channel A anomaly----------------- The mission had two probe-orbiter radio link channels, which arereferred to as channels A and B. Both transmitters (onboard the probe)and both receivers (onboard Cassini) were equipped with a temperature-controlled crystal oscillator (TCXO) which provided sufficientfrequency stability (~10^-6) fot telemetry. One of the channels(channel A) was additionally equipped with ultra-stable oscillators(USOs) that were needed for the Doppler Wind Experiment (DWE), whichrequired a stable carrier frequency signal. As part of finalising theHuygens probe's configuration for its mission, it had been decided touse the channel A USOs instead of the TCXOs because the performance ofthe USOs had been very satisfactory during the seven-year cruise.The command to power on the USO on the receiver side was unfortunatelyomitted. As a result, the Channel A receiver onboard Cassini did nothave a reference oscillator and was unable to lock on to the Huygenssignal. Consequently, the frequency measurements for the Doppler WindExperiment (DWE), together with the non-redundant telemetry data onChannel A, were lost. The loss of the DWE data was, fortunately,largely mitigated by the radio astronomy segment of the missionconsisting of a network of ground-based radio telescopes. The ChannelA carrier signal, driven by the probe's USO, was received by 15 radiotelescopes and tracked for post-flight data analysis. Real-timeDoppler tracking information was obtained through the two largesttelescopes of the network: the NRAO R. C. Byrd Green Bank Telescope(West Virginia, USA) and the CSIRO Parkes Radio Telescope (New SouthWales, Australia). Both telescopes were equipped with NASA Deep SpaceNetwork's Radio Science Receivers (RSR) operated by the Radio ScienceGroup of the Jet Propulsion Laboratory. In addition, the other 13radio telescopes recorded the Channel A carrier signal fornon-real-time Doppler and VLBI analysis.  Huygens mission timeline on 14 January 2005=========================================== Activity                             Time (UTC)   Mission time, t - t0----------------------------------------------------------------------Probe power-on                           04:41:18          -4:29:03Probe support avionics power-on          06:50:45          -2:19:56Arrival at interface altitude (1,270 km) 09:05:53          -0:04:28t0 (start of the descent sequence)       09:10:21           0:00:00Main parachute deployment                09:10:23           0:00:02Heat shield separation                   09:10:53           0:00:32Transmitter ON                           09:11:06           0:00:45GCMS inlet cap jettison                  09:11:11           0:00:50GCMS outlet cap jettison                 09:11:19           0:00:58HASI boom deployment (latest)            09:11:23           0:01:02DISR cover jettison                      09:11:27           0:01:06ACP inlet cap jettison                   09:12:51           0:01:30Stabilizer parachute deployment          09:25:21           0:15:00Radar altimeter power-on                 09:42:17           0:31:56DISR surface lamp on                     11:36:06           2:25:45Surface impact                           11:38:11           2:27:50End of Cassini-probe link                12:50:24           3:40:03Probe support avionics power-off         13:37:32           4:27:11Last channel A carrier signal reception ~14:53              5:42:39 by Earth-based radio telescopes         16:00 (ERT)----------------------------------------------------------------------The second column gives the time in UTC (for the probe), while thethird column gives the time relative to t0, where t0 is the officialstart of the descent associated with the pilot chute deployment event.