ESA studies multiple Atomic Clock Failures on Galileo Navigation Satellites

The European Space Agency is studying a potentially serious problem with the atomic clocks that drive Europe’s Galileo Navigation Satellites and have shown an alarming failure rate across the early phase of the satellite constellation.

European government officials decided to postpone the next Galileo satellite launch by three months from August to a tentative target of November to provide sufficient time for engineers to look into atomic-clock failures on orbiting satellites. ESA and industry specialists are now working to uncover multiple systemic issues with Galileo’s onboard systems that already caused ten clocks to stop operating on orbiting satellites.

Galileo currently has 18 satellites in Medium Earth Orbit and the constellation was officially declared ready for initial services in December. Each of the 720-Kilogram satellites is equipped with four clocks – a pair of traditional Rubidium atomic clocks that have been widely used in space applications, and two hydrogen masers that offer a higher precision and were designed to give Galileo a performance edge over the current generation of U.S.-operated Global Positioning System satellites.

Atomic clocks build the heart of the Galileo satellites as ultra-precise time-keeping with nano-second accuracy enables precise time code to be generated to help users on the ground receive a fix on their position with sub-meter accuracy. Like conventional clocks that rely on the tick of a pendulum, atomic clocks also count regular oscillations, though at much greater rate. In case of Galileo those are highly stable transitions of the energy states of rubidium and hydrogen induced by heat or light.

As of mid-January, ten atomic clocks had failed across the current Galileo constellation. One was re-started, leaving nine outages. Installing four clocks on each satellite provides a great deal of redundancy, allowing the spacecraft to tolerate three clock failures and still remain an active part of the constellation.

>>Galileo Space Segment Overview

Particularly worrying is that both types of clocks are affected – six Hydrogen Masers and three of the Rubidium devices are currently out of commission. The issue is further complicated by the fact that clock failures occurred on two different satellite platforms, one built by Airbus and Thales Alenia as part of the In-Orbit Validation (IOV) satellite series and the other by OHB Systems that is the prime contractor for the operational Galileo satellites.

Most of the Hydrogen Maser failures occurred on the IOV satellites while all three Rubidium clock outages are on the fully operational Galileo satellites. No satellite has experienced more than two clock failures, still leaving one line of redundancy to keep all 18 satellites in an operational state.

The common denominator between the different types of clocks and satellite buses is SpectraTime, a Swiss firm that provides both atomic clocks for the Galileo constellation. SpectraTime, ESA and the satellite manufacturers are currently in the process of working through an extensive fault tree, but work already revealed that the design of both clock types is sound and the fault is likely within an auxiliary piece of equipment that causes clocks to fail when operated in a certain way, possibly with several contributing factors.

As part of design work on Galileo, the clocks underwent extensive ground testing and each unit that made it to space went through exhaustive acceptance tests. Ground-based testing was not able to replicate the failure signature seen in orbit.

Work completed so far revealed that the failures of the Rubidium Atomic Frequency Standard (RAFS) clocks are likely linked to short circuits which may be caused by a particular testing procedure performed on the ground. As part of their detective work, engineers re-activated the RAFS clock on the GIOVE-A satellite launched as a pathfinder for Galileo in 2005. Impressively, even after 12 years in orbit, the clock powered up and showed nominal operation.

ESA said there may be a number of weak points in the RAFS design that could make them susceptible to failures arising from testing & operational parameters, but no root cause of the anomalies has been discovered yet.

With the Passive Hydrogen Masers (PHMs), ESA has made better progress, revealing a pair of probable failure mechanisms. The first is related to the operational environment of the clocks which have a relatively low margin for one particular operational parameter that, on some units, can lead to failure. ESA did not share what that particular parameter is but said that engineers were working on temperatures, voltage and current applied to the clock systems to create a more benign operational environment.

The second failure mechanism on the PHMs is a problem occurring when powering up the clocks after a long period. Typically, each Galileo satellite has two active clocks at any given time – one PHM acts as the primary timekeeper and one RAFS clock is in hot backup mode, ready for an instantaneous switchover in case of problems with the PHM. The other two units are powered off and only switch on in case of a problem with the primary units.

According to ESA, two PHM clocks have failed due to the first mechanism while four ran into problems during cold start-up after a long period of time.

Going forward, ESA plans to put in place new operational measures for the RAFS clocks in orbit and existing units on the ground will be refurbished once the exact locations of weaknesses are known. Corrective measures for the remaining 30 PHMs will be implemented in the coming weeks to reduce the risk of further in-orbit failures.

The Indian Regional Navigation Satellite System operated from Geosynchronous Orbit also uses clocks provided by SpectraTime and ESA contacted their Indian counterparts to explore possible commonality between clock issues. While IRNSS also faced some turmoil in the clock department, it was determined that there was no commonality between the failure mechanisms. China’s early Beidou navigation satellites also used SpectraTime technology, but ESA did not provide information on whether it reached out to Beidou operators.

Last November’s launch of four Galileo satellites was carried out with knowledge of the clock problem to boost the number of satellites in orbit to 18 to reinforce the constellation and ensure Initial Operational Services could continue even if a satellite went offline altogether. Additional checks were conducted on the satellites’ clocks before they were put into a 22,900-Kilometer orbit where they are being thoroughly checked before joining the operational constellation 23,200km in altitude.

Now, with a robust constellation in orbit, ESA decided to pin-point the causes of the clock failures before committing further satellites to launch. Plans to launch the next quartet of satellites in August atop an Ariane 5 rocket were shifted toward the end of the year and ESA remains confident problems will be sorted out to meet that launch date.

This latest string of problems marks another setback for Galileo that, over the program’s two-decade history, experienced its fair share of trouble ranging from cost-overruns and political hurdles to technical issues in various areas including a botched launch in 2014 that left a pair of satellites in a non-compliant orbit. At present, eleven Galileo satellites are listed as fully usable, two are in testing mode, one is not available and the four recently-launched birds are still under commissioning.

Galileo will reach is fully operational constellation when 24 active satellites will be part of the carefully maintained constellation, delivering 24/7 coverage around the world at the highest possible accuracy. By 2020, the constellation will consist of 30 satellites with two operational spares in each of the three orbital planes to ensure fully continuous services in case satellites become unavailable due to clock issues or other problems.