A billion kilometres from Earth, in cryogenic temperatures, Saturn’s largest moon, Titan, is soaked in deadly radiation, in a thick opaque atmosphere of unknown composition. Dr Steve Lingard and Pat Norris helped engineer the parachute and computer systems that enabled a soft and successful landing by the Huygens space probe on this inhospitable surface.

In the early 17th century, Galileo was the first person to look at Saturn through a telescope. Confused by what appeared to be strange ‘handles’ growing and disappearing from the planet without explanation, he died not knowing that he had seen Saturn’s rings. Nearly half a century was to pass before the Dutch astronomer, Christiaan Huygens, could confirm through observation that Saturn had rings. Earlier, in 1655, Huygens had also discovered Saturn’s largest moon and several years later his Italian colleague Jean- Dominique Cassini discovered Saturn’s four other large moons.

The Huygens mission

Launched from Cape Canaveral on 15 October 1997, the Cassini space probe is undertaking a four-year exploration of the Saturnian system – the planet and its atmosphere, rings and magnetosphere. On Christmas Day 2004 it ejected the Huygens probe which then travelled another 4 million kilometres, until on 14 January 2005 it undertook the first scientific in situ measurements of the atmosphere and surface of Titan – a body that is the size of a small planet, the only moon in the solar system with a significant atmosphere, and one that mimics Earth’s early atmosphere in many ways.

A few very large radio astronomy dishes were able to pick up the carrier signal from Huygens directly, but could not detect the data modulated onto it. Thus, for about four hours on 14 January, Cassini swung its radio antenna away from Earth and pointed it at Titan in order to receive the scientific results from Huygens. Once Huygens had reached Titan’s surface and its scientific mission was complete, Cassini swung its antenna back towards Earth and transmitted the pictures and other scientific data which we saw on our television screens. Since Saturn was more than 1.2 billion km from Earth, radio signals took about 67 minutes to reach us from Cassini.

Huygens overall design

The Huygens probe comprised a Descent Module cocooned within a front shield and a back cover. Weighing 320 kg, the probe was protected by the shield and cover from the harsh temperature and radiation extremes of space during its seven-year journey to Saturn, and from the heat of entry into Titan’s atmosphere (about 12,000°C) as it decelerated from a speed of more than 22,000 km/hr.

The Descent Module itself contains a complex assembly of engineering and scientific equipment on two platforms. The 2.7 m diameter front shield weighed 88 kg and comprised a CFRP (carbon fibre-reinforced plastic) honeycomb shell to which tiles were attached made of AQ60 ablative material – a felt of silica fibres reinforced by phenolic resin. The 21 kg back cover was a stiffened aluminium shell protected by Prosial (a layer of small silica spheres sprayed on), containing a breakout patch, and a door for late access during integration. Rod cutters to release the shield and cover were included in the separation assembly that provided the attachment points to the Cassini orbiter.

The descent control sub-system

Three minutes after reaching the top of Titan’s atmosphere the probe had decelerated to 1,400 km/hr at an altitude of 160 km above the surface. Here accelerometers alerted the flight software that it was time for Huygens to start work and the descent control sub-system (DCSS) took over. The DCSS is the series of parachutes and associated mechanisms which brought the Huygens probe down softly to the surface of Titan.

First, a mortar attached to the rear of the probe was fired. This punched through a breakout patch in the back cover and deployed a 2.6 m diameter pilot chute. Two and a half seconds later the back cover was released and the pilot chute pulled it away from the probe, in turn deploying the 8.3 m diameter main parachute. The main parachute inflated, and stabilised and decelerated the probe. It was essential that the parachute system was in control above Mach 1.3 since the probe becomes aerodynamically unstable at transonic velocity and would tumble. After 30 seconds, when the probe had decelerated below Mach 0.5, the front shield was released and fell away.

It would take the probe six hours to reach the surface descending on the large main parachute by which time the batteries would have been drained. Therefore three pyrotechnic parachute jettison mechanisms detached the main parachute bridle from the probe after 15 minutes. The separating main parachute deployed a 3 m diameter stabilising drogue (smaller parachute), sized to achieve the required descent time of two hours.

During the final descent to the surface under the stabilising drogue, Huygen’s stability was critical. The probe attitude had to be maintained at less than 10 degrees to the vertical in order to avoid loss of the radio link, and pitch rate had to be less than 6 degrees per second to prevent blurring of the images produced by the onboard camera. This is a difficult problem as the winds on Titan may reach 250 km/h. The drogue was therefore attached to the probe by a carefully optimised three-leg bridle designed to provide maximum stability and minimum gust response. Additionally, during the descent, the probe had to rotate slowly at a defined rate to permit the camera to build up pictures of Titan’s clouds and the planet’s surface. A very low friction swivel was incorporated in the drogue bridle to prevent random parachute rotation from modifying the critical probe spin rate.

High Mach, low pressure

The descent control sub-system was one of the most critical sub-systems for the probe since its failure would have resulted in complete loss of mission. The parachutes were required to meet very different requirements to those normally experienced on Earth. The pilot and main parachutes had to inflate at supersonic Mach number but very low dynamic pressure. The designs selected had also to be compatible with the rigorous stability requirements for the probe.

Additionally, the textile materials had to undergo strict cleansing procedures, long term vacuum storage, cryogenic temperatures, radiation and a 14- year lifetime without significant degradation. Prediction of parachute behaviour in a terrestrial environment is still in its infancy. Extrapolation to an extra-terrestrial atmosphere and 1/7 Earth gravity necessitated the development of new computer simulations of parachutes. During the seven-year voyage to Titan the subsystem components were dormant and were exposed to space vacuum (10-9 torr: torr is a non-SI unit of pressure where 1 torr ~ 133 pascals = 1.33 millibar), radiation (105 rads) and temperature fluctuations between -40°C and +30°C. On Titan the mechanisms that sequence the parachutes are exposed to a temperature of -180°C to -200°C, as if plunged into liquid nitrogen. They then had to function first time or the mission would have been lost.

The pyrotechnics had to be entirely hermetically sealed, dual redundant and designed to be insensitive to the mission environment. Even a simple swivel became a complex piece of precision engineering to meet the demands of Titan: grease would freeze solid, so only dry lubricants could be used.

Extensive testing in wind tunnels and at full scale, culminating in a drop test from 40 km altitude in Sweden provided confidence that the descent control sub-system would work well, and so it proved.

The flight software

Once separated from Cassini, Huygens became an autonomous robot, whose intelligence was encapsulated in the flight software designed and developed by LogicaCMG.

For 20 days, Huygens coasted towards Titan in a dormant mode, woken up by triply redundant timers (three alarm systems) half an hour before entering the atmosphere. From then on, the software carried out typical onboard tasks such as starting up the various pieces of equipment, collecting telemetry (health) data from them, sending instructions to them on the basis of the stored mission timeline, formatting the science results into data packets to be transmitted back to Cassini. It also undertook highly critical tasks such as calculating the right moment at which to release the parachutes and back cover, and initiating the scientific experiments and the radio link to the orbiter based on information from accelerometers and other sensors. Given the critical nature of these functions a great deal of design effort went into ensuring that the software would successfully undertake its task even in the presence of unexpected events.

Simple but effective

Huygens was a probe of very little intelligence. The onboard computer architecture comprised redundant radiation resistant processors and memory – the USA Military Standard 1750A processor was based on Silicon-on-Sapphire technology for that reason. The processor performance of about 250,000 instructions per second, read-only memory of 64K words and random access memory of 1M words were 1,000–10,000 times less powerful than the PC on which this article was written – both because the design was carried out in 1992 and because radiation resistant hardware is inevitably less powerful than the current commercial systems. The same software runs in each redundant processor. Each software unit monitors its own health, and invalidates itself on error. However, even in failure the software will continue to attempt to fulfill its mission.

The software was programmed in the Ada language, which was developed for military applications requiring high integrity software. The software was designed with a 125 ms cyclic scheduler, using the Ada exception mechanism to ensure that timing overruns were recovered without stopping the software to reboot – thus providing what is called ‘hardreal-time scheduling’. In the interests of simplicity and reliability, various Ada language features were prohibited, and the run-time system was stripped down to remove potentially dangerous items.

The software design was performed using another tool with a military heritage, the hierarchical object oriented design (HOOD) tool, which provides clear traceability between requirements, design and implementation. The independent arming of the pyros by g-switches allowed the software to be classified as mission critical rather than safety critical, resulting in slightly less stringent design and testing requirements.

The software was extensively tested both by LogicaCMG using simulated test data, and also after integration with the rest of the spacecraft. The testing continued during the seven-year journey to Saturn – every six months the probe was activated and the software ran through the mission sequence. Nevertheless, the first time it could be tested in a real environment was when it arrived at Titan, and then it had to work first time.

Conclusion

The Huygens mission was completed successfully with the receipt on Earth of extensive measurements of the properties of its atmosphere plus hundreds of images and measurements of Titan’s surface. All systems onboard the probe appear to have worked at or above their specified levels.

The experience developed on Huygens was used again in the late 1990s to design and develop parts of the UK’s Mars probe, Beagle 2. Further missions to Mars and other solar system bodies are now being planned, and the Huygens engineering and management experience will be an essential part of their success.

Huygens was designed and developed for the European Space Agency (ESA) by a consortium of about 20 mainly European companies under the prime-contractorship of Alcatel Space. The Particle Physics and Astronomy Research Council (PPARC) organised the UK scientific involvement in the mission and provided the UK's share of ESA's funding. The main UK industry involvement comprised:

• LogicaCMG: flight software

• IGG: parts procurement

• Irvin: parachute manufacture

• Martin-Baker: descent control sub-system (responsibility later transferred to Vorticity Ltd)

Three minutes after reaching the top of Titan’s atmosphere the probe had decelerated to 1,400 km/hr at an altitude of 160 km above the surface. Here accelerometers alerted the flight software that it was time for Huygens to start work and the descent control sub-system (DCSS) took over.

Huygens’ engineering sub-systems Include:

• The inner structure of honeycomb aluminium sandwich platforms plus two protective aluminium shells linked by a central ring and three radial titanium struts, and with 36 spin vanes on the outside to provide a controlled spin rate during descent

• Thermal control that maintains room temperature inside the Descent Module despite variation in solar flux from 3,800 watts per square metre (W m-2) to 17 W m-2 by a combination of (a) the gold-coloured multi-layer insulation blanket attached with Velcro to all external surfaces, (b) 35 radioisotope heaters on the platforms providing about 1W each, and (c) open cell Basotect foam inside the Descent Module to prevent convection cooling by Titan’s cold atmosphere (-180°C to -200°C)

• Electrical power supplied by five batteries, each comprising two modules of 13 LiSO2 (7.6 Amp hours) cells in series, conditioned, distributed via a regulated 28 volt (V) main bus to the probe equipment, a special safety certified +5V supply for the Pyro unit and three dedicated battery voltage lines to the mission timer (the ‘clock’)

• Data relay to the Cassini orbiter via two redundant S-band transmitters and two circularly polarised antennae, and also incorporating an ultra-stable oscillator for use by the scientific experiments to allow accurate measurement of the Doppler shift in the probe-orbiter radio link

• Two redundant command and data management units plus triply redundant clocks with two mechanical g-switches to independently arm the pyros and thus protect against an erroneous software command, and a triply redundant acceleration sensor

• Software to control events, collect data and manage its transmission to the orbiter

• Descent control comprising a suite of parachutes, their deployment devices and low friction swivels

Biographies – Pat Norris and Steve Lingard

Pat Norris is Business Development Manager at LogicaCMG. Born and educated in Dublin, his experience of systems for landing on solar system bodies dates back to his 1967–1970 role as manager of Apollo Navigation at TRW in Houston for the first moon landings.

Contact: pat.norris@logicacmg.com

Steve Lingard is Technical Director at Vorticity Ltd and was programme manager for the Huygens descent control sub-system. Educated in Bristol, he has 15 years experience of extraterrestrial probes and 30 years experience of parachute systems. Contact: steve.lingard@vorticity-systems.com

Further reference

The European Space Agency website contains a wide range of Huygens engineering and science information: www.esa.int/SPECIALS/Cassini-Huygens/index.html

More information on the Huygens flight software: ‘To the Surface of Mars via Titan’, J Barrington-Cook, et al, in Proceedings of DASIA’99 Conference, Lisbon 17-21 May 1999; available as publication ESA SP-447 from: www.esa.int/SPECIALS/ESA_Publications/SEMR9YZ990E_0.html