The Colour and Stereo Surface Imaging System (CaSSIS) for the ExoMars Trace Gas Orbiter

Abstract

The Colour and Stereo Surface Imaging System (CaSSIS) is the main imaging system onboard the European Space Agency’s ExoMars Trace Gas Orbiter (TGO) which was launched on 14 March 2016. CaSSIS is intended to acquire moderately high resolution (4.6 m/pixel) targeted images of Mars at a rate of 10–20 images per day from a roughly circular orbit 400 km above the surface. Each image can be acquired in up to four colours and stereo capability is foreseen by the use of a novel rotation mechanism. A typical product from one image acquisition will be a $9.5~\mbox{km} \times {\sim}45~\mbox{km}$ swath in full colour and stereo in one over-flight of the target thereby reducing atmospheric influences inherent in stereo and colour products from previous high resolution imagers. This paper describes the instrument including several novel technical solutions required to achieve the scientific requirements.

1 Introduction

In the 1990s, the European Space Agency (ESA) set up a series of study teams to establish the scientific aims and objectives for a mission focused on the search for past or present extra-terrestrial life. Outputs from these studies included a detailed report (ESA 1999) and associated papers (e.g. Brack et al. 1999) which eventually led to the setting up of the ExoMars mission as part of ESA’s optional programme. This programme was aimed at performing an in situ search for extinct or extant life on Mars. The programme underwent a number of configuration changes in the subsequent decade but in 2009 the scenario became based around a two-step programme combining instrumentation from both NASA and ESA. The first element, an orbiter, was to be followed by a rover, 26 months later. The orbiter element was to provide communications while the rover was specifically targeted at investigating the sub-surface where primitive lifeforms might have survived having been protected from the harmful UV and ionising radiation present at the surface.

Although the orbiter was primarily foreseen as communication infrastructure for the rover element, the possibility to place payload on the orbiter was attractive and the detection of methane in the atmosphere of Mars (Formisano et al. 2004; Geminale et al. 2008; Mumma et al. 2009) led to the concept of providing the orbiter with the capability to detect trace gases. We note in passing the on-going work connected to the detection and variability of Martian atmospheric methane and other trace species (e.g. Fonti and Marzo 2010; Villanueva et al. 2013; Webster et al. 2015 and references therein) and work to place these results into context (e.g. Wray and Ehlmann 2011). A NASA-ESA Joint Instrument Definition Team (JIDT) report (see Zurek et al. 2011) suggested provision of very high spatial resolution imaging or mapping instruments (e.g., cameras and/or multi-beam active lasers) to provide geological context and location of small-area sources of trace gases should they exist (e.g., a volcanic vent, rift or crater). The definition team focused on a High Resolution Colour Stereo Camera (HRCSC) concept that would provide geological characterisation of trace gas sources.

The orbiter spacecraft was named the ExoMars Trace Gas Orbiter (TGO) and a commitment was made to launch in the 2016 window. An Announcement of Opportunity (AO) was issued in 2010 calling for payload based on the JIDT report. This report foresaw that the HRCSC would provide ∼1 m/pixel, near-simultaneous stereo, colour discrimination of water ice, and dust and surface variations incorporating imaging of potential trace gas sources and detection of surface changes. A total mass of 25 kg was allocated and an average power of 15 W. A joint US-European team successfully responded to this AO with an instrument called HiSCI (McEwen et al. 2011a, 2011b).

However, following the loss of the attempted collaboration with NASA in ExoMars, both the programme and the payload were reconfigured in 2012 as a joint ESA-Roscosmos endeavour. The schedule for TGO was maintained with a payload of 4 instruments (2 Russian led, 2 European led) and an entry, descent, and landing demonstrator (subsequently called Schiaparelli). The Colour and Stereo Scientific Imaging System (CaSSIS) became the main imaging system on the spacecraft replacing the HiSCI instrument. The full payload is described in Vago et al. (2015).

Many aspects of CaSSIS are derived from the HiSCI concept, but although similar in concept and scope, CaSSIS has several important differences forced by the need to meet a highly accelerated schedule and reduced mass and volume allocations. This paper describes CaSSIS in detail to act as a future instrument reference. We note that Vandaele et al. (2015) have described the other European-led instrument on TGO, Nadir and Occultation for Mars Discovery (NOMAD) with an update in Vandaele et al. (2017). The two Russian experiments, ACS and FREND, are described in Korablev et al. (2015, 2017) and Mitrofanov et al. (2017), respectively.

We begin by describing the top level scientific objectives of CaSSIS. We then describe the instrument concept which will also act as a framework for the more detailed sections in the rest of the paper. We then provide estimates of the expected signal to noise ratios. The next section describes the operation and data structure. We then discuss the data processing and its development status at the time of writing. A paper describing the ground calibration is presented in a companion paper (Roloff et al. 2017). A detailed investigation of the potential performance of CaSSIS, including examples of how other instrument results might be combined with CaSSIS data to provide high quality products, is given in a second companion paper by Tornabene et al. (2017). A later section also shows the first successful image acquisitions in Mars orbit.

2 High Level Scientific Objectives

The baseline is to place TGO in a 400 km circular orbit with an inclination of 74°. This is not Sun-synchronous (unlike other orbiters e.g. MRO) and hence the spacecraft will rotate through all local times of day several times per Mars season. So CaSSIS will have the unique ability to monitor how the surface colour and albedo changes with time of day as well as season. It is important to recognise that this orbit provides more opportunities to monitor mid-latitudes, but none over polar surface regions (>±74° latitudes) unless the spacecraft provides special pointing opportunities.

The top level scientific objectives of the imager on TGO were (1) to characterise sites which have been identified as potential sources of trace gases, (2) to investigate dynamic surface processes (e.g. sublimation, erosional processes, impacts, and potential volcanism) which may help to constrain the atmospheric gas inventory, and (3) to characterise potential future landing sites by measuring local (down to ∼10 m) slopes. The relatively short lifetime of methane in the Martian atmosphere suggests that rapid methane replenishment is necessary and hence it was expected that the instrument should contribute to the investigation of numerous dynamic phenomena and, in particular, take advantage of the changes in local time. The ability to increase high resolution coverage of the Martian surface is also of importance.

The dynamic phenomena that can be studied with an imaging system can be broken down into specific types of process. We give here a few examples of phenomena that may provide sources of short lived atmospheric trace gases.

Aeolian Processes

Analysis of HiRISE images over the past 4–5 Martian years has shown that ripples and dunes are in motion at a rate that is measurable by orbital remote sensing (Fenton 2006; Silvestro et al. 2011; Bridges et al. 2012; Cardinale et al. 2016). For example, observations of Endeavour crater in Meridiani Planum show multiple spatial and temporal scales of aeolian-driven surface change with migration rates of 4–12 m per Mars year in some places (Chojnacki et al. 2015). This is within the scope of moderately high resolution imagers. It is conceivable that this motion could expose sub-surface organics or provide trace gas sources. Dust motion in the first metres above the surface can also be studied. Choi and Dundas (2011), for example, could identify circulatory motion within dust devils by taking advantage of the short duration between colour acquisitions of the High Resolution Imaging Science Experiment (HiRISE) on the Mars Reconnaissance Orbiter (MRO). Investigation of recent dust devil tracks can also be undertaken.

Volcanic Processes

There does not appear to be any strong evidence for extant volcanic activity on Mars. Ground-based surveys looking for active release of gases above the Tharsis and Syrtis regions have so far drawn a blank with hard upper limits on SO₂, H₂S and SO being set (Khayat et al. 2015). Nonetheless recent volcanism has been identified in several regions and dated by crater counts (<10 My at Cerberus Fossae, see Vaucher et al. 2009) showing that the interior of Mars is warm enough to trigger volcanism at the surface. Therefore, spectroscopic instruments on TGO may change the picture of an inactive planet and an imager can try to localise detected active volcanic gas sources. Sub-surface intrusions could also release trace gases.

Dry Dust Avalanches

Slope streaks, which are probably dry grain flows, are seen occurring on slopes in high-albedo, low thermal inertia, dust-rich equatorial regions (Sullivan et al. 2001; Brusnikin et al. 2016). They are sporadic (Schorghofer and King 2011) and their formation does not appear to be seasonally controlled. The formation occurs on short timescales (probably < 1 day) while disappearance (fading) typically requires decades. The modification process is probably related to airfall of dust and wind patterns (Baratoux et al. 2005; Chuang et al. 2010) and may place constraints on deposition rates.

Seasonal Slope Processes (Gullies)

HiRISE observations suggest widespread current activity in gullies in the southern hemisphere, particularly in those with the freshest morphologies (Dundas et al. 2015). Pasquon et al. (2016) have investigated southern hemisphere linear gullies finding that gully channels can lengthen by as much as 100 m per year. The activity recurs on an annual cycle in a specific range of Ls that coincides with the final stages of the sublimation of annual CO₂ ice deposits (see also Dundas et al. 2012) although recent observations suggest that activity can occur in early winter as well. Raack et al. (2015) have also looked at present-day seasonal gully activity in Sisyphi Cavi and suggested a combination of dry flow with a flow supported by CO₂ gas. Dundas et al. (2015) identified recent deposits beneath a gully that were prominent in HiRISE enhanced colour composite images. It is possible that currently active processes could be responsible for all geologically recent gully formation and growth without requiring climate change (Dundas et al. 2015). Freshly exposed material from this activity might also be connected to trace gas release.

Seasonal (Polar) Processes

Although the maximum observational latitude will be constrained by the orbit inclination, phenomena associated with the polar regions can still be well observed. Winter CO₂ deposits can reach as far as 50° latitude. The southern polar seasonal dust fan morphologies described in areas such as “Inca City” (Hansen et al. 2010; Thomas et al. 2010) are also evident at latitudes within the range of nadir pointing TGO instruments. Modelling indicates that, when active, these fan-producing “jets” should be 200 m high plumes of dark material. At the time of writing, there remains no unambiguous observation of an active plume (see Thomas et al. 2010, 2011). Probably the only way to “catch” a plume in action (and hence place constraints on models) is to acquire real-time stereo observations at times when plumes should be turning on (probably mid-morning). The TGO orbit would allow this type of experiment. In the northern hemisphere, variations in dune morphology have been associated with CO₂ frost and/or wind activity (Hansen et al. 2015) although in many cases the exact mechanisms remain unclear. As with low latitude dune motion, exposure of fresh surfaces may lead to trace gas release.

Seasonal Slope Processes (Recurring Slope Lineae, RSL)

RSL (McEwen et al. 2011c) remains a “hot topic” even if the production mechanism remains somewhat unclear. These narrow dark markings can be imaged at 5 m/px and below (Tornabene et al. 2017) and their properties can be explained by a seasonal flow or seepage of water or a brine or alternatively by granular flow exposing wet soil. Near-infrared absorption band signatures have been detected and are consistent with hydrated salts (Ojha et al. 2015). The TGO orbit may provide additional information because of the possibility of observing RSL sites at different times of day. If the mechanism is brine-related then one would expect increased activity near midday although the volumes of brines produced in a Martian sol may not be sufficient to produce large diurnal changes. Stillman et al. (2016) have recently suggested that RSL at different latitude bands have different source types. Additional coverage provided by the TGO imager is therefore of importance in challenging or supporting conclusions of this kind. If RSL are related to deliquescence (e.g. Gough et al. 2016), then CaSSIS may see areas in the early to middle morning being darker than in the middle afternoon (observed by MRO).

Shallow Sub-Surface Ice, Periglacial Processes, and Recent Impacts

In many areas, the texture of the surface is indicative of periglacial processes. Polygons and scalloped terrains have been reported by many authors (e.g. Mangold et al. 2004; Lefort et al. 2009; Mellon et al. 2009a) and have been interpreted as evidence of near-surface ice. The proximity of water ice to the surface has been revealed by new impact craters (Byrne et al. 2009; Reufer et al. 2010) that have exposed or ejected sub-surface water ice (see also Mellon et al. 2009b) that subsequent sublimes (Dundas et al. 2014). Trace gas release could also be related to this mechanism. Continued monitoring of fresh impacts would increase our knowledge of the distribution and depth of near-surface ices. The “blast zones” around fresh impacts also show changes with time. The original darkening around the impact sites is returned to the original colour/brightness probably as a result of deposition of high albedo atmospheric dust (Daubar et al. 2013, 2016).

In addition to the studies of dynamic phenomena, an additional high resolution colour imager can extend the coverage of past instruments such as HiRISE and can support the investigation of local mineralogy (e.g. Thollot et al. 2012; Tornabene et al. 2017) and photometry including cross-calibration with other experiments.

3 Structure of the Instrument

CaSSIS is based on meeting a series of technical, programmatic, and scientific requirements. Two key programmatic aspects constrained, indirectly, the instrument resolution. Firstly, the schedule drove the use of a detector and proximity electronics previously developed for the SIMBIO-SYS instrument slated to fly on ESA’s BepiColombo mission to Mercury in 2018 (Flamini et al. 2010). This system operates in a “push-frame” mode (an intermediate approach between conventional line-scanners and framing imaging systems). Secondly, the schedule also drove use of a previously manufactured primary mirror for the telescope leading to a fixed instrument aperture. A further consequence of the schedule was that a “proto-flight” approach to instrument development was adopted.

In spite of these compromises, it was important that CaSSIS retain much of the capability of the original HiSCI concept and hence its scientific usefulness as a full-swath colour, stereo imaging system at a resolution exceeding most previous imagers with the exception of HiRISE (McEwen et al. 2007) and the Mars Orbital Camera, MOC (Malin et al. 1992). This was defined as providing

• Stereo imaging within one pass over a target

• Colour information in at least 3 filters within the visible to near-IR range with a signal to noise ratio exceeding 100

• ≤5 m/px scale (∼10 m resolution)

• Multi-local time observations (which is, in effect, provided by the spacecraft orbit described elsewhere)

• Complementary capability with respect to existing data sets.

Finally, mass, power, and volume requirements were specified but at a lower level in relation to the original HiSCI proposal in part to allow accommodation of the FREND and ACS experiments (Vago et al. 2015). The instrument’s position on the payload deck was also modified.

With the above in mind, CaSSIS was designed to provide the highest resolution (∼4.6 m/pixel) coverage of Mars everywhere except for the ∼2.5% of Mars’ surface covered by HiRISE (and only ∼0.5% in colour or stereo) and another few percent covered by the highest resolution MOC data. Table 1 shows a numerical comparison of recent imagers.

Table 1 Comparison of the capabilities of different imaging systems on Mars missions

Although the Context Imager (CTX) on MRO has a similar imaging scale (∼5.5 m/pixel), it does not provide colour images and useful stereo coverage is restricted to only ∼10% of Mars. HRSC has provided >90% global stereo and colour coverage, but the highly elliptical orbit and wide-angle optics result in >10 m/pixel scale at best. Also, the HRSC images are acquired at different emission and phase angles per colour making generation of photometrically accurate colour products at best difficult (McCord et al. 2007). THEMIS colour data (typically binned to 36 m/pixel) suffers from severe stray light calibration difficulties and poor signal to noise (McConnochie et al. 2006) while CRISM provides excellent spectral imaging data in 545 wavelengths but at no better than 18 m/pixel scale (Murchie et al. 2007). HiRISE has revealed spectacular small-scale colour diversity but has a very narrow colour swath width (<0.5% of global coverage) and absolute radiometric calibration challenges because of highly variable focal-plane temperatures (Delamere et al. 2010). CaSSIS uses a single focal plane covered with a segmented filter and a rotation mechanism to acquire along-track stereo with matching illumination of the surface in colour which should lead to a superior dataset for photometric purposes. Considerable effort in the on-ground calibration has been placed in support of this goal (Roloff et al. 2017). Hence, CaSSIS should complement previous imaging systems while providing a continuing imaging asset around Mars in case of failure of the other, now ageing, instruments and spacecraft.

The resolution is mostly driven by the transfer speeds of data from the detector to the digital processing unit described below. In a push-frame system, an acquired image (to be called “framelet” hereforth) has to be transferred out of the proximity electronics before the next framelet is acquired otherwise gaps in the swath are produced. Sufficient overlap between framelets is also necessary to ensure accurate registration of the final reconstructed swath. With a nominal ground-track velocity of 3.012 km/s and the need to acquire colour data over a large swath width, angular scales in the range 10–12 μrad/px needed to be used resulting in a focal length of 850–900 mm. In addition, the aperture size was constrained by a trade-off between mass, volume and signal to noise ratio (which is linked to the maximum allowable image smear coming from the spacecraft ground-track motion) resulting in an F-number of between 6 and 7. The long-lead time for manufacture of the primary mirror (referred to hereafter as M1) led to the concept of using a previously manufactured mirror. This provided an additional constraint to the design.

The resulting conceptual solution split the instrument into two units (Fig. 1), a camera rotation unit (CRU) and an electronics unit (ELU). The CRU was conceived as a support structure holding a telescope with the detector and a rotation mechanism to produce the stereo pair. The idea of rotating or tilting a camera to obtain a stereo pair from one pass over an object is not new. For example, the LANYARD system from 1963 (part of the first generation of U.S. photo-reconnaissance satellites) was programmed to tilt between fore and aft to cover the same land area twice during one photographic pass and thus to acquire stereo coverage at 2 m resolution from around 160 km altitude (see http://www.fas.org/spp/military/program/imint/corona.htm and http://www.earsel.org/SIG/3D/Dati/Porto/Jacobsen1.pdf). One of the most recent implementations of this technique can be seen in the GeoEye-1 programme. Unlike these imagers, TGO presented an additional issue. The spacecraft was designed such that one side (the $-\mbox{Y}$ panel) is always nadir pointing. However, the spacecraft rotates about this vector in order to maintain sunlight orthogonal to the spacecraft solar panels.

Fig. 1

The CaSSIS Flight Model on the bench at the University of Bern in November 2015. The ELU with a protective cover for its radiator in red is to the right. The CRU is to the left. The multi-layer insulation had not yet been mounted to the CRU so that details of the telescope and wiring can be seen. Key elements are marked

The HiSCI concept (McEwen et al. 2011a), which CaSSIS also adopted, is an elegant solution to the dual problem of the rotation of the platform about the nadir vector plus the requirement for stereoscopic imaging. Here it is the instrument that moves and not the whole spacecraft (as in the case of GeoEye-1) and rotation accomplishes not only the stereoscopic objective but also the compensation for the spacecraft attitude allowing the detector to be always aligned with respect to the ground-track motion (Fig. 2).

Fig. 2

Schematic of the imaging approach for CaSSIS. The spacecraft is moving from right to left on its orbit. CaSSIS acquires push-frame images to build up a full image swath (Image 1) before rotating by 180 degrees to acquire the second image of the stereo pair (Image 2)

The rotation of TGO about its nadir-pointing direction can be suspended during imaging. It is currently baselined to perform this suspension of yaw-steering once per orbit to allow stereo image acquisition. However, images can be obtained without yaw-steering suspension. A 20 second image acquisition sequence leads to a 1° change in rotation of the orientation of the image between the first and the last framelet, degrading stereo overlap. However, this effect is not a major issue and simulations show that the reconstruction of the framelets into a final image should still be easily possible. CaSSIS may use this to acquire individual (non-stereo) images of targets when yaw-steering suspension is impossible.

The CRU design limited the mass and volume by using a T-shaped structure with the bulk of the instrument balanced across a rotation bearing. The telescope is mounted on one side and is tilted by 10° with respect to the axis of symmetry of the bearing. Rotating through 180° between two images results, when coupled with the spacecraft orbital motion, in a stereo convergence angle of 22.4° for a circular 400 km orbit above Mars. This convergence angle represents a good compromise between vertical precision, ground resolution, and atmospheric haze signal in the images, based on HiRISE experience.

The rotation drive motor is mounted on a support structure that forms the vertical part of the ‘T’. The rotation bearing is part of this support structure. Considering the mass and concerns over the length of the harness from the detector to its proximity electronics (PE), the PE box is mounted within the bearing. This in turn passes a harness to a cable management system (often referred to as the “Twist Capsule”) which acts as a counterweight to the telescope across the support structure. A harness is then routed from the CRU to the ELU which houses the instrument power, control and rotation electronics.

We now discuss the individual elements in more detail.

4 Telescope Design

The CaSSIS telescope assembly has been designed to support acquisition of both single images and stereo image pairs. The telescope assembly comprises optical elements for focusing the beam, mechanical mounts for supporting the optical elements, structures to support the optical elements and mounts, internal baffles and field stops, and mounting structures for interfacing to the rotation drive and to the Focal Plane Assembly (FPA). An image of the flight telescope is given in Fig. 3. The mass of the telescope assembly is 4626 g.

Fig. 3

Marked-up drawing of the telescope assembly

4.1 Optical Sub-System

The optical system consists of a ø135 mm, $\mbox{f} = 880~\mbox{mm}$, F/6.5 off-axis 4-mirror (M1-4) reflective telescope with a field of view (FoV) of 0.878° in the plane of symmetry and 1.336° in the cross-track direction. The initial baseline considered a Three-Mirror-Anastigmat (TMA) with an intermediate image and an additional flat folding mirror. During design it was determined that such a TMA would result in a tertiary mirror almost as big as the primary and could not fit into the available volume. To find configurations with reduced element sizes, iterations were made with a system with 3 ideal lenses, keeping the focal length and overall length constrained and taking the element sizes as performance merits. The only optical performance metric involved was the Petzval correction (the sum of the element powers to be zero). Two basic configurations emerged from this iteration: (i) one configuration with an intermediate afocal space and (ii) one configuration with a 1:1 imaging element. Configuration (ii) would eventually result in a Korsch-like telescope with a minimum size tertiary, although the mirror would be too large. Configuration (i) was selected, which required 4 mirrors with optical power.

In the transition from the ideal lenses to a design with real mirrors, the first element was substituted by a Cassegrain Telescope [M1, M2], yielding an intermediate image (Fig. 4 position a). The second element became the ocular mirror M3, yielding nearly collimated space (b). The third element became M4 and delivers the final image. Mirrors M3 and M4 are about the same size and have less than half the size compared to a single tertiary mirror of a TMA. The increased number of degrees of freedom was further used to incorporate an existing primary mirror (M1) from another telescope built in a small series at RUAG Space, thus eliminating the longest lead item and reducing schedule pressure. This mirror was already manufactured and its optical properties had to be incorporated into our design. The severest penalty proved to be the loss of the flat folding mirror. The off-axis clearance had now to be achieved solely with tilts and decentres of the aspheric mirrors, which cost imaging performance. The most critical—and performance limiting—feature proved to be the clearance (c) between M3 and the beam underneath from M4 to the image.

Fig. 4

The optical path for the CaSSIS telescope. The lower case letters refer to specific aspects of the design discussed in the text

The first order design had foreseen an accessible exit pupil to support stray light suppression. This pupil still exists (d), but there was insufficient clearance to baffle at this point. The remaining options for stray light baffling were the placement of a field stop (e) at the intermediate image (a) and two intermediate walls (f and g) which subdivide the telescope into an upper compartment with M1 and M2 and a lower compartment with M3 and M4. The optical design has further taken care to prevent direct sky view from the detector through the field stop into object space, line (h).

The overall imaging performance achieves a modulation transfer function (MTF) of >0.3 at the detector Nyquist frequency of 50 lines/mm (44 lines/mrad in object space) at a wavelength of 632 nm over almost the entire FoV, thus making optimal use of the detector i.e. the MTF should also not be much greater 0.3 at the Nyquist frequency to avoid aliasing effects (Fiete and Bradley 2014). This will be compromised to some extent by the along-track smear generated during the exposure time (nominal exposure times correspond to <1 px of along-track smear) and the, as yet unknown, effects of spacecraft jitter. The geometrical distortion has been determined pre-flight by analysis (Fig. 5). The maximum distortion of the image within the field is currently estimated to be <0.9%.

Fig. 5

Preliminary distortion map with the field of view of the CaSSIS telescope. The distortion values are in pixels and give the magnitude of the distortion from a perfect field of 11.3764 μrad/px

The 4 aspheric mirrors are made of ZERODUR^® Expansion Class 0. All four mirrors carry a protected silver coating using a process previously qualified for space applications by RUAG Space.

4.2 Structural Sub-System

A carbon-fibre reinforced polymer (CFRP) material, manufactured according to a RUAG Space proprietary process, has been used in the design of the structure. The structure was reinforced throughout the development phase to increase its stiffness and its ability to withstand the random vibration loads. The tube structure, which has a wall thickness of 4.8 mm, was manufactured as one piece. Inserts were then added to the tube allowing it to accommodate receiving walls and other metallic structural components. The walls are made in sheets from the same quasi-isotropic near zero coefficient of thermal expansion (CTE) CFRP type, from which they were then cut-out and machined to the required dimensions.

CFRP is known to outgas and contract. The material used had previously been tested for shrinkage and the position of the focal plane shift calculated so that a pre-compensation of the focal plane position (46 micron) could be assumed during integration.

The internal baffles are made of aluminium and located adjacent to the field stop allowing them to block the optical path (shown in Fig. 4; position h), and to transfer heat radiatively and conductively to the telescope assembly from a series of electrical heaters thereby supporting temperature stabilisation. It should be noted that CFRP has near-zero CTE only in the two lateral dimensions (i.e. along the surface of the sheets), but not in the third dimension, i.e. vertical to the sheets. Hence, temperature stabilisation is still required.

INVAR^® mirror mounts are attached to the CFRP tube and maintain the mirrors in place throughout the environmental changes and allow testing in 1 g gravity without significant degradation to the image.

The interface between the telescope assembly and the rotation drive mechanism uses three titanium bipods (Fig. 3) which are glued to the structure. The feet are then bolted to the mechanism with six titanium M8 bolts. The bipods were designed, based on heritage, to provide a highly stiff 3-point interface to the telescope assembly. They have been optimised several times during the development phase. VETRONITE^® washers were implemented at the bipod interface to isolate the telescope assembly thermally from the rotation mechanism.

Major effort was required to optimise the mass of the telescope assembly throughout the development phase, principally because the strengthening of the structure, following load analysis, consumed a significant amount of the design contingency. The CFRP structure has been significantly light-weighted, as can been seen in Fig. 6.

Fig. 6

The CFRP structure of the telescope prior to mounting of the mirrors

4.3 Thermal and Electrical Sub-System

The telescope assembly thermal sub-system has to allow the instrument control sub-system to regulate the temperature of the telescope assembly during both survival and operational phases. In addition, it must also provide information about the temperature to the spacecraft. The thermal sub-system design was supported by analyses (the operational cold case is shown in Fig. 7), and has satisfied the above requirements by implementing heaters, thermostats and thermistors.

Fig. 7

Operational cold case temperatures for the mirrors and structure of the telescope

In order to keep all components of the telescope above their qualification temperatures during cruise and long eclipse during aerobreaking (e.g., in survival mode), 7W was required. For the operational case, 14.5 W was needed to keep the telescope assembly at its nominal operational temperature of $21\pm5$ °C. To achieve this, 4 heaters were bonded to the internal metallic baffles (2 nominal and 2 redundant). Each heater had a double circuit. The heater power regulation is performed in the digital processing module (DPM—see below). In case the heater regulation fails, thermostats (6 KLIXON^® 3BT) prevent the hardware from overheating. Two were allocated for each heating zone (one nominal and one redundant). The cut-off temperatures of the thermostats were set to 60 °C. To provide sufficiently accurate measurements of the respective temperature, eight PT1000 temperature sensors were bonded to the telescope assembly. Six of these are monitored by CaSSIS, and two are monitored by the spacecraft only. For redundancy, all 6 sensors are used for the thermal control in the operational and survival phase. The sensor located at the structure is not only monitored but also triggers an alarm for the spacecraft should it deliver readouts outside pre-defined alarm limits.

5 Focal Plane and Proximity Electronics Design

5.1 Focal Plane Assembly (FPA)

In order to save development time, CaSSIS re-uses the focal plane assembly (FPA) of the SIMBIO-SYS instrument for ESA’s BepiColombo mission (Flamini et al. 2010). This FPA (Fig. 8) uses a Raytheon Osprey 2k hybrid CMOS detector as the light sensitive element and is surrounded by local electronics.

Fig. 8

The FPA on its transport mount. The detector area is covered with a protective plate (top). A flex cable (which forms the electrical interface) loops from the FPA to a grounding support

The detector is based on Hybrid Silicon PIN (Si PIN) CMOS technology. The Si PIN diodes, being backside illuminated, have a 100% fill factor and very high quantum efficiency up to near-IR wavelengths, ranging from 4% at 400 nm up to 91% at 800 nm at 293 K by taking advantage of the Raytheon anti-reflection coating. The FPA array is composed of $2048 \times 2048$ pixels with $10~\upmu \mbox{m}\times 10~\upmu \mbox{m}$ pixel pitch. The CMOS process provides a full well capacity of about 90000 electrons.

This technology allows snapshot acquisition and windowing. The window size can vary from 1 to 2048 in the row direction (foreseen as along-track) with the resolution of one row and from 128 to 2048 with 64 columns resolution (cross-track). The detector is read-out with 14 bit digital resolution. However, it remains a framing device meaning that acquiring an un-smeared image along a rapidly moving ground-track requires short exposures and a rapid imaging sequence. The along-track dimension of the image is then built up and put together during on-ground processing. The read-out integrated circuit (ROIC) allows a read-out speed of 5Mbps with a clock frequency up to 5MHz.

The detector is enclosed in a dedicated package, which provides the necessary electrical, mechanical and thermal interfaces to the device, including an optical window support allowing incorporation of broad-band optical filters. A rigid-flexible ‘ribbon’ cable and connector for interconnection of the FPA with the Proximity Electronics (PE) is also part of the packaging.

The original SIMBIO-SYS optical window was replaced with one custom-made for the scientific requirements of CaSSIS (see below). The alignment of this Filter Strip Assembly (FSA) was executed and tested by Selex ES in Campi Bisenzio under the responsibility of Thales-Alenia Space, Italy. The parallelism with respect to the detector area was measured to be within a pixel.

A thermo-electric cooler had been mounted to the detector in the SIMBIO-SYS design to reduce the temperature in Mercury orbit. In the specific case of the CaSSIS FPA, this cooler was known to be defective. Hence, a radiator was incorporated into the design to cool the detector and a heater implemented to provide stability. This simpler approach proved to be viable for the less challenging thermal environment of TGO. The default detector temperature has been set to 0 °C. The detector is thermally decoupled from the telescope (except via radiative coupling) which is held at 20 °C by default.

5.2 Proximity Electronics

5.2.1 Hardware

The Proximity Electronics (PE), which were designed and manufactured by Selex-ES, is the electronics module which controls the operation of the FPA. It links the FPA to the ELU (via the twist capsule) which provides power and data interfaces (Fig. 9).

Fig. 9

The Proximity Electronics housing containing the PE board for driving the FPA. The board is similar to that used on SIMBIO-SYS but with small modifications to the connector positioning so that the box could be mounted inside the rotation bearing. The box is roughly 20 cm in length

The PE is derived from the one designed for the HRIC and STC channel of the BepiColombo SIMBIO-SYS instrument (Flamini et al. 2010). The box (above) had to be re-designed to adapt the mechanical and thermal interface to the position of the PE within the rotation bearing. As a consequence of this, the connector locations had to be moved from the sides to the top cover.

The main functions of the PE are

• Command reception from the ELU via a SpaceWire interface and command decoding

• Detector bias generation.

• Detector clock generation (the PE generates the correct clocking sequence to read the detector image area, in accordance with the commands sent by the ELU).

• Detector video signal acquisition and analogue to digital conversion

• Video data transmission to the ELU, via the SpaceWire interface

• Temperature and other housekeeping read-out, conversion and transmission to the ELU.

Some of these functions are programmable. The relevant parameters are included in telecommands sent by the flight software from the ELU to the PE via the SpaceWire interface. A PE functional block diagram is shown in Fig. 10.

Fig. 10

Proximity electronics functional blocks

5.2.2 Communication and Control

The data interface to the PE is composed of a full-duplex SpaceWire link with a data rate up to 100 Mbit/s. The physical layer is implemented by a dual LVDS (low-voltage differential signalling) transceiver integrated circuit (UT54LVDM055LV) while the SpaceWire Codec is integrated in the PE field programmable gate array (FPGA—Microsemi RTAX2000 device). The data handling of the channel is controlled by the ELU. The PE Data Control FPGA decodes and executes the commands received from the ELU and sends the needed data back to the ELU.

A 4 Mbit SRAM memory buffer is implemented in the PE. This is used as a temporary buffer for pixel data. When the detector is operated at the maximum frequency, pixel buffering is needed, because data production by the video ADC, when taking into account overheads, is higher than data transmission over the 100 Mbit/s SpaceWire link to the ELU.

The communication across the SpaceWire interface can be split into three main types of command.

• The HK Acquisition Command (PE_SendHK) is a request of all the analogue housekeeping, configuration settings and status words relevant to the FPA

• The SCIENCE Acquisition Command (PE_AcquireScience) carries information about the sequencing that the PE has to perform during the next integration period and comprises the request for detector data or the test pattern

• The Detector ON/OFF control Command, (Detector_OnOff).

The PE allows a number of different kinds of sequences, according to a set of configuration parameters. These are sent to the PE within the parameters of the PE_AcquireScience command. The four main parameters are

• Integration Time: A programmable value in the range 10 μs to 32 s.

• Windows: This parameter defines the number of windows to be read from the detector and is a programmable value in the range 1 to 6.

• Window position and size: These parameters define the positions and sizes of each window to be read. This feature is the key to the operation of the FPA.

• Binning factor: This parameter defines the binning factor to be performed on the read windows. Values of $1\times 1$, $2\times 2$, $4\times 4$, and $8\times 8$ are available and are individually programmable. The algorithm implemented in the FPGA avoids recording the whole frame before computation, but operates while the pixels are acquired and transmitted. This allows the use of reduced SRAM memory and a faster transmission of the acquired data.

Pixel data are acquired and converted to 14 bit digital numbers to be transmitted as 2-byte integers. The binning is performed digitally by summing the pixels and dividing by the number of binned pixels so that the data remain within 14 bits. The flight software within the DPM provides the instrument level control of these functions.

The FPGA is based on a radiation-tolerant technology, implementing also SEU (single event upset) -hardened flip-flops with built-in triple module redundancy (TMR) in order to further improve SEU tolerance of long-term data storage. The firmware uses three different FIFOs which are composed of internal SRAM memories, namely SpaceWire Rx and Tx buffers, and a pixel data temporary storage buffer. Since internal SRAM memories are not protected against SEU by built-in TMR, the SpaceWire Rx buffer, which is the most critical of the three, has been protected by an error detection and correction (EDAC) scheme. The EDAC block, which is at the heart of the EDAC-protected RAM, contains a shortened Hamming code encoder and a shortened Hamming code decoder, in order to detect and correct single bit errors on the data.

6 Filter Strip Assembly Design

The high speed imaging and scientific requirements for colour information dictated that, as with SIMBIO-SYS, fixed filters should be implemented directly above the detector surface. Although butted and glued individual filter strips were initially considered, a more elegant solution is to use a single, rad-hard, fused silica substrate with precise direct deposition of bandpass filters onto it. The whole substrate is referred to as the Filter Strip Assembly (FSA).

The strategy to obtain colour images using the push-frame imaging approach follows the one used on SIMBIO-SYS and is based on the capability of the CMOS detector to acquire framelets in up to six user-defined windows simultaneously. The filters were placed in front of the detector with their long-axes perpendicular to the ground-track direction. Framelets are acquired from pixels exposed by each filter with a repetition rate synchronised to the ground track velocity and set to obtain sufficient overlap between successive framelets to permit accurate mosaicking.

The overall dimensions of the FSA from SIMBIO-SYS were conserved but the number, dimensions and positioning of the filters within the window have been modified to reflect the differences in imaging operation, optical design, and scientific goals of the SIMBIO-SYS and CaSSIS instruments. The field-of-view of CaSSIS, the ground-track velocity of TGO, the signal-to-noise budget, and internal bottlenecks in the data transmission rate resulted in selecting four different colour filters for the FSA. The simultaneous acquisition of three framelets with a maximum size of $2048 \times 280$ pixels, at a repetition rate of <400 ms can be achieved. Faster repetition rates require adaptation of the swath width or the number of filters in order to provide a continuous swath along track.

A broad transmission filter, PAN, was selected to provide the highest signal and will be used for stereo reconstruction. In our baseline configuration, 280 px-high framelets will be acquired through this filter in order to have a 15% overlap between successive acquisitions from the nominal 400 km circular orbit. The framelets acquired through the three other colour filters will be 256 px high, resulting in a 5% overlap. Data through the PAN filter are acquired on both observations in a stereo run to provide the stereo pair. The colour framelets (including binning) can be chosen to optimise the science return within the data volume constraints.

The dimensions of the filters to be applied on the window were derived from the framelet sizes on the detector and the nominal F-number of the instrument. A distance of 200 μm was left between the filters in order to prevent ghosting and cross-talk between them. Further stray light reduction was incorporated by using black masks between the filters and an anti-reflection coating while keeping all filters within the field-of-view of the telescope with sufficient margin. The chosen distance between the filters guarantees that any incident ray falling into one filter would need to be reflected at least twice on the black mask and/or the detector surface before reaching another filter area. As the anti-reflection surfaces used have an average reflectivity of the order of a few percent, a double reflection means that possible artefacts would be limited to a maximum of 0.1% of the actual image signal. The sizes of the framelets can be commanded. The area of the detector correctly illuminated behind each filter is about 310 pixels high, which leaves a margin of 15 pixels on each side if the height of the framelet is set to 280 pixels and a margin of 27 pixels if the height is set to 256 pixels. Because it is commanded, the area of the detector read does not have to be exactly centred within the illuminated area but can be slightly shifted (for example to avoid areas affected by defects on the detector or on the filter). Figure 11 shows the structure of the FSA and shows its most important dimensions.

Fig. 11

Exploded view of the structure of a filter array showing the four bandpass filters on the left side and the broadband anti-reflection coating on the right side. Black chromium masks are deposited between the fused silica substrate and the coating, on each side, to reduce ghosting and crosstalk

The wavelength bands for the four colour filters of CaSSIS were derived from the ones used on the HiRISE/MRO instrument (McEwen et al. 2007). The two first bands, BLU and PAN correspond closely to the first two bands used by HiRISE (“BG” and “RED”, respectively) ensuring consistency between the CaSSIS and HiRISE datasets. The two other CaSSIS filters, RED and NIR, split the third filter of HiRISE (“IR”) in two. This additional colour is designed to improve the discrimination between expected surface minerals, particularly Fe-bearing phases, as electronic transitions and crystal field effects are responsible for strong and diagnostic absorptions in the 0.7–1.1 μm range by minerals containing ferrous iron $\mbox{Fe}^{2+}$ (mafic minerals olivine and pyroxene) and ferric iron $\mbox{Fe}^{3+}$ (hematite, goethite, etc.). The wing of the saturated UV absorption band caused by the Fe charge-transfer also strongly affects the spectrum at shorter wavelength, which should be evident in the BLU/PAN ratios. As the reflectivity of the ice-free Martian surface at blue and green wavelengths is very low, the BLU filter provides an extremely high sensitivity to fog and surface frost or ice.

Five space-qualified FSAs were produced by Balzers (Optics Balzers Jena GmbH) using an innovative photolithography technique to deposit thin-film passband optical filters and black masks (made of low reflective chromium) on a single fused silica monolithic substrate (Bauer et al. 2014). The mask allows one to reach an out-of-band rejection ${>}10^{-5}\mbox{/nm}$ over the entire CaSSIS wavelength range (400 nm–1100 nm). The filter array selected for integration on the PFM model, “assembly_10-5”, is based on the minimum number of defects (pinholes and black chromium residual) identified on all four filters of the array. Figure 12 shows the transmission curves for the selected FSA for incorporation into the system transmission model. Figure 13 presents a picture of the FSA installed on the detector.

Fig. 12

Measured transmission curves through the centres of each of the bandpass filters of assembly 10_5, which was then integrated on the CaSSIS PFM. These measurements were performed by Balzers (Optics Balzers Jena GmbH) prior to shipment of the filters to the University of Bern. The numbers shown below the filters names for BLU, PAN and RED are the central wavelengths for these three filters, calculated from the filters edges, defined here by 50% of transmission. This number is not defined for the NIR filter as the long wavelength edge is constrained by the silicon absorption cut-off of the detector

Fig. 13

Picture of the filter assembly 10_5 integrated on the Focal Plane Assembly (FPA). The filter on the left of the picture is PAN, reflecting blue light and the filter on the right is BLU reflecting red and orange light. In between, the RED and NIR filters both reflect all visible light and appear mirror-like

7 Rotation Drive Design and Mounting Concept

The rotation mechanism consists of a stepper motor connected via a two-stage reduction gear to a large hollow shaft which supports the telescope (Fig. 14).

Fig. 14

Components of the drive mechanism

The stepper motor is a heavily modified Portescap motor (Turbo DiscTM P430-258-013), where only stator coils and the naked rotor were retained. The original grease-lubricated ball bearings were replaced by slightly larger, fully ceramic, bearings. A coiled spring of stainless steel was used to preload axially the bearings and to prevent the magnetic disc colliding with the poles of the stator coils during launch. The gap is only 90 μm. Modifying the original stamped poles plate to house the new ceramic bearings was considered unreliable. The plate was therefore replaced by a milled part of pure iron, which was electroless nickel plated for corrosion protection. Pure iron and iron-cobalt 50/50 mix were tested with very satisfactory results. The motors using pure iron plates performed slightly better. Preliminary outgassing tests of the stator coils showed significant release of volatiles and related mass loss. Because of the tight project schedule, producing a completely new stator was not a viable solution. It was therefore decided to condition the original part in a dedicated bake-out chamber. Using information provided by Portescap (which is proprietary), optimised temperature-time profiles could be defined to degas the parts efficiently without damaging the polymers used for housing, potting, and wire insulation. After conditioning, the parts were compliant to the project outgassing requirements. The printed circuit used to connect the thin coil wires with the motor harness was redesigned and produced with space-qualified material (Arlon 85N). To comply with electro-magnetic compatibility (EMC) requirements, the motor was entirely enclosed in a thin-walled aluminium housing.

7.1 Reduction Gear

A two-stage gearing for the rotation drive was eventually chosen.

A planetary gear with reduction ratio of 3.33:1 was introduced in the course of the development as a first stage to increase the torque margin at low speed and to improve the reliability of the system at the beginning of the rotation movement when the slip-stick friction is dominant. At higher speeds the beneficial effect of the reduction gear is cancelled by the steep drop of the motor torque curve.

Hard coated titanium and hardened stainless steel were the materials chosen for the first gear stage components.

At the very beginning of the development phase a classic worm gear design was considered as a single stage. However, the resulting size and mass exceeded the assigned budgets. The innovative toroidal gear design recently developed by Tedec (http://torus-gear.com/en/) is significantly more compact and was therefore chosen. As the concept was very new, no experience with lightweight materials and operation in thermal-vacuum environments was available. Several material and coating combinations were tested prior to manufacture of the final components. The final material selection for the toroidal gear was a hard coated titanium pinion running on a gear rim manufactured out of PEEK pvx. Braycote 601 was chosen as a lubricant.

7.2 Support Structure and Bearings

The telescope was mounted via an adapter flange to a large thin-walled hollow shaft of high strength titanium alloy, which was supported on two custom-made angular contact ball bearings made of silicon nitride. The bearings are preloaded with a wave type spring which generates the required axial force of 7.5 kN to guarantee enough stiffness during the launch phase. Particular attention was paid to the design of the ball cage which, being made of PEEK, significantly contracts when the instrument cools down to its minimum operational temperature, and therefore leads to reduced clearances inside the bearings. The bearings, reduction gears, and motor were housed in a monolithic, strongly light-weighted structure which was built specifically to achieve the very tight geometric tolerances required for low friction and high reliability of the mechanism. The housing, as well as the telescope adapter flange, is made of AlBeMet AM162, which was selected for its outstanding specific stiffness and moderate CTE. Both parts were gold plated for surface protection and low thermal emissivity. Because of the stringent limitation of the thermo-elastic forces induced by the instrument at the interface with the spacecraft panel, it was decided to decouple the mechanics of the instrument from the spacecraft by using an intermediate sandwich plate with near-zero CTE facesheets of CFRP, whereby a cyanate ester matrix was selected to minimise moisture absorption and outgassing. Three titanium isostatic mounts connect the AlBeMet housing to the sandwich plate and compensate the CTE mismatch. The decoupling plate is hard-mounted to the spacecraft panel with eight M8 screws. A similar design was implemented for the electronics box (ELU).

The unit is conductively decoupled from the spacecraft using thermal insulators of Vetrotherm and, except for the radiator of the focal plane assembly, completely covered in MLI to minimise the exchange with the environment and the spacecraft.

The strength of the support structure was tested in the usual way via vibration testing to levels set by ESA on the basis of loads transmitted to the instrument interface via the spacecraft. The modal analysis showed that the first eigenfrequency mainly depends on mass but especially on the location of the telescope centre of gravity. Figure 15 shows the result of one of the resonance searches on the proto-flight CRU. The accelerometer here was placed close to M4 where some of the largest accelerations were expected. A 1st eigenfrequency of 107.9 Hz was measured.

Fig. 15

Resonance search for the CRU showing a first eigenfrequency of 107.9 Hz

As part of the instrument redundancy concept, failure of the mechanism only results in the loss of stereo capability. The imaging element would still function and the push-frame system could still be used to generate colour images although compromises on timing of image acquisition and swath width would be necessary.

8 Cable Management System (“Twist Capsule”)

Power, signals, and grounding to the detector proximity electronics (PE), which is mounted to the mechanism hollow shaft and therefore rotates with the telescope, are transferred through a cable management system which was usually referred to as the “Twist Capsule”. The Twist Capsule (Fig. 16) consists of a bell-shaped stationary section with the connectors for the harness to the ELU, which encloses a rotating, spool-shaped drum on which seven cables are wound in individual sectors to prevent friction and jams. The cables exit the twist capsule through the central hole of the drum. The number of windings was chosen to allow a rotation angle of $\pm190$°. Individual shielded twisted pairs were used for the SpaceWire connection, while for power and temperature sensor lines, flex cables were selected to minimise mass and friction. The drum is mounted to a titanium shaft supported by two ball bearings of silicon nitride. The stationary section is fixed to the instrument structure via a disc of glass fibre reinforced polymer (GFRP), which nearly matches the CTE of AlBeMet and hence prevents excessive deformations which could compromise the reliability of the rotating system.

Fig. 16

The cable management system (“Twist Capsule”) showing how the wiring is prevented from snagging

9 Electronics Box Design

The ELU is a mechanical enclosure housing 3 modules

• Power Converter Module (PCM) which provides power distribution to the instrument and forms the power interface to the spacecraft.

• Digital Processing Module (DPM) which provides instrument control and monitoring through the flight software (FSW) and provides the digital interface to the spacecraft.

• Rotation Control Module (RCM) which drives the stepper motor for the rotation mechanism.

The ELU controls the entire instrument and is specifically responsible for the PE with its associated CMOS detector in the FPA. The PE and the FPA are both located on the CRU. The cable connection from the stationary element (the ELU) to the rotating part (on the CRU) is made with the Twist Capsule. Figure 17 shows an electrical functional block diagram of the complete CaSSIS instrument.

Fig. 17

The electrical functional block diagram of the CaSSIS instrument

The main constraints were an extremely low survival power consumption of 4.5 W orbit average in the long eclipse phase (LEP) during aerobreaking. For cruise, the CaSSIS power allocation was 11 W at 22 V (peak). Unlike many other missions, the TGO spacecraft does not provide any thermal control in survival mode (e.g., instrument power off). Instruments are merely connected to the survival power bus lines and have to manage their thermal control themselves. In order not to overheat the instrument in the ‘science hot cases’ when CaSSIS is imaging and thus facing Mars, radiators are needed to keep the electronics and the detector within operational range. However, these radiators—designed against the hot case requirements—are facing deep space during cruise. This introduces a rather challenging heater concept. The same is true for the telescope where a large aperture is, on the one hand, desirable in terms of signal to noise but, on the other, makes thermal control difficult because it acts as a large radiator. Additionally the specification of the spacecraft power bus voltage was between 20 V and 40 V which requires design against a wide range of heater power values.

The ELU contains the three Printed Circuit Boards (PCB) which are stacked together directly with board to board connectors avoiding the need of a backplane. All three boards were developed using Altium Designer CAD software. We look at each module in turn.

9.1 Power Converter Module (PCM)

The main purpose of the Power Converter Module (PCM) is to convert, regulate and control power generated and delivered from the spacecraft to voltage levels required by the CaSSIS electronics modules (Fig. 18). A block diagram of the PCM is shown in Fig. 19.

Fig. 18

The Power Converter Module after integration into its frame

Fig. 19

Block diagram of the PCM as implemented

The PCM was developed to combine 2 single output $+5$ V, 15 W commercial DC/DC converters (SVHF2805 made by VPT), 2 double output ±12 V, 20 W commercial DC/DC converters (SVHF2812D made by VPT) and 2 custom-designed, application-oriented multi-output DC/DC converters with secondary rails at +3.3 V, +25 V, and ±8.5 V.

The multi-output converters operate at a frequency of around 110 kHz. They are run without synchronisation, with output rails galvanically separated by magnetic feed-back loops. An integrated circuit UC1825SP was used as a controller. A closed regulation loop is present on the $+3.3$ V rail. Other rails are cross-regulated using filter inductor windings coupled on a common ferrite pot core. Overcurrent and short circuit protection was implemented on the primary side. The converter powered from the spacecraft operational bus at 22 V to 36 V can deliver about 5 W of secondary power, however the final load is smaller. A maximum, non-nominal $+48$ V input voltage is not harmful to the converter.

The multi-output DC/DC PE converters, and DC/DC 5 V-SVHF2805 converters work in cold redundancy. The converters used for powering the stepper motor are implemented with hot redundancy and are cross-strapped with the nominal and redundant operational power buses by means of diodes. Additional MOSFET switches are implemented on the primary side of the DC/DC1 and DC/DC2 converters to cut off the converters from the bus in case of failure.

To fulfil EMC requirements, the PCM was equipped with input and output common mode filters with toroid ferrite cores and differential mode filters with MPP toroid cores from the company, Magnetics^®. The PCM enters operational mode after receiving the HV-HPC ON command from the spacecraft and switching on the MOSFET switch on the 28 V operational bus line. The survival bus line has no switch and is used for powering the heaters and DC/DC+5 V. This drives electronics for temperature regulation in the survival mode (non-operational) case. Housekeeping electronics (HK) with an ADC converter measures the voltages and currents on the outputs and sends these values to the DPM for health monitoring.

9.2 Digital Processing Module

The DPM uses the Dual-Core LEON3-FT SPARC V8 32-bit Processor GR712RC from Cobham Gaisler (formerly Aeroflex Gaisler). This processor in the CQFP240 package is robust against a Total Ionizing Dose (TID) of up to 300 krad(Si) and has proven Single-Event Latch-Up (SEL) immunity and Single-Event Upset (SEU) tolerance. The 1.8 V supply voltage for the core and 3.3 V for the periphery require only low power consumption. The system frequency was set to 48MHz as a trade-off between performance and power consumption. This processor includes SpaceWire (SpW) links and redundant MIL-STD-1553 interfaces. Two SpW links are used to send the science data to the Payload Data Handling Unit (PDHU) of TGO and one SpW link is used to communicate with the PE and, through that, the FPA.

On the fault tolerant memory controller, an 8-bit EDAC is used to detect and correct single bit-flips. There are 32 data + 8 EDAC lines between the processor and the memories.

There are a total of 3 memories on the DPM board. Two non-volatile MRAMs (Magnetoresistive Random Access Memory) are used, each of which has a stored image of the flight software (FSW). One of them is re-writable to allow later updates of the firmware and saving of persistent parameters. Hence, we always have two bootable FSW versions in the instrument. These MRAMs, UT8MR2M8 from Cobham have a total of 16 Mbit and, with resistance to a TID of 1 Mrad(Si), are very robust against radiation and have SEL/SEU Immunity. The drawback is that the data bus is only 8 bits wide and the read/write access is limited to 45 ns which requires the insertion of 2 wait states by the memory controller of the processor. Therefore the firmware is loaded from the MRAM to faster, 40-bit wide SDRAM (Synchronous Dynamic Random Access Memory) for execution.

The SDRAM from Cobham (UT8SDMQ64M40 2.5 Gbit) has a maximum clock frequency of 100 MHz. It is powered with 3.3V and is available in a 128-lead Ceramic Quad Flatpack with radiation hard values of TID: 100 krad(Si) and SEL immunity of $111~\mbox{MeV}\,\mbox{cm}^{2}/\mbox{mg}$. One drawback of this multi-chip module is that the input capacitance of 65 pF is very high for the “low power” GR712 Processor and only 1 memory block instead of the two originally planned could be used. With only one SDRAM, the raw data from only one four-colour stereo image from the Martian surface can be stored. This leads to an operational constraint that, before the next image can be taken, the stereo image must be compressed (if required) and sent to the PDHU via the SpaceWire link.

The analogue temperature sensor and acquisition circuit is located on the DPM. This circuit measures the temperature of the telescope, the PE and the FPA and compares it with the survival temperature to set the logic output which switches the heaters ON and OFF. This electronic temperature control allows a much lower hysteresis ($\Delta T=2~\mbox{K}$) than classic thermostats which have $\Delta T=16~\mbox{K}$ in this low temperature range. The mean survival temperature is therefore lower, thereby saving power.

The as-built DPM is shown in Fig. 20.

Fig. 20

The DPM in its frame prior to integration in the ELU

9.3 Rotation Control Module (RCM)

The control of the rotation stepper motor and the heater power switches is located on the RCM.

Initially, we needed to investigate whether the processor is able to control, in real time, the transistors on the four H-Bridges used to control the 4 currents of the step-motor windings or was it necessary to use a dedicated FPGA for this task. The radiation tolerant ProAsic3 LowPower Spaceflight Flash FPGA RT3PE600L from Microsemi, was selected. The core voltage of 1.2 V was of sufficiently low power so that it could be allowed to run all the time, even in survival mode, where it is used for the logic combinations to switch the heaters on and off. To have the highest flexibility, the FPGA reads-out the 5 ADCs via the serial peripheral interface (SPI) bus every 100 ms. In operational mode, the communication with the GR712 processor is achieved through the memory mapped I/O space with 8 wait states.

A total of five ADC128S102QML 8-Channel 12-Bit A/D Converters from Texas Instruments with a TID specification of 100 krad(Si) and low power consumption are used to measure the different voltages, currents and temperatures on the instrument.

10 Electronic Peripherals

10.1 Stepper Motor and End-Switches

To turn the telescope a stepper motor from Portescap (Turbo DiscTM P430-258-013) was chosen (see above). The power of this four-windings motor is sufficiently small that it was decided to build the 4 H-Bridges with discrete components which also allows slow-switching of the power MOSFET to reduce electromagnetic interference (EMI).

To reduce eventual resonance and vibrations generated by the stepper motor, a 1/8 microstep was introduced in the FPGA which results in a quasi-sinusoidal motor current. The instantaneous power drawn by a turning stepper motor is not constant because of the two sine-currents that are 90° phase shifted. To reduce such a ripple requires a huge quantity of capacitors, hence this power ripple can be seen on the input current of the instrument when the motor turns. Stepper motors are known to have high losses, therefore the temperature is monitored by two PT1000 sensors.

There are two end switches in each direction before the mechanical stop is reached on the rotation mechanism. These Hall-Effect Sensors (OMH3040S from OPTEK Technology) are powered from the 12 V rail and deliver a digital output which is filtered before entering the FPGA.

10.2 Heater Switches

The total survival heater power on the instrument had to be carefully distributed in order not to exceed the 11 W peak power at 22 V required by the spacecraft in survival mode. The need to use a passive ELU radiator for operational temperature control resulted in a tight constraint such that the difference between the survival power and the operational power should not exceed a factor of 3. Therefore the heater power to the instrument had to be switched directly on the primary and not the transit DC-DC converters as the latter solution would produce losses thereby heating up the ELU unnecessarily. The heater power in operational mode is considerable, because the telescope must be heated up to an operational temperature of around +20 °C to obtain the optimum point spread function. The heaters are switched in the return line by 100 V rated N-Channel MOSFET’s JANSR2N7481U3 from International Rectifier in a SMD-05 case and with a radiation specification of 100 kRads. The telescope typically requires about 45 minutes from switch-on to reach operational temperature although the focus is acceptable after about 25 minutes.

The telescope is held within ±1 K of its operational temperature which was set to allow room temperature operation during testing. The focal plane assembly is held at 0 °C. This was achieved by using a radiator for the focal plane (see Sect. 5.1) and heating against it. This provided a stable thermal environment for all optically active elements of the instrument.

11 On-board Software Design

The compressed schedule led to the implementation of a simple flight software (FSW) approach.

11.1 Hardware Environment

From the viewpoint of CaSSIS’s FSW, the hardware environment consists of 3 major modules: (1) The essential hardware elements for running the FSW are integrated onto the CPU board. This (CPU) module also provides connections to the other major modules, namely, the FGPA and the PE. (2) The FPGA module defines an interface (via the memory bus) for collecting telemetry data measured by the analogue sensors connected to the FPGA via ADCs, thereby controlling the thermal management system and the telescope rotation mechanism. (3) The PE module provides an interface, via a SpaceWire (SpW) link, to access the detector, control the imaging process and receive exposure data recorded by the detector.

The standard interfaces necessary to connect CaSSIS to the spacecraft (main and redundant Mil-1553, main and redundant SpaceWire links) are integrated into the LEON3 processor as IP cores. The 2 MRAM memory modules (2 MB each, see above) store the boot loader, binary images (one of which can be modified) of the FSW and persistent data. An additional 256 MB SDRAM memory module is used to run the FSW and store temporary data during execution. Most of its storage capacity is allocated for the huge amount of image data acquired from the PE. During the time when the processor is not powered, the FPGA module maintains thermal management (survival mode). A series of controlling software modules were necessary to manage the instrument.

11.2 Operating System

Strict timing requirements in rotation and imaging processes as well as MIL-STD-1553 communication force the use of a Real Time Operating System (RTOS). There are several compilers available for LEON3 from bare metal compilers to more complex solutions like RTEMS (Real-Time Executive for Multiprocessor Systems). The latter was selected. It includes a scalable multitasking real time operating system that provides the opportunity for developers to use its services and focus on the implementation of application specific features. RTEMS has been designed for embedded systems. As it is free open-source software it can be used on many platforms. To use RTEMS easily on a LEON3, an additional software package, the BSP (Board Support Package), is required and is provided by the hardware vendor. This package includes pre-implemented drivers for special hardware elements (e.g. 1553, SpW) and tools to support the production phases of the software from source code implementation to generation of the final binary software image (including the boot loader software). The source code of the integrated software elements (boot loader, RTEMS, drivers) are available and can be modified and recompiled according to requirements.

11.3 FSW Details

The CaSSIS FSW uses RTEMS as the RTOS, low level drivers for the 1553 and SpW links provided in the BSP and a modified boot loader based on that provided by the BSP. Almost all the various functions are organised into separate RTEMS tasks in the FSW with different priorities (Fig. 21). Within the CaSSIS project, we think of different “managers” dealing with specific tasks connected to the instrument.

Fig. 21

Schematic diagram of the flight software task management

The FSW can be executed in two modes: safe and normal operation. In case of any critical failure, the FSW goes into safe mode automatically where only essential functions (1553 communication, software update, and thermal management) are available.

11.3.1 Telemetry and Telecommand (TM/TC)

As Fig. 21 shows, the FSW has to be able to receive telecommands via the MIL-STD-1553 bus (up to 64 bytes in one command with a nominal 1 command per second) and to send back telemetry data to the spacecraft (up to 64 bytes in one 1553 frame, up to 10 1553 frames per second). The FSW provides the opportunity to group the housekeeping (HK) parameters into different 64-byte (or less) sized HK frames. These frames can be queried with different periods according to a pre-defined table. The HK PreSynthesys task composes the response for the next 1553 telemetry polling from the HK table which contains the collected and most recent values of different HK parameters. Additional time/communication synchronisation and health data transfers are also managed via the 1553 bus with strict timing requirements. The 1553 manager task runs with high priority in the FSW. Such time sensitive tasks are shown as HRT (Hard Real-time Tasks) in Fig. 21. Redundancy of the 1553 bus is managed by the driver at low level.

11.3.2 Telescope Rotation

The rotation manager task controls the rotation of the telescope and sets the desired position via the FPGA module. Signals provided by the end switches of the rotation mechanism and the current telescope position are also monitored via the FPGA module. The logic has been set so that fast motion of the rotation drive through the first of the two end switches will result in the instrument stopping the motor and entering safe mode. The correct functionality of this approach has been demonstrated in flight.

11.3.3 Thermal Control

When the CPU is powered, the thermal control task of the FSW takes over the thermal control from the FPGA. The thermal control task uses the collected HK data as input to control heaters and keep the temperature of different zones of the instrument in the desired range according to a pre-defined table. Values of this table are stored as persistent data in non-volatile memory, but can be updated during flight.

11.3.4 Imaging

After rotating the telescope into the desired position, an image acquisition sequence can be started. The FSW controls the readout of the detector via a SpaceWire link to the PE. A whole image can contain up to about 50 exposures. This number can be commanded and is determined by the need to perform the following rotation at a specific time within the sequence (which is itself a function of spacecraft altitude) and an exposure can be divided into 1–6 framelets (rectangular-shaped detector areas of different sizes). The FSW has to maintain different pre-defined parameter tables to store parameters for images. These tables are stored in non-volatile memory but can be easily changed. Each exposure is taken by the PE at the exact time when the corresponding PE command is sent by the FSW. The strict timing requirements of the exposures of an image demand that the FSW should provide reliable real-time scheduling of the issuing of the PE commands. Based on the services of RTEMS, the internal notification chain of the CaSSIS FSW ensures 1 ms exposure accuracy with 400 μs latency and 150 μs uncertainty. This was verified during on-ground calibration (Roloff et al. 2017). The FSW provides a run-time writeable parameter to control the pre-issue time of a PE command. This mechanism can eliminate the 400 μs latency to provide more accurate exposure timing which increases the precision of framelet overlap. Received exposure data are stored in the memory with DMA (Direct Memory Access). Without DMA, the huge amount of exposure data could not be stored before a new exposure should be started. The imaging process is managed by the imaging manager task.

11.3.5 Compression Algorithms and Management

At the time of writing, the compression is still to be implemented in the flight software and will be uplinked to CaSSIS shortly before the start of the prime mission. Test versions are however already available and the “hooks” needed in the FSW (including the manager) have already been prepared.

The speed of the algorithm is one of the key points. While data can be sent quickly to TGO’s on-board computer on a high speed SpaceWire link, TGO does not compress them as “image data” which places a high load on the downlink unless CaSSIS performs the compression. The constraint is that CaSSIS has only 256 MB volatile random access memory which can be used as a temporary storage of image data. Most of the capacity of this memory is allocated for image data (about 230 MB for raw and compressed image data), about 10 MB is used by the compression algorithm and about 16 MB is reserved for the flight software. The raw exposure data received from the PE are stored in the memory with DMA. The PE sends about 3.2 MBytes of raw science data during a nominal detector readout. Assuming a 40 exposure acquisition is commanded in a 15 s long time window, this results in around 130 MBytes of raw science data and approaching 10 MB/s bandwidth. The processor has to store, compress and then send this amount of data to the spacecraft fast enough to make room for the next image as soon as possible. The LEON3 processor has 2 cores which can be used by tasks run by the RTEMS operating system. Using the second core simultaneously with the first one reduces the time needed to compress image data. The second core is switched on only during compression which limits the average power consumption and reduces load on the first core which is committed to several other tasks.

The compression algorithms work on a window basis and compress the raw image data window by window. Different compression parameters can be set for the different framelets in an exposure. In a sequence of exposures making up the full swath, the parameters for each framelet are fixed.

The most frequently used technique is transform coding. Transform coding first switches to the frequency domain before compression. The transform coefficients should be decorrelated, to reduce redundancy and to have a maximum amount of information stored in the smallest space. These coefficients are then coded as accurately as possible to maintain information. The DWT-BPE (Discrete Wavelet Transformation—Bit Plane Encoding) methods with purely integer calculations have been used in CaSSIS, based on the CCSDS 122.0 B-1 Blue Book. The applied 9/7 Daubechies DWT shift invariant lifting algorithm uses three decomposition levels before the BPE method, as recommended in the standard.

The main disadvantage of this algorithm is that it is rather slow although it provides high compression ratios with relatively good quality. If the compression time and quality of compressed image are both critical and bandwidth for science data allows, another simpler and efficient algorithm can be used which consists of two independent and distinct stages: modelling and encoding. This algorithm, called NEAR, is based on ISO-14495-1/ITU-T.87 Image Compression Standard.

The main advantage that NEAR has over DWT-BPE is execution speed. Examining the timing results, it can be seen that the DWT-BPE encoder is slower than the NEAR encoder by a factor of about 2.25–4.0. With NEAR, no transform is used, and a relatively simple entropy coding technique is applied (run-length and Golomb coding). On the other hand, DWT-BPE uses multicomponent/wavelet transforms and complex bit-plane and entropy coding techniques. In terms of compression efficiency, there is no clear winner. For some classes of imagery, DWT-BPE yields superior results, while for others NEAR fares better. Computational complexity aside, DWT-BPE has a number of important advantages over NEAR:

• DWT-BPE provides an efficient framework for both lossy and lossless compression, whereas NEAR only supports lossless and near-lossless compression modes;

• DWT-BPE is both rate and resolution scalable. NEAR has no rate control, the compression ratio depends on image fine details and a compression parameter named “NEAR” (which describes the allowed loss level).

• NEAR speed and compression ratio depends on image details: if the image contains a lot of similar pixels in the calculated range (described by “RANGE” parameter), the algorithm switches to “run mode coding” and compression speed gets higher and the compressed image size is much less than in “regular mode coding”.

The flight software of CaSSIS provides the opportunity to use both algorithms simultaneously. The used algorithm can be selected and the parameters for the selected algorithm can be set before taking an image. As the compression is framelet based, different algorithms can be selected for different framelets if necessary. Following on-ground testing, the DWT-BPE encoder will be default.

11.3.6 Memory Management

The processor has to store, compress and send data to the spacecraft fast enough to make room for the next image. This was made more challenging by the following:

• Only 256 MB of total system memory

• RISC processor with 48MHz system clock

• Due to reliability considerations dynamic—run-time—memory allocation is prohibited

• Varying size of images

To meet the above requirements, the FSW uses two memory buffers to store science data. The first buffer stores raw (uncompressed) data while the second stores compressed data. The FSW minimises the number of data transfers by using a dedicated allocation scheme inside the buffer areas. This allocation scheme allows the FSW to use the raw data buffer as a DMA input area and the compressed data buffer as a DMA output area. This approach ensures that only the compression process has to move the science data inside the memory.

A manager allocates a varying number of slots for an exposure based on the actual size of the exposure. Each exposure has an allocation descriptor which contains the first allocated slot ID, the number of subsequent allocated slots and the actual status of the allocation. As the allocated area is used as a DMA area, the allocation has to ensure that the allocated slots are placed in a physically coherent area inside the system memory. Figure 22 shows the life-cycle of a memory slot. A slot enters the ERROR state if an error occurs while the slot contains science data. The content of ERROR state slots are used for error report generation before the slot is released.

Fig. 22

Life-cycle of a memory slot in the CaSSIS memory

11.3.7 Boot-up

For reliability and maintainability, CaSSIS contains two independent flight software binary images. One is burned into a non-volatile read-only memory on ground while the other one is stored in a mission-time writeable non-volatile memory. A CaSSIS-specific bootloader software component has to initialise the LEON3 processor, validate the integrity of the FSW images, and load the appropriate one. The basis of the bootloader component was provided by Gaisler for the GR712RC environment. Because of the special requirements of the target environment, it could not be used without modification and had to be tailored to meet requirements. The major modifications covered the following areas:

• Prepare the bootloader to run from a non-writeable memory.

• Prepare the bootloader to meet the strict timing requirement needed by the watchdog component in CaSSIS which checks for errors.

• Prepare the bootloader to be able to check the integrity of software images and load the appropriate one.

11.3.8 FSW Update

In a space mission such as TGO, it is essential to have a reliable procedure to update the onboard instrument software. In the hardware architecture, this is supported by the doubled MRAM memory modules. MRAM0 is read-only during flight and stores the “golden binary image” of the FSW. MRAM1 is an identical module, but can be written by the running FSW during flight. By booting the software from MRAM0, it is possible to upload an updated FSW image into MRAM1 by telecommand. At power up or restart the bootloader can check the software images in MRAMs and decide which software image should be booted. In case of unreceived telecommands (TCs) which result in missing blocks in the updated software image, it is possible to send again only the missing TCs instead of starting the whole upload procedure from the beginning. The FSW has been prepared for differential software update as well in order to reduce the amount of data to be uploaded in case of limited resources. The FSW update has already been tested successfully in flight.

11.3.9 FSW Safety Features

Besides the safety features provided by the spacecraft to the instrument, the FSW has additional features to check and maintain data integrity and protect the instrument. Software images and science data (including dumped data over SpW) are protected by an md5 checksum. TC and TM (HK) data are protected by a 2-byte CRC (cyclic redundancy check). Telecommands received with incorrect CRC are ignored. Data stored in MRAMs and SDRAM are protected (and corrected if possible) by the EDAC mechanism of the memory modules.

12 System Performance

The schedule pressure led to a reduction in measurements of system performance pre-flight. However, the basic properties of the instrument have been verified (Table 2). Results from the on-ground calibration are presented in more detail in Roloff et al. (2017). It is expected that further results will be presented after in orbit commissioning in mid-2018. The focal length was verified to be within specification on ground and subsequently confirmed in flight. The precise positioning of the FPA with respect to the optimum proved more difficult than anticipated and some error was expected. The final point spread function (after complete desiccation of the CFRP structure) was nonetheless expected to be <1.7 px full width half maximum although variable across the focal plane. The best PSF was expected in the centre of the RED and PAN areas. Preliminary analysis of standard stars acquired during commissioning indicate a PSF of ∼1.35 px in the centre of the field. The PSF has been observed to be temperature dependent reaching optimum value close to the nominal operational temperature. The in-flight calibration will be the subject of a further paper expected to be prepared prior to the start of the prime mission. In the event that undersampling of the PSF producing aliasing, the telescope operational temperature can be reduced to produce a slight de-focussing.

Table 2 Nominal and (where available) measured properties of CaSSIS. For completeness, nominal TGO orbit parameters are also given

The detector is well-centred in the focal plane and no vignetting is expected. The timing of the framelet acquisition has been checked stroboscopically to be accurate to <1 ms. The rotation mechanism is able to complete a 180° rotation in <16 s leaving significant margin for degradation while the accuracy of positioning of the mechanism is better than 0.3°. A 3D measuring arm has been used at 5 rotation positions to determine the axis of rotation and the true offset of the pointing direction with respect to nominal nadir. This was found to be 9.89 (±0.10)° leading to a stereo convergence angle of 22.14° for nominal imaging from 400 km to a surface at 0 km above datum.

The FSA with the dark inter-filter masks appears to be rather effective with cross-talk only detectable in 8 pixel rows nearest the inter-filter mask. The exact positions of the framelets to be returned in nominal operation can be seen in relation to the full detector in Fig. 23. The limited cross-talk has allowed us to propose a 2048 × 280 framelet for the PAN which increases the overlap between framelets by 9% thereby improving co-registration for the channel used mostly for stereo. The system effective wavelengths and equivalent bandwidths (see Abergel et al. 1987) are shown in Table 2.

Fig. 23

An image of the full detector with the positions and coordinates of the framelets to be read in nominal operation. Note that two additional small framelets from under the mask are foreseen for bias and dark current assessment

The detector is a spare and does have some cosmetic defects. The most problematic is a quasi-linear row of bad pixels in the centre of the PAN. Attention will therefore be paid to studying the possibility of using the RED channel to “fill-in” this data loss. However, flight data suggests that the line can be calibrated when exposure times are short (<2 ms) and comparable to those needed for Mars imaging. The bias level of the FPA is also rather high and limits the total dynamic range to 13.5 bits. The radiative cooling of the detector provides significant gains and the dark current at operational temperature appears to be negligible. The detector linearity is excellent with linear regression values exceeding 0.004 in all colours up to 25 ms exposure time.

Figure 24 shows an image from the (grayscale) CTX imager on MRO and compares the fields of view of CaSSIS and HiRISE. The image shows the extended colour and stereo coverage achievable with CaSSIS with respect to other imagers currently orbiting Mars. The length of the swath depends upon the number of framelets requested and the exact altitude. The number of framelets is constrained by the memory available in the DPM and the time needed to execute the rotation. Swath lengths in the range 40–50 km will be typical.

Fig. 24

CTX mosaic of a region in Mawrth Vallis with a HiRISE image footprint (blue) and a CaSSIS one (white). The coloured part of the HiRISE image is also overlain (centre part of the blue box) for comparison with CaSSIS, which will be able to generate stereos and coloured images spanning its full footprint. Unlike the shown HiRISE footprint, the CaSSIS footprint shown does not mimic the actual orientation with respect to TGO’s orbit but is intended only to show differences in spatial cover between CaSSIS and HiRISE

13 Signal to Noise Ratio Estimates

We have built a simple spectro-radiometric model of CaSSIS using characterisations of the three main components, the telescope, the filters and the detector, provided by the manufacturers. The transmission of the entire telescope was calculated by RUAG from measurements of the mirror silver coating reflectivity. The transmission through the FSA, including its anti-reflection coating, was measured for each of the four colour filters by Balzers. The quantum efficiency of the detector was measured at its nominal detector operational temperature of 273 K. (Variations with respect to the temperature were not expected to exceed ±5 K). All these characterisations were performed as a function of wavelength, with a spectral sampling of 1 nm over the spectral range 400–1100 nm. In addition, mean parameters of the detector (i.e. averaged over all pixels) were provided by Raytheon and used in the signal budget and signal-to-noise calculation (Table 3).

Table 3 Detector properties used for the signal to noise calculations

The model considers as input the spectrum of the Sun measured at the top of Earth atmosphere and representative average spectra for the dark and bright regions of Mars. The reference solar spectrum was taken from the ASTM (American Society for Testing and Materials) Standard Solar Constant and Zero Air Mass Solar Spectral Irradiance Tables (ASTM standards E490) and the average Mars surface spectra from Erard and Calvin (1997). The solar irradiance must be attenuated by the square of the heliocentric distance. An average distance of 1.52 AU was used for all calculations here. The signal budget calculation requires the knowledge of two additional instrument parameters, the pixel angular FoV and the diameter of M1 (Table 2).

Two other parameters of the observation are set as variables in the model: the incidence angle of the Sun at the observed target and the integration time. The integration time has been set to correspond to 1 pixel of smear and is 1.52 ms in the nominal orbit (Table 2). Combining these spectral curves and parameters, we calculate the number of photons reaching the detector through each of the four filters over the 400–1100 nm range at a resolution of 1 nm. Using the quantum efficiency curve to calculate the number of electrons generated and integrating the resulting spectral curve for each filter, we finally obtain the signal in electrons, $N$, generated by each pixel of the detector for the simulated exposure. This signal value can be compared to the full well depth of the pixel and expressed as a percentage. The signal-to-noise ratio can now also be calculated as:

$$\mathit{SNR}= \frac{N}{\sqrt{R^{2} + T^{2} +N}} $$

where $R$ is the readout noise and $T$ is the thermal noise. The third term in the denominator expresses the statistical noise also called the “shot noise”. It dominates here in all configurations and sets the upper limit for the achievable signal to noise ratio. The readout noise has a much lower effect on the final SNR whereas the effect of the thermal noise is totally negligible. The electronic gain of the analogue-to-digital converter is nominal 7.2 e/DN.

Figure 25 shows the results of these calculations for the case of an average dark surface illuminated with an incidence angle of 30°. The signal reaches 59% of the full well capacity for pixels in PAN, resulting in a high signal-to-noise ratio of 222, suitable for stereo reconstruction. The SNR in RED and NIR are almost identical, around 140, whereas the SNR in BLU is lower than 100. We expect to use $2\times 2$ binning in BLU frequently to reach adequate SNR in this filter. Increasing the incidence angle beyond 30° results in a loss of SNR as the integration time cannot be increased. In the case of bright surfaces, it should still be possible to reach an SNR of 100 in PAN for an incidence angle of 82°, which, together with the orbit of TGO, opens interesting possibilities for observations in early morning and late evening. In the case of a typical dark surface, an SNR of 100 in PAN is achieved for an incidence angle of 77°. Regarding RED and NIR, a SNR of 100 can still be achieved at an incidence angle of 72° for bright surfaces and 60° for dark surfaces. Binning to increase SNR can also be considered. We note that the instrument $\mbox{A}\Omega$ product indicates a 50% higher photon flux per pixel than an equivalent 128 line time-delay and integration image from HiRISE (Table 4).

Fig. 25

Model of the signal measured by CaSSIS through the four colour filters for a simulated observation of a dark Martian surface with an incidence angle of 30° and an integration time of 1.52 ms. Values of percentage of full well (%FW), signal-to-noise ratio (SNR) and total electrons, from top to bottom, are overplotted for each filter

Table 4 Comparison of the signal level expected from CaSSIS with respect to HiRISE. For identical filter and optics transmissions, the $\mbox{A}\Omega$ product multiplied by the exposure time gives a measure of the expected signal. The table shows that CaSSIS should collect around 26% more photons per pixel than HiRISE within the nominal exposure time

Note that these estimates are for SNRs at the top of Mars’ atmosphere. Typically >25% of the top-of-atmosphere signal is scattered light from the bright dusty air. SNRs for surface features are typically less than half the value at top-of-atmosphere, depending on atmospheric opacity and scattering angles.

An observation of Mars was acquired in flight at a phase angle of 13° in the NIR filter on 13 June 2016. The resulting signal level agreed well with prediction.

14 Operations

At the time of writing (∼12 months from the start of the prime mission), the detailed operational approach has not been completely defined. However, the current plan is that the Mission Operations Centre (MOC) and ESA’s Flight Dynamics (FD) team located at the European Space Operations Centre (ESOC) in Darmstadt will plan reaction wheel off-loadings such that the ground-track can be predicted to an accuracy of a few seconds several months in advance. The CaSSIS team will use a targeting tool based closely on the HiWISH tool (http://www.uahirise.org/hiwish/; retrieved 29 July 2016) for HiRISE. This tool is called CaST. A database of scientifically chosen targets will be constructed using CaST (Fig. 26). Once the orbit is known, a long-term plan (LTP) will be generated by identifying and prioriterizing targets along the ground-track. This will be done using a tool called PLAN-C (Fig. 26) which will also allow the setting of instrument parameters allowing assessment of data volumes and general feasibility. An overplanning of approximately a factor of 2 is expected at this stage. The LTP generated will then be iterated with the Science Operations Centre (SOC) at ESAC, near Madrid. The LTP iteration process is designed to identify and resolve conflicts between CaSSIS and other instruments and spacecraft operations. The medium term plan (MTP) confirms the LTP input with the latest orbit predictions. The final target parameters are tweaked in the short-term planning (STP) process, approximately 1 week before execution.

Fig. 26

The image selection approach for CaSSIS

Currently, the downlink rate offers 2.9 Gb/day on average. Within the LTP skeleton, CaSSIS will be allocated one stereo pair and one non-stereo image per orbit. For the former, the yaw motion of the spacecraft will be suspended. However, the data volume generated by CaSSIS using such an approach would be around 12 times more than can be downlinked on average. Hence, data compression and optimization of the planning will be necessary. We estimate that around 6 stereo pairs and 6 non-stereo images will be acquired per day on average assuming an average compression ratio of 6.

Once an image has been successfully acquired, it will be mapped back to the database (CaST) and flagged as retired unless multiple observations of the same site have been requested.

15 Processing Pipeline, Storage and Archiving

The data from CaSSIS will be delivered to ESA’s Planetary Science Archive (PSA) for publication. The basic flow of data is shown in Fig. 27. The pipeline through to UBE Level 1B in this diagram was completed shortly after reception of the first flight data from Mars orbit and has been written in Interactive Data Language (IDL). The geometric rectification step will be completed using ISIS for which ingestion routines have already been written.

Fig. 27

Data flow from the spacecraft data repository through the processing system to the archive

The proprietary period is 6 months but it is hoped that level 0 data can be provided for ingestion after 3 months once routine operations are in place. The data will be delivered in an XML format that is similar to the PDS V4 standard and will be converted to that standard either by PSA responsibles at the Science Operations Centre or by the University of Bern. In the latter case, software generated in support of the CaSSIS project by University of Arizona and/or USGS would be used.

The final pipeline products will be images that are calibrated both radiometrically and geometrically. It is expected that images comprising framelets stitched together to make complete swaths over the target in each colour will be made available through a public web site. There are currently no resources within the CaSSIS project to provide stereo products routinely as part of the public distribution. The co-I team does however include many stereogrammetry experts who will provide stereo products to the community on a best effort basis, possibly funded through their national agencies. This is indicated in Fig. 27 as level 4.

16 Scientific Examples

CaSSIS is designed to achieve its primary science goals of monitoring possible production sites of trace gases (particularly methane) in the atmosphere as well as characterising candidate landing sites for the 2020 ExoMars rover. Furthermore, the combination of its high spatial resolution, colour capabilities, high quality stereos, and flexibility of imaging time, ensures that CaSSIS will be capable of supporting various scientific investigations of the surface including existing and on-going studies as well as establishing new areas of research.

At 4.6 m/px, CaSSIS can generate an image comparable or superior to all currently operational orbiting cameras apart from HiRISE and, of past imagers, only MOC had superior resolution. Its stereo capability will however generate high resolution DTMs for regions up to ${\sim}450~\mbox{km}^{2}$ in one imaging sequence, which will permit high resolution morphometric studies in support of regional mapping campaigns. CaSSIS will be able to resolve features <10 m in dimension, which permits detailed geological/geomorphological studies and seasonal monitoring as well as carrying out/supporting many of the ongoing investigations, including those that are better resolved by HiRISE.

Tornabene et al. (2017) sought to test the spatial and colour capabilities of CaSSIS by several methods, including the generation of rigorous CaSSIS-simulated data products using Mars Reconnaissance Orbiter datasets and a comparison with HiRISE. Figure 28 shows a region of Nili Fossae which is known to contain diverse mafic minerals (e.g., olivine and low-calcium pyroxene) and hydrated silicates, which includes the mineral serpentine (see Ehlmann et al. 2010). This site and the presence of olivine and serpentine are highly relevant to CaSSIS and TGO mission objectives as the formation of this mineral, via aqueous alteration of olivine produces methane as a byproduct (e.g., Parnell et al. 2010). Indeed, this location was originally identified by Mumma et al. (2009) as one of three regions where methane appeared notably localized during northern summer in 2003. Simulations of the appearance of this region to CaSSIS post-reduction were constructed from the wavelengths of a CRISM (Murchie et al. 2007) Full-Resolution Targeted (FRT) S-detector cube 0000ABCB (18 m/px), which was convolved with the bandpass filters of CaSSIS (Fig. 25), and then pan-sharpened with an oversampled 32-bit CTX (Malin et al. 2007) image (P19_008347_2019_XN_21N286W) with an initial resolution of ∼5.6m/pix. On the left, a false colour composite from 3 CaSSIS bands is shown. In high signal to noise cases, band ratios can be used to produce a false colour image as on the right of Fig. 28. Several mineral detections from CRISM correlate with distinct colours in the colour and ratio images. Serpentine-bearing deposits appear to correlate with greyish and dark orange materials while light cyan and cyan are consistent with olivine-bearing materials. Bright magenta and orange specifically correlate with the relatively Fe-poor kaolinite rich materials. This example demonstrates that CaSSIS will provide additional geologic context via its improved colour coverage and Fe-sensitivity, over HiRISE, and also at a higher pixel resolution over HRSC. Despite having a lower pixel resolution than HiRISE, Tornabene et al. (2017) demonstrates that CaSSIS will be able to resolve some of the small-scale features under close study by HiRISE (e.g., gully activity, RSL, recent impacts, etc.), provide additional Fe-sensitivity through its two IR bands, and improved colour context needed for understanding the fine-scale distribution of key mineral detections and geologic context for sites of interest on Mars. Further examples of these simulations and a description of their production are presented in Tornabene et al. (2017).

Fig. 28

Simulated CaSSIS images (at 4.6 m/px and ∼10 km across) sampling olivine- and serpentine-bearing terrain in the Nili Fossae Region (centred at 73.3°E, 20.9°N). (A) A false-colour infrared colour composite using the NIR, PAN and BLU bands in RGB, and (B) A CaSSIS Fe-sensitivity band ratio colour composite image using RED/PAN ($\mbox{Fe}^{3+}$), PAN/BLU ($\mbox{Fe}^{3+}$), PAN/NIR ($\mbox{Fe}^{2+}$) ratios in RGB. The colours represented in these images have been correlated with spectral detections of serpentine, olivine and kaolinite (see Fig. 3 in Ehlmann et al. 2010)

17 First Flight Data

The first flight data from in orbit about Mars were acquired on 22 Nov. 2017. Figure 29 shows one of the first exposures acquired by CaSSIS in orbit. It is part of an image sequence that was subsequently assembled to produce a swath of the surface in four colours. The figure shows the four colour framelets mapped back to their position on the detector. Colour reconstruction still requires some improved in-flight calibration but first colour composites are promising. A data set of the Martian moon, Phobos, has been acquired and the surface distribution of colour units is consistent with other observations (Pajola et al. 2017). The stereo capability was also tested and first scientific results from these data from Noctis Labyrinthus are currently being prepared (Massironi et al. 2017).

Fig. 29

A single CaSSIS exposure from the first image sequence acquired in Mars orbit on 22 Nov. 2016. The four different framelets (from the top BLU, NIR, RED and PAN) have been mapped back to their positions on the $2\mbox{k} \times 2\mbox{k}$ detector

18 Conclusions

Despite limited mass, volume and schedule resources, a highly capable imaging system has been delivered to the ExoMars Trace Gas Orbiter spacecraft. The as-built characteristics of CaSSIS are summarised in Table 2. The instrument provides a novel solution to the problem of stereo acquisition and implements a “push-frame” approach that has certain advantages for calibration and test. The instrument characteristics will complement those of other imagers currently in Mars orbit by enhancing the high resolution, colour, and stereo coverage over a surface area equivalent to ∼3–4% of the planet for every Mars year in orbit. The instrument is now successfully functioning in Mars orbit and the data output appears to be fully in line with expectation.