Proposed System for Automating Electrical

Verification and Validation of Spacecraft Liquid

Propulsion Systems

Iain A. Miller
Javelin Technology Group
12706 Maryvale Court
Ellicott City, MD 21042
iawmiller@[Link]

Abstract—A majority of National Aeronautics and Space This paper presents a PTS that includes components to
Administration (NASA) and Department of Defense spacecraft systematically perform testing during I&T and support
require the ability to be maneuvered in space after separation hazardous operations. Using equipment such as the proposed
from the launch vehicle. These maneuvers may be for station PTS in this paper for integration, test, and verification of
keeping, orbit insertion, collection of science data, or avoidance spacecraft propulsion systems will enable the I&T team to
maneuvers. Many of these spacecraft utilize a liquid propulsion complete testing with a less time-consuming and more efficient
system involving thrusters, latch valves, propellant tanks, process, thus reducing cost and effort. Test procedures will have
propellant lines, and associated pressure- and temperature- more repeatable variables wherein results can be compared more
monitoring equipment. To thoroughly test the propulsion system accurately. Safety of the test team and test facility is enhanced
prior to launch, the spacecraft integration and test (I&T) team because of automated hardware/software routines that
must put all of the propulsive elements through a series of tests, continuously monitor the spacecraft.
both electrical and mechanical, that include hazardous
operations. Because of the repetitive nature of many of the tests, a Keywords—propulsion testing, automation, GSE, ground
propulsion test system (PTS) is desired; the PTS will include a support equipment, test system, data acquisition
mix of automated and manual elements to make electrical testing
of the propulsion subsystem more efficient, repeatable, and safe. I. INTRODUCTION
Currently, testing of spacecraft propulsion systems across the The Johns Hopkins University Applied Physics Laboratory
industry is heavily reliant on manual test methods. For example, (APL) designs and builds spacecraft for both the National
operators may toggle fuel and thruster valves opened or closed Aeronautics and Space Administration (NASA) and the
via a manual switch. Overactivation of these valves could result Department of Defense. The integration and test (I&T)
in damage to the valve, which would pose significant risk to the campaign comprises a major facet of the spacecraft build
spacecraft. In addition to the value of using the PTS for process. During the I&T phase, each major subsystem is
repeatable tests, there is the added value of using it in place of an integrated into the spacecraft bus and run through a series of
engineer during hazardous operations. For instance, during acceptance, functional, and performance tests. To thoroughly
spacecraft fueling, the toxic chemical hydrazine is loaded into the test each subsystem, external stimuli and monitoring may be
spacecraft propellant tanks. During this time, the spacecraft must needed. For this reason, ground support equipment (GSE) is
be unpowered and all personnel must either be in a separate used for functions such as powering the spacecraft, uplinking
facility or wearing hazardous material suits, which offer limited commands, downlinking telemetry, simulating loads, emulating
mobility [1]. Although it will still be necessary to have a live maneuver data, and monitoring critical spacecraft elements.
technician in place to facilitate fueling of the spacecraft, the PTS Fig. 1 depicts a typical GSE setup used during a spacecraft I&T
eliminates the need for other engineers to be in close proximity to
campaign.
monitor the propellant system. The PTS allows for remote
monitoring of the fueling operation as well as remote activation The propulsion test system (PTS) is designed to verify the
of safety valves should the fueling operation require intervention. functionality of the spacecraft propulsion system as well as to
For the fueling operation to be successful, the pressures and assist in liquid propulsion fueling and checking for leaks.
temperatures must be monitored continuously for all fuel tanks Currently, APL uses several independent units to verify the
and fuel lines. An added benefit for spacecraft integration electrical elements of the liquid propulsion system. These units
facilities is the ability of the PTS to be reconfigured for use on rely on fully manual operations, with the test conductor
multiple missions. Because of the “proven” nature of flight physically toggling switches and reading back values. The PTS
propulsion components, they are inherently similar across several
is designed to reduce the manual effort involved in testing the
missions [2] [3]; thus, the PTS can interface with these propulsion
elements with minimal modification to physical interfaces and
propulsion system, increase the repeatability of tests, increase
can be used across the industry. the safety for personnel and flight components, and reduce
long-term costs by being used for multiple missions.

978-1-4244-9363-0/11/$26.00
Authorized licensed use limited to:©2011 IEEE de Madrid. Downloaded on July 22,2025 at [Link] UTC from IEEE Xplore. Restrictions apply.
Univ Politecnica
 Figure 1. Typical GSE setup used during a spacecraft I&T campaign.

II. DESIGN FACTORS and personnel, reliability of test equipment, accuracy of

Several top-level design requirements were identified measurements, and multi-mission capability.
throughout the course of the PTS design definition. These
requirements derive from Interface Control Documents, Test A. Safety
Plans, Specifications, and Launch Safety Plans from several Hazards involved with a liquid propulsion system can be
APL missions. Major design factors include safety of hardware summarized as fire/explosion, inadvertent actuation (electrical),

Authorized licensed use limited to: Univ Politecnica de Madrid. Downloaded on July 22,2025 at [Link] UTC from IEEE Xplore. Restrictions apply.
overpressurization, and exposure to toxic material (hydrazine) monitoring software routines to continuously monitor the
[1]. Each of these concerns must be addressed by the spacecraft health of PTS hardware, and error-correction algorithms to
I&T team to mitigate the risk of testing a liquid propulsion detect and mitigate hardware/software errors such as loss of
system on the ground. The PTS is designed to address each communication to a data acquisition (DAQ) card, loss of
hazard by adhering to NASA/Kennedy Space Center launch network connectivity, or computer hardware malfunction.
safety standards and NASA GSE design standards. To reduce
the risk of explosion, the PTS uses sealed harnessing and D. Accuracy
chassis, and also has the ability to utilize a nitrogen purge to
reduce the risk of sparks [4]. Inadvertent actuation of valves Because of the strict measurement requirements for
poses several concerns to the spacecraft team. The valves are validating propulsion subsystem components, the accuracy of
considered limited-life items and repeated switching may measurements is paramount to the success of a propulsion
degrade performance over time. Another concern is that if the subsystem verification and validation campaign. For example,
propulsion system is pressurized and a valve is inadvertently a mission may require pressure sensors to be accurate to ±0.5%
opened, toxic propellant may release into the atmosphere. throughout the transducer measurement scale. Flight
Output filtering on control lines and safety interlocks are used temperature sensors may need to be calibrated to within 0.5°C
in the PTS to reduce the chance of an inadvertent valve [3]. The PTS incorporates built-in calibration hardware for both
actuation. The PTS monitors pressures and temperatures to flight sensors and PTS internal sensors to ensure accuracy
ensure that they are within nominal limits. Overpressurization throughout the test cycle.
may cause structural degradation or rupturing of propellant
tanks, valves, or lines. E. Multi-mission Capability
Cost savings and increased efficiency are major motivators
B. Safety for GSE design. If a piece of equipment can be built for one
Hazards involved with a liquid propulsion system can be program and be modified for use on a future program at a
summarized as fire/explosion, inadvertent actuation (electrical), lower cost than that for development of a new unit, major
overpressurization, and exposure to toxic material (hydrazine) consideration should be given to its merit. The PTS takes this
[1]. Each of these concerns must be addressed by the spacecraft mindset and expands upon it. Reconfiguration of hardware via
I&T team to mitigate the risk of testing a liquid propulsion software control essentially allows the PTS to become a test
system on the ground. The PTS is designed to address each unit for several spacecraft, independent of physical differences.
hazard by adhering to NASA/Kennedy Space Center launch The idea is that the PTS is configured to use a certain number
safety standards and NASA GSE design standards. To reduce of DAQ channels, configured as either analog or digital
the risk of explosion, the PTS uses sealed harnessing and input/output (I/O), to interface to flight hardware. These
chassis, and also has the ability to utilize a nitrogen purge to channels are easily reconfigured via software command or
reduce the risk of sparks [4]. Inadvertent actuation of valves configuration file. The only custom hardware needed to use the
poses several concerns to the spacecraft team. The valves are PTS on multiple programs are the physical connections directly
considered limited-life items and repeated switching may to the spacecraft test connectors. These connections would
degrade performance over time. Another concern is that if the require custom harnessing per spacecraft. Other changes to the
propulsion system is pressurized and a valve is inadvertently number of interfaces, types of flight hardware, range of
opened, toxic propellant may release into the atmosphere. measurements, and safety parameters can be customized in
Output filtering on control lines and safety interlocks are used software. This minimizes the need to create a custom PTS for
in the PTS to reduce the chance of an inadvertent valve each program requiring propulsion test GSE.
actuation. The PTS monitors pressures and temperatures to
ensure that they are within nominal limits. Overpressurization III. SYSTEM DESCRIPTION
may cause structural degradation or rupturing of propellant
tanks, valves, or lines. The PTS combines custom circuit components, commercial
off-the-shelf (COTS) computer hardware, and custom software
C. Reliability to create an automated spacecraft propulsion test and
verification system. The PTS not only activates and exercises
As defined in the NASA GSE development standard components of the spacecraft propulsion system but also
NASA-STD-5005C, reliability in GSE constitutes redundancy, collects data in near real time to be checked for errors, logged,
in which several subsystems perform the same functions and evaluated by the test team. A local graphical user interface
independently to ensure that a failure of one does not prevent (GUI) provides the test team with real-time data and indicators,
the GSE from performing its required function, and failure while custom software algorithms continuously verify
tolerance, in which a failure to GSE does not result in damage temperatures, pressures, flow rates, and exercise valves
to flight hardware [5]. The PTS is designed with reliability in accordingly. Hardware safeguards are built in to ensure that no
mind by utilizing redundant safety hardware and software single failure can propagate through the spacecraft flight
routines to ensure constant monitoring and control of flight system. This system is used on a daily monitoring basis during
components. Also, power interfaces to flight hardware nominal spacecraft I&T as well as in a more integral role
incorporate overcurrent and overvoltage protection to ensure during fueling and leak checking.
that voltage spikes or electrical shorts do not affect the
propulsion subsystem. Other factors considered for PTS Fig. 2 presents a context of the PTS external interfaces. The
reliability are redundant data acquisition hardware, self- PTS interfaces to either a powered or unpowered spacecraft

Authorized licensed use limited to: Univ Politecnica de Madrid. Downloaded on July 22,2025 at [Link] UTC from IEEE Xplore. Restrictions apply.
where propulsion pressures, temperatures, latch valve, and from onboard sensors on temperature, pressure, and flow rate.
thruster valve positions represent data inputs from the These data are processed and archived locally and also are sent
spacecraft to the PTS. Spacecraft sourced valve control pulse- to the MOC for display to the test conductor. Local and remote
width and amplitude data are also captured and verified during control of the system is provided to enable the fueling
integration. All data are independent of the spacecraft technician or test conductor to operate valves as the fueling
command and data handling system, providing a redundant operation commences. Upon completion of the fueling
safety mechanism should the spacecraft be unpowered during operation, the PTS is put into a round-the-clock monitoring
fueling activities. The PTS uses custom software to log the mode to ensure that the propulsion subsystem does not lose
incoming data as well as to apply algorithms to determine the pressure, which would indicate a leak. If the PTS does detect a
safety of the propulsion system and intervene if necessary. A leak, it automatically closes the latch valves and notifies the
user console allows for real-time monitoring and control of the test conductor of the anomalous situation. The PTS is used
system. A TCP/IP connection is provided to allow access to continuously once the spacecraft is fueled, both at the fueling
remote-test-team ground control. This link is used during location and at the launch pad. The PTS is also used on a test-
remote operations when the test team is in a Mission by-test basis during propulsion subsystem I&T prior to fueling
Operations Center (MOC) and the spacecraft is in the operations.
hazardous fueling location.
During a typical fueling operation, the PTS will reside in IV. HARDWARE
close proximity to the spacecraft. This will require the PTS to Five subsystems make up the proposed PTS solution as
not only have an explosion-proof rack enclosure but also to depicted in Fig. 3. Note that internal PTS signal and power are
have a kill switch for emergency operations in which all power represented by blue lines, signal and power to external nodes
is removed from the system and all latch valves are closed are represented by black lines, and the external interfaces are
immediately. As the fuel is being loaded, the PTS collects data represented by blue ovals.

Temperature Sensor

Pressure Transducer
Latch Valve Control Pulse

Thruster Valve Control Pulse

Safety Interrupt Signals

Position Data

Position Data Regulated Power

Pressure Data

Temperature Data
PTS Power (Current)

Desired Voltage Position/Power/Status Network Packet Headers

Desired Valve Position
120VAC
Test Parameters/Scripts

Power

Test Conductor

Network Packet Headers

Remote Command Terminal

Figure 2. PTS context diagram.

Authorized licensed use limited to: Univ Politecnica de Madrid. Downloaded on July 22,2025 at [Link] UTC from IEEE Xplore. Restrictions apply.
 Spacecraft Propulsion System

Data Signals

Power
Keyboard Commands
Digital Data User
3.0 External Mouse Commands
Analog Data Communications
Subsystem Switched Power
Power Data

Configuration Files
Test Scripts Control Signals Interlock Level
Remote 1.0 Data
Archive Files Acquisition and Data Signals Control Signal 4.0 Power AC Power Facility
Workstation
Commands Control Hardware
Voltage and Current Measurements
Telemetry

5.0 Safety
Hardware
Remote I/F Data

Safety Signal
Config Data
Control Data
Configuration Data
Spacecraft Digital Data
Spacecraft Analog Data

Safety Config Files

Test Scripts
User I/O
2.0 Processing (Software) Archive Files
Platform
User Commands
Status Display

Figure 3. PTS subsystem diagram.

A. Data Acquisition and Control Hardware D. Power

The data acquisition subsystem will interface directly with The power subsystem includes linear regulated power
the computer backplane, power components, and spacecraft supplies, programmable power supplies, solid-state overvoltage
first circuit interfaces (Fig. 4). This subsystem is responsible and overcurrent protection, power-switching circuitry, and
for physically actuating valves, controlling power supplies, and circuitry for voltage and current monitoring.
reading analog and digital values from the spacecraft. The
processor, storage media, and computer input/output (I/O) are E. Safety
housed in this component as a backplane controller. Physical The safety subsystem is a real-time processing component
interfaces to the spacecraft test connector(s) route through that acquires data from the data acquisition subsystem and
harnessing encompassed in the External Communications analyzes the data for irregularities or possible hazardous
Hardware subsystem. conditions. The real-time safety component can directly
remove power from the spacecraft propulsion system via
B. Processing digital signals to power-switching components and can also
The processing subsystem is the software portion of the command data acquisition devices through the computer. This
PTS and is discussed in further detail in the following section. subsystem is in operation while the PTS is powered and
This subsystem controls data acquisition functions, user continuously monitors for safety concerns.
interfaces, procedures, alarms, archival of data, and remote
network interfaces.
V. SOFTWARE
C. External Communications Hardware Fig. 5 depicts the architecture of the PTS software. At the
The external communications subsystem is responsible for core is the data processor, which includes low-level functions
displaying information to the test conductor, receiving that drive each routine of the PTS. The data processor also
feedback from the test conductor, and publishing data to the provides the interface to the Windows operating system
network as well as for the physical interface to the spacecraft installed on the computer. The PTS code houses the modules to
(harnessing). interface with the hardware inside of the PTS, process data
algorithms, process user input and GUI outputs, and
communicate with remote and system safety interfaces.

Authorized licensed use limited to: Univ Politecnica de Madrid. Downloaded on July 22,2025 at [Link] UTC from IEEE Xplore. Restrictions apply.
 3.0 External Communications

Pressure
Valve Position
Power Data
Hardware

Temperature
Configuration Files
Test Scripts
Remote
Archive Files Temperature Data
Workstation
Commands Pressure Data
Telemetry 1.1 Processing Board Power 1.2 Custom
Chassis Valve Position Data Hardware

Board and Chassis Power

Interlock Control Signals

Raw Temperature Data

Valve Control Signals
Voltage

Raw Pressure Data

Switched Pulses
Current

Spacecraft Analog Data

Spacecraft Digital Data
Configuration Data

Remote I/F Data

Control Data
2.0 Processing 5.0 Safety
4.0 Power Software Hardware

Figure 4. Data acquisition and control hardware.

PTS Custom Code

Acquisition and Control Archive

Hardware APIs
Data
Compiler Timekeeping

Channel Channel Channel

Configuration Input Output
Controller Controller Controller

File Handler

Digital Analog User Interface

Compression
Data Data
Handler Handler Algorithms

Real-Time
VGA
Display Controller
Controller
Data Data
Hard Disk File I/O
Conversion Packaging
Controller

Keyboard/
GUI
Mouse Input
Process Operating Handler
Service
Controller Data Processor System I/O
Priority
Voter Error Removable
Memory PXI Interface PC Input Media Read/
Handling
Controller Controller Controller Write
Service

Audible Alert
Controller

Real-Time Controller
Command/
Telemetry
File Data
Packetizer
Handler

Real-Time
Reset
Data Transfer Service
Service
TCP/IP Controller

Safety
Configuration
Interrupt Connection
Load Routine
Routine Acq/
Reconnect
Service

Real-Time Interface Remote Interface

Figure 5. PTS software architecture.

Authorized licensed use limited to: Univ Politecnica de Madrid. Downloaded on July 22,2025 at [Link] UTC from IEEE Xplore. Restrictions apply.
 Figure 6. Radiation Belt Storm Probes (RBSP) propulsion electrical GSE.

VI. COST BENEFIT AND DISCUSSION

Automated test sequencing is a major part of the PTS
functionality. The concept behind test sequencing operations is Currently, APL develops two to three independent GSE
to allow for automated propulsion testing at the spacecraft I&T units for the purposes of integrating and validating a spacecraft
level. Currently, APL uses STOL-like scripting of procedures propulsion subsystem (Fig. 6). Each GSE unit is custom
for aliveness, functional, and performance procedures. These designed from the ground up depending on the requirements of
scripts include command transmission and automatic checking the mission at hand. Once the unit is designed, circuit boards,
of relevant telemetry points. The PTS incorporates a similar mechanical panels, and COTS equipment are procured, tested,
functionality, in which a command script can be loaded and and assembled. Acceptance testing is then performed on each
executed either directly at the PTS or remotely on the test unit prior to delivery and at each subsequent transport of the
conductor command terminal. unit. The cost of this development effort may involve two full-
time employees for 3–4 months for each unit being produced.
As the I&T campaign proceeds, the propulsion system The benefit of developing a test system such as the PTS is
matures to a more operational state in which tanks become envisioned to outweigh the up-front cost of designing and
pressurized and their temperature and pressure data must be producing the more complicated and COTS-oriented PTS. In
monitored to ensure safe operations. The PTS utilizes data the case of several programs running concurrently, the added
acquisition hardware and automated safety routines to monitor benefit of having a reconfigurable test system is clear. Limited
pressures, temperatures, voltages, and currents during round- effort is required to reconfigure the PTS to tailor it to a specific
the-clock operations. This safety ability also includes a user- mission. Maintainability is also of great concern to the I&T
defined feature that allows the PTS to intervene and remove team. During the I&T campaign, one would not want a piece of
power or close valves if the propulsion subsystem readings go GSE to fail, thus halting testing until the problem is corrected.
out of red limits. This feature allows the PTS to be used for An advantage to having identical parts in each PTS means
monitoring of spacecraft propulsion health without personnel in minimal downtime. Should a component fail in one PTS,
the loop, hence presenting the I&T team with savings in cost another can be configured to take the failed unit’s place on very
and resources. short notice.
Because of the nature of the COTS data acquisition Aside from the cost aspect, the PTS also presents the I&T
hardware, and the custom interfaces to PTS software, the I/O team with a solution for creating a highly reliable and
data and power channels can be configured per user request. As repeatable test. Because of the limited interaction of personnel
is typical with many software programs these days, an and the use of identical test equipment, there will be very little
initialization file with specific mappings of I/O channels is variability in data from test to test unless a flight component is
loaded when the PTS is powered up. This feature allows the out of its specified parameters. Automated routines allow the
GSE team to take the I&T requirements and deliver a PTS test conductor to execute a test far more quickly than if
without needing to change the internal hardware or custom entering manual commands or throwing switches and reading
software routines. In other words, the PTS is designed to be back data. These routines also allow the subsystem engineers to
used over many missions with minor variability between review the test sequences prior to execution on flight hardware.
deliveries, thus saving time and materials. All data collected during a test are then stored in a standardized
format for post-processing.

Authorized licensed use limited to: Univ Politecnica de Madrid. Downloaded on July 22,2025 at [Link] UTC from IEEE Xplore. Restrictions apply.
 Because of the nature of the PTS design, the scope can be
easily expanded. Discussions have been made about including REFERENCES
test services for pyrotechnic devices (i.e., actuators for solar [1] O. Ndu, “RBSP mission missile system pre-launch safety package
arrays). In this way, the consolidation of GSE will not only (MSPSP),” Johns Hopkins University Applied Physics Laboratory
present savings for propulsion testing during I&T but also for Technical Document, Laurel, MD: JHU/APL, 2010.
system-level testing, which represents a highly desirable [2] S. Bushman, “RBSP propulsion subsystem requirements document,”
Johns Hopkins University Applied Physics Laboratory Technical
spacecraft validation tool. Document, Laurel, MD: JHU/APL, 2009.
[3] C. Engelbrecht, “STEREO liquid propulsion system performance
VII. SUMMARY specification,” Johns Hopkins University Applied Physics Laboratory
Technical Document, Laurel, MD: JHU/APL, 2002.
As described in this paper, there are many advantages to [4] Standard KSC-STD-E-0002E, “Standard for hazardproofing of
standardizing the way that electrical testing of spacecraft electrically energized equipment,” Washington, DC: National
propulsion is executed. From repeatable tests, automated test Aeronautics and Space Administration /Kennedy Space Center, 2009.
routines, automated safety monitoring, data archival, and cross- [5] NASA Technical Standard NASA-STD-5005C, “Standard for the design
mission functionality, the PTS provides a solution for a more and fabrication of ground support equipment,” Washington, DC:
National Aeronautics and Space Administration, 2009.
robust propulsion electrical GSE system.

Authorized licensed use limited to: Univ Politecnica de Madrid. Downloaded on July 22,2025 at [Link] UTC from IEEE Xplore. Restrictions apply.