Presentation on theme: "Dokumentname > 23.11.2004 SDL sequence: the system standpoint J. Biele Philae Science team meeting Venezia, Palazzo Cavalli Franchetti March 30, 31, April."— Presentation transcript:
Dokumentname > 23.11.2004 SDL sequence: the system standpoint J. Biele Philae Science team meeting Venezia, Palazzo Cavalli Franchetti March 30, 31, April 1, 2009 v2
SDL J. biele Jan 2009 Folie 2 > Vortrag > Autor SDL workshops, deadlines SDL#1: Jan 28/29, 2009 Cologne SDL #2: Feb 5/6, 2009, Cologne SDL #3: Apr 28, 2009, Toulouse Status is documented in Minutes of Meeting of SDL#2, version v0 of 25.03.2009. SDL reference documents and presentations accessible from ftp server philae.dlr.de DECISIONS to be taken by end-April 2009: All decisions on CDMS S/W development Test cases definition confirmation for end-2009 verification Payload comments and requests
SDL J. biele Jan 2009 Folie 3 > Vortrag > Autor Summary status SDL workshop Recommendations ADS tank opener activation before FW spin-up Check whether there are nominal scenarios with MSS delta-v of 17,5 cm/s (like emergency release) Investigate additional Touch-down signal strategy (see attached flow chart) Fire 2nd harpoon unconditioned ~0,5 sec (tbc) after first one Anchor rewind force: Use level 1 (4-5 N) Anchor rewind counter setting: 240 cm Implement "careful re-tensioning procedure“ (details to be defined for SDL_029) RF link to be established only tbd time after separation (15 min tbc) (details to be defined for SDL_023) Switch off RF units around touch-down (details to be defined for SDL_023) Decisions SDL model case definitions for ‘Core SDL’ and ‘Extended SDL’ End-to-end SDL test incl. OBCPs will be performed during hibernation ESS test in MPS Lindau planned for 2009 to check/confirm SAT application and setting first [Küchemann]; no action/due date is given yet. Go with automatic emergency eject (12 sec after nominal sep), but check for compatibility Lander temperature at separation shall NOT be ’as high as possible’ to avoid overheating ofBatteries; required temperature pending on thermal analysis for SDL and FSS No CDMS Batteries temperature control during SDL (details to be defined for SDL_008) Anchoring Sequence Flowchart : Have "8 sec" timeout as parameter (sequence to be re-checked for short time-outs, 0,5-2 sec)
SDL J. biele Jan 2009 Folie 4 > Vortrag > Autor SDL – to be decided urgently Final Anchoring sequence Final touchdown detection Final SDL test cases, experiment priorities Final power (incl. Batteries temperature) managment Final RF communication / MM scenario (what do we want? What can the Orbiter provide?) Final CDMS software change requirements
SDL J. biele Jan 2009 Folie 5 > Vortrag > Autor CDMS SW Requirements from SDL Workshop to be derived from… - SDL_008 Monitoring of PBatt temperature by CDMS SW (No decision yet on battery temperature control by CMDS after SDL. But if decided, temperature limits as parameters, not fixed values!) - SDL_018 Criteria for 'PBatt empty' shall be configurable in CDMS SW - SDL_028 Provide optional anchoring sequence via RTTC - SDL_029 Proposal of re-tightening anchor procedure - SDL_030 TD detection by SESAME -SDL_031 Flowchart of updated TD detection scenario All topics have to be confirmed in the next SDL_WG#3!
SDL J. biele Jan 2009 Folie 6 > Vortrag > Autor Status of reference documents Philae SDL reference documentationPhilae SDL reference documentation, One doc added wrt. last version 26.1.2009 – now 3.2.2009 1. LID-B, RO-EST-RS-3020/LID B, iss. 3.0, 8.12.2004 (this is the Lander's answer to the EID-A, signed with ESA)LID-B, RO-EST-RS-3020/LID B, iss. 3.0, 8.12.2004 2. Rosetta Lander User Manual, RO-LAN-UM-3100-DLR, Iss. 4 Rev.: 0, 22.12.2005 (LUM iss. 5 under work) (this is the basic technical description of the Lander and its units)Rosetta Lander User Manual, RO-LAN-UM-3100-DLR, Iss. 4 Rev.: 0, 22.12.2005 3. Crema, RO-ESC-RP-5500, ROSETTA: CONSOLIDATED REPORT ON MISSION ANALYSIS CHURYUMOV-GERASIMENKO 2004, iss. 5.0 Aug. 2003 (this is the valid ROSETTA mission analyis including lander delivery; soon -2009- to be updated)Crema, RO-ESC-RP-5500, ROSETTA: CONSOLIDATED REPORT ON MISSION ANALYSIS CHURYUMOV-GERASIMENKO 2004, iss. 5.0 Aug. 2003 4. ROSETTA LANDER MISSION ANALYSIS WORKING GROUP FINAL REPORT, RO-ESC-RP-5003, Issue 1, April 1999, RO-ESC-RP- 5003 (this is the Lander MA still for Wirtanen)ROSETTA LANDER MISSION ANALYSIS WORKING GROUP FINAL REPORT, RO-ESC-RP-5003 5. Lander Mission Analysis SONC: ROS-TNO-LTAN-1771-CNES; iss. 1.1, 3.11.2004 (this is the latest detailed Lander MA for 67 CG; to be updated in 2009)Lander Mission Analysis SONC: ROS-TNO-LTAN-1771-CNES; iss. 1.1, 3.11.2004 6. SDL timeline (for testprocedure) "Basic", RO-LAN-TP-3431, iss. 2.5, 7.11.2003 (this is the input table upon which ref. 10 is based)SDL timeline (for testprocedure) "Basic", RO-LAN-TP-3431, iss. 2.5, 7.11.2003 7. SDL timeline (for testprocedure) "Fast Descent", RO-LAN-TP-3432, iss. 1.0, 18.07.2003 (this is the input table upon which ref. 10 is based but for short descent)SDL timeline (for testprocedure) "Fast Descent", RO-LAN-TP-3432, iss. 1.0, 18.07.2003 8. Lander (SSP) Separation Strategy, RO-DSS-TN-1213, iss. 1, 27.04.2005 (Astrium)Lander (SSP) Separation Strategy, RO-DSS-TN-1213, iss. 1, 27.04.2005 9. Lander Separation Tests Investigations RO-DSS-TN-1212, iss. 1., 27.04.2005 (Astrium)Lander Separation Tests Investigations RO-DSS-TN-1212, iss. 1., 27.04.2005 10. SDL Separation&Descent&Landing Procedure, RO-LAN-TP-xxxx(3431), iss. 3.0, 29.09.2005 (SDL test procedure by A. Balasz, basis for AMST 1000)SDL Separation&Descent&Landing Procedure, RO-LAN-TP-xxxx(3431), iss. 3.0, 29.09.2005 11. M. Hilchenbach: Rosetta Lander Modelling, RO-LAN-TN-3113, Iss. 1, Nov. 1999 OBSOLETE, DELETED FROM SERVER 12. M. Hilchenbach, H. Rosenbauer and B. Chares, FIRST CONTACT WITH A COMET SURFACE: ROSETTA LANDER SIMULATIONSM. Hilchenbach, H. Rosenbauer and B. Chares, FIRST CONTACT WITH A COMET SURFACE: ROSETTA LANDER SIMULATIONS L. Colangeli et al. (eds.), The New ROSETTA Targets, 289–296, (2004) (Landing simulations for 67P) 13. RO-LAN-LI-1000 (Rosetta Lander Scientific Objectives of the Philae Mission) (edited by H. Boehnhardt, Science Themes Lander)RO-LAN-LI-1000 (Rosetta Lander Scientific Objectives of the Philae Mission) 14. Instrument Flight Operation Plans (IFOPS) by each PI team, 2008/2009 (the basic input by each experiment for the comet phase – SESAME and Ptolemy update missing at the time being) 15. Definition of the Lander sequence for the Separation, Descent & Landing phase and for the touch-down phase, Moura&Biele, ROS- NO-L-INTES-946-CNES, 17.5.2002, iss.3 (the overview document about SDL, status 2002)Definition of the Lander sequence for the Separation, Descent & Landing phase and for the touch-down phase, Moura&Biele, ROS- NO-L-INTES-946-CNES, 17.5.2002, iss.3 16. ROSETTA LANDER: OBCP for LANDER User Requirements Document, RO-LAN-TN-3210, Iss. 8, 13.05.2003ROSETTA LANDER: OBCP for LANDER User Requirements Document, RO-LAN-TN-3210, Iss. 8, 13.05.2003
SDL J. biele Jan 2009 Folie 7 > Vortrag > Autor Ref. docs, cont. 17. ROSETTA Lander Separation SAT Definition, Doc.No.: RO-LAN-TP-3901, Issue : 1 Revision : 0, Date : 29.04.2003ROSETTA Lander Separation SAT Definition, Doc.No.: RO-LAN-TP-3901, Issue : 1 Revision : 0, Date : 29.04.2003 (for the ROSETTA LANDER Separation, Descent and Landing with SAT and OBCP) 18. ROSETTA Lander Test Report Separation Procedure with SAT on Orbiter level, RO-LAN-TR-3403, Issue : 1.0, Date : 19.11.2002ROSETTA Lander Test Report Separation Procedure with SAT on Orbiter level, RO-LAN-TR-3403, Issue : 1.0, Date : 19.11.2002 19. CDMS Detailed Design Document, RO-LCD-SW-3610, Version 6/98, 28.03.2008CDMS Detailed Design Document, RO-LCD-SW-3610, Version 6/98, 28.03.2008 20. Rosetta Lander Development & Validation Plan CDMS SW, RO-LCD-TN-3403, 1.1, 20/Jan/2009 (replaces CDMS General overview on SW 7.0 development, RO-LCD-TN-3401, Version 6/98, 28.03.2008)Rosetta Lander Development & Validation Plan CDMS SW, RO-LCD-TN-3403, 1.1, 20/Jan/2009 21. CDMS Subsystem Specification, RO-LCD-SP-3101, Version 6/0, 02.09.2003CDMS Subsystem Specification, RO-LCD-SP-3101, Version 6/0, 02.09.2003 22. CDMS EEPROM Memory Map, Version 6/90, 12.01.2008CDMS EEPROM Memory Map, Version 6/90, 12.01.2008 23. ESS SW User Manual, RO-CAP-MA-8001, Version 3/D, 06.09.2002 (Software V2f4) incl. Appendix A-FESS SW User Manual, RO-CAP-MA-8001, Version 3/D, 06.09.2002 24. RO-LAN-RD-1000 Requirements of Philae landing wrt Orbiter measurements and models, 2008 (towards ESA and the Orbiter instruments)RO-LAN-RD-1000 Requirements of Philae landing wrt Orbiter measurements and models 25. RO-LAN-RD-2000 Lander Model for Descent navigation and sensitivity analysis, 2008 (to define the Lander for Mission Analysis purposes, for ESOC and SONC)RO-LAN-RD-2000 Lander Model for Descent navigation and sensitivity analysis, 2008 26. Hilchenbach, M.; Küchemann, O.; Rosenbauer, H., Impact on a comet: Rosetta Lander simulations, Planetary and Space Science, Volume 48(5),Hilchenbach, M.; Küchemann, O.; Rosenbauer, H., Impact on a comet: Rosetta Lander simulations 361-369, 2000 (Landing simulations for 67P) 27. ROS-NO-LAN-ETAN-1426-CNES; 08.04.2003, Landing Assessment on Comet CG (minutes of meeting)ROS-NO-LAN-ETAN-1426-CNES; 08.04.2003, Landing Assessment on Comet CG 28. RO-EST-MN-0706 – May 03 - Comet Approach Mtg @ ESOC (minutes of meeting, basic reference for ESOC)RO-EST-MN-0706 – May 03 - Comet Approach Mtg @ ESOC 29. RO-EST-RS-3001 Iss. 2.3 – Oct 03 - EID-A (this is the basic requirements documents ESA to Lander, signed; basic reference for ESOC)RO-EST-RS-3001 Iss. 2.3 – Oct 03 - EID-A 30. Generation and Distribution of the Lander Touch-Down Signal, RO-LAN-TN-3111-jb, Iss. 1/1, 18.06.99 (maybe outdated)Generation and Distribution of the Lander Touch-Down Signal, RO-LAN-TN-3111-jb, Iss. 1/1, 18.06.99 31. S-D-L requirements (mainly towards Orbiter, for pre-separation and separation phase), inclusive risk assessment; J. Bossler, ca. 1999, draft (maybe outdated, will be merged into new SDL Operations plan document)S-D-L requirements 32. FDIR descent iss. 0.0, 1999.doc (started by J. Bossler; superseded by TN-3112) 33. ROSETTA LANDER SDL Operation Plan Instruments Requirement Synthesis, iss. 0.0 by JF Fronton, 22.12.2008ROSETTA LANDER SDL Operation Plan Instruments Requirement Synthesis 34. Thermal Predictions for Descent and On-Comet Operations, RO-LTC-AN-3709, iss. 1, 06.06.2003Thermal Predictions for Descent and On-Comet Operations, RO-LTC-AN-3709 35. M. Hilchenbach (MPS) June/July 2003, Philae landing simulations report part I, II, IIIM. Hilchenbach (MPS) June/July 2003, Philae landing simulations report part IIIIII 36. RO-DSS-RS-1034 ESS/Lander OBCPs URD, I1D, 04.10.2002RO-DSS-RS-1034 ESS/Lander OBCPs URD, I1D, 04.10.2002 37. RO-DSS-RS-1052 Lander OBCPs URD I2, 04.12.2002RO-DSS-RS-1052 Lander OBCPs URD I2, 04.12.2002 NEW: 38. RO-LAN-TP-3347a,b(--> -3417?), iss. 1.1, 30.07.2002 (G. Abt), Rosetta Lander S_D_L-Test (a On GRM, b On FM)RO-LAN-TP-3347a,b(--> -3417?), iss. 1.1, 30.07.2002 (G. Abt), Rosetta Lander S_D_L-Test (a On GRMb On FM 39. Sdl30_Timeline.xls this is the CDMS AMST 1000 as xls-ExportSdl30_Timeline.xls this is the CDMS AMST 1000 as xls-Export 40. Rosetta Lander: FDIR Failure Detection, Isolation and Recovery Analysis of the Separations-Descent-Landing Sequence (RO-LAN-TN-3112, Iss. 1, 20.12.2000, prepared by G. Hummel)Rosetta Lander: FDIR Failure Detection, Isolation and Recovery Analysis of the Separations-Descent-Landing Sequence (RO-LAN-TN-3112, Iss. 1, 20.12.2000, prepared by G. Hummel) 41. Biele, Jens; Ulamec, Stephan; Richter, Lutz; Knollenberg, Jörg; Kührt, Ekkehard; Möhlmann, Diedrich:THE PUTATIVE MECHANICAL STRENGTH OF COMET SURFACE MATERIAL APPLIED TO LANDING ON A COMET, 58th International Astronautical Congress, 24-28 September 2007 / Hyderabad, India, IAC-07- A.3.5.03, Presentation and Paper
SDL J. biele Jan 2009 Folie 8 > Vortrag > Autor Science priorities during SDL for CDMS verification Operational requests see table Proposed in last meeting (and in minutes) a bit arbitrarily: ROMAP, ROLIS and MUPUS were built for descent measurements Priority A. SESAME, MUPUS-TM have good science rationale or vital calibration opportunity Priority B All other requests may be considered not scientifically mandatory, will not be in core SDL test scenario (but in full test scenario) Prioritisation to be confimed by SWT! Decision needed by 1.April 2009 InstrumentSub- Instrument OperationPrio rity CIVACIVA-P Civa-P Pan. Image after landing Stereo image of Orbiter ACAC CONSERT Ranging 30 m, 1 Hz C PTOLEMYMS Sniffing C COSACMS Sniffing C SESAMECASSE DIM PP Calibration, landing impact seismogramm Dust fluxes Electrical field BBBBBB ROMAPMAG slow mode Magnetic field A ROLISD DIT and DIS images A MUPUSANC TM Anchor acceleration & temp Calibration ABAB
SDL J. biele Jan 2009 Folie 9 > Vortrag > Autor Actions SDL
SDL J. biele Jan 2009 Folie 10 > Vortrag > Autor
SDL J. biele Jan 2009 Folie 11 > Vortrag > Autor Summary of Anchoring Sequence Discussion Nota bene: Anchoring brake fails if soil weaker than (compressive strength) ca. 200 kPa! Since this is possible, we face the ripping of the anchor tether. Tightening force: Decision to use level 1 (not level 0: if voltage is too low, motor may not move at all!) ~ 4 Newton instead of level 3 as foreseen up to now. Decision to use rewind counter = 240 cm (=criterion for safe anchoring). Re-tighten later (AI to investigate autonomous procedure to stop if significant tether movement starts). The re-tightening as such after firing is unavoidable since hard-coded in FPGA. 2nd harpoon: at the moment, it is parameter-dependent whether it is fired unconditionally or not. If yes, 8 sec after 1st harpoon. That parameter, 8 sec, could be changed but has a number of implications (e.g., in hard soil, a shorter time is not sufficient to retighten tether completely, i.e. ANC will not know if safe anchoring with the first harpoon has occurred or not).
SDL J. biele Jan 2009 Folie 12 > Vortrag > Autor Anchoring – cont.- We went through ANC flow diagram (from CDMS DDD V6.98) and hardware logic. It is noted that the only reason why the 2nd harpoon should be kept is the following: in very hard soil (ice), if the first harpoon penetrates only a few cm, over the course of the comets activity this layer might sublimate away and the first harpoon come loose. Then it would make sense to fire the second harpoon. Since it is now widely believed (see e.g. Biele et al., 2007) that the comet surface material is rather soft (kPa instead of MPa), this argument looses importance. Rather, firing the harpoons in quick succession would ensure that the ADS hold-down thrust (now a continuous thrust triggered by the TD signal, force ~ 17 N* exp (-t/9 sec)) will damp the rebound of the 2nd harpoon shot). Note: ADS SW needs to be patched to provide a continuous trust, triggered by TD signal. A patch test, to check patch procedure for ADS, is planned in PC10.
SDL J. biele Jan 2009 Folie 13 > Vortrag > Autor Summary of TD detection Current status of discussion on TD detection: Sensitive LG accelerometer cannot be used to detect touchdown (TD) (perturbed by FW vibrations, does not integrate properly). Not-so-sensitive LG accelerometer cannot be used to detect touchdown (not sensitive enough for soft comet soil). LG bubble current and voltage signal would work in most cases, but then has no redundancy any more and could fail as well in very soft comet soil. A signal is needed by ROLIS, to stop imaging at TBC secs after the expected TD The signal could be used by CDMS, to activate ADS and fire anchor(s) at TBC secs after the expected TD Idea: use variation of bubble position provided by LG potentiometer (LG- HK) to detect TD. This has been proven (MPS tests) to be sensitive, but might lead to false-positive signals (either by elasticity of harness or by LG being hit by a big dust grain). Therefore, use only in possible time range (-uncertainty + calculated TD … + uncertainty + calculated TD) and do not fire ANC and ADS based on LG poti TD signal alone. New TD detection proposal (flow diagram) prepared by SU, see below Issue: cover emergency release somehow! With emergency release, timing of predicted touchdown and its uncertainty, CDMS has no knowledge whether release was nominal or not Discussion, whether SESAME/CASSE could support TD detection: trigger word to CDMS is in principle possible. S/W (to be written for PC12 earliest) would be in Sesame. H.-H. Fischer to analyze for (next) SDL_WG#3, 28.4.09
SDL J. biele Jan 2009 Folie 14 > Vortrag > Autor Touchdown proposal 1
SDL J. biele Jan 2009 Folie 15 > Vortrag > Autor Touchdown proposal 2
SDL J. biele Jan 2009 Folie 16 > Vortrag > Autor Harpoon Anchoring Device Harpoon, accelerated by a cartridge driven piston into surface material and con- nected by tensioned tether to the Lander´s landing gear. mass of unit: 400g rewind velocity: 0.5 m/s anchor velocity: 60 m/s rewind force(TBC): 1...30 N max. tether tension: 200 N max. gas pressure: 250 bar Tether length: 2.5 m
SDL J. biele Jan 2009 Folie 17 > Vortrag > Autor MM discussion summary Possible scenario if one want to save the SDL data by all means after TD, for example to retransmit them to the Orbiter: 1. Copy MM-RAM to MM-EEPROM. In this time (<= 40 sec) MM usage is not possible. 2. Then establish RF link: MM-RAM content will be uplinked to Orbiter and emptied. At the same time the (new) real-time data are written into MM-RAM and transmitted at the end of the dump (FIFO). Still, all SDL data are stored in the MM-EEPROM (and can be re-transmitted as often as wished by copying into MM- RAM). (Size: each MM-RAM board and each MM-EEPROM board can store 8728 packets (~19 Mbit on Lander TM packet level). Operational constraint in this scenario: The RF link shall not be established until ‘uncertainty + calculated TD time + time for immediate post-TD operations + 40 sec to copy MM-RAM into MM-EEPROM’. This contradicts the present Philae link requirement to Orbiter. Another operational constraint might be that an item change or switch-off of MM needs to be excluded, since this triggers an “autosave” of MM to EEPROM, possibly overwriting precious data in EEPROM. Agenda-point for next meeting.
SDL J. biele Jan 2009 Folie 18 > Vortrag > Autor Mission analysis: to be analyzed – main points New models and test cases Effect of FW (nutation dynamics), rotation of Lander necessary? Dispersion analysis update with sensitivity analysis Study nominal release orbits with constraint that emergency release (0.18 m/s) still leads to a landing. Max. descent duration? No ADS during descent preferred
SDL J. biele Jan 2009 Folie 19 > Vortrag > Autor Andromac to-do-list (15.12.2008) Once Andromac is ready, first the models of 2004 shall be re-used but the density case of 1.5 g/cm^3 shall be dropped, and a lower density of 0.1 g/cm^3 shall be added for the new study (most likely density is 0.1- 0.37) An alternative heliocentric radius vector of 2.5 AU (in addition to 3 AU) shall be studied (in case the Rosetta Orbiter has indeed a problem with the fuel tanks) An optimization case shall be run without any use of ADS (except for hold-down thrust after landing). Percentage of accessible area of the comet to be calculated A flag shall be set in the output of the tool if the post-delivery orbit has a lower altitude than 1 km if possible (if not, then only in the next step, see below) Calculate a matrix of the dependence of the landing dispersion (linear and time) on the various input uncertainties to facilitate the identification of most important dispersion sources. See, e.g. chapter 6.7 in ESA/CNES: Rosetta Lander Mission Analysis Working Group Final Report, RO-ESC- RP-5003, Iss. 1, April 1999 Most important: the landing dispersion (linear and time) shall be studied as a function of the uncertainty in the first (GM) and second (C20, C22) harmonics of the gravitational field of the comet. A straightforward way seems to be the following: calculate the gravity field of, e.g., the star-fish model exactly (numerically), expand it in spherical harmonics, cut after degree and order 2, allow uncertainties in GM, C20, C22. The order of magnitude of those uncertainties has to be estimated The uncertainty of the gas drag shall be assumed to be a factor of 2 in the modulus (i.e., take nominal drag, then 1/2 of the nominal modulus, then 2 times the nominal modulus). This ad-hoc factor shall be confirmed by inspection of the scatter of observed gas production rates for CG The backup trajectory (spring eject) shall be studied (any successful landing at all??) Results available by end of 2008 After redoing the 2004 calculations with the extension listed above, new models shall be implemented in the Andromac tool. Specifically, LAM will provide the last shape deduced from the 2007 observations in June 2008 Service d'Aéronomie will provide a new outgassing model by September 2008. GRGS will provide a new gravitational potential model for end of July 2008 New updated shape /outgassing/potential models might be introduced with its parameters estimated from the latest observations (ask H. Boehnhardt) ; uncertainty of the gas drag to be assumed: factor 2 Flywheel: recalibrated MoI (PC8) and speeds to be taken into account in Lander model document (RO-LAN-RD-2000 Lander Model for Descent navigation and sensititvity analysis.doc). Highest speeds probably unsafe to use. Flywheel: which speed is necessary to stabilize Lander sufficiently during descent? I.e., calculate precession/nutation dynamics of realistic Lander with FW speed as parameter under realistic (nominal/worst case) perturbations by MSS (separation imperfections), gas drag inhomogenieties, dust grain impacts, LG and Romap and Consert Antenna unfolding, misalignment of FW and ADS axes with Lander CoG and z axis… Landing dispersion: calculate also the dispersion in descent time! (Could be a histogram) Calculate max. lateral velocity (1 sigma or similar measure) that is caused by errors (nominally, it is optimized to be zero) Foresee the possibility to calculate trajectories with an arbitray but small attack and attitude angles (angle between velocity vector, Lander z and local vertical) (reason: to increase the likelihood of safe landing, it might be advisable to land in a way to compensate for landing errors in a way safer for the LG) Calculate maximum lateral velocity (caused by errors) at touchdown New: Calculate trajectories for which vsep~18 cm/s (emergency eject), thus an emergency eject may still land (error ellipse may be as big as comet) Feasible? Max. descent duration?