European Robotic Arm

NASA. Public domain (NASA / US government work).

Overview

The European Robotic Arm is the manipulator of the Russian segment of the International Space Station, designed and built by Dutch Space in Leiden with Astrium, SABCA and Stork as principal subcontractors [1], [4]. It was originally to be launched by Space Shuttle in 2001 mounted on a Russian module; after the Columbia accident the launch was moved to a Proton, and ERA eventually flew on the Multipurpose Laboratory Module Nauka on 21 July 2021 [2].

The Russian segment needed an arm of its own because Canadarm2 and the Japanese Experiment Module Remote Manipulator System cannot reach it: base point and payload mounting interfaces differ between segments. ERA does not have to capture visiting vehicles, since Russian spacecraft dock automatically, and it supplements rather than replaces the segment’s two Strela cargo cranes [3].

ERA is a mirror-symmetric arm of two limbs and three joint clusters: a three-degree-of-freedom wrist at each end, roll, yaw and pitch, and a single pitch joint at the elbow. The two wrists are identical, so either can act as shoulder or hand, and relocation is performed by grappling a new base point with the free end effector and releasing the old one [1], [3], [4].

Specifications

Parameter	Value	Source
Total length	11.3 m	[4]
Reach	9.7 m	[4]
Mass	630 kg	[4]
Rated moveable mass	8000 kg	[4]
Maximum payload dimensions	3 by 3 by 8.1 m	[1]
Maximum tip speed	0.10 m/s	[4]
Braking distance at maximum joint speed	0.15 m	[1]
Positioning accuracy, open loop	+/-40 mm	[1]
Positioning accuracy, closed loop	+/-5 mm	[4]
Average operating power, 120 V DC	475 W	[4]
Peak operating power	800 W	[4]
Cameras	4 infrared	[3]

The fact sheet these headline figures come from gives only the top-level numbers and no qualification of open versus closed loop; treat it as a cross-check on the detailed figures in the sections below rather than an independent measurement [4].

The operator’s own public description gives the same seven joints and hand-over-hand relocation between fixed base points as the joint and relocation account above [13].

Mission profile

Parameter	Value	Source
Host	Multipurpose Laboratory Module Nauka, Russian segment of the ISS	[2], [3]
Original launch plan	Space Shuttle in 2001, mounted on a Russian module	[3]
Actual launch	Proton with Nauka from Baikonur, 21 July 2021	[2], [3], [13]
First tasks planned in orbit	airlock setup and radiator installation	[13]

Kinematics and workspace

Total length is 11.3 m and working reach 9.7 m, with seven degrees of freedom [3]. Launch mass integrated with Nauka is 630 kg. Each wrist is roll, yaw and pitch, and the elbow contributes a single pitch axis using the same basic hardware as the wrist pitch joints [1]. This gives a fully symmetric 3-1-3 arrangement rather than the distributed 7-joint chain of Canadarm2 [8], and the consequence is that the kinematics look identical from either end: whichever end effector is latched to a base point becomes the shoulder, and the arm’s model of itself simply inverts. The other seven-degree-of-freedom station manipulators built since, the Chinese Space Station Manipulator among them, keep the asymmetric arrangement instead, distributing all seven joints along a single kinematic chain with a movable base rather than mirroring them around a symmetric center [11]. Its redundant seven joints also let it plan trajectories that steer around singularities and structure, a choice unavailable to ERA’s non-redundant 3-1-3 chain, where each end pose fixes the joint angles uniquely [11]. Canadarm2 carries the comparison further still: at 1497 kg dry it is more than twice ERA’s mass for a single, un-mirrored 7-joint reach rather than a walking, mirror-symmetric one [8]. Canadarm2’s rated payload capacity is an order of magnitude beyond ERA’s 8000 kg for the same reason it is built to berth visiting cargo vehicles, a task ERA does not have to perform on the Russian segment, where spacecraft dock rather than being captured [8]. The Chinese Space Station Manipulator is built to the same redundant, distributed-control pattern, with a two-arm system and its own high-precision servo control and trajectory planning layered on top of the movable base rather than achieved through mirror symmetry [11]. Multi-constrained trajectory planning of that kind is one of the technologies its designers list as a key challenge for the class of arm, alongside the servo control loop itself [11].

The limbs are carbon fiber tube with aluminum interfaces, approximately 5 m each [1], [3]. The first bending mode contains more than 90 percent of the total inertia, so it is the mode the control system has to handle [1].

Joint design and actuation

Each joint contains a motor unit, a gearbox assembly, and a motor housing and yoke, plus an EVA access provision for manual override [1].

The motor unit, developed and qualified by ETEL, is a pancake brushless permanent-magnet synchronous machine of 120.0 mm external diameter and 29.0 mm length, massing 0.750 kg [2]:

Motor parameter	Value
Design voltage	30 V +/-10 percent
Stall torque	greater than 1.45 N m
No-load speed at 30 V	345 rpm
Torque at maximum voltage and 25 rad/s	0.60 N m
Detent torque	less than 40 mN m
Stall power at 100 C	28 W
Torque constant	0.83 N m/A
Back EMF constant	0.83 V per rad/s
Motor constant	0.316 N m per root W
Torque ripple across the full torque range	less than 0.3 percent peak to peak

Source: [2].

That torque ripple figure is a development result, not a raw motor property: an early motor ran at roughly 15 percent ripple of mean torque, and lookup-table current shaping calibrated on a test bench brought it down to the qualified figure above [2].

Position is read by a 6040 Rotasyn speed-1 resolver of 14 bit resolution and better than 32 arcmin accuracy, 65.0 mm outside and 30.0 mm inside diameter, 20.0 mm long, 0.420 kg, with a rotor inertia of 0.96e-3 kg m2 [2]. The motor is a permanent magnet synchronous machine with a two-phase redundant winding. Its electronics are tuned for ripple-free torque, which requires instantaneous rotor position, supplied by a resolver whose two secondary windings give sine and cosine of angular position [2]. A separate Joint Position Sensor measures angular rotation at the joint output axis and feeds the joint control electronics; each contains a redundant set of read stations, light emitting diodes and signal processing. Measuring at the output rather than only at the motor is what lets the control system see through the gearbox.

The brake is fail-safe and electromagnetically attracted: eight springs supply on average about 85 N of axial force pressing two friction surfaces together when unpowered, a constant coil current separates them magnetically, and the friction coating itself is Cr2O3 ceramic [2]. Disc separation is 0.2 mm nominal under coil attraction, reported by cruijssen as 0.25 to 0.30 mm [1], and a microswitch reports brake status, which has to be highly reliable at that separation.

Brake parameter	Value
Torque range	0.70 to 1.10 N m, average 0.90
Torque variation	+/-22 percent of the average
Emergency stopping time from runaway	less than 3.5 s
Operating temperature range	-55 to +85 C
Qualified duty	4380 h and more than 10,700 brake operations

Source: [2].

The brake is qualified in vacuum at LEO conditions [2], which is the case that rules out an oil-damped design: the friction pair has to work dry across a 140 C span with no atmospheric oxide replenishment.

The Cr2O3 coating is not ready to hold torque as manufactured: it needs a controlled in-vacuo running-in of at least 12,000 revolutions to roughen the surfaces and generate the third-body wear particles the friction pair actually relies on, and without enough running-in the brake sticks and slips instead of sliding smoothly, with qualification testing recording torque peaks of 1.78 N m against the 1.1 N m mechanical limit the joint is built to survive [2].

The coating also behaves nonlinearly in air, so a brake run in and measured at ambient pressure cannot be correlated one to one with its in-vacuo torque, which is why the qualification program tested the flight units in vacuum rather than inferring vacuum behavior from bench results taken in air. A related guideline covers the reverse case, how long a brake may sit at ambient pressure after vacuum exposure before it needs to be run in again, though the source that documents the guideline’s existence does not give the recovery time itself [2]. That same source also states the mass and power margins the motor and brake carried against their allocations, though relative to specification values it does not itself quote [2].

The gearbox is an epicyclic train supplied by Stork Product Engineering, quoted as 454:1 in the joint hardware paper [2] and as a four-stage 450:1 train in the mechanisms paper [1], with gears of nitrided steel in stainless steel trains, with thermal expansion matched to the gearwheel material specifically to hold backlash stable across temperature. Three design choices in it are worth stating because they follow directly from the requirement for low backlash at low mass [1]:

• Three planet wheels per stage, because a three-wheel system self-balances its internal load distribution. The last stage needed six wheels to keep Hertzian stress within limits in the available space, and those six are carried on a floating support to recover load sharing.
• A tandem configuration in which stages 1 and 2 share a ring wheel, as do stages 3 and 4 [1]. The gearwheels are too narrow to self-align individually, so pairing them through a common ring wheel lets each tandem self-center.
• A floating ring wheel, supported by a tooth coupling, with the planet carrier and sun wheel assembly on a flexible plate flexure. Between those two interfaces the gear train is not connected to the housing at all, which isolates the gears from housing deflection under load and thermal distortion.

Measured backlash including hysteresis is less than 1 mrad [1]. The roll joint runs on two angular contact bearings for radial and axial support plus a deep groove ball bearing for radial support only, lubricated with Bray oil and preloaded by Belleville springs to survive launch vibration. Bray is a perfluoropolyalkylether, the class whose vapor pressure at 150 C is around 3.5e-6 Pa, three orders of magnitude below a multiply alkylated cyclopentane [5]; at the 1e-4 to 1e-7 torr of orbital ambient [6] that margin is what keeps the film in the bearing rather than on the surrounding structure.

Bray is the older of the two liquid lubricant families evaluated for this kind of service; newer silahydrocarbon candidates are characterized against it with the same instruments, a spiral orbit tribometer for lifetime and a vacuum four-ball tribometer for wear rate, because a bearing lubricant choice for a mechanism like ERA’s roll joint has to be justified against the incumbent oil rather than on its own, and viscosity and vapor pressure both trade off against temperature range for any candidate in the comparison [5]. Traction and reciprocating wear rate are measured too, on a separate reciprocating tribometer, because a lubricant that survives a rolling contact is not automatically proven for the sliding contact a joint’s brake or a latch’s hooks present [5].

End effector

Both end effectors are identical Basic End Effectors. One is latched to a base point, providing a stiff structural connection to the Russian segment and carrying power, data and video into the arm, while the other acts as the hand.

Four mechanisms sit inside each one [1]:

Grapple mechanism. Three hook and lever systems coupled to a moving platform. The platform is driven by a brushless motor through a gear train and three synchronized roller screws whose nuts are mounted to the platform with restricted float. The hooks pull on the grapple fixture or base point until the gap closes, then rigidize and pre-tension. Three redundant switches report the platform’s upper end position, the position at which the end effector is aligned with the fixture, and the position at which the latches are closed and pre-stressed, which is also where connectors mate. Hall sensors on the motor give continuous platform position between those points [1].

The hooks are sprung outward by coil springs. If a hook meets an obstruction while grappling, spring deformation applies about 30 N to it, the torque force sensor measures the reaction, and the onboard computer repositions the end effector relative to the fixture to relieve the load [1], correcting an alignment error by sensing and reaction rather than by mechanical compliance in the capture geometry itself.

Torque force sensor. A strain-gauge unit measuring forces and moments in six degrees of freedom, temperature compensated and protected from overload by rigid end stops [1]. Every grapple on ERA is therefore force-instrumented. The two end effectors are described by the operator as identical gripper mechanisms [3], so the instrumentation is present whichever end is acting as the hand.

TFS rigidization mechanism. Because a force sensor is by construction compliant, ERA can lock it out when stiffness matters more than measurement, for example when the end effector is acting as the shoulder or when transporting a large mass. A brushless motor drives a worm gear of ratio 105, turning a cam wheel through 60 degrees [1]; three cam tracks convert that rotation into 3 mm of translation on three rods, which push solid inner cones into flexible slotted outer cones, expanding them to block the sensor. The worm gear is not backdriveable, so the blocked state holds without power.

Integrated Servicing Tool. A powered wrench in the lower end effector compartment: a redundant brushless motor, a gearbox, and a tool head with a pop-in device. The drive shaft enters a receptacle on the grapple fixture as the platform moves down, and the head rotates slowly on command until it pops in; the receptacle provides compliance if it does not seat immediately, and a sensor confirms insertion [1]. This lets ERA drive bolts on a grappled object, for example to release a stowed radiator stack, without a separate tool changeout; the operator describes the same capability from outside the mechanism as a motorized screwdriver with programmable torque and rotational speed [3].

Three floating system connectors on the moving platform carry power, video and data across the interface, mounted on floating devices to absorb lateral and angular misalignment, each reporting its own mated status [1]. This is the only path power, video and data take into the arm, carrying the operating power given above.

Base points are mechanically identical to grapple fixtures but omit the IST receptacle and instead carry the station-side halves of the three connectors [1].

Force and moment sensing

Six-axis force and moment sensing is built into both end effectors, and is used both for contact management during grappling and for monitoring loads during insertion, extraction and transport of a payload [1]. It can be rigidized out of the load path when stiffness is the binding requirement, which distinguishes it from a fixed end-effector force-moment sensor such as Canadarm2’s [8]: ERA’s sensor doubles as a grapple-contact instrument precisely because it sits inside the interface that closes on the fixture, not behind a wrist that is already rigid.

Contact sensing at the grapple interface is backed by proximity sensing over the final approach: the operator describes real-time collision avoidance that compensates for remaining misalignment between the end effector and the fixture before the hooks close [3], so the force sensor’s correction loop only has to handle whatever small error the proximity system did not already remove.

Pairing vision-based positioning with force control rather than relying on either alone is what on-orbit servicing reviews treat as the baseline sensing architecture for a manipulator expected to make and break its own mechanical connections [9], and ERA’s proximity cameras plus grapple-interface force sensor are that pairing applied to a crew-tended arm rather than a free-flying servicer. The same review literature treats redundancy in the sensing path itself, not just in the actuators, as part of that baseline once a mechanism is meant to operate for years rather than a single mission [9].

Power and energy

ERA draws from the station bus through whichever base point it is latched to. Peak power dissipation is 800 W, standby heat dissipation 420 W, and hibernation heater power 250 W [1].

Thermal

Joints carry multi-layer insulation and heaters [1], while the limb tubes themselves are wrapped in beta cloth thermal blankets rather than MLI [4]. Thermal deformation was a first-order design driver rather than a survival question: gear material and thermal expansion were matched to keep backlash stable, bearing preload was arranged so that thermal expansion loads distribute across the bearing through the lateral elasticity of the yoke fingers, and flexures were introduced through the joint specifically to absorb thermal and manufacturing deformation in a statically indeterminate support. MLI covers the manual override inlets and position indicators to prevent sun trapping, and folds back for EVA access. The cycling load behind that design is roughly 34,000 eclipse transitions per 5.8 years at LEO altitude, the rate measured on LDEF, where cycling produced microcracking in composites, delamination of some coatings, and widespread molecular contamination across specimens [6]. That is one reason a mechanism like ERA’s brake and gearbox keep their friction and gear surfaces enclosed rather than exposed to the same LEO environment the exterior structure has to tolerate. These findings were already being folded into materials design databases for Space Station Freedom while LDEF’s own data was still being analyzed, which put ERA’s designers among the first to have that record available rather than having to wait for it. The underlying LDEF data was consistent across specimens rather than a single anecdote, which is what let contemporaries treat it as a design benchmark for LEO materials [6].

System-level operating and survival temperature ranges are not stated in the retrieved sources, though thermal vacuum and thermal balance testing were performed at system level [1]. At joint level the brake is qualified from -55 to +85 C [2].

Compute and avionics

The ERA Control Computer, also called the onboard computer, is the system’s central processor, mounted at the elbow in the operator’s own description of the arm [3]. It communicates with the station over an external data bus and with each subsystem over an internal bus [1]. Joint control is distributed: each wrist contains an electronics box that drives its three motors independently with redundancy provided by two circuit boards, and the elbow has its own box. Those boxes are mounted between the limbs and form part of the structural load path, so they are built as ribbed, stiffened rectangular structures rather than as ordinary avionics housings. Distributing control this way, one box per joint cluster rather than a single central controller doing everything, is the same pattern the Chinese Space Station Manipulator’s own distributed control system follows [11].

The four cameras counted above are placed one on each end effector and one on each side of the elbow [1]. The operator distinguishes their fields of view functionally: close-up at the ends, where grapple alignment is judged, and wide-angle on the limbs, where the crew needs situational awareness of the arm’s pose rather than fine detail [3]. The closed-loop positioning accuracy given in the specifications table depends on the end-effector pair.

Camera-based pose estimation of this kind is one of the two approaches the broader space robotics literature relies on for manipulator perception, the other being laser or lidar ranging, and the choice between them is generally a matter of what a mission’s targets and lighting already require rather than one approach being universally better [12]. Either way, the handbook treats pose estimation as feeding a control loop rather than as an end in itself, the same relationship ERA’s cameras have to its closed-loop positioning figure [12].

Autonomy

ERA is described by its operator as fully programmable, able to work automatically or semi-automatically, and controllable in real time or from a preprogrammed sequence [13]. That split between real-time teleoperation and preprogrammed execution is the same one that earlier orbital manipulators such as ROTEX and ETS-VII established for ground-commanded space robotics [10]. ROTEX, the first remotely controlled space robot, was operated from inside the Space Shuttle rather than from a fixed station segment [10]; ERA moves the commanding end from a ground station to the crew, but keeps the same two modes. ETS-VII went further still, using its own arm to control its host satellite’s attitude from the ground, a capability no ISS-mounted arm needs because station attitude control runs independently of any manipulator on board [10]. The relocation maneuver is autonomous: the arm walks from base point to base point on the Russian segment without step-by-step commanding [1], [13].

The clearest documented autonomous behavior at the mechanism level is the grapple correction loop, where an obstructed hook produces a measurable reaction at the force sensor and the computer repositions the end effector to relieve it [1].

Communications

ERA has no independent radio. Power, data and video pass through the mated end effector’s three system connectors into the base point and thence to the Russian segment [1], and the control computer talks to the station over an external data bus. Commanding reaches it through the IMMI laptop inside the pressurized segment or the EMMI console outside [4], not through a dedicated ground link.

Payload and instruments

ERA carries no science instruments. Its sensing consists of the four camera and lighting units, the two six-axis force and torque sensors, and the joint position sensors and Hall sensors described above [1]. Its functional payload is the Integrated Servicing Tool, which turns the arm from a transporter into a servicer capable of driving a torque interface on a grappled object. That combination, a manipulator whose end effector can also drive a servicing interface rather than only grasp it, is one of the capabilities on-orbit servicing studies treat as a baseline requirement rather than a bonus feature [9].

Modes of operation

Two crew control stations exist [4]:

• The IVA Man-Machine Interface (IMMI), a laptop-based application inside the pressurized Russian segment, with an adjacent workstation able to display ERA camera views [1], [4].
• The EVA Man-Machine Interface (EMMI), a dedicated console of switches and LED displays built to be operated by a crew member in a pressure suit and to survive extended exposure to the space environment.

Every end-effector function also has a mechanical override available to the crew [3].

A hibernation configuration is defined in which both end effectors are mated to base points, with heaters drawing 250 W [1].

Manual override at the mechanism level is provided throughout for contingency: EVA overrides exist for the grapple mechanism, the Integrated Servicing Tool, the TFS rigidization mechanism and the joints, using dedicated EVA tools [1].

Ground operations

ERA was designed from the outset to be maintainable in orbit. Large components are defined as EVA Replaceable Units, and one ERU was launched ahead of the arm itself on STS-132 in 2010 and stored externally on MRM-1 in a protective MLI bag, so that a spare was already on orbit before the arm arrived [1]. Serviceability by replaceable units and standardized interfaces is a design requirement on-orbit servicing reviews list alongside sensing and control, not an afterthought added once a manipulator is already in service, and ERA’s pre-positioned spare is that requirement applied before the arm itself ever flew [9]. Writers surveying ground-controlled space robotics in the 1990s and 2000s expected the next operational step to be on the International Space Station specifically [10], which is the context ERA’s maintainability requirements were written into from the start, alongside a longer-term expectation that ground-controlled arms would eventually take on tasks now reserved for crew extra-vehicular activity [10]. Mechanism dimensions and accessibility were driven by EVA tool clearances, and EVA handrails and tether eyes are fitted along the arm. A cosmonaut walkaround of the qualification model was conducted as part of the Critical Design Review, with the arm posed operationally and the overrides, labels, handrails and tether eyes presented for inspection. External hardware is also exposed to a meteoroid population whose average impact speed in low Earth orbit is 19 km/s [7], which is one reason the EVA Replaceable Unit approach was adopted rather than a sealed non-serviceable design. That speed figure comes from a piecewise model built up from an isotropic flux assumption and a three-step particle density distribution, not a single measured value, and NASA’s meteoroid environment models have been through three further major revisions since it was first adopted for Space Station risk assessments [7]. The isotropic assumption behind the original model made the orientation of an exposed flat surface irrelevant to its impact rate [7], which is one reason EVA Replaceable Unit sizing and placement on ERA did not have to treat meteoroid exposure as direction-dependent.

Ground qualification faced the same problem as every large space manipulator: the arm cannot support itself in one gravity. Only planar motion in the pitch plane could be tested physically, and three-dimensional robotic operation was qualified analytically, with a multi-body dynamics model in the ERA Simulation Facility whose flexible-body parameters were validated by striking the real arm with its joints braked and measuring the response [1]. Qualification followed a mixed qualification-model and protoflight approach, with structural and thermal qualification on the engineering and qualification model and electrical qualification on the flight model, since only the flight model carried high-reliability parts. A boosted modal survey was used to qualify launch interfaces by exciting selected modes to qualification load levels, though not all levels were reachable because of non-linear behavior in the launch configuration, and static strength tests had to complete the qualification for axial components [1].

Technologies developed

The mirror-symmetric 3-1-3 architecture gives relocation with inverse kinematics that are the same problem from either end, at the cost of a smaller usable workspace for a given length [4].

A six-axis force and torque sensor integrated into the grapple interface, with a non-backdriveable worm-and-cone mechanism to lock it out of the load path, addresses the conflict between force sensing, which requires compliance, and payload transport, which requires stiffness [1].

The planetary joint with floating ring wheels in tandem pairs holds backlash including hysteresis below 1 mrad at a ratio of 450:1 in a mass-constrained package [1]. Its motor unit holds torque ripple below 0.3 percent peak to peak across the full torque range [2]. Harmonic drives are the default reduction stage in most space manipulator joints [12]; ERA’s epicyclic train is the exception, chosen where a four-stage 450:1 ratio and stable backlash mattered more than a single-stage harmonic gear’s simplicity.

Designing for EVA replacement from the start, and pre-positioning a spare unit on orbit eleven years before the arm itself launched, is an operational precedent for long-lived external robotics [1].