The Enceladus Orbilander Mission Concept: Balancing Return and Resources in the Search for Life

Enceladus’s long-lived plume of ice grains and water vapor makes accessing oceanic material readily achievable from orbit (around Saturn or Enceladus) and from the moon’s surface. In preparation for the National Academies of Sciences, Engineering and Medicine 2023–2032 Planetary Science and Astrobiology Decadal Survey, we investigated four architectures capable of collecting and analyzing plume material from orbit and/or on the surface to address the most pressing questions at Enceladus: Is the subsurface ocean inhabited? Why, or why not? Trades specific to these four architectures were studied to allow an evaluation of the science return with respect to investment. The team found that Orbilander, a mission concept that would first orbit and then land on Enceladus, represented the best balance. Orbilander was thus studied at a higher fidelity, including a more detailed science operations plan during both orbital and landed phases, landing site characterization and selection analyses, and landing procedures. The Orbilander mission concept demonstrates that scientifically compelling but resource-conscious Flagship-class missions can be executed in the next decade to search for life at Enceladus.


Introduction
Saturnʼs moon Enceladus offers the unique opportunity to conduct in situ analyses of a habitable subsurface ocean without drilling or melting through kilometers of ice. A plume of vapor and ice emanates from Enceladus's south pole (Hansen et al. 2006;Porco et al. 2006;Spahn et al. 2006;Waite et al. 2009), and evidence gathered by the Cassini mission indicates that these ejecta are ultimately sourced from Enceladus's subsurface ocean (e.g., Hsu et al. 2015;Thomas et al. 2016). Furthermore, Cassiniʼs investigations revealed that Enceladus's subsurface ocean meets the standard criteria for habitability (Des Marais et al. 2008;McKay et al. 2014;Cable et al. 2020;Hoehler et al. 2020): a liquid water reservoir, bioessential elements and compounds, and sources of energy (e.g., chemical disequilibrium, Gaidos et al. 1999), summarized in Table 1. Any successor to Cassini is therefore well poised to, and should, determine if Enceladus supports or could have supported life.
New Frontiers-class (∼$1B cost cap, competed) missions have been proposed to search for evidence of life via multiple flybys of the Enceladus plume from Saturn orbit (Cable et al. 2017;Eigenbrode et al. 2018). But a larger investment to place a spacecraft in orbit around Enceladus or on its surface would open up new science opportunities -specifically, low relative sampling velocities and significant sample collection-that have not yet been thoroughly explored. In preparation for the 2023-2032 Planetary Science and Astrobiology Decadal Survey, we investigated four Flagship-class (>$1B, directed) mission architectures that would enter into Enceladus orbit to search for evidence of life in plume samples acquired from orbit and/ or on the surface. The science and engineering aspects of each mission architecture were evaluated in a trade study (Concept Maturity Level 3, CML 3; Wessen et al. 2013) to determine which of the four architectures represented the highest science return per dollar. The result from this trade study, the Orbilander concept, in which a single spacecraft conducts science in orbit and then on the surface, was then further developed in a point-design study (CML 4), where details of the operations and mechanical design were finessed. Results of the final point-design study were captured in a report to the National Academies of Sciences, Engineering and Medicine (NASEM;MacKenzie et al. 2020). In this paper, we summarize the results of the CML 3 trade study and the CML 4 pointdesign study and provide more detailed commentary on the study methodology and selection criteria.

Architectures and Payload
The four architectures explored the trade space of orbiting and landing on Enceladus and are shown in Figure 1. The distinctions primarily lie in where sample is acquired for the life detection analyses (Figure 1, horizontal axis) and the number of architectural elements (vertical axis). Given the limited time allotted to conduct this study in advance of the Decadal Survey and our study goal of investigating smaller Flagship-class missions, we elected to focus on these four and not others, such as sample return (Tsou et al. 2012;Neveu et al. 2020), drilling through the ice crust (Dachwald et al. 2014;Konstantinidis et al. 2015), surface mobility, or employing CubeSats (Brucato et al. 2020). Conducting science in Enceladus orbit and/or on the surface enables greater sample volume collection at low relative velocities to the plume, thus enabling a robust approach to the search for life.
Mission architectures differed only slightly in their science payloads (Figure 2), which were derived from a common set of science goals and objectives, summarized in Figure Thomas et al. 2016) Chemical ingredients Essential elements (CHON) and simple and complex organics (Waite et al. 2017;Postberg et al. 2018b;Khawaja et al. 2019) Energy sources Nearly pure silica nanograins indicative of ongoing serpentinization, chemical redox couples (CO 2 and H 2 ), methane, organic matter (Postberg et al. 2011;Hsu et al. 2015;Waite et al. 2017;Glein & Waite 2020) Figure 1. The four mission architectures investigated for Enceladus in this study. The surface in situ suite, a seismometer and context imager, are not included on the Orbiter because they require contact with or close proximity to the surface. A nanopore sequencer (part of a life detection suite; Figure 2) and active sampling system are only found on architectures with a long-lived lander (Small Orbiter + Large Lander and Orbilander). Orbital elements would not accumulate sufficient samples to conduct nanopore sequencing based on current best estimates of organic abundances within the plume material. An ice particle counter ( Figure 2) was only included in large orbital elements as this is a lower priority with respect to other instruments for an astrobiology-focused mission (MacKenzie et al. 2021). All architectures are powered with RTGs and/or batteries.
Enceladus is inhabited, to what extent Enceladus's ocean is able to sustain life, and what processes drive these oceanic conditions. The objectives listed in Figure 3 were chosen to provide complementary and orthogonal approaches. For example, the search for signs-of-life objectives (1-5) target multiple characteristics of life (Neveu et al. 2018), and, for objectives 1-3, this search would be addressed by multiple instruments. The total complement of instruments considered is listed in Figure 2 and was divided into the Life-detection Suite (LDS), Remote-sensing/Reconnaissance Suite, the In Situ Suite, and the Sampling System. Detailed spacecraft descriptions are given in MacKenzie et al. (2020). Solar panels were not deemed a feasible power solution because the large area needed at Saturn's distance from the Sun would present significant challenges to flying through the plume and/or landing. Thus, all architectures are powered by batteries and/or 2-3 radioisotope thermoelectric generators (RTGs). Chemical propulsion is also common to all architectures, after the electric propulsion was determined to be an inefficient option. For the initial phase of the study, gross target values of mass, power, and volume guided the design trade (total launch mass of 6800 kg, 130 kg of payload; 400W BOL NextGen RTGs; and fitting within a standard 5 m fairing, respectively).
1. Orbiter. This architecture would orbit Enceladusevery 12 hr at orbital velocities up to ∼200 m s −1 . Operations are similar to those described for the orbital phase of Orbilander (Section 4.1), except that the priority of landing site reconnaissance (in this case, conducted for a potential follow-on landed mission rather than a subsequent mission phase) is relaxed and would be carried out at a slower cadence. Science operations in orbit would last 3 yr. At the end of mission, the Orbiter would exit Enceladus's orbit to be disposed of elsewhere in the Saturnian system so as to minimize the potential for introducing any viable microorganisms into Enceladus's ocean.
2. Orbilander. Because of the moonʼs relatively low gravity, once in Enceladus orbit, the additional ΔV required to land is negligible (17% the ΔV required for Enceladus orbit insertion). The Orbilander would leverage this by landing the entire spacecraft after conducting orbital science for 1.5 yr. On the surface, the In Situ Suite and LDS would operate for 2 yr. At the end of the mission, the Orbilander would remain on Enceladus's surface. This architecture was selected for the point-design study based on the balance of science return and cost, detailed in Section 3.
3. Small Lander and Large Orbiter (SLLO). This architecture was defined to explore the endmember of a simple lander with a highly capable orbiter. The Orbiter would carry the LDS and the remote sensing suite and would conduct science operations for 3.5 yr following the Orbiter concept of operations. The small lander would carry only the seismometer and a context camera, as that geophysical investigation cannot be accomplished from orbit. The small lander is designed to accommodate a ballistic landing on any side of the vehicle and thus requires less robust reconnaissance. Landed operations would be limited to the battery lifetime (∼15 days), ensuring that the seismometer monitors multiple tidal cycles of Enceladus's 33 hr orbital period. Although it is desirable for the small lander to also include the nanopore sequencer, the architecture was found to not be viable due to data volume limitations. The lander would remain on the surface and the Figure 2. Notional instrument types, in no particular order, meeting the science objectives of Figure 3. Other measurement approaches may exist. HRMS = highresolution mass spectrometer. SMS = separation-capable mass spectrometer. ESA = electrochemical sensor array. μCE-LIF = microcapillary electrophoresis with laser-induced fluorescence. TES = thermal emission spectrometer. NAC = narrow-angle camera. During the CML 3 trade, the WAC was considered part of the navigation instrumentation. Figure 3. Science Traceablity Matrix for the mission concept study. All four architectures investigated were derived from these science objectives. * Notional instrument types were selected for the study, but other implementations exist. HRMS: high-resolution mass spectrometer. μCE-LIF: microcapillary electrophoresis with laser-induced fluorescence. ESA: electrochemical sensor array. SMS: separation-capable mass spectrometer. TES: thermal emission spectrometer. NAC: narrowangle camera.
Orbiter would be disposed of as in the Orbiter architecture at the end of the mission.
4. Large Lander and Small Orbiter (LLSO). During the initial phase of this mission, the highly capable lander is attached to the small orbiter, thus effectively creating a highly capable orbiter. For the first 1.5 yr in orbit, the lander and orbiter elements would remain attached. Thus, during this period, the science operations for the LLSO mirror those of the Orbilander: identifying a safe landing site, surveying the plume with the LDS, and conducting context measurements with the remote sensing suite. Once a safe landing site is found, the lander would separate from the Orbiter . On the surface, the lander would operate the LDS and the in situ suite for 2 yr. The distinction from Orbilander comes from the additional relay capability offered by the orbiting element and the increased science return of the remote sensing suite it carries. Disposal of the orbital and landed elements would follow Orbiter and Orbilander architectures, respectively.
Sample requirements were derived from the volume of sample required by analog instrument types and the assumed abundance of biomass in the plume, leading to a total of 3 mL for 5 runs of all LDS measurements except the nanopore (10 mL). The latter was informed by terrestrial analogs scaled to the Enceladus system (see MacKenzie et al. 2021 for a detailed derivation). Though other considerations arrive at higher estimates (e.g., Porco et al. 2017), our study assumed biomass availability in the plume to be 10 3 cell/mL (which may be conservative if concentrating processes such as bubble scrubbing are at work; Porco et al. 2017). The potential impact of this fundamental assumption is discussed in Section 3.2.

Selection Criteria for Further Study
By design, the four mission architectures carried a similar payload, and all required the same resources to reach Enceladus orbit. Programmatic (e.g., cost, schedule) and technical (e.g., resources, risk) factors did not span the full phase space of possibility but were similar enough to facilitate a CML 3 study of the associated trades. Estimated costs for the four architectures differed by about $1B (FY25) and resource deviations arose from the need for landing and small differences in payload (e.g., sample acquisition systems). This allowed us to develop and implement a quantitative tool to select among the four mission architectures based primarily on science return on investment, with a consideration for risk associated with landing on the moonʼs surface. We defined the relative science value of the four mission architectures as a function of five factors: where lower-case letters are weighting coefficients, L is a measure of the life detection and characterization capabilities, B is the resilience to uncertainty in ocean biomass estimates, P is the ability to do physical oceanography and geophysics, C is the ability to do chemical oceanography and geochemistry, and S is the resilience to uncertain landing conditions and potential surface hazards.

Ability to Do Life Detection and Characterization (L)
The ability to perform life detection and characterization in situ depends on the number of independent measurements that could potentially yield a positive biosignature detection, i.e., the complementarity of the life detection payload. This provides redundancy and thus robustness in biosignature interpretation. We also considered the likelihood of success with the high-risk, high-reward microscope and nanopore sequencer. In addition to potentially providing unambiguous evidence of life, both systems could also reveal specific aspects of the nature of detected lifeforms (high reward). However, the likelihood of a positive result from these systems was considered lower than for the rest of the life detection payload (high risk). A sequenced polyelectrolyte, for example, offers insight into the exotic biochemistry but also has the ability to identify terrestrial contaminants by comparison to a database of known contaminant DNA sequences (i.e., organisms isolated from clean rooms as part of planetary protection protocols). A higher value for the L factor would therefore reflect a robust payload with multiple independent measurements and the ability to discriminate between indigenous Enceladus life and Earth contamination, whereas a more limited payload without this capability would have a lower value.

Resilience to Ocean Biomass Uncertainty (B)
As biomass uncertainty is perhaps the most critical unknown in designing life detection missions, resilience to biomass uncertainty appears as a multiplicative factor in Equation (1). The chemoautotrophic biosphere that Enceladus could support has been loosely constrained to 5 × 10 −6 − 5 × 10 3 cells per mL of ocean water, compared to ∼5 × 10 5 cells/mL in Earthʼs sunlit ocean (Cable et al. 2020). This wide range of uncertainty (nine orders of magnitude) reflects a compound uncertainty in Enceladus's chemical energy supply (H 2 being the limiting reactant for methanogenesis, presumably the dominant metabolism at Enceladus given the relative abundances of CH 4 , CO 2 , H 2 , and H 2 O in the plume; Waite et al. 2017), the biosynthesis yield for methanogenesis, and the energy needed for cellular maintenance (currently known only with an uncertainty of six orders of magnitude; Hoehler & Jørgensen 2013). This range is depicted in green in Figure 4. (Other metabolisms may be possible at Enceladus's ocean.) According to the sample requirements of each LDS instrument (see also MacKenzie et al. 2020), 3 mL of plume material are required to conduct all life detection analyses five times (with the exception of the nanopore sequencer, which itself would require 30 mL for three analyses). The amount of sample required is inversely proportional to the biomass density in Enceladus's ocean: 3 mL of sample was derived assuming a biomass density of 10 3 cells/mL, highlighted in pink in Figure 4. This is at the upper end of the expected biomass range in the ocean (excluding any processes that would enrich biomass in the plume by as much as several orders of magnitude, like the bubble scrubbing described in Porco et al. 2017).
The Orbiter architecture can cumulatively capture a few mL over its 3 yr mission, achieving the ability to detect signs of a 10 3 cells/mL biosphere. A lander (Orbilander and LLSO) can both passively catch plume fallback and actively acquire (e.g., excavate) sample from the surface. With either or both sampling mechanisms, a lander could collect 2-3 orders of magnitude more plume material than the Orbiter in a nominal 3 yr mission, enabling detection of biosignatures from a 10 and a 1 cells/mL biosphere (assuming the capability to concentrate sample and that the cell abundance in the sample is representative of the abundance in the ocean). If we include the nanopore measurement, the dashed Lander lines of Figure 4 move to the right: the detection ability would be limited to 100 and 10 cells/mL because of a 10x increase in required sample. For comparison, we also show the expected ocean cell abundance on Europa (10 2 cells/mL; Hand et al. 2017) and the sample amount (of order 30 μL) that can be collected in 10 to 20 Enceladus flybys by Saturn orbiters, which may be achievable with a New Frontiers mission (Cable et al. 2017;Porco et al. 2017;Eigenbrode et al. 2018).
We emphasize that the relationship between the volume of sample needed (black scale) and lowest detectable biomass density in cells/mL (green scale) hinges on the ensemble of life detection and characterization measurements, and particularly on the individual sample requirements for each measurement. In this case, the amino acid chirality measurement with SMS requires the greatest sample volume (400 μL per analysis) and is thus the primary driver of the 3 mL requirement. If it were decided that amino acid chirality with SMS was not necessary (noting the amino acid chirality would also be measured by μCE+LIF on a smaller sample volume), less plume material would be needed to detect a given biomass density. In this case, the bottom black scale, to which the mission architectures are attached, would shift toward the left. Alternatively, if it were decided that a nanopore measurement was necessary to convincingly detect life, the black scale and attached architectures would shift toward the right.
The above limits of biomass density detection also assume that sample collection, not sample processing, sets the maximum volume of sample that can be analyzed. However, the ability to process sample (e.g., concentrate, buffer, and desalinate) likely becomes limiting for volumes of liters or more (red gradient box in Figure 4).
Optimistically, assuming that the understanding of Enceladus's geology and geochemistry (based on Cassini data and on geochemical and geophysical data collected by a Flagship architecture) collapses the current five-order-of-magnitude uncertainty on chemical energy supply flux (Cable et al. 2020) into a single value, the plausible biomass range may be reduced from more than 10 orders of magnitude to perhaps the 6 orders of magnitude spanned by the current uncertainty in cell-maintenance energy (Hoehler & Jørgensen 2013; horizontal blue lines, placed arbitrarily). Comparing the relative values of the limits of detection (dashed vertical bars in Figure 4) and post-mission, plausible biomass range estimates allows one to tentatively quantify the probability of mission outcomes as a function of how habitable and inhabited Enceladus may be. These are narrated as purple text in Figure 4, under the If we assume that the density of biomass in the ocean is primarily limited by the energy available in the system, then there is a range of possible values (green) based on our current knowledge of Enceladus's energy supply from Cassini data and our current knowledge of cell energy demand based on studies of analogous terrestrial environments. The amount of sample needed to conduct a life detection mission (black) depends on both the science payload and sampling processing technologies. How much sample an Enceladus mission can acquire and analyze depends on where the plume is sampled: larger volumes are available at the surface than from orbit. Extremely large volumes are probably not analyzable for any mission given typical mission timelines (red). Geochemical analyses of the plume material can collapse the uncertainty on how much biomass can be supported by the Enceladus environment (blue), thus enabling a more informative interpretation of the life detection result (purple). assumption of equal probabilities of a biomass density in each order-of-magnitude bin. They quantify the scientific value of being able to sample more material.
Thus, low values of B indicate that the mission architecture returns a lower information value if our assumptions about the biomass available in the plume are overestimates: introducing the ambiguity that a null life detection may be a function of sample acquired. Higher values of B indicate that even if the plume biomass concentration is lower, sufficiency of sample is better disambiguated from the life detection results. (Of course, if our biomass availability assumptions are underestimates, then the ambiguity to the relative amount of sample decreases.)

Ability to Do Physical Oceanography/Geophysics (P) and
Chemical Oceanography/Geochemistry (C) We evaluated the ability to physically characterize Enceladus's surface, near subsurface, and deep subsurface as part of quantifying Enceladus's habitability and changes to ocean material upon ascent and ejection into the plume. In Figure 5 we map investigations by instrument type to the environments they interrogate and show which architectures carry those instruments. Architectures that are capable of interrogating the crust from both the surface and orbit (e.g., with a seismometer and radar sounder), for example, score higher P values than architectures with one method of interrogation; higher P values are also given for longer-duration monitoring (e.g., more radar sounder flybys or more days of seismometer operation).
As all architectures carry the same chemical analyzers, our evaluation of chemical characterization hinges on the type of plume material investigated. We divided the plume into four unique compositional regimes, distinguished by the physics of ejection. The mixed plume (high altitude) contains a higher concentration of vapor samples and nm-sized particles. At lower altitudes, the collimated plume contains micron-sized particles. All four architectures access these two regimes. The largest particles, which fall back at lower altitudes than is safe for the spacecraft to orbit, are accessible only by landers. Larger particle sizes are anticipated to contain higher organic content based on Cassiniʼs characterizations of ice grains (Postberg et al. 2018a(Postberg et al. , 2018b, thus sampling populations of increasingly large grains both provides insight into the limits of detectability and increases the likelihood of biosignature detection. At the surface, active sampling accesses surface deposits while passive sampling accesses fresh fallout. Comparison between these two kinds of materials can reveal postemplacement modification processes and whether they might be important for habitability. Figure 6 summarizes which architectures access each population of plume material. Therefore, an architecture with orbital and surface sampling have higher values of C, whereas an architecture sampling only the diffuse plume from orbit would have lower values of C.

Resilience to Surface Safety Uncertainty (S)
Recognizing the difficulty inherent in de-orbit, descent, and landing (Lorenz 2019), we included a factor for resiliency of  the architectures to unknown conditions on the moonʼs surface, such as the porosity, degree of consolidation, or thermal properties of surface materials. In the evaluation, the largest landers are the least resilient (lowest value of S) relative to orbiting architectures that do not require landing (highest value of S). In the CML 4 study, we identified specific means to ensure a resilient Orbilander, including landing site selection criteria (Section 4.1.2) and descent maneuvers (Section 4.2).

Evaluation Results
Each term of the Science Value score was evaluated independently by the science team. Each scientist scored how well each architecture addressed the five components of science value on a scale chosen based on preliminary ranking exercises of 1 (not well) to 10 (very well). In Figure 7 we show the responses of the core team (involved in more day-to-day decisions; N = 12) and the team of collaborators (N = 23) for each architecture. Rationales were also solicited for each component score from the collaborators; inspection of these responses did not reveal any miscommunications of the material that would invalidate the evaluations.
Science value is subjective, but the distribution of responses shows some degree of consensus. The results are largely similar between the two groups, often with greater spread in the collaborator responses. Notably, the core team responses for the life detection capability are more narrowly distributed than other categories. This seems appropriate given the emphasis placed on constructing a robust life detection suite of measurements and corresponding payload.
As an independent, dispassionate means of evaluation, we also applied the quantitative (Bayesian) risk-payoff framework of Lorenz (2019) to the four architectures. In this framework, the payoff is evaluated by assuming that the science value V of the result for a binary question (here, "Is there life on Enceladus?") is proportional to the logarithm of the posterior likelihood ratio of the answers. The four possible outcomes are that Enceladus (1) has or (2) does not have life and that the LDS reports a (3) positive or (4) negative result, i.e., true/false positives/negatives. As shown by Lorenz (2019), V can be expressed solely in terms of the falsepositive rate Φ of the life detection suite and of the likelihood P D that biosignatures are present in the sampled material: The factor of 10 results in values of order ∼1-10 (deciban units), facilitating relative comparisons. Like Lorenz (2019), we set Φ to either 5% or 20%. If the LDS includes a nanopore sequencer, we assume Φ = 0.5%. We set P D to the fraction of the green bar in Figure 4 (i.e., the estimated range of possible biomass densities in the ocean and plume) detectable by each architecture, assuming a uniform probability distribution of possible log(biomass densities):  Figure 4, log(detectable biomass density) in cells/ mL is 3 for orbiters, 1 for passive sampling landers (2 with nanopore sequencing due to the need for about ten times as much sample), and 0 for active sampling (1 with nanopore sequencing). Cable et al. (2020) suggest log (maximum estimated biomass density) ∼3.7 and log (minimum estimated biomass density) ∼−5.3, also in cells/mL.

Based on
Risk is then accounted for by multiplying V with success probabilities of required steps (launch, orbital navigation, landing, sampling), derived from historical data, to obtain the final expectation payoff metric of comparison: The likelihood of successful launch P p , thus set to 0.96 (Lorenz 2019), is common to all four architectures. Other aspects differ among architectures. For the orbiters and the orbital phases of the landers, we arbitrarily set P L = P(flyby success) number of flybys = 0.95 as the probability of successful navigation of unstable orbits. For the landers, historical data yield a likelihood of successful landing P L = 0.66 (Lorenz 2019). Historical data also suggest that the probability of in situ analysis success (sample acquisition and payload working as intended) is P A = 0.67. We bookkeep separately the added value of nanopore sequencing, given its low maturity, with P A = 0.2.
Results of this analysis, shown in Figure 8, quantify the added value (factoring in risk) of landing, active sampling, and nanopore sequencing. Landers score E(V ) = 3 to 7 and orbiters score E(V ) = 1 to 2. These estimates quantify the ability to do life detection and the resiliency to biomass and operational uncertainties. They favor landed architectures more than the more holistic (inclusive of non-LDS science) yet subjective estimates of the science team.
In Figure 9, we show the science value as determined by the science team for the four CML 3 architectures relative to their cost estimate. Based on the above evaluations, all four architectures have high science value, but the Orbilander represents the best balance ("knee in the curve") of science  (2019). a Assumes nanopore is a separate mission element to allow consideration of a separate P A = 0.2 in calculating E(V ) (see text). b Assumes use of the nanopore sequencer decreases the overall LDS false-alarm rate to Φ = 0.5% and that the overall LDS P A is 0.2. c Sum of the orbital phase and either [landed phase excluding nanopore + nanopore only] or [landed phase including nanopore]. return on investment (i.e., highest science value divided by CML 3 cost). The greater capability of the Large Lander + Small Orbiter provides higher science value, but this gain comes at a higher cost. These findings are not sensitive to the choice of coefficients in the science value equation (l, p, c, g, s). The core team thus opted to choose the Orbilander for development to CML 4.
We note that the dispersion ("error bars") in the science values in Figure 9 is large enough such that all four architectures overlap in science value to within their dispersion. This may hold true for the cost, but the uncertainties of the CML 3 cost estimates were not determined. Inspection of Figure 7 indicates that this is also true for all five parameters of the science value equation, for both the core team and collaborators. Thus there are consistent trends in the science values of the four architectures but also significant dispersion. This indicates that all four architectures are scientifically valuable and suggests that further concept maturity of additional architectures is warranted before any final decisions of which architecture should be implemented.

Orbilander Point-design Concept of Operations
In this section, we provide an overview of the concept of operations (conops) for the Orbilander architecture which was developed during the CML 4 point-design study (see MacKenzie et al. 2020). We note that many of the details presented are largely applicable to the other three architectures described above.
The mission design begins with a launch window 2038 October-November (with a backup opportunity at the end of 2039), late into the decade to arrive at Enceladus when latitudes that receive sufficient plume fallout (south of 60°) receive sunlight. The launch and interplanetary cruise described in the report to NASEM (MacKenzie et al. 2020) uses an SLS Block 2 with a CASTOR 30B upper stage for a direct trajectory to the outer solar system, a 7 yr cruise. Other launch windows and trajectories with less capable launch vehicles are possible and could be further pursued with spacecraft modifications. For example, using a Venus-Earth-Earth trajectory would yield a 9 yr cruise but could be accomplished by a Falcon Heavy expendable launch vehicle. Longer cruise times equate to smaller RTG output at Enceladus but provide the benefit of more southern latitudes available for landing as increasingly southern latitudes, where plume material is most abundant, are reached by sunlight in the late 2040 s.
In the nominal mission design, Saturn orbit insertion takes place in 2045 September. For the next 4.5 yr, a sequence of Saturn moon encounters reduces the spacecraft orbital energy to enable capture into Enceladus orbit at a minimal ΔV (and thus minimal propulsive resources) , ∼100 m s −1 . In addition to updating moon ephemerides, these encounters with Titan, Rhea, Dione, and Tethys could be exploited to exercise the remote sensing and reconnaissance instruments. For example, the long tour duration could be leveraged to send back raw radar sounder data (harder to accommodate in Enceladus orbit due to the density of activities). In between moon encounters, checkouts of the LDS could be performed. During the Enceladus flybys, high-phase imaging of the plume with the NAC could provide the imagery necessary to update models of plume structure and particle density (Porco et al. 2017) and of vent activity and plume fallout (Southworth et al. 2019). Detailed implementation of these operations was not conducted as part of this study.

Enceladus Orbit Phase
Orbilander would orbit Enceladus in a halo orbit (Haapala et al. 2015) with period and libration point families chosen to maximize ground-track diversity over areas with known highplume fallout. The orbital period of 12 hr is amenable to the station-keeping maneuvers necessary to maintain the otherwise unstable orbit. Plume flythroughs occur during closest approach (periapsis 20-75 km), at which point the reconnaissance and remote sensing instruments would operate while the passive collector accumulates sample. Outside of closest approach, the spacecraft would conduct station-keeping maneuvers to maintain the unstable orbit. About 8 hr of the orbit are reserved for communications with Earth, including 6 hr of data downlink. At 40 kbps and accounting for housekeeping data by subtracting 15%, 734 Mb of science data can be returned in a 6 hr pass. Some LDS analyses require up to 10 hr for warm-up, sample preparation, and analysis and thus operate outside of the above timeline. Orbits dedicated to onboard life detection analyses are infrequent and thus easily accommodated during the 1.5 yr orbital science phase. (Note that sample is acquired in all orbits but only analyzed infrequently as sufficient volumes accumulate.) To ensure sufficient time for data collection and return, we map out the first 200 days of the orbital phase, summarized in Figure 10.

Life Detection Science
In orbit, the timeline of LDS analyses is driven by the rate of sample accumulation (assumed to be 1.6 μL/orbit; Guzman et al. 2019) and is divided into three modes of operating the LDS and three associated sampling campaigns (A, B, and C), shown in Table 2 and Figure 10. Campaign A comprises 20 orbits, during which the sample capture system collects enough plume material to analyze ice particles for amino acid content with the μCE-LIF, measure pH, salinity, redox potential, macro-and micronutrients, and potential energy sources with the ESA, and search for cells with the microscope (LDS A). Campaign B comprises 111 orbits and accumulates enough sample to analyze ice particles for LDS B: lipids with the SMS, repeat geochemical measurements with the ESA, and search for cells with the microscopes. Campaign C accumulates enough sample to analyze ice particles for amino acid content with both the SMS and μCE-LIF in LDS C over a total of 260 orbits. Together, LDS A-C are equivalent to running LDS Contingency surface mode ( Table 2), except that the material collected represents a different population of plume material ( Figure 6); comparing results between these modes-as well as the vapor samples analyzed via the gas inlet with the HRMSprovides a powerful characterization of the plume. MacKenzie et al. (2020) details how the different life detection measurements are organized into an interpretative framework to determine if plume materials contain evidence of life.

Landing Site Criteria
To land safely at a scientifically compelling site, we defined six landing site criteria.
1. Must receive sunlight. Scouting with the NAC and WAC requires surface illumination by the Sun, and landed direct-to-Earth communications require that Earth (6°from the Sun at 9.5 au) be over the horizon for at least a few hours per Enceladus day. For Enceladus orbital insertion in 2051, the Enceladus season restricts landing site locations to north of 65°S latitude. As the Orbilander orbital phase unfolds, more southern latitudes and topographic highs become sufficiently illuminated and thus provide additional scouting opportunities should no suitable landing site be identified equatorward of 65°S.
2. Low but nonzero boulder count. Where the surface of Enceladus has meters of porous plume fallout ("snow") or a thin coating of fresh fallout is not known, thus the strength of the surface is difficult to anticipate from Cassini data alone. To constrain the terrain encountered by a landed element, we restrict landing sites to those with sparse meter-sized ice boulders. The presence of meter-sized boulders indicates that the surface is strong enough to support the lander and the snowpack not so insulating as to facilitate penetration of RTGs into the crust if the landing is off-nominal . Boulders are counted in NAC images and laser altimetry data. The high solar incidence angles will result in long shadows that may facilitate boulder counting in the optical images.
3. Slopes <10°. The landed element design is robust against tipping or sliding on slopes less than 10°. Slopes can be measured both by laser altimetry and stereo imaging with the WAC and NAC.
4. Not in a local valley. It is important that the landerʼs line of sight to the Earth not be blocked by surrounding high topography. Topographic lows can be identified both by laser altimetry and stereo imaging with the WAC and NAC. The high solar incidence angles will result in long shadows that may facilitate identification of valleys (and other topography) in the optical images. 5. Temperatures <85 K. This is required to mitigate planetary protection concerns. Off-nominal landings in areas with surface temperatures <85 K have negligible likelihoods of melting through the ice crust down to the subsurface ocean due to the heat of the RTGs, even in the most efficient melting geometries . To identify warmer keep-out areas for planetary protection, surface temperatures are measured with the TES at higher resolution than available from Cassini.
6. Fallout rate > 0.01 mm yr − 1 . A 1 m 2 passive collector area should be able to collect enough sample for 2 full runs of the LDS during the landed phase (2 Earth yr, see Section 4.3), if fallout rates are >0.01 mm yr −1 ( Table 3). Below this rate, insufficient sample would be passively collected for nanopore sequencing. Thus, active sampling serves as a contingency for ensuring enough sample is collected on the surface for the nanopore, in addition to enabling access to a new sample reservoir ( Figure 6). Plume fallout-rate maps akin to those built from modeling plume particle trajectories based on the location, orientation, and density of plume sources determined from Cassini images of the plume (e.g., Southworth et al. 2019) would be updated with Orbilander WAC and NAC images. Note. Passive sample collection drives the cadence of analyses in both orbital and surface phases of the mission. In orbit, it takes longer to build up enough plume material, so intermittently conducting a subset of the LDS measurements ensures science return at a reasonable pace. The sample required for each instrument is derived from analogies with terrestrial ocean abundances and described in detail in MacKenzie et al. (2020).
Cassini data support the existence of landing sites that meet the above criteria, as shown in Figure 11. Plume fallout peaks at ∼1 mm yr −1 (darkest purple of Figure 11(a)), but the cadence of science operations is robust to plume fallout 2 orders of magnitude lower ( Table 3). In Figure 11(b), we represent latitudes that experience daylight in 2050 in yellow, with blue shading indicating that latitudes farther south become illuminated in time (sunrise at the pole is in 2055). Cassini measurements show that surface temperatures decrease rapidly away from the tiger stripes (Howett et al. 2011). Martens et al. (2015 mapped the occurrence of ice blocks in the area surrounded by dashed white lines in Figure 11. Cassini data do not allow mapping the entire south pole in this manner, but the analysis of Martens et al. (2015) suggests that there exist areas where 10 m class boulders are scarce but not absent, i.e., useful for determining the surface "fluffiness" (Landry et al. 2014). With the higher resolution data accumulated by the Remote Sensing Suite, Orbilander would refine the map of Figure 11 and better define desirable or keep-out areas.

Landing Site Characterization and Remote Sensing
Cassini data are sufficient to demonstrate that suitable landing sites can be anticipated, discussed above. However, the data are insufficient for either (1) selecting a landing site that meets the criteria we derived for a safe and scientifically valuable landing site or (2) use in guiding the spacecraft during descent with terrain relative navigation.
Thus, during Orbital Campaign A (while accumulating sample for LDS A), data collection with the wide-angle camera (WAC; either of two navigation cameras co-boresighted with the NAC), laser altimeter, and TES for landing site reconnaissance is prioritized ("Recon Orbits"). Operating these three instruments fits within the power and data profiles, with ample margin. During this stage, WAC observations are prioritized over NAC to survey a broader area from which targets for focused NAC imaging are selected. Within the first 15 days of the orbital phase, at least 264 WAC images (equivalent to more than twice the areal coverage of the area within 30°of the south pole), and 22 laser altimeter and TES passes are acquired and returned.
Data collected during the Recon Orbits are the foundation to begin the search for and characterization of potential landing sites. Candidate landing sites are selected by the mission team for high spatial resolution mapping during Campaigns B and C with the NAC, laser altimeter, and TES. Although the lander footprint is only a few square meters, candidate landing sites are defined as 5 km 2 areas to assess the potential landing region wherein a landing ellipse would be targeted. Each candidate landing site is characterized in terms of surface roughness, boulder counts, and local slopes and topography (Section 4.1.3). This requires high-resolution imaging multiple times (assuming 30%-50% overlap) under various lighting conditions for an equivalent of 300 NAC images per landing site (field of view of 1% of a landing site at 40 km altitude). At the end of Campaign C, enough NAC images are accumulated (at a cadence of 1 Hz during closest approach) and returned to characterize 42 candidate landing sites.
The radar sounder produces by far the largest amount of data (much more than can be returned within a single 6 hr communication window; Figure 14) and thus operates only during dedicated orbits. For 200 s during closest approach, at Orbilanderʼs maximum orbital velocity (∼200 m s −1 ), the radar sounder interrogates a 40 km swath across the surface along track (cross-track extent depends on the orbital altitude: at 40 km altitude, the swath is ∼2 km wide for the notional radar instrument). With vents located about every 5 km along the tiger stripes (Helfenstein & Porco 2015), each 40 km swath has a >99% chance of covering a vent. If only one vent were encountered (i.e., less favorable flyover paths) every 40 km, the probability would decrease to 64%.
Analysis by the HRMS on the vapor collected via the gas inlet can also be run during Recon Orbits but brings the total power consumption during science operations to just under the 100 W maximum allocation. Should power prove a concern, HRMS measurements can be run on separate orbits during any campaign, especially during the relaxed cadence of Campaigns B and C. After 200 days, the minimum orbital science objectives have been met, the rest of the ∼1.5 yr long orbital phase is schedule margin (∼60%). The orbital phase of the Orbilander mission is therefore robust to a low number of suitable landing sites and to lower-than-anticipated abundances of targeted species in the plume. After an appropriate landing site has been selected, secondary mission objectives can be executed (e.g., gravity science and reflectometry with the radar sounder) but were not further detailed as part of this study.

Landing
Upon selection of a landing site, Orbilander descends to the surface using terrain relative navigation to target the landing site and ensure hazard avoidance, similar to the strategies developed for DART, OSIRIS-REx touchdown, and Dragonfly (Adams et al. 2019;Witte et al. 2019). In addition to avoiding hazards such as slopes and boulders, it is important to consider any contamination effect of hydrazine deposited on the surface during the main engine burn during descent because nitrogenbearing compounds are targeted by science measurements (Lorenz 2016). The Orbilander passive sampler (funnel) has a cover that opens at Enceladus insertion to sample particles in Note. Range of fallout rates from Southworth et al. (2019). We assumed 0.1 mm/Earth year for this study. Active sampling increases robustness to lower fallout rates.
orbit, closes in preparation for landing to prevent contamination, and opens again once landed. Thus, exhaust contamination would only affect active sampling. We calculate the ammonia deposited by a hydrazine burn as a function of cutoff distance using the mass fluence  due to gravity on Earth, and I sp is the specific impulse (here, 220 s). The ammonia deposition rate is then the mass fluence scaled by the fraction of ammonia in the exhaust gas and the fraction that sticks to the ground. Enceladus's <85 K surface at targeted locations results in more efficient cryotrapping than at the warmer surfaces of Europa and Mars, for which Lorenz (2016) estimated a 10% sticking fraction; this value is thus an underestimate for Enceladus. We therefore consider two endmember cases of 10% and 100% sticking efficiencies. (Clearly, laboratory and/or modeling investigations into rates at which ice regoliths retain ammonia as a function of temperature and porosity are needed). We also assume a penetration depth of 10 cm. With these assumptions, the calculated ammonia deposited into the surface of Enceladus for the Orbilander (green) is compared to the amount of NH 3 observed in the plume by Cassini in Figure 12 (that is, assuming that the ratio of NH 3 /H 2 O in the plume vapor measured by Cassini is the same as in the ice particles that would fall back onto the surface for Orbilander to sample). The molar percent of ammonia in the plume vapor is between 0.4 and 1.3 (Waite et al. 2017); taking the lower value, the naturally occurring ammonia is almost 4000 ppm (gray line). Even for high sticking efficiencies (dashed lines), the amount of ammonia emplaced is several orders of magnitudes lower than the natural abundance. (This analysis has been updated since the MacKenzie et al. 2020 report.) Descent is controlled by main engine burn from an initial altitude of about 80 km where the spacecraft's orbital velocity is ∼230 m s −1 . At about 5 km altitude, this first main engine burn ends and the spacecraft rolls to descent attitude where the main engine exhaust points toward the ground: accommodations in mechanical design mean that while the main engine points nadir, the landing legs point perpendicular to the surface. Aligning the bipropellant main engine in this manner greatly reduces the landed height, reducing structural mass, increasing margin to protect against tip-over, and allowing for better reach with the active sampling mechanism. Additionally, it provides more stability during any deep-space maneuvers and de-orbit burns, as the direction of main engine thrust is always maintained through the center of gravity regardless of propellant levels.
By firing the main engine for 5 s at 10 m above the surface while firing the monopropellant thrusters, the spacecraft pitches over and is gently propelled up to 20 m above the surface, adding a late turn to an otherwise typical soft landing (e.g., Surveyor, Apollo, and ALHAT; Beall et al. 1966;Bennett 1970;Amzajerdian et al. 2017). The resulting horizontal translation is about 25 m downtrack, well within the scouted safe area but well away from the exhaust-affected radius: given Enceladus's gravity, a thrust of 176 N, the exhaust-affected radius would be ∼4 m according to the empirical model derived by Lorenz (2016). This trajectory is well defined by the upward vertical velocity at a defined height, requiring thruster firings only to control the rotational attitude, not the vertical motion. The spacecraft then executes a final rotation with the monopropellant thrusters such that the legs are in the downward orientation before all rotational and translational motion is then arrested by the monoprop thrusters. Final vertical velocity is reduced to <2 m s −1 and final horizontal velocity is reduced to <0.5 m s −1 , with a vertical-to-horizontal ratio sufficient to ensure a successful landing.
Thus, even if thruster contamination became a concern, this maneuver to reorient the spacecraft once a suitably low terminal velocity was reached very near the ground would move the spacecraft well beyond the thruster-affected area.

Landed Operations
On the surface, the availability of higher sample mass means that all LDS instruments can be run concurrently. The first LDS is run in "contingency" mode (all instruments except the nanopore sequencer, which requires an order of magnitude more sample than the other instruments combined; Table 2) as soon as enough sample is collected via the passive collector. The full complement of LDS instruments ("LDS Full"; Table 2) is subsequently run at about a monthly cadence, alternating between samples collected passively and actively for a total of three full mode runs on passively collected sample, three full mode runs on actively collected sample, and one contingency mode on passively collected sample. This timeline provides ample time for data downlink as well as characterization and ground-in-the-loop decision of where to actively collect within the first 176 Earth days, leaving 76% of the landed phase as margin against, for example, uncertainties in biomass.
The context imagerʼs fields of view covers the area accessible to the scoop with overlap for stereo. Illuminating the surface with full-spectrum LEDs allows night imaging. Images are taken to identify active sampling sites and to characterize and monitor sampling. The seismometer is a shortperiod seismic probe notionally placed on the surface by the active sampler arm during checkout post-landing. Placement on the surface, rather than on the spacecraft, should enable higher performance between 0.1 and 1 Hz and significantly higher at Figure 12. NH 3 deposition for architectures carrying the LDS to the surface for Orbilander (green) and Large Lander of LLSO (blue) compared to the NH 3 content of the plume as a function of the fraction of exhaust ammonia that sticks to the surface (10%, solid; 100%, dashed). Differences between Orbilander and the Large Lander arise from factor of ∼3 thrust required to slow down the heftier Orbilander (1600 kg dry mass) than the Large Lander (500 kg), which leaves the remote sensing elements in orbit. In all cases, the fraction of ammonia from the thruster exhaust that sticks is well below the naturally occurring NH 3 . (This analysis has been updated since the MacKenzie et al. 2020 report.) frequencies >1 Hz where the spacecraft serves as a noise source (Panning & Kedar 2019). However, a body-mounted instrument should be capable of operating with a factor of a few of the instrumentʼs noise floor during mechanically quiescent periods. Thus, nondeployed options with acceptable sensitivity are also feasible.
The above surface LDS and other in situ measurements produce 24 Gb of data. At 65°S, we assume 6 hr of usable direct-to-Earth communication time and use only 5 hr for science return. As above, the downlink rate is 34 kbps, allowing all data from the nominal surface mission to be returned within 41 passes (Figure 14), where one pass occurs each Enceladus day (Esol = 1.33 Earth days). The cadence of science operations is such that there are many Esols in between activities that can be used to simply return data. Since the context camera is equipped with LEDs, all science can be done during the Enceladus night.

Conclusions
In this paper we describe the motivation and choices behind the Enceladus Orbilander mission concept. After careful consideration of a suite of four flagship architectures, the Orbilander architecture was selected for further maturation, the details of which have been submitted as the final report for the NASA-funded PMCS study (MacKenzie et al. 2020). It and 10 other PMCS studies are inputs to the National Academies 2023-2032 Decadal Survey of Planetary Science and Astrobiology. 16 Enceladus's plume offers unparalleled access to an extraterrestrial ocean that meets a preponderance of criteria for habitability. Orbilander is designed to detect life from orbit at levels ∼500× scarcer than in Earthʼs oceans, and from the surface at levels ∼500,000× scarcer than in Earthʼs oceans. Life at these detection levels can be sustained by Enceladus's supply of energy and CHON determined from Cassini data. However, by tapping this reservoir both from orbit and the surface and by including ample schedule margin for additional sample collection, Orbilanderʼs life detection investigation is robust to orders-of-magnitude uncertainty in the biomass available in the plume. With the minimum science data returned from the first 200 days in orbit and the first 176 days on the surface, Orbilander is designed with 2.7× schedule margin in orbit and 4.1× on the surface. Figure 13. Orbilander's descent follows a typical soft-landing profile with an additional rotation to reorient the spacecraft such that the landing legs point nadir, effectively translating away from exhaust-affected areas.
Proven technologies above or approaching technology readiness level (TRL) 6 make up the majority of the Orbilander concept payload. The nanopore sequencer requires the most development, which we strongly encourage due to the powerful data set provided by such an instrument. However, we do not recommend its use on an Enceladus mission should development be slower than anticipated. A compelling search-for-life mission is possible with technology currently at or above TRL 4, especially if an orthogonal "confirmation" technique is included (such as the search for cells with a microscope). Furthermore, we encourage continued support for the development of other biosignature technologies, such as measuring molecule-specific isotopic abundance (e.g., Glavin et al. 2020), as well as the technologies necessary to minimize and characterize contamination. Sample collection, processing, and transfer are key steps to any life detection mission and thus should also receive continued development.
Notably, the architectures presented here are not the only conceivable life detection missions possible at Enceladus. However, they represent a robust approach that can be implemented with currently available technology or a modest program of technology maturation and Flagship-class resources. With continued funding for instrument development and maturation, an unparalleled opportunity provided by Enceladus's plume to search for life in an alien ocean is open to humanity. The ocean of Enceladus beckons: Orbilander represents a scientifically exciting and technically feasible response.
We thank the APL Concurrent Engineering (ACE) Team for lending their expertise to this mission concept study: Helmut Seifert, Ryan Hacala, Grace Colonell, Amanda Haapala Chalk, Seth Kijewski, Stewart Bushman, Rob Coker, Erich Schulze, Spencer Brock, Matt Shannon, Dan Gallagher, Jeff Boye, John Qirzburger, Michelle Chen, Tom Criss, Steve Jenkins, Ryan Figure 14. Estimated data per measurement for each instrument and the number of measurements anticipated during the nominal orbital and surface operations. To estimate the data-return capacity, we multiplied the number of 6 hr downlinks at 34 kbps (decrementing the full 40 kbps by 15% to account for housekeeping) during the orbital campaign (twice per Earth day) and the number of 5 hr downlinks at 34 kbps for the surface campaign (once per Enceladus day, 1.33 Earth days).