Design and Realization of Recovery System of Chang’e-5 Reentry Spacecraft

On December 17, 2020, the Chang’e-5 reentry spacecraft landed safely and brought back the lunar sample without damage. This paper describes the recovery system that has critically contributed to the scientific success of the Chang’e-5 missions and presents the technical requirements and constraints of the recovery system for the Chang’e-5 reentry spacecraft and discusses the design process of the recovery system, including the system composition, working procedure, and some other key aspects. Finally, the ground cover rejection tests and air drop and flight tests were carried out to confirm the design configuration. The results showed that the Chang’e-5 reentry spacecraft recovery system was designed correctly, and its functions and performances met the design requirements. A breakthrough in the recovery technology of the reentry spacecraft was achieved for Chinese first lunar sample-return mission.


Introduction
The first phase of Chinese unmanned lunar exploration was implemented in accordance with the three steps, i.e., orbiting the Moon, landing on the Moon, and returning from the Moon [1][2][3]. Since the Soviet Union's Luna 24 mission in 1976 [4], Chang'e-5 is the first spacecraft, which has returned 1.7 kilograms of samples of the Moon to Earth. The Chang'e-5 spacecraft consisted of 4 modules, a service module, and an Earth return module remained in the lunar orbit, while a lander and an ascent vehicle landed to the lunar surface. The lander collected the rock and soil samples using a mechanical scoop and a drill and placed the samples in the ascent vehicles, which was blasted back into the orbit and rendezvoused with the service module. Then, the samples were transferred to the Earth-return capsule. On December 17, 2020, the Chang'e-5 reentry spacecraft landed safely under the action of parachute, and the obtained lunar sample returned without damage. It is worth noting that the Chang'e-5 reentry spacecraft carried the lunar soil sample to Earth at hypersonic speeds, which is close to the second cosmic velocity. Thus, a semiballistic skip reentry method was adopted for the reentry and descent of the Earth-return capsule. After the reentry capsule separated from the orbiter, it entered the atmosphere after inertial taxiing. It passed through the atmosphere and then skipped out of the atmosphere after a preliminary deceleration. Then, the capsule reentered the atmosphere at the second time. When the capsule descended to a height of about 10 km from the ground [5], the parachute recovery system was deployed to decelerate it to the subsonic speeds.
However, compared with the recovery system for the return and reentry of the recovery satellites, manned spacecraft, and other near-earth orbit spacecraft, Chang'e-5 reentry spacecraft has the specific features as shown in the following.
(1) The reentry spacecraft reentered into the earth atmosphere at a speed of about 11 km/s, which is close to the second cosmic speed. The reentry speed is much higher than other Chinese returnable spacecraft such as recovery satellites or Shenzhou manned spacecraft. Thus, the skip return method was adopted for Chang'e-5 reentry spacecraft, which results in the mission process having a long reentry distance and large aerodynamic uncertainty. The reentry spacecraft has a small weight and can be affected significantly by the aerodynamic thermal environment in reentry process. Furthermore, the ballistic conditions of the reentry spacecraft are extremely complicated (2) The reentry capsule is small in size, light in weight, and requires high accuracy in the configuration of the center of mass. The configuration design of the reentry capsule requires the lateral layout of the recovery system, which requires a lateral ejection of the cover to open the parachutes. Due to the lightweight and small moment of the inertia of the reentry capsule, in order to avoid adverse effects on the reentry capsule, there are strict restrictions and constraints on the forces generated by the cover ejection and parachutes inflation and the connections between the parachutes and the spacecraft. It is necessary to ensure that the process of ejecting cover, deployment and inflation of the parachutes, and the movement process of the combined body formed by the reentry spacecraft and the parachute are stable (3) The total mass and installation volume of the recovery system are very limiting. The percentage of the recovery system mass relative to the mass of the reentry capsule is less than 7.9%, and the allocated mass of the parachute is no more than 2.5% of the capsule. The strict restrictions on mass and volume requirements lead to the recovery system must be lightweight and integrated Consequently, a new recovery system for Chang'e-5 should be designed to meet high design requirements such as lightweight, high reliability, and high environmental adaptability. This paper will describe the design and testing activity that made possible the Chang'e-5 recovery system.

Recovery System Requirements and Constraints
2.1. Main Performance Requirements. The performance requirements for the Chang'e-5 recovery system are listed below; they include the operation conditions, reliability, and safety.
(1) When the total landing weight of the reentry spacecraft is 310 kg, the vertical landing speed of the reentry spacecraft with the help of a parachute is not more than 13 m/s in the landing areas with an altitude of 1 km (2) The height of opening the parachute is not less than 10 km (altitude above sea level) (3) The parachute can be opened normally within the range of 1.8 kPa~3.8 kPa dynamic pressure (4) Under the normal return conditions, the reliability of the recovery system should be greater than 0.99 (the confidence level is 0.8)

Constraints.
Based on the weight, space, power supply, and other conditions of the Chang'e-5 reentry spacecraft, the main constraints of the recovery system are listed as follows: (1) The overload of opening parachute should be not more than 7 g (2) The total mass of the recovery system should be not more than 26 kg (3) The total parachute package volume should be not more than 23 L (4) The total power consumption of the recovery system should be not more than 15 W

Description of the Recovery System
3.1. System Composition and Working Procedure. Based on the performance requirements of the Chang'e-5 reentry spacecraft recovery system, the recovery system needs to achieve aerodynamic deceleration, recovery program control, command status feedback, and instantaneous execution of actions such as cover ejections and parachutes deployments. Thus, the recovery system is a quite complex system including many components. After designing, the Chang'e-5 recovery system consists of four subsystems, i.e., parachute, install and fix components, recovery control, and pyrotechnic devices. Note that the parachute is used to aerodynamically decelerate the reentry spacecraft and stabilize the descending attitude, which is composed of a drogue parachute and a main parachute assembly. The install and fix parachute components are used to achieve the connection and separation between the parachute and the reentry spacecraft, which is composed of a parachute cabin and a connection and separation mechanism. The recovery control subsystem is used to judge the descending altitude of the reentry spacecraft; send out a series of work instructions and status signals such as the recovery system initiation, parachute ejection, and antenna cover ejection; provide telemetry signals; and supply power for the recovery system, which is composed of the pressure altitude controller, the recovery program controller, and the overload switch. The pyrotechnic device subsystem is used to perform various instantaneous actions during the recovery and landing process including ejection of parachute cover, drogue parachute separation, main parachute reefing line severing, and ejection of antenna cover, which is composed of the parachute cover ejectors, the nonelectric detonation device, the drogue parachute release device, the reefing line cutters, the antenna cover ejectors, and so on. The working procedure of the Chang'e-5 reentry spacecraft recovery system is shown in Figure 1. The procedure mainly includes the following: (1) During the skip return process of the reentry spacecraft, when the second reentry reaches altitude of near 40 km above sea level, the recovery system is powered on and enters the working state 2 Space: Science & Technology (2) When the reentry spacecraft descends to an altitude of near 11 km above sea level (note: the altitude of the recovery landing area is about 1 km, so the height above ground is about 10 km), the pressure altitude controller is turned on and the recovery work program is started (3) 0.5 s after the recovery system starts, the parachute cover is ejected from the spacecraft and the drogue parachute is pulled out by the cover and is deployed and inflated automatically (4) The drogue parachute is separated from the reentry spacecraft after working for 15 s, and the main parachute is pulled out by the drogue parachute. The main parachute works in a skirt reefing state. At the same time, after the main parachute is deployed and the soft rope beacon antenna which is installed with the parachute riser is pulled out, so that the recovery location device on the reentry spacecraft can send out location signals on the air (5) After the reefing main parachute worked for 8 s, the main parachute reefing line is severed, and the main parachute is fully inflated. The reentry spacecraft is slowed down further (6) 390 s after the recovery system is started, the main parachute reaches a stable working state, and the recovery program controller is connected to the power-on signal of the overload switch to prepare for issuing the landing state signal (7) The reentry spacecraft takes the main parachute to land safely at a speed of less than 13 m/s, and sends a landing state signal through the overload switch (8) 510 s after landing, the recovery system program controller receives the command of the data management system of the reentry spacecraft to eject two antenna covers In addition to the work of recovery and landing phase, the recovery system also participates in some work when the spacecraft is in the orbit around the moon. Through the recovery program controller, the ignition circuit of the pyrotechnic devices in the hatch door mechanism of the reentry spacecraft is connected. In the reentry process after the reentry spacecraft is separated from the orbiter, the recovery program controller is used to connect the ignition circuit of the thermal control electric explosion valves of the reentry spacecraft and so on.

Recovery System Key Components Design
3.2.1. Parachutes Design. The Chang'e-5 reentry spacecraft cannot decelerate to a safe descent speed by only its own aerodynamic shape. The recovery system employs parachutes to aerodynamically decelerate the reentry spacecraft to achieve a vertical landing speed of no more than 13 m/s. Comprehensive consideration of parachute descending speed, parachute opening conditions, parachute opening forces, parachute and spacecraft combined system motion stability, installation layout of parachute devices, mass and volume constraints, and other factors, it is determined to adopt a two-stage deceleration scheme, that is, the drogue parachute and the main parachute are used sequentially to decelerate the reentry spacecraft. The nominal area of the drogue parachute is 2 m 2 , and the nominal area of the main parachute is 50 m 2 . In order to further reduce the opening load of the main parachute, the main parachute is deployed At the second stage, the main parachute is fully inflated till the spacecraft lands on the ground finally [6,7].
The drogue parachute is opened at an altitude of about 11 km, the maximum dynamic pressure of the parachute is close to 4 kPa, and the maximum parachute opening speed is about 140 m/s. It has high requirements for the strength and stability of the drogue parachute, and the conical ribbon type was chosen. The conical ribbon type parachute has good stability, small opening force coefficient, and strong structural load-bearing capacity, which could adapt to the required higher speed and dynamic pressure opening conditions, so as to slow down the descending speed of the reentry spacecraft to the range that the main parachute can bear [8]. The main parachute type chooses the ringsail parachute, which has the characteristics of superior opening performance, strong antidestructive ability, reliable work, large drag coefficient, and good stability. Through the reefing technology to further reduce the opening force of the main parachute, it is better for the realization of the parachute and reentry spacecraft lightweight structure design. The composition of parachutes is shown in Figure 2. The reader can refer to [7] for the more details on these aspects.
The main characteristic parameters of the two-stage parachutes of the Chang'e-5 reentry spacecraft are shown in Table 1.

Recovery Control Design.
The main content of the recovery control includes the multichannel instruction reception of the reentry spacecraft, the control of the parachute opening, the control of the work sequence after the parachute system is initiated, the ignition control of the pyrotechnic devices, and the state feedback of the recovery system. The recovery control function of the Chang'e-5 reentry spacecraft is shown in Figure 3.
The Chang'e-5 reentry spacecraft recovery system adopts integrated design. System power supply, pyrotechnic devices power supply, power distribution and signal interface circuit, parachute open decision voting circuit, recovery program timing circuit, pyrotechnic devices ignition circuit, pyrotechnic devices test and protection interface circuit, and other functions are integrated into the recovery program controller for a unified realization. The parachute opening control function is realized by the pressure altitude controller, adopting the vacuum aneroid type altitude signal sensitive mechanism. The pressure altitude controller is in the off state when the reentry spacecraft is higher than the parachute opening height, and the signal is on when the spacecraft return from the outer space and descend to the designated parachute opening altitude. In order to ensure that the parachute opening control signal is reliably sent out, the pressure altitude controller adopts 3 independent vacuum aneroid signal generators and sends out the parachute opening signal through the recovery program controller by 2-out of-3 voting. In addition, adopting mechanical spring vibrator type overload switch to realize reentry spacecraft landing judgment, the landing command is sent out.

Design of Ejecting Cover to Deploy
Parachute. According to the general layout of the Chang'e-5 reentry spacecraft, the recovery system adopts a lateral ejection cover method, which is similar to that of the Shenzhou manned spacecraft, and uses the ejection and separation of the parachute cover to directly pull out the drogue parachute pack to realize the deployment of the drogue parachute. Compared with the Shenzhou spacecraft, the advantage of this solution is that it reduces the pilot parachute device which is used to pull out the drogue parachute, thereby simplifying the composition of the recovery system and reducing the mass and volume of the parachute system [9]. However, this solution has higher requirements on the ejection cover to pull out the parachute. The aerodynamic shape of the parachute cover is irregular and the mass is small, so the separation process in the wake of the reentry spacecraft is complicated. In order to ensure that the drogue parachute can deploy with high reliability, it must be ensured that the parachute cover can escape the wake flow quickly with sufficient separation speed. Furthermore, during the separation process, the parachute  Based on the dynamic model of the parachute cover ejection and separation process considering the coupling of fluid and rigid body, the dynamic characteristics of the parachute cover separation process under unsteady wake flow conditions were analyzed in detail. The minimum ejection and separation speed of the parachute cover was determined. The nonelectric detonation device was adopted to detonate four cover ejectors to ensure the synchronization of the action of the cover ejection. The flexible continuums such as the extraction bridle, the drogue parachute canopy, its pack, suspension lines, and risers were discretized in the form of damping spring finite mass nodes model, as shown in Figure 4. Based on such discretization, the dynamic model of the drogue parachute deployment including the parachute cover, the extraction bridle, the pack, the drogue parachute bag, and the risers was established and analyzed. According to the research results, a technology solution of an adaptive balance was proposed, which can make the parachute cover has a certain attitude adjustment capacity. In this solution, the asymmetrical three-point connection between the parachute cover and the parachute pack was adopted, which solved the stability problem in the process of ejecting cover to deploy the drogue parachute [10,11]. The reader can refer to [10,11] for the more details on these aspects.
In order to avoid the risk of collision between the parachute cover and the drogue parachute or the main parachute after the parachute cover is separated, the recovery system is equipped with a small parachute on the parachute cover to decelerate the cover to ensure a sufficient safety distance between the parachute cover and the assemblies of the reentry spacecraft and the parachutes. According to the relative ballistic analysis, and considering that the cover parachute does not have high requirements for stability, the cover parachute is designed as a flat circular parachute with a nominal area of 1.1 m 2 . Although the flat circular type does not have good stability, it has some advantages such as simple structure, reliable operation, and great drag characteristics. Including the cover parachute, the Chang'e-5 reentry spacecraft recovery system uses a total of three parachutes, as shown in Figure 2.

Design of Parachute Connection and Separation
Mechanism. Both the Chang'e-5 recovery system drogue parachute and the main parachute adopt a single-point hanging design. The hanging point is located at the top of the parachute cabin. The drogue parachute and the main parachute are connected to the reentry spacecraft through an integrated connection and separation mechanism successively. This design meets the demands of strict structural layout, lighweight, and redundant design. It realized the multifunctional and highly reliable integrated design such as the connection of the drogue parachute, the connection of the main parachute, the separation of the drogue parachute with the reentry spacecraft, and the pulling out of the main parachute pack.
Among them, in order to ensure the reliable opening of the main parachute, the separation of the drogue parachute adopts a redundant design, which is realized by using two parachute release devices, which are installed on the connection and separation mechanism. The release mechanism uses the pin puller design shown in Figure 5. As long as there is one parachute release device (that is, the pin puller in Figure 5) that works to retract the connecting pin, the sleeve    Figure 1, the entire working procedure of the recovery system is an irreversible process. Cover ejection to pull out the drogue parachute, the drogue parachute deployment and inflation, the separation of drogue parachute to pull out the main parachute, the main parachute deployment and inflation, etc., each step must be guaranteed to work reliably and must be a one-time success. Therefore, sufficient verification tests must be carried out during the development process, including simulation analysis, product performance tests, and experimental verification tests. During the development process of the Chang'e-5 recovery system, a large number of verification tests were carried out according to the different levels of single products, subsystems, and the recovery system. Moreover, the recovery system participated in the overall assembly, testing, and environmental tests of the spacecraft.

Overview of the Verification Tests. As shown in
In addition to regular performance tests and environmental tests, combined with the key working links and event chain of the recovery system, a series of special verification tests projects at the recovery system level were planned and carried out, including the ground cover ejection tests, the rocket sled cover ejection tests, hardware-in-the-loop simulation tests, and airdrop tests, as shown in Figure 6. Through multilevel comprehensive verification tests, it is ensured that the reliability evaluation result of the recovery system is 0.9993 (the confidence level is 0.8), which met the test coverage and reliability requirements of the spacecraft.

Cover Ejection and Drogue Parachute Deployment
Tests. For the Chang'e-5 recovery system, ejection of the parachute cover to pull out the drogue parachute is a key link to ensure the normal opening of the drogue parachute and decides subsequent opening of the main parachute. The ejection separation of the cover not only opens the passage for the parachute to exit but also uses the kinetic energy imparted by the ejection to the cover to deploy the drogue parachute. Through the simulation tests of the ejection separation of the parachute cover and the deployment process of the drogue parachute, which covered the nominal, upper and lower deviations of the attitude and dynamic pressure range when the parachute cover is ejected, the conclusion that the cover ejection speed to ensure the deployment of the drogue parachute should not be less than 10 m/s was obtained. Through an optimized design, the cover ejection separation speed actually realized by the recovery system is not less than 22 m/s, and the safety factor is not less than 2.2.
On the basis of the single-product verification test of the parachute cover ejector and the related simulation tests, further verification of the cover ejection to pull out the drogue parachute was carried out through the recovery system level ground cover ejection tests and the rocket sled cover ejection tests. Through the ground cover ejection tests, the correctness of the design of the cover ejection to pull out drogue parachute was verified statically. The negative pressure condition of the parachute cover was also set up in the ground cover ejection tests to simulate the effect of the wake of the reentry spacecraft. Through the rocket sled ejection and drogue parachute deployment tests, the correctness of the design of the opening of the drogue parachute under dynamic conditions was verified. In the tests, the maximum dynamic pressure of the drogue opening reached 5.4 kPa, which proved that the recovery system's capability of ejecting the cover and opening the drogue parachute was significantly better than the performance requirement of the "1.8 kPa~3.8 kPa dynamic pressure range" described in Section 2.2. Figure 7 shows the ground cover ejection test and the rocket sled ejection test.

The Recovery System Hardware-in-the-Loop Simulation
Tests. In order to ensure the reliability and test coverage of the recovery system, a lot of calculation analysis and test verification are required. If the working process of the recovery system is fully verified by physical objects, it will be very costly and need a long period. In fact, it is difficult to carry out some tests under failure modes and extreme conditions. For this reason, the Chang'e-5 recovery system has developed a hardware-in-the-loop simulation test system. The hardware-in-the-loop simulation tests were used to solve the difficult problem that the extreme working conditions of the recovery system cannot be executed in the airdrop tests. Thus, the hardware-in-the-loop simulation test system played important role on carrying out the reliability tests of the recovery system more fully and became an indispensable means of verification.
The hardware-in-the-loop simulation system of the recovery system is a loop real-time simulation system, which consists of the dynamic simulation program of the reentry spacecraft recovery process, the pressure environment simulation equipment of the recovery process, and the recovery control products such as the recovery program controller and the pressure height controller, its composition is shown in Figure 8. As shown, there are five components including visualization subsystem, program-controlled automatic test  Space: Science & Technology and IO subsystem, recovery simulation subsystem, environmental pressure simulation subsystem, and recovery program control devices. The recovery simulation subsystem is the core of the hardware-in-the-loop simulation, which mainly implements tasks such as simulation management, dynamics simulation calculation, and simulation data management. Its dynamics simulation program covers the dynamic model of the reentry spacecraft, the dynamic model of the cover ejection and separation, the dynamic models of the drogue parachute, and the main parachute including deployment, inflation, and descending.
Based on the hardware-in-the-loop simulation system, dynamic simulation and visual output of the entire recovery process of the reentry spacecraft were carried out. The kinematics and dynamics parameters of the reentry spacecraft and parachutes during the recovery process, as well as important characteristics such as parachute forces and command timing deviation, were obtained. The simulation and verifica-tion results of the parameters provide important support for the performance evaluation of the recovery system and the verification of the recovery control scheme. Furthermore, some reliability tests and automatic tests of the control products such as the recovery program controller and the pressure height controller can be implemented by the hardware-inthe-loop simulation test system [12].

Airdrop
Tests. The airdrop tests are the most critical test verification projects in the development process of the recovery system. Through the airdrop tests, the parachute can be specifically assessed, and the strength performance, parachute opening performance, and aerodynamic performance of the parachute can be tested under simulated real working conditions. In addition to the parachute, the airdrop tests can also comprehensively verify the whole recovery system; verify the design correctness of the recovery system, the rationality of the work procedure, and the coordination of control and action execution; and verify the performance   During the development of the Chang'e-5 recovery system, four batches of airdrop tests were carried out for different test purposes. Among them, the first batch of airdrop tests was carried out in the prototype design phase, mainly used for parachute type selection and the verification of parachute strength performance and stable landing performance. The second batch of airdrop tests was carried out in the product design phase to verify the parachute performance and the matching of the whole recovery system. Based on the second batch of airdrops results, the flight products state of the recovery system was determined. In this batch, a comprehensive airdrop test of the reentry spacecraft was also carried out to comprehensively verify the working performance of the reentry spacecraft in the recovery and landing process and verify the matching performance of the recovery system with the reentry spacecraft measurement and control system, antenna system, and other systems. The third batch of airdrop tests was carried out during the flight products development phase of the Chang'e-5 flight tester. It included parachutes' random inspection tests of the same batch products for flight mission, the parachute strength assessment tests, and the recovery system performance verification tests. The results confirmed that the reliability of the recovery system met the requirements for participating in the launch and flight mission. The fourth batch of airdrop tests was carried out in the Chang'e-5 flight products development phase, which verified the processing quality and working performance of the same batch of random-checked parachute products delivered. The tests verified the reliability of the recovery system flight products.
The opened parachutes during an airdrop test of the Chang'e-5 recovery system are shown in Figure 9. It can be seen that the drogue parachute and the main parachute are fully inflated, and the structures are complete under simulated real working conditions. After verification by the airdrop tests, it was confirmed that the design of the recovery system and the working procedures are correct, the recovery system products have stable and reliable quality, and the system performance behaviors meet the overall requirements of the reentry spacecraft. And more, the recovery system matches well with other systems and has sufficient safety margin and complete coverage of the envelope range of the mission requirements.

Long-Term Storage
Tests. The Chang'e-5 recovery system completed its product development in June 2017 and had prepared well to participate in the flight mission. Due to the delay of the launch plan, the Chang'e-5 recovery system did need to be stored for more than three years. In order to confirm that the recovery system can still meet the flight test requirements after long-term storage, in addition to  Figure 8: Hardware-in-the-loop simulation test system. Space: Science & Technology ensuring the storage environment and performing regular inspections and tests on the products, the recovery system specially arranged accompany test pieces to verify the key products performance after long-term storage. The storage test pieces mainly included the pressure height controller, the reefing line cutter, and the special textile materials of the same batch used in the parachute flight products. During the entire storage period, the recovery system carried out multiple status inspections and electrical performance tests. The results showed that the recovery system was in normal condition, and the recovery control parameters and procedures were correct and effective.
The performance tests of the pressure altitude controller product were carried out. Before and after the storage, the change of the parachute opening control altitude value was less than 45 m, which was within the boundary of the product test data, indicating that long-term storage had no effect on the performance indicators of the pressure altitude controller.
In order to verify whether the long-term storage of the packed state affects the performance of the parachute reefing line cutter, the cutters stored in the packed parachute and in the free placement are both subjected to ignition test. The ignition test data was compared with the data of the same batch reefing line cutters before storage, the results showed that the reefing line cutter can reliably cut off the test rope in each state, and the time delay did meet the 8 s requirement of the main parachute reefing work.
The same batch of special textile materials accompanied by parachutes mainly included various specifications of nylon silk, nylon ribbon, aramid tape, and aramid rope. All of these materials were tested for mechanical and physical properties. The results showed that the strength and elongation of all materials were better than the rated value and met the requirements, and the difference from the results before long-term storage was within 10%.
The long-term storage test verification results showed that the recovery system products could meet the (a) e drogue parachute is fully inflated (b) e main parachute is fully inflated Figure 9: The parachute fully inflated in an airdrop test.

Landing speed
When the total landing weight of the reentry spacecraft is 310 kg, in the landing area with an altitude of 1 km, the vertical landing speed of the reentry spacecraft with the main parachute is not more than 13 m/s In flight tests, when the reentry spacecraft is 310 kg, in the landing area with an altitude of 1 km, the vertical landing speed of the reentry spacecraft with the main parachute is not greater than 11.8 m/s The altitude of opening parachute The altitude of opening parachute is not less than 10 km (above sea level) The altitude of opening parachute in the flight test is not less than 11 km (above sea level) The dynamic pressure of opening parachute The parachute can be opened normally in the range of 1.8 Pa~3.8 kPa The parachute can be opened normally in the range of 30.9 Pa~9.4 kPa (no data in the flight missions. This is the comprehensive results of airdrop tests and high tower drop tests which show the performance is better than flight requirement.) The overload of opening parachute The overload of opening parachute should be no more than 7 g The overload of opening parachute is no more than 4.4 g in flight tests System weight The total mass is no more than 26 kg 21.6 kg (measured data of products) Parachute volume Parachute volume is no more than 23 L 15.2 L (measured data of products) Power consumption Power consumption is no more than 15 W Power consumption is no more than 5.6 W (measured data of products) 9 Space: Science & Technology requirements of the Chang'e-5 launch and flight mission after three years of ground storage.

Flight Mission Results
Before the mission of Chang'e-5 flight, in order to break through and master the key techniques of moon-earth hyperspeed reentry, the circumlunar return and reentry spacecraft of 3rd phase of Chinese lunar exploration program was developed which completed the flight test mission successfully from October 24, 2014 to November 1, 2014. On November 24 of 2020, the Chang'e-5 probe was successfully launched. On December 17 of 2020, the lunar sample carried by the reentry spacecraft was successfully recovered at the landing field in Chinese Inner Mongolia Autonomous Region. During the two missions, the performances of the recovery system were stable and reliable, the parachute opening processes were normal, the recovery commands were issued correctly, all actions during the recovery and landing process were executed accurately, and the performance indicators met and even exceeded the requirements (see Table 2). The recovery system effectively guaranteed the successes of the two flight missions of the third phase of Chinese lunar exploration program.

Conclusions
The Chang'e-5 mission is the final work of the three-step "orbiting, landing, and returning" of Chinese lunar exploration program. It is Chinese first autonomous lunar sampling and return mission, and one of the most complex and difficult space exploration missions in China so far. The recovery system is an important part of the Chang'e-5 probe and a key link in whether the reentry spacecraft carrying lunar samples can land safely. The Chang'e-5 recovery system addressed the problems of multiple uncertain factors, high technical risks, severe structural layout constraints, high product integration and lightweight requirements, and high reliability requirements caused by semiballistic skip return and reentry of light and small spacecraft. It broke through some key technologies such as lightweight and miniaturized parachutes, integrated recovery control technology, and developed a lightweight and highly reliable recovery system suitable for semiballistic skip return of light and small reentry spacecraft. The performances of the recovery system met and exceeded the requirements of the flight mission and ensured the complete success of Chinese first lunar autonomous sampling and return mission.

Data Availability
The data used to support the findings of this study are included within the article.

Conflicts of Interest
All authors declare no possible conflicts of interests.