741

AAS 13-103

HARDWARE IN THE LOOP VALIDATION OF GNC

FOR RVD/RVC SCENARIOS

Pablo Colmenarejo,*

Valentín Barrena†

and Thomas Voirin‡

The big challenge of new technologies, particularly related to GNC systems, is

to achieve a TRL (Technology Readiness Level) high enough before flying in

order to minimize the failure risks. Most of GNC related technologies need, in

fact, to fly as experiment before being declared as validated for space use as

mission baseline. In flight experiment opportunities are, nevertheless, expen-

sive and very limited in terms of number of opportunities. This is especially

true for new mission concepts in Europe such as Formation Flying or Rendez-

vous and Docking/capture.

ESA HARVD activity (High integrity Autonomous RendezVous and Docking

control system for MSR Capture scenario and Earth servicing missions), has

been developed by an industrial team led by GMV, and includes a design and

validation strategy that, using an incremental validation approach concept,

starts by Model In the Loop (MIL, based on Matlab/Simulink), passes through

SW In the Loop (SIL, non real-time), arrives to Processor In the Loop (PIL,

real-time) and finalizes with Hardware in the Loop (HIL) with camera and

Lidar HW breadboards in the loop with air-to-air signal transmission and

space-representative relative motion generated by specific robotic devices syn-

chronized with the GNC real-time host system and processor. Representative

illumination conditions are guaranteed by the use of Fresnel lights.

This paper describes briefly the above-mentioned Design, Development, Verifi-

cation and Validation (DDVV) approach and focuses mainly on the integration

of the PIL real-time test bench with the specific dynamic test bench devices

(called platform® and including two robotic arms, one of them hosted on a lin-

ear axis with motion capability up to 15 meters), the performance of the tests

(several scenarios including the use of scaled mock-ups of MSR mission Sam-

ple Canister, the MSR Mars Ascent Vehicle and the IBDM Demo mission tar-

get spacecraft including a model – geometry representative – of the IBDM

docking mechanism) and the obtained dynamic tests results (including a video

of some of the cases) and lessons learnt. In addition, comparison of HIL test

results with PIL/SIL/MIL results serve to validate the PIL/SIL/MIL test

benches/simulator environment, to demonstrate the coherency of the DDVV

approach and its use for later (and faster) design iterations (if needed).

* GNC Division, GMV, Isaac Newton, 11, P.T.M. Tres Cantos, 28760, Madrid, Spain.

E-mail: pcolmena@gmv.com.

† OBSW & Avionics Division, GMV, Isaac Newton, 11, P.T.M. Tres Cantos, 28760, Madrid, Spain.

E-mail: vbarrena@gmv.es.

‡ ESC Section, ESA-ESTEC, Noordwijk, The Netherlands. E-mail: Thomas.Voirin@esa.int.

742

INTRODUCTION

Space systems and technologies require having a high reliability/maturity level before being considered as potential candidates for operational missions. This means that, for most of the space systems and technologies, an in-orbit demonstration is required before being declared as eligible as baseline for operational missions.

The current possibilities for performing in-orbit demonstrations are either by embarking the technology demonstration as a payload in carriers of opportunity, or by designing dedicated In-Orbit Demonstration (IOD) missions. However both aspects raise substantial problems. Finding carrier of opportunities can be difficult and imposes technical and programmatic constraints on the technology/system to be demonstrated in-orbit, as the technology has to fulfill with the main platform requirements in terms of power, size, operations and schedule. On the other hand, dedi-cated IOD missions can be difficult to finance and are therefore not frequent, and when their fi-nancing can be guaranteed they may end up in integrating a set of different technology develop-ment which have to harmonize their requirements and schedule in order to fit in a single mission.

In this context, it is fundamental to find different ways to increase the reliability/maturity level of the space technology/systems by using on-ground means and test facilities, in order to reduce the gap between on-ground validation and in-flight validation/use.

Dynamic HW-in-The-Loop (DYN-HIL) test facilities allows to realistically reproduce and control on-ground the space dynamics (particularly true for specific scenarios with low dynamic, such as Formation Flying, RdV and docking/capture, In-Orbit Servicing and Active Debris Re-moval where the relevant dynamic is the relative one between the involved spacecraft, being this usually low), include sensors with realistic air-to-air stimulation and being able to validate till TRL 5/6 (the maximum that can be achieved on ground) stand-alone sensors/equipment and complex GNC subsystems design and development.

COST-EFFECTIVE GNC DESIGN, DEVELOPMENT, VERIFICATION & VALIDATION (DDVV) APPROACH

A cost effective approach for GNC systems DDVV approach can be based on the following integrated chain: FES Autocoding PIL T/B HIL T/B, where:

The Functional Engineering Simulator (FES) includes reference models of the select-ed algorithms (GNC-ALG) and solutions for the GNC (and associated AMM and FDIR) system/s. This is the main conductive design supporting tool and verification at algorithm level (Model in the Loop, MIL) all along the GNC work. It is fundamental to define modelling rules/guidelines for later autocoding. The FES simulator supports the full V-cycle for the GNC-ALG (Simulink algorithms).

Autocoding techniques (e.g. TargetLink from dSpace) can be used to translate the FES-validated On-Board Part (GNC, AMM, FDIR) into C code and start the SW V&V process. A SW in the Loop (SIL) verification step by integrating the produced GNC-SW in the FES simulator can be envisaged as intermediate V&V step (SIL V&V level is achieved).

The PIL (Processor In the Loop) test benches, non real-time (optional depending of the GNC design case and the eventual provided added value) and real-time, will inte-grate the GNC-SW. The PIL test bench/es will allow testing the GNC-SW in flight re-alistic conditions regarding the avionics (representative processor/s of the mission platform flight models). In this stage, the PIL V&V level is achieved.

743

The dynamic HIL/Sensors test bench is logical extension of the PIL test benches (the PIL test bench is an integral part of the dynamic HIL/Sensors test bench, thus already including the GNC-SW). This test bench is the last step on the on-ground GNC vali-dation and verification chain and provides real dynamic conditions reproduction that stimulates real HW sensors with air-to-air signals so as to achieve the maximum ground testing level (HIL level, TRL 5-6) regarding the achieved representativity of the flight conditions.

This chain can provide (as demonstrated during ESA HARVD activity) invaluable support during the Design and Development phases and possibility to test V&V requirements already at early and intermediate design phases, allowing fast design iterations.

Following Figure 1 presents a diagram with the cost-effective GNC DDVV approach.

Figure 1. Coherent, incremental, highly automated GNC Design, Development, Verification and

Validation (DDVV) Approach.

PLATFORM® DYNAMIC TEST FACILITY

platform® is a dynamic test bench developed by GMV in the frame of the Spanish Space Pro-gram, has developed the PLATFORM© test bench and based on the use of commercial robotic arms. The objective of this facility is the testing of GNC systems and sensors equipment, for sev-eral scenarios as Formation Flying, Rendezvous & Docking, Landing, and for robotic applica-tions.

The platform® test bench allows the use of real sensors measurements in the loop with air-to-air stimulation, obtained through the recreation of a real relative trajectory and attitude profile of two spacecraft (or one spacecraft in the presence of a planetary surface) by using numerically controlled robotic arms.

GNCRequire-ments

GNC Design

GNCPrototype

Generation

Auto CodeGeneration

Software inthe Loop

(SIL)

Hardwarein the loop

(HIL)

Final GNC SW atTRL 5/6 Level

Design

Development

Validation

Processorin the Loop

(PIL)

Model inthe Loop

(MIL)

FES sim

Dynamic HIL/ Sensors TB platform®

PIL Real-Time

744

The real relative sensor devices can installed on-board the spacecraft mock-ups, so they exper-iment the same relative kinematics and produce the same measurements (including most of the error sources) as in the space environment. This system can be used to perform the validation of single sensors, or the validation of the entire GNC systems. In the second case, platform® is used in combination with a PIL (processor-in-the-loop) real time test bench, in which the GNC on-board SW is executed inside a space representative target board, whereas the RW (Real World: dynamic&kinematic environment and actuators) is run inside a dedicated device for real time simulation.

This way, platform® test facility system allows the use of HIL (HW-in-the-loop), with the sensors measurements feeding the GNC algorithms which runs in the target board. The GNC computes the control actuations, which are passed to the RW and the relative kinematics comput-ed in the RW is implemented by the robotic arms, closing the loop.

platform® System Architecture

The architecture of platform® test bench has been conceived in order to be highly modular and flexible so that new components can be added with minimum effort.

Figure 2 shows the architecture scheme of platform® system used for the real time HIL vali-dation of a GNC SW. The specific components of the platform® facility are the ones indicated in block number 2 of Figure 2:

Mitsubishi PA10 robotic arm with its controller. This robotic arm is devoted to host the target spacecraft (usually the more passive scenario spacecraft/element) mockup.

KUKA KR 150-2 mounted on a rail track, including the controller. This robotic arm is devoted to host the chaser (usually the more active spacecraft/element) mockup.

Motion Control System, in charge of commanding and synchronizing the two robotic devices.

These elements are connected from one side to the part which provides PIL capability and a kinematic profile to be implemented (indicated as block number 1 in Figure 2), and from the oth-er side with the metrology sensor processor (the hardware included in the loop, indicated as block number 3 in Figure 2).

It shall be noticed that the components recognized as block number 1 in Figure 2 can work in stand-alone mode as a PIL test bench and is normally used as previous step in the validation chain of the GNC SW. The PIL provides a real-time development and validation environment that al-lows running and testing the GNC SW in a space representative target processor.

The PIL test bench allows:

Assessing the algorithm’s robustness to delays coming from synchronisation between Real World and GNC application.

Checking time constraints in the data communication and algorithm execution on the real processor.

Testing behaviour that cannot be tested in a non-real time environment (for instance, synchronisation, scheduling, memory management, time exception, thread priorities management).

Assessing code performance: computational load, memory and code size.

745

With respect to the PIL test bench environment, the platform® system adds the possibility of including the hardware metrology in the loop. This way, the measurements come from the real sensors, allowing the assessment of the effects of real HW behavior, including all the error sources and communication delays. Usually the sensor which is included in the loop is the most important for the relative navigation (e.g. the LIDAR or the optical camera), while the other sen-sors continue to be simulated inside the RW application.

In order the metrology sensors to work properly with space representative behavior, space rep-resentative mock-ups (which depend on the scenario) are used. They shall be representative in shape and structure/coverage of the real spacecraft, since the external structure/coverage will impact on the accuracy of the sensors measurements.

The platform® motion control component interfaces with a real time simulator (based on the dSPACE COTS), with the two robotic devices controllers and with the illumination system.

Figure 2. Architectural overview of specific platform® components (block 2 in the figure) connected with PIL test bench (block 1) and sensor devices (block 3).

HIL – LIDAR system

platform® Dynamic Test Facility

Processor in the Loop (PIL) Test Facility

EthernetLink

LIDAR Acquisition System+

Navigation Estimation

Motion Control System(RTOS)

EthernetLink

EthernetLink

Mitsubishi PA-10Control System

(RTOS)

Ethernet Link

Simulation Links

Development,Monitoring or

Debugging Links

PHS-CAB5

Target Processor(LEON)

Serial or EthernetLink

OBC monitoring anddebugging system

(GRMON)

Serial or EthernetLink

PCI or SerialLink

Development, monitoringand debugging system

(RTW, RTI and Control Desk)

Real-Time Simulator(dSpace)

EthernetLink

Operator

ARCNET

PA-10 RobotController

PowerLine

MitsubishiPA-10

CanisterMock-up

Track Motion System

0

KUKA KR C2Controller(VxWorks)

Power

Line

Ethernet Switch

LIDAR

KUKAKR 150-2

1

2

3

746

USE CASE: HARVD DYNAMIC HIL VALIDATION

The HARvD (High Integrity Autonomous RVD Control System) activity includes design, pro-totyping and testing at three different levels (Functional Engineering Simulator, Real Time Test Benching and Dynamic Test Benching) of a complete GNC system for a generic rendezvous and docking/capture scenario.

The development and validation activity follows the cost-effective DDVV approach described in previous paragraphs, applied as follows:

The FES phase uses the Matlab/Simulink models and simulates the full system in no-Real Time. The simulation is performed in a single PC under Matlab/Simulink.

The next step is the RT simulator (RVD-RT). Here, the Simulink models are convert-ed into C code with the dSpace tools and compiled. While the real world is simulated in a dSPACE Board (real time simulator), the on-board software is hosted in a LEON Board inside a Linux workstation.

The RVD-RT is completely functional by itself, providing closed loop simulation capability through SW simulated sensors. Additionally, it provides the SW develop-ment environment for Real World models and GNC algorithms to be run in the on-board processor, and a simulation control.

The last step is the RVD-DYN Test Bench. In addition to the RT simulator, the sensor measurements are provided using real sensors stimulated through dynamic platforms fed by the dynamic and kinematics conditions (position, velocity, attitude and attitude rates) generated with the simulated RW, while the on-board software runs in the LEON Board.

The RVD-DYN is based on the platform® facility and uses dedicated scenario de-pendent mock-ups and dedicated sensor HW, specifically selected for the scenarios reproduced.

Figure 3 shows two different types of mock-ups used as target for a LIDAR (Light Detection And Ranging) sensor and a visual based sensor; they are equipped with retro-reflectors especially selected for the LIDAR sensor. They are held by the Mitsubishi PA10 robot.

Figure 3. Target mock-ups (Left: MSR sample canister; Right: Earth servicing scenario spacecraft

with IBDM docking mechanism mock-up; Note: mock-ups images not in the same scale).

747

The sensors electrical models mounted on board the mock-up (held by the KUKA robotic arm in Figure 4) are:

Imaging Lidar Technology (ILT) LIDAR bread board from JenaOptronic/ESA, for fi-ne range and lateral measurements.

Optical navigation camera (from GMV), for acquiring relative navigation observa-tions with real image processing function.

The current configuration of the platform® infrastructure has an operational range of about 15m. So, for reproducing the HARVD scenarios, two scale factors (mock-ups resizing) have been used:

1/35 for far ranges between ~450m (including a robotic arm safety margin) and 35m

1/3 for close ranges below 35m (see Figure 4).

Figure 4. RVD-DYN tests.

748

USE CASE: HARVD PROCESSOR IN THE LOOP (PIL) AND DYNAMIC HW IN THE LOOP (HIL) VALIDATION RESULTS

Model in the Loop (MIL) Test Results and Validation

The integration of the HARVD Control system models within the FES (Functional Engineer-ing Simulator), verification of the integration, validation of the full FES simulator, together with the use of the FES for the HARVD test campaign running, results analysis and derivation of con-clusions has been performed. An example of the test cases graphical results (corresponding to 1000 MonteCarlo cases) is included hereafter. All the runs lead to a successful capture of the sample. The maximal lateral error is about 10 cm but could be reduced to about 5 cm by a retun-ing of the guidance parameters in order to remove the capture mechanism bias. The Montecarlo results show that the specification of 20 cm and 4 cm/s are fulfilled with great margins.

Figure 5. MSR capture final trajectories.

Figure 6. MSR capture position error (zoom on the right).

749

Processor in The Loop (PIL) Test Results and Validation

Within ESA HARVD activity, an extensive test campaign at all levels have been performed. The following table shows the definition of the most representative test cases and scenarios for the Processor in The Loop (PIL) test campaign.

Table 1. Definition of GNC Validation Test Cases for Processor in The Loop (PIL) Test Campaign.

Mars Sample Return (MSR) Nominal Scenarios

MSRC_C_00_000 MSR capture scenario on a circular orbit (500km, 30° inclination). The chaser is initialized at long range (~300 km) from the target, with an initial difference in semi-major axis of 50 km. The target is the sample container which has no attitude control.

MSRC_E_00_000 MSR capture scenario on an elliptical orbit (300 x 2200km, 30° inclination). The chaser is initialized at long range (500km) from the target. The target is the sample container which has no attitude control.

MSRD_E_00_000 Elliptic (300 x 2200km, 30° inclination) MSR docking (with MAV) scenario with final approach direction along X-bar. The chaser is initialized on V-bar at ~2 km behind the target (-x axis) with an initial out of plane error.

MSRD_E_00_001 Elliptic (300 x 2200km, 30° inclination) MSR docking scenario with final approach direction along V-bar (instead of X-bar seen in the previous case). Note that V-bar and X-bar directions are different in an elliptic orbit.

MSRD_E_00_002 Equal to MSRD_E_00_001, except for forced motion and docking approach direction, which in this case is R-bar instead of V-bar.

MSRD_E_00_003 Equal to MSRD_E_00_001 and MSRD_E_00_002, but in this case the target satellite follows an inertial pointing (the forced motion approach direction shall be fixed in the inertial frame in order to follow the docking port)

Earth RdV and Docking Demo Mission (RVDM) Nominal Scenarios

RVDM_C_00_000 RVDM docking scenario on a circular orbit (Earth orbit, 560km altitude). The chaser is initialized at long range (300km) from the target. The target is a vehicle which has its own attitude control. Docking is done along X-bar.

RVDM_C_00_001 RVDM docking scenario on circular orbit (Earth orbit, 560km altitude). The chaser is initialized at short range from the target. The target is a vehicle with its own attitude control. The docking is done along an inertial direction.

RVDM_E_00_000 RVDM docking scenario on an elliptical orbit (Earth orbit, 500 x 620km). The chaser is initialized at long range from the target. The target is a vehicle which has its own attitude control. The docking axis is X-bar.

RVDM_E_00_001 Elliptic RVDM scenario (Earth orbit, 500 x 620km) from short range (hopping + forced motion). The chaser is initialized on V-bar at ~3500m behind the target (-x axis). The docking is done along V-bar which is slightly different from X-bar due to the elliptic shape of the orbit.

Mars Sample Return (MSR) Contingency Scenarios

MSRC_C_30_001

Same as MSRC_C_00_000, but during the final forced motion, at 11.5 m from the target, an erroneous (e.g. valve failure) delta V is applied making the trajectory unsafe (~30 cm/s toward target instead of nominal 10 cm/s). A Collision Avoidance Manoeuvre (CAM) is autonomously commanded and the scenario concludes with fly-around and recovery actions.

MSRC_C_30_004

Same as MSRC_C_00_000, but during the final forced motion, a retreat command is received from ground. The safe distance is reached through a backward forced motion and a station keeping is commanded. Then, during the station keeping an alarm of attitude not safe is injected (by reducing the maximum radiator temperature), leading to Short Term Recovery Plan triggering (CAM is commanded, taking the chaser to a farer safe distance (~400 m); a fly-around manoeuvre is computed and applied to avoid further drifting; finally, a safe mode is commanded). After a certain period in safe mode, the mission is resumed.

MSRC_C_30_007 Several actuators failures (wheels and thrusters) are simulated in order to check the good behaviour of the Failure, Isolation and Recovery (FIR) system.

MSRC_T_30_014 MAV failure and Sample Continer orbital injection in an non-nominal orbit (218 x 500km). The MSR Orbiter (chaser) performs an orbital synchrnonization from nominal capture orbit into the non-nominal MAV injection orbit.

The following Figure 7 to Figure 10 show the results for the first test case (MSRC_C_00_000) as from the SW-in-the-Loop (SIL) GNC SW test (blue lines) and from the Processor-in-the-Loop (PIL) GNC SW test.

Figure 7 shows the resulting Rendez-vous and Capture trajectory from 300 km dis-tance.

Figure 8 shows a zoom of the in-plane (X-Z) trajectory for the last kilometers. A dif-ference between SIL and PIL resulting trajectory can be observed due to small numer-ical differences. In this case, those differences in the Orbit Synchronization phase

750

provokes that the trajectory obtained with the PIL does not cross the along track axis (while the reference SIL trajectory crosses along track for the first holding point). This provokes a slightly different answer at translational guidance decision. The final result is the same in both cases after matching in later defined hold points.

Figure 9 shows the propellant consumption along the time.

Figure 10 shows the final capture performances in terms of lateral displacement.

Figure 7. MSRC_C_00_000-Approach trajectory.

Figure 8. MSRC_C_00_000-Approach trajectory (zoom).

Figure 9. MSRC_C_00_000-Propellant consumption.

Figure 10. MSRC_C_00_000-Capture position performance.

-3-2-10123

x 105

-5

0

5

10

x 104

X axis (m)

Z ax

is (m

)R_rel_dyn__tof_V_tgt_chs

SILRVD-RT/RASTA

-3-2-10123

x 105

-4

-2

0

2

4x 10

4

X axis (m)

Y ax

is (m

)

020004000600080001000012000140001600018000

-3000

-2000

-1000

0

1000

X axis (m)

Z ax

is (m

)

R_rel_dyn__tof_V_tgt_chs

SILRVD-RT/RASTA

0 1 2 3 4 5 6 7

x 104

0

20

40

60

80

100

120

time (s)

Prop

ella

nt c

onsu

mpt

ion

(kg)

R_thr_dm (difference 2%)

SILRVD-RT/RASTA

-0.4 -0.2 0 0.2 0.4 0.6

-0.5

-0.4

-0.3

-0.2

-0.1

0

0.1

0.2

0.3

0.4

0.5

Chaser spacecraft Y axis (m)

Cha

ser s

pace

craf

t Z a

xis

(m)

MSR Capture performance: position misalignment on +X face

Target center in SILTarget center in RVD-RT/RASTA20 cm requirementBasket aperture (1m)

751

Some small differences have been detected between the SIL and the PIL (RVD-RT/RASTA) test results, due principally to:

Numerical errors coming from the use of different HW platforms (including operating system and compiler) and mathematical libraries:

o SIL: GNC is run on a PC computer using the OS mathematical libraries.

o PIL (RVD-RT/RASTA): GNC is run on the main RASTA processor (LEON2, GR-CPCI-AT697@80MHz) using the RTEMS mathematical libraries.

Small delays coming from the RT conditions (limited to one time step).

In general, the PIL (RVD-RT) test campaign has provided satisfactory results in all cases (the general behavior has been as the expected one):

Approach trajectories are correct (do not present strange/unexpected behaviors).

The docking/capture performances fulfill the requirements.

The propellant consumptions and scenario durations are very similar to what obtained with the reference SIL results.

The following table presents a summary of the results of all the test cases in terms of scenario duration and propellant consumption (capture/docking final condition is successful in all cases). Minimum deviations are observed between the SIL and the PIL (RT) GNC SW test cases.

Table 2. Processor in The Loop (PIL) Test Results and Validation.

Test Case Capture / Docking

Performance

Contingency / Recovery Success

Scenario Duration [sec]

Propellant Consumption [Kg]

SIL PIL Diff SIL PIL Diff

MSR Nominal Scenarios

MSRC_C_00_000 YES n/a 65300 65370 0.1% 108.640 110.946 2.1% MSRC_E_00_000 YES n/a 69100 69150 0.1% 90.578 90.656 0.1% MSRD_E_00_000 YES n/a 32512 32512 0% 7.384 7.380 -0.1% MSRD_E_00_001 YES n/a 5570 5570 0% 3.226 3.226 0% MSRD_E_00_002 YES n/a 9611 9611 0% 4.978 4.971 -0.1% MSRD_E_00_003 YES n/a 9728 9728 0% 4.197 4.176 -0.5%

RVDM Nominal Scenarios

RVDM_C_00_000 YES n/a 55700 55710 0% 28.469 28.427 -0.1% RVDM_C_00_001 YES n/a 20630 20510 -0.6% 1.745 1.748 0.2% RVDM_E_00_000 YES n/a 56010 56200 0.3% 28.850 28.853 0% RVDM_E_00_001 YES n/a 19190 19190 0% 1.008 1.007 -0.1%

MSR Contingency Scenarios

MSRC_C_30_001 YES YES 21161 21161 0% 5.653 5.655 0% MSRC_C_30_004 YES YES 19050 19050 0% 6.208 6.204 -0.1% MSRC_C_30_007 YES YES 37109 37198 0.2% 8.534 8.923 4.5% MSRC_T_30_014 n/a YES 30000 30000 0% 46.143 46.143 0%

752

Dynamic HW in The Loop (HIL) Test Results and Validation

The following table shows the definition of the most representative test cases and scenarios for the Dynamic HW in The Loop (HIL) test campaign.

Table 3. Definition of GNC Validation Cases for Dynamic HW in The Loop (HIL) Test Campaign.

MSR Nominal Scenarios

MSRC_C_00_000_DYN Corresponds to the last 450 m of MSRC_C_00_000 (Sample Container capture in Mars circular orbit). The chaser is initialized at ~450 m from the target in along-track direction.

MSRC_E_00_000_DYN Corresponds to the last 450 m of MSRC_E_00_000 (Sample Container capture in Mars elliptical orbit). The chaser is initialized at ~450 m from the target in along-track direction.

MSRD_E_00_000_DYN Corresponds to the last phase of MSRD_E_00_000 (MAV docking in Mars elliptical orbit with final approach direction along X-bar). The chaser is initialized at a hold point ~100 m from the target in along-track direction.

MSRD_E_00_001_DYN Corresponds to the last phase of MSRD_E_00_001 (MAV docking in Mars elliptical orbit with final approach direction along V-bar). The chaser is initialized at a hold point ~100 m from the target in along-track direction.

MSRD_E_00_002_DYN Corresponds to the last phase of MSRD_E_00_002 (MAV docking in Mars elliptical orbit with final approach direction along R-bar). The chaser is initialized ~250 m from the target in along-track direc-tion.

MSRD_E_00_003_DYN Corresponds to the last phase of MSRD_E_00_003 (MAV docking in Mars elliptical orbit with final approach direction along an inertial direction). The chaser is initialized ~250 m from the target in along-track direction.

RVDM Nominal Scenarios

RVDM_C_00_000_DYN Corresponds to the last phase of RVDM_C_00_000 (RVDM demo mission docking in Earth circular orbit with final approach direction along X-bar). The chaser is initialized ~450 m from the target in along-track direction.

MSR Contingency Scenarios

MSRC_C_30_001_DYN Corresponds to MSRC_C_30_001 (Sample Container capture in Mars circular orbit, failure delta V is applied making the trajectory unsafe at 11.5 m from the target, Collision Avoidance Manoeuvre (CAM) is autonomously commanded and the scenario concludes with fly-around and recovery actions).

MSRC_C_30_003_DYN Corresponds to MSRC_C_30_004 (Sample Container capture in Mars circular orbit, retreat command from ground during final approach to capture, fast recovery and mission completion), without the injection of an alarm about “attitude not safe”.

Within the dynamic HIL test campaign, it has been noticed some relevant discrepancies be-tween the metrology modelling assumption used to design the HARVD GNC (and to validated through the PIL test campaign) and the physical ILT LIDAR working features, namely:

ILT LIDAR laboratory breadboard working rate is 1Hz, while design assumption was 10Hz.

Large delay between the ILT LIDAR measurement generation and the availability of the LIDAR navigation estimation for the HARVD GNC SW application (> 1sec), while small delays were expected.

The main outputs and conclusions of the dynamic HIL test campaign are:

Relative trajectory are as expected, which demonstrates the HARVD GNC design ro-bustness and GNC SW Demonstrator robustness in front of conditions for which it was not designed (for instance LIDAR working rate at 1Hz).

The capture/docking performance are compromised in some cases due to the LIDAR measurement delays (e.g. MSRC_E_00_000_DYN).

No meaningful differences are found in the scenario duration comparison.

The most significant differences are found for capture scenarios in circular orbit.

753

A delay in the relative LIDAR measurements for elliptical scenarios changes signifi-cantly the relative conditions to be estimated. It forces to correct the hopping trajecto-ry with higher actuations in such way that the final trajectory is significantly different and the propellant consumption is higher. Capture/docking is successfully achieved.

LIDAR measurement delay and LIDAR working rate impact on the Station Keeping performance. A degradation of the Station Keeping performance leads to a degrada-tion of the accuracy control and a reduction of the number of actuations to maintain this accuracy. Therefore, it reduces slightly the propellant consumption (as result of a degraded working).

Following Table summarizes the HARVD GNC performance obtained in the dynamic HIL test campaign with ILT LIDAR laboratory breadboard in the loop. Some comparison data w.r.t PIL test campaign results have been included (Diff column). Despite the LIDAR anomalous working mode, the dynamic HIL test campaign results can be considered as very good.

Table 4. Dynamic HW in The Loop (HIL) Test Results and Validation.

Test Case Relative Trajectory

as expected

Capture / Docking

Performance *

Scenario Duration [sec]

Propellant Consumption [Kg] †

PIL DYN-HIL Diff PIL DYN-HIL Diff

MSR Nominal Scenarios

MSRC_C_00_000_DYN YES YES 8280 8259 -0.3% 3.216 3.193 -0.7% MSRC_E_00_000_DYN YES NO 9455 9272 -1.9% 3.518 3.810 8.4% MSRD_E_00_000_DYN YES YES 1633 1633 0% 3.226 3.087 -4.3% MSRD_E_00_001_DYN YES YES 2435 2436 0% 3.185 2.807 -11.9% MSRD_E_00_002_DYN YES YES 5732 57.32 0% 3.965 3.730 -5.9% MSRD_E_00_003_DYN YES YES 5838 5838 0% 3.951 3.636 -7.9%

RVDM Nominal Scenarios

RVDM_C_00_000_DYN YES YES 7512 7484 -0.4% 0.434 0.413 -4.9%

MSR Contingency Scenarios

MSRC_C_30_001_DYN YES n/a 4230 4230 0% 2.693 2.693 0% MSRC_C_30_003_DYN YES n/a 1163 1163 0% 3.709 3.688 -0.6%

This DYN-HIL test campaign has shown the robustness of the HARVD GNC to the use of re-

al metrology sensors equipment (dynamically stimulated), in this case the ILT LIDAR laboratory breadboard in the loop. It is important to highlight the “laboratory breadboard” character of the used metrology equipment, and the feedback of the DYN-HIL test campaign results towards the identification of significant constraints and limitations to be upgraded/solved with respect to the future flight equipment.

It can be concluded that the DYN-HIL test campaign has provided in general very good results (the general behavior has been as the expected one):

Approach trajectories are correct (do not present strange/unexpected behaviours).

The docking/capture performances fulfil the requirements.

* LIDAR measurement delays may compromise the expected capture performance as it is shown in test MSRC_E_00_000_DYN. † For docking scenarios propellant consumption is reduced as consequence of Station Keeping performance degradation during the alignment of the chaser w.r.t the chaser docking port.

754

The scenario durations are very similar to the reference PIL results.

The propellant consumptions have discrepancies w.r.t the reference PIL results easily justifiable based on the identified ILT LIDAR working discrepancies.

CONCLUSIONS

An incremental nested design/validation loop has been used and demonstrated during the ESA HARVD activity. The final use of Dynamic HW-in-The-Loop (DYN-HIL) test facility has al-lowed to realistically test and validate the full GNC system (including the physical sensor/s and interfaces) with space representative dynamics, air-to-air sensors stimulation, and with repre-sentative real-time Avionics platform.

The abovementioned use of a physical LIDAR breadboard has allowed to identify mismodel-ing assumptions between the theoretical LIDAR model and the real physical one and to assess and evaluate the impact of the physical sensor behavior into the GNC system design and the GNC SW implementation. The result is twofold:

On one side, the HARVD GNC system has been tested in realistic conditions, reach-ing a higher reliability and maturity of the system, till TRL 5 (with respect to achieved TRL 3/4 level if not using a dynamic HIL test facility).

On the other side, a feedback on the LIDAR prototype has been provided with respect to the needed upgrades/re-design of the prototype towards a final flight unit).

As main conclusion, Dynamic HIL test bench has demonstrated, in the scope of the ESA HARVD activity and scenarios (MSR Capture and Earth in-orbit servicing), to be a very cost-effective solution towards increasing the validation level and maturity of GNC systems and GNC sensors, and to reduce the gap between on-ground validation and in-flight validation/use.

Finally, it is possible to state that the described approach is fully applicable to other similar scenarios, such as Formation Flying scenarios (e.g. different metrology levels equipment and Formation Flying system, including GNC/FDIR) and Active Debris Removal (ADR) scenarios within the Clean Space initiative (e.g. capture/berthing/grasping mechanisms systems and prox-imity/synchronization GNC systems).

REFERENCES 1 Matteo Suattoni, Luis Mollinedo, Valentín Barrena, Pablo Colmenarejo, Thomas Voirin, "Use of COTS Robotics for On-Ground Validation of Space GNC Systems: platform® Dynamic Test Bench" 11th International Symposium on Artificial Intelligence, Robotics and Automation in Space (i-SAIRAS), Turin, Italy, 4-6 Sept. 2012. 2 Colmenarejo, P. et Al.. “Autonomous GNC Rodmap for Mars Sample Return Mission”. Global Space Exploration Conference 2012, 22-24 May 2012,Washington DC, USA. 3 Strippoli, L. et al., “High Integrity control system for generic autonomous RvD”. 61st International Astronautical Congress, October 2010, Prague, CZ. 4 Colmenarejo, P. et al., “HARVD Development, Verification and Validation Approach (from Traditional GNC De-sign/V&V Framework Simulator to Real-Time Dynamic Testing)”. 7th International ESA Conference on Guidance, Navigation & Control Systems, 2-5 June 2008, Tralee, County Kerry, Ireland. 5 JenaOptronik. Imaging Lidar Technology User Manual. 25/01/2010.