HARDWARE IN THE LOOP VALIDATION OF GNC FOR RVD/RVC SCENARIOS

Transcription

1 AAS HARDWARE IN THE LOOP VALIDATION OF GNC FOR RVD/RVC SCENARIOS Pablo Colmenarejo, * Valentín Barrena and Thomas Voirin The big challenge of new technologies, particularly related to GNC systems, is to achieve a TRL (Technology Readiness Level) high enough before flying in order to minimize the failure risks. Most of GNC related technologies need, in fact, to fly as experiment before being declared as validated for space use as mission baseline. In flight experiment opportunities are, nevertheless, expensive and very limited in terms of number of opportunities. This is especially true for new mission concepts in Europe such as Formation Flying or Rendezvous and Docking/capture. ESA HARVD activity (High integrity Autonomous RendezVous and Docking control system for MSR Capture scenario and Earth servicing missions), has been developed by an industrial team led by GMV, and includes a design and validation strategy that, using an incremental validation approach concept, starts by Model In the Loop (MIL, based on Matlab/Simulink), passes through SW In the Loop (SIL, non real-time), arrives to Processor In the Loop (PIL, real-time) and finalizes with Hardware in the Loop (HIL) with camera and Lidar HW breadboards in the loop with air-to-air signal transmission and space-representative relative motion generated by specific robotic devices synchronized with the GNC real-time host system and processor. Representative illumination conditions are guaranteed by the use of Fresnel lights. This paper describes briefly the above-mentioned Design, Development, Verification and Validation (DDVV) approach and focuses mainly on the integration of the PIL real-time test bench with the specific dynamic test bench devices (called platform and including two robotic arms, one of them hosted on a linear axis with motion capability up to 15 meters), the performance of the tests (several scenarios including the use of scaled mock-ups of MSR mission Sample Canister, the MSR Mars Ascent Vehicle and the IBDM Demo mission target spacecraft including a model geometry representative of the IBDM docking mechanism) and the obtained dynamic tests results (including a video of some of the cases) and lessons learnt. In addition, comparison of HIL test results with PIL/SIL/MIL results serve to validate the PIL/SIL/MIL test benches/simulator environment, to demonstrate the coherency of the DDVV approach and its use for later (and faster) design iterations (if needed). * GNC Division, GMV, Isaac Newton, 11, P.T.M. Tres Cantos, 2876, Madrid, Spain. pcolmena@gmv.com. OBSW & Avionics Division, GMV, Isaac Newton, 11, P.T.M. Tres Cantos, 2876, Madrid, Spain. vbarrena@gmv.es. ESC Section, ESA-ESTEC, Noordwijk, The Netherlands. Thomas.Voirin@esa.int. 741

2 INTRODUCTION Space systems and technologies require having a high reliability/maturity level before being considered as potential candidates for operational missions. This means that, for most of the space systems and technologies, an in-orbit demonstration is required before being declared as eligible as baseline for operational missions. The current possibilities for performing in-orbit demonstrations are either by embarking the technology demonstration as a payload in carriers of opportunity, or by designing dedicated In- Orbit Demonstration (IOD) missions. However both aspects raise substantial problems. Finding carrier of opportunities can be difficult and imposes technical and programmatic constraints on the technology/system to be demonstrated in-orbit, as the technology has to fulfill with the main platform requirements in terms of power, size, operations and schedule. On the other hand, dedicated IOD missions can be difficult to finance and are therefore not frequent, and when their financing can be guaranteed they may end up in integrating a set of different technology development which have to harmonize their requirements and schedule in order to fit in a single mission. In this context, it is fundamental to find different ways to increase the reliability/maturity level of the space technology/systems by using on-ground means and test facilities, in order to reduce the gap between on-ground validation and in-flight validation/use. Dynamic HW-in-The-Loop (DYN-HIL) test facilities allows to realistically reproduce and control on-ground the space dynamics (particularly true for specific scenarios with low dynamic, such as Formation Flying, RdV and docking/capture, In-Orbit Servicing and Active Debris Removal where the relevant dynamic is the relative one between the involved spacecraft, being this usually low), include sensors with realistic air-to-air stimulation and being able to validate till TRL 5/6 (the maximum that can be achieved on ground) stand-alone sensors/equipment and complex GNC subsystems design and development. COST-EFFECTIVE GNC DESIGN, DEVELOPMENT, VERIFICATION & VALIDATION (DDVV) APPROACH A cost effective approach for GNC systems DDVV approach can be based on the following integrated chain: FESAutocodingPIL T/BHIL T/B, where: The Functional Engineering Simulator (FES) includes reference models of the selected algorithms (GNC-ALG) and solutions for the GNC (and associated AMM and FDIR) system/s. This is the main conductive design supporting tool and verification at algorithm level (Model in the Loop, MIL) all along the GNC work. It is fundamental to define modelling rules/guidelines for later autocoding. The FES simulator supports the full V-cycle for the GNC-ALG (Simulink algorithms). Autocoding techniques (e.g. TargetLink from dspace) can be used to translate the FES-validated On-Board Part (GNC, AMM, FDIR) into C code and start the SW V&V process. A SW in the Loop (SIL) verification step by integrating the produced GNC-SW in the FES simulator can be envisaged as intermediate V&V step (SIL V&V level is achieved). The PIL (Processor In the Loop) test benches, non real-time (optional depending of the GNC design case and the eventual provided added value) and real-time, will integrate the GNC-SW. The PIL test bench/es will allow testing the GNC-SW in flight realistic conditions regarding the avionics (representative processor/s of the mission platform flight models). In this stage, the PIL V&V level is achieved. 742

3 The dynamic HIL/Sensors test bench is logical extension of the PIL test benches (the PIL test bench is an integral part of the dynamic HIL/Sensors test bench, thus already including the GNC-SW). This test bench is the last step on the on-ground GNC validation and verification chain and provides real dynamic conditions reproduction that stimulates real HW sensors with air-to-air signals so as to achieve the maximum ground testing level (HIL level, TRL 5-6) regarding the achieved representativity of the flight conditions. This chain can provide (as demonstrated during ESA HARVD activity) invaluable support during the Design and Development phases and possibility to test V&V requirements already at early and intermediate design phases, allowing fast design iterations. Following Figure 1 presents a diagram with the cost-effective GNC DDVV approach. Dynamic HIL/ Sensors TB platform Final GNC SW at TRL 5/6 Level Design Development Validation Hardware in the loop (HIL) PIL Real-Time Processor in the Loop (PIL) GNC Requirements GNC Design FES sim Software in the Loop (SIL) Auto Code Generation Model in the Loop (MIL) GNC Prototype Generation Figure 1. Coherent, incremental, highly automated GNC Design, Development, Verification and Validation (DDVV) Approach. PLATFORM DYNAMIC TEST FACILITY platform is a dynamic test bench developed by GMV in the frame of the Spanish Space Program, has developed the PLATFORM test bench and based on the use of commercial robotic arms. The objective of this facility is the testing of GNC systems and sensors equipment, for several scenarios as Formation Flying, Rendezvous & Docking, Landing, and for robotic applications. The platform test bench allows the use of real sensors measurements in the loop with air-toair stimulation, obtained through the recreation of a real relative trajectory and attitude profile of two spacecraft (or one spacecraft in the presence of a planetary surface) by using numerically controlled robotic arms. 743

4 The real relative sensor devices can installed on-board the spacecraft mock-ups, so they experiment the same relative kinematics and produce the same measurements (including most of the error sources) as in the space environment. This system can be used to perform the validation of single sensors, or the validation of the entire GNC systems. In the second case, platform is used in combination with a PIL (processor-in-the-loop) real time test bench, in which the GNC onboard SW is executed inside a space representative target board, whereas the RW (Real World: dynamic&kinematic environment and actuators) is run inside a dedicated device for real time simulation. This way, platform test facility system allows the use of HIL (HW-in-the-loop), with the sensors measurements feeding the GNC algorithms which runs in the target board. The GNC computes the control actuations, which are passed to the RW and the relative kinematics computed in the RW is implemented by the robotic arms, closing the loop. platform System Architecture The architecture of platform test bench has been conceived in order to be highly modular and flexible so that new components can be added with minimum effort. Figure 2 shows the architecture scheme of platform system used for the real time HIL validation of a GNC SW. The specific components of the platform facility are the ones indicated in block number 2 of Figure 2: Mitsubishi PA1 robotic arm with its controller. This robotic arm is devoted to host the target spacecraft (usually the more passive scenario spacecraft/element) mockup. KUKA KR 15-2 mounted on a rail track, including the controller. This robotic arm is devoted to host the chaser (usually the more active spacecraft/element) mockup. Motion Control System, in charge of commanding and synchronizing the two robotic devices. These elements are connected from one side to the part which provides PIL capability and a kinematic profile to be implemented (indicated as block number 1 in Figure 2), and from the other side with the metrology sensor processor (the hardware included in the loop, indicated as block number 3 in Figure 2). It shall be noticed that the components recognized as block number 1 in Figure 2 can work in stand-alone mode as a PIL test bench and is normally used as previous step in the validation chain of the GNC SW. The PIL provides a real-time development and validation environment that allows running and testing the GNC SW in a space representative target processor. The PIL test bench allows: Assessing the algorithm s robustness to delays coming from synchronisation between Real World and GNC application. Checking time constraints in the data communication and algorithm execution on the real processor. Testing behaviour that cannot be tested in a non-real time environment (for instance, synchronisation, scheduling, memory management, time exception, thread priorities management). Assessing code performance: computational load, memory and code size. 744

5 With respect to the PIL test bench environment, the platform system adds the possibility of including the hardware metrology in the loop. This way, the measurements come from the real sensors, allowing the assessment of the effects of real HW behavior, including all the error sources and communication delays. Usually the sensor which is included in the loop is the most important for the relative navigation (e.g. the LIDAR or the optical camera), while the other sensors continue to be simulated inside the RW application. In order the metrology sensors to work properly with space representative behavior, space representative mock-ups (which depend on the scenario) are used. They shall be representative in shape and structure/coverage of the real spacecraft, since the external structure/coverage will impact on the accuracy of the sensors measurements. The platform motion control component interfaces with a real time simulator (based on the dspace COTS), with the two robotic devices controllers and with the illumination system. HIL LIDAR system LIDAR Acquisition System + Navigation Estimation 3 Canister Mock-up LIDAR KUKA KR C2 Controller (VxWorks) 2 ARCNET PA-1 Robot Controller Power Line Mitsubishi PA-1 KUKA KR 15-2 Track Motion System Power Line Mitsubishi PA-1 Control System (RTOS) Ethernet Link Ethernet Link Ethernet Link Ethernet Link Motion Control System (RTOS) platform Dynamic Test Facility Ethernet Switch Ethernet Link Development, monitoring and debugging system (RTW, RTI and Control Desk) Serial or Ethernet Link OBC monitoring and debugging system (GRMON) Operator Simulation Links Development, Monitoring or Debugging Links PHS-CAB5 PCI or Serial Link Real-Time Simulator (dspace) Serial or Ethernet Link Processor in the Loop (PIL) Test Facility Target Processor (LEON) 1 Figure 2. Architectural overview of specific platform components (block 2 in the figure) connected with PIL test bench (block 1) and sensor devices (block 3). 745

6 USE CASE: HARVD DYNAMIC HIL VALIDATION The HARvD (High Integrity Autonomous RVD Control System) activity includes design, prototyping and testing at three different levels (Functional Engineering Simulator, Real Time Test Benching and Dynamic Test Benching) of a complete GNC system for a generic rendezvous and docking/capture scenario. The development and validation activity follows the cost-effective DDVV approach described in previous paragraphs, applied as follows: The FES phase uses the Matlab/Simulink models and simulates the full system in no- Real Time. The simulation is performed in a single PC under Matlab/Simulink. The next step is the RT simulator (RVD-RT). Here, the Simulink models are converted into C code with the dspace tools and compiled. While the real world is simulated in a dspace Board (real time simulator), the on-board software is hosted in a LEON Board inside a Linux workstation. The RVD-RT is completely functional by itself, providing closed loop simulation capability through SW simulated sensors. Additionally, it provides the SW development environment for Real World models and GNC algorithms to be run in the onboard processor, and a simulation control. The last step is the RVD-DYN Test Bench. In addition to the RT simulator, the sensor measurements are provided using real sensors stimulated through dynamic platforms fed by the dynamic and kinematics conditions (position, velocity, attitude and attitude rates) generated with the simulated RW, while the on-board software runs in the LEON Board. The RVD-DYN is based on the platform facility and uses dedicated scenario dependent mock-ups and dedicated sensor HW, specifically selected for the scenarios reproduced. Figure 3 shows two different types of mock-ups used as target for a LIDAR (Light Detection And Ranging) sensor and a visual based sensor; they are equipped with retro-reflectors especially selected for the LIDAR sensor. They are held by the Mitsubishi PA1 robot. Figure 3. Target mock-ups (Left: MSR sample canister; Right: Earth servicing scenario spacecraft with IBDM docking mechanism mock-up; Note: mock-ups images not in the same scale). 746

7 The sensors electrical models mounted on board the mock-up (held by the KUKA robotic arm in Figure 4) are: Imaging Lidar Technology (ILT) LIDAR bread board from JenaOptronic/ESA, for fine range and lateral measurements. Optical navigation camera (from GMV), for acquiring relative navigation observations with real image processing function. The current configuration of the platform infrastructure has an operational range of about 15m. So, for reproducing the HARVD scenarios, two scale factors (mock-ups resizing) have been used: 1/35 for far ranges between ~45m (including a robotic arm safety margin) and 35m 1/3 for close ranges below 35m (see Figure 4). Figure 4. RVD-DYN tests. 747

8 USE CASE: HARVD PROCESSOR IN THE LOOP (PIL) AND DYNAMIC HW IN THE LOOP (HIL) VALIDATION RESULTS Model in the Loop (MIL) Test Results and Validation The integration of the HARVD Control system models within the FES (Functional Engineering Simulator), verification of the integration, validation of the full FES simulator, together with the use of the FES for the HARVD test campaign running, results analysis and derivation of conclusions has been performed. An example of the test cases graphical results (corresponding to 1 MonteCarlo cases) is included hereafter. All the runs lead to a successful capture of the sample. The maximal lateral error is about 1 cm but could be reduced to about 5 cm by a retuning of the guidance parameters in order to remove the capture mechanism bias. The Montecarlo results show that the specification of 2 cm and 4 cm/s are fulfilled with great margins. Figure 5. MSR capture final trajectories. Figure 6. MSR capture position error (zoom on the right). 748

9 Processor in The Loop (PIL) Test Results and Validation Within ESA HARVD activity, an extensive test campaign at all levels have been performed. The following table shows the definition of the most representative test cases and scenarios for the Processor in The Loop (PIL) test campaign. Table 1. Definition of GNC Validation Test Cases for Processor in The Loop (PIL) Test Campaign. MSRC_C MSRC_E MSRD_E MSRD_E 1 MSRD_E 2 MSRD_E 3 RVDM_C RVDM_C 1 RVDM_E RVDM_E 1 MSRC_C_3_1 MSRC_C_3_4 MSRC_C_3_7 MSRC_T_3_14 Mars Sample Return (MSR) Nominal Scenarios MSR capture scenario on a circular orbit (5km, 3 inclination). The chaser is initialized at long range (~3 km) from the target, with an initial difference in semi-major axis of 5 km. The target is the sample container which has no attitude control. MSR capture scenario on an elliptical orbit (3 x 22km, 3 inclination). The chaser is initialized at long range (5km) from the target. The target is the sample container which has no attitude control. Elliptic (3 x 22km, 3 inclination) MSR docking (with MAV) scenario with final approach direction along X- bar. The chaser is initialized on V-bar at ~2 km behind the target (-x axis) with an initial out of plane error. Elliptic (3 x 22km, 3 inclination) MSR docking scenario with final approach direction along V-bar (instead of X-bar seen in the previous case). Note that V-bar and X-bar directions are different in an elliptic orbit. Equal to MSRD_E 1, except for forced motion and docking approach direction, which in this case is R-bar instead of V-bar. Equal to MSRD_E 1 and MSRD_E 2, but in this case the target satellite follows an inertial pointing (the forced motion approach direction shall be fixed in the inertial frame in order to follow the docking port) Earth RdV and Docking Demo Mission (RVDM) Nominal Scenarios RVDM docking scenario on a circular orbit (Earth orbit, 56km altitude). The chaser is initialized at long range (3km) from the target. The target is a vehicle which has its own attitude control. Docking is done along X-bar. RVDM docking scenario on circular orbit (Earth orbit, 56km altitude). The chaser is initialized at short range from the target. The target is a vehicle with its own attitude control. The docking is done along an inertial direction. RVDM docking scenario on an elliptical orbit (Earth orbit, 5 x 62km). The chaser is initialized at long range from the target. The target is a vehicle which has its own attitude control. The docking axis is X-bar. Elliptic RVDM scenario (Earth orbit, 5 x 62km) from short range (hopping + forced motion). The chaser is initialized on V-bar at ~35m behind the target (-x axis). The docking is done along V-bar which is slightly different from X-bar due to the elliptic shape of the orbit. Mars Sample Return (MSR) Contingency Scenarios Same as MSRC_C, but during the final forced motion, at 11.5 m from the target, an erroneous (e.g. valve failure) delta V is applied making the trajectory unsafe (~3 cm/s toward target instead of nominal 1 cm/s). A Collision Avoidance Manoeuvre (CAM) is autonomously commanded and the scenario concludes with flyaround and recovery actions. Same as MSRC_C, but during the final forced motion, a retreat command is received from ground. The safe distance is reached through a backward forced motion and a station keeping is commanded. Then, during the station keeping an alarm of attitude not safe is injected (by reducing the maximum radiator temperature), leading to Short Term Recovery Plan triggering (CAM is commanded, taking the chaser to a farer safe distance (~4 m); a fly-around manoeuvre is computed and applied to avoid further drifting; finally, a safe mode is commanded). After a certain period in safe mode, the mission is resumed. Several actuators failures (wheels and thrusters) are simulated in order to check the good behaviour of the Failure, Isolation and Recovery (FIR) system. MAV failure and Sample Continer orbital injection in an non-nominal orbit (218 x 5km). The MSR Orbiter (chaser) performs an orbital synchrnonization from nominal capture orbit into the non-nominal MAV injection orbit. The following Figure 7 to Figure 1 show the results for the first test case (MSRC_C ) as from the SW-in-the-Loop (SIL) GNC SW test (blue lines) and from the Processor-in-the-Loop (PIL) GNC SW test. Figure 7 shows the resulting Rendez-vous and Capture trajectory from 3 km distance. Figure 8 shows a zoom of the in-plane (X-Z) trajectory for the last kilometers. A difference between SIL and PIL resulting trajectory can be observed due to small numerical differences. In this case, those differences in the Orbit Synchronization phase 749

10 provokes that the trajectory obtained with the PIL does not cross the along track axis (while the reference SIL trajectory crosses along track for the first holding point). This provokes a slightly different answer at translational guidance decision. The final result is the same in both cases after matching in later defined hold points. Figure 9 shows the propellant consumption along the time. Figure 1 shows the final capture performances in terms of lateral displacement. Z axis (m) x R_rel_dyn tof_v_tgt_chs SIL RVD-RT/RASTA X axis (m) x x 14 Y axis (m) X axis (m) Figure 7. MSRC_C -Approach trajectory. -3 x 1 5 R_rel_dyn tof_v_tgt_chs Z axis (m) SIL RVD-RT/RASTA X axis (m) Figure 8. MSRC_C -Approach trajectory (zoom). Propellant consumption (kg) R_thr_dm (difference 2%) SIL RVD-RT/RASTA Chaser spacecraft Z axis (m) MSR Capture performance: position misalignment on +X face Target center in SIL Target center in RVD-RT/RASTA 2 cm requirement Basket aperture (1m) time (s) x 1 4 Figure 9. MSRC_C -Propellant consumption Chaser spacecraft Y axis (m) Figure 1. MSRC_C -Capture position performance. 75

11 Some small differences have been detected between the SIL and the PIL (RVD-RT/RASTA) test results, due principally to: Numerical errors coming from the use of different HW platforms (including operating system and compiler) and mathematical libraries: o o SIL: GNC is run on a PC computer using the OS mathematical libraries. PIL (RVD-RT/RASTA): GNC is run on the main RASTA processor (LEON2, GR-CPCI-AT697@8MHz) using the RTEMS mathematical libraries. Small delays coming from the RT conditions (limited to one time step). In general, the PIL (RVD-RT) test campaign has provided satisfactory results in all cases (the general behavior has been as the expected one): Approach trajectories are correct (do not present strange/unexpected behaviors). The docking/capture performances fulfill the requirements. The propellant consumptions and scenario durations are very similar to what obtained with the reference SIL results. The following table presents a summary of the results of all the test cases in terms of scenario duration and propellant consumption (capture/docking final condition is successful in all cases). Minimum deviations are observed between the SIL and the PIL (RT) GNC SW test cases. Table 2. Processor in The Loop (PIL) Test Results and Validation. Test Case Capture / Docking Performance Contingency / Recovery Success Scenario Duration [sec] Propellant Consumption [Kg] SIL PIL Diff SIL PIL Diff MSR Nominal Scenarios MSRC_C YES n/a % % MSRC_E YES n/a % % MSRD_E YES n/a % % MSRD_E 1 YES n/a % % MSRD_E 2 YES n/a % % MSRD_E 3 YES n/a % % RVDM Nominal Scenarios RVDM_C YES n/a % % RVDM_C 1 YES n/a % % RVDM_E YES n/a % % RVDM_E 1 YES n/a % % MSR Contingency Scenarios MSRC_C_3_1 YES YES % % MSRC_C_3_4 YES YES % % MSRC_C_3_7 YES YES % % MSRC_T_3_14 n/a YES 3 3 % % 751

12 Dynamic HW in The Loop (HIL) Test Results and Validation The following table shows the definition of the most representative test cases and scenarios for the Dynamic HW in The Loop (HIL) test campaign. Table 3. Definition of GNC Validation Cases for Dynamic HW in The Loop (HIL) Test Campaign. MSRC_C DYN MSRC_E DYN MSRD_E DYN MSRD_E 1_DYN MSRD_E 2_DYN MSRD_E 3_DYN RVDM_C DYN MSRC_C_3_1_DYN MSRC_C_3_3_DYN MSR Nominal Scenarios Corresponds to the last 45 m of MSRC_C (Sample Container capture in Mars circular orbit). The chaser is initialized at ~45 m from the target in along-track direction. Corresponds to the last 45 m of MSRC_E (Sample Container capture in Mars elliptical orbit). The chaser is initialized at ~45 m from the target in along-track direction. Corresponds to the last phase of MSRD_E (MAV docking in Mars elliptical orbit with final approach direction along X-bar). The chaser is initialized at a hold point ~1 m from the target in along-track direction. Corresponds to the last phase of MSRD_E 1 (MAV docking in Mars elliptical orbit with final approach direction along V-bar). The chaser is initialized at a hold point ~1 m from the target in along-track direction. Corresponds to the last phase of MSRD_E 2 (MAV docking in Mars elliptical orbit with final approach direction along R-bar). The chaser is initialized ~25 m from the target in along-track direction. Corresponds to the last phase of MSRD_E 3 (MAV docking in Mars elliptical orbit with final approach direction along an inertial direction). The chaser is initialized ~25 m from the target in along-track direction. RVDM Nominal Scenarios Corresponds to the last phase of RVDM_C (RVDM demo mission docking in Earth circular orbit with final approach direction along X-bar). The chaser is initialized ~45 m from the target in along-track direction. MSR Contingency Scenarios Corresponds to MSRC_C_3_1 (Sample Container capture in Mars circular orbit, failure delta V is applied making the trajectory unsafe at 11.5 m from the target, Collision Avoidance Manoeuvre (CAM) is autonomously commanded and the scenario concludes with fly-around and recovery actions). Corresponds to MSRC_C_3_4 (Sample Container capture in Mars circular orbit, retreat command from ground during final approach to capture, fast recovery and mission completion), without the injection of an alarm about attitude not safe. Within the dynamic HIL test campaign, it has been noticed some relevant discrepancies between the metrology modelling assumption used to design the HARVD GNC (and to validated through the PIL test campaign) and the physical ILT LIDAR working features, namely: ILT LIDAR laboratory breadboard working rate is 1Hz, while design assumption was 1Hz. Large delay between the ILT LIDAR measurement generation and the availability of the LIDAR navigation estimation for the HARVD GNC SW application (> 1sec), while small delays were expected. The main outputs and conclusions of the dynamic HIL test campaign are: Relative trajectory are as expected, which demonstrates the HARVD GNC design robustness and GNC SW Demonstrator robustness in front of conditions for which it was not designed (for instance LIDAR working rate at 1Hz). The capture/docking performance are compromised in some cases due to the LIDAR measurement delays (e.g. MSRC_E DYN). No meaningful differences are found in the scenario duration comparison. The most significant differences are found for capture scenarios in circular orbit. 752

13 A delay in the relative LIDAR measurements for elliptical scenarios changes significantly the relative conditions to be estimated. It forces to correct the hopping trajectory with higher actuations in such way that the final trajectory is significantly different and the propellant consumption is higher. Capture/docking is successfully achieved. LIDAR measurement delay and LIDAR working rate impact on the Station Keeping performance. A degradation of the Station Keeping performance leads to a degradation of the accuracy control and a reduction of the number of actuations to maintain this accuracy. Therefore, it reduces slightly the propellant consumption (as result of a degraded working). Following Table summarizes the HARVD GNC performance obtained in the dynamic HIL test campaign with ILT LIDAR laboratory breadboard in the loop. Some comparison data w.r.t PIL test campaign results have been included (Diff column). Despite the LIDAR anomalous working mode, the dynamic HIL test campaign results can be considered as very good. Table 4. Dynamic HW in The Loop (HIL) Test Results and Validation. Test Case Relative Trajectory as expected Capture / Docking Performance * Scenario Duration [sec] Propellant Consumption [Kg] PIL DYN-HIL Diff PIL DYN-HIL Diff MSR Nominal Scenarios MSRC_C DYN YES YES % % MSRC_E DYN YES NO % % MSRD_E DYN YES YES % % MSRD_E 1_DYN YES YES % % MSRD_E 2_DYN YES YES % % MSRD_E 3_DYN YES YES % % RVDM Nominal Scenarios RVDM_C DYN YES YES % % MSR Contingency Scenarios MSRC_C_3_1_DYN YES n/a % % MSRC_C_3_3_DYN YES n/a % % This DYN-HIL test campaign has shown the robustness of the HARVD GNC to the use of real metrology sensors equipment (dynamically stimulated), in this case the ILT LIDAR laboratory breadboard in the loop. It is important to highlight the laboratory breadboard character of the used metrology equipment, and the feedback of the DYN-HIL test campaign results towards the identification of significant constraints and limitations to be upgraded/solved with respect to the future flight equipment. It can be concluded that the DYN-HIL test campaign has provided in general very good results (the general behavior has been as the expected one): Approach trajectories are correct (do not present strange/unexpected behaviours). The docking/capture performances fulfil the requirements. * LIDAR measurement delays may compromise the expected capture performance as it is shown in test MSRC_E DYN. For docking scenarios propellant consumption is reduced as consequence of Station Keeping performance degradation during the alignment of the chaser w.r.t the chaser docking port. 753

14 The scenario durations are very similar to the reference PIL results. The propellant consumptions have discrepancies w.r.t the reference PIL results easily justifiable based on the identified ILT LIDAR working discrepancies. CONCLUSIONS An incremental nested design/validation loop has been used and demonstrated during the ESA HARVD activity. The final use of Dynamic HW-in-The-Loop (DYN-HIL) test facility has allowed to realistically test and validate the full GNC system (including the physical sensor/s and interfaces) with space representative dynamics, air-to-air sensors stimulation, and with representative real-time Avionics platform. The abovementioned use of a physical LIDAR breadboard has allowed to identify mismodeling assumptions between the theoretical LIDAR model and the real physical one and to assess and evaluate the impact of the physical sensor behavior into the GNC system design and the GNC SW implementation. The result is twofold: On one side, the HARVD GNC system has been tested in realistic conditions, reaching a higher reliability and maturity of the system, till TRL 5 (with respect to achieved TRL 3/4 level if not using a dynamic HIL test facility). On the other side, a feedback on the LIDAR prototype has been provided with respect to the needed upgrades/re-design of the prototype towards a final flight unit). As main conclusion, Dynamic HIL test bench has demonstrated, in the scope of the ESA HARVD activity and scenarios (MSR Capture and Earth in-orbit servicing), to be a very costeffective solution towards increasing the validation level and maturity of GNC systems and GNC sensors, and to reduce the gap between on-ground validation and in-flight validation/use. Finally, it is possible to state that the described approach is fully applicable to other similar scenarios, such as Formation Flying scenarios (e.g. different metrology levels equipment and Formation Flying system, including GNC/FDIR) and Active Debris Removal (ADR) scenarios within the Clean Space initiative (e.g. capture/berthing/grasping mechanisms systems and proximity/synchronization GNC systems). REFERENCES 1 Matteo Suattoni, Luis Mollinedo, Valentín Barrena, Pablo Colmenarejo, Thomas Voirin, "Use of COTS Robotics for On-Ground Validation of Space GNC Systems: platform Dynamic Test Bench" 11 th International Symposium on Artificial Intelligence, Robotics and Automation in Space (i-sairas), Turin, Italy, 4-6 Sept Colmenarejo, P. et Al.. Autonomous GNC Rodmap for Mars Sample Return Mission. Global Space Exploration Conference 212, May 212,Washington DC, USA. 3 Strippoli, L. et al., High Integrity control system for generic autonomous RvD. 61 st International Astronautical Congress, October 21, Prague, CZ. 4 Colmenarejo, P. et al., HARVD Development, Verification and Validation Approach (from Traditional GNC Design/V&V Framework Simulator to Real-Time Dynamic Testing). 7th International ESA Conference on Guidance, Navigation & Control Systems, 2-5 June 28, Tralee, County Kerry, Ireland. 5 JenaOptronik. Imaging Lidar Technology User Manual. 25/1/