ESA and Airbus Create Upper-Stage Attitude Control Development Framework Using Model-Based Design

Challenge

Speed the development of software for controlling complex launcher upper stage missions including the attitude of satellite payloads after they separate from ESA launch vehicles

Solution

Use Model-Based Design to develop controller models and multidomain physical models, run closed-loop simulations, and generate code for PIL testing

Results

Design iterations reduced from one week to one day
Failure modes modeled and eliminated
Comprehensive design framework established

“Model-Based Design multiplies the range of capabilities that I have as an engineer. As an individual control engineer I can do what previously took a handful of engineers, because I can create and simulate my own multidomain models. I don’t have a wall around me anymore; I am able to better communicate and contribute across disciplines.”
Hans Strauch, Airbus D&S

Propellant motion in spinning upper stages at 46, 350, and 600 seconds. Distribution after 350 seconds becomes uneven.

When a European Space Agency (ESA) launcher, such as the Ariane 5 or Vega, delivers its satellite payload into orbit, the attitude control system (ACS) takes control, orients the payload, and commands the separation from the upper stage of the launcher. In addition to orienting the satellite, the ACS must identify and manage problems associated with the separation process, the sloshing of propellant, and a wide range of potential hardware faults.

The ESA Future Launcher Preparatory Programme (FLPP) evaluates novel technologies that increase launcher capabilities at reduced costs. A special FLPP project dedicated to develop an Upper Stage Attitude Control and Design Framework (USACDF) has been put into place for development of future complex orbital missions. The framework was developed using Model-Based Design with MATLAB^® and Simulink^® and includes multidomain physical models of separation mechanisms, thermodynamics-based propulsion, and CFD-based fuel tank fluid sloshing, enabling closed-loop, system-level simulation of the control software in normal operation and under fault conditions.

“In the past, it was difficult for control engineers to switch between and integrate domain-specific fluid dynamics, mechanics, thermal, propulsion, and other disciplines,” says Samir Bennani, guidance navigation and control system engineer at ESA. “Model-Based Design enables us to span multiple disciplines and use one environment for the entire process, from tracing specifications to the design through validation with processor-in-the-loop testing.”

Challenge

When a payload separates from the launcher upper stage, even a small failure can cause unanticipated events. A broken spring or a misfiring pyrotechnic fastener, for example, can send the payload into an unplanned spin. In the past, a separate engineering group analyzed separation mechanics and provided the control engineers with written results.

ESA and Airbus wanted to simulate separation failures with a physical model in order to test the controller’s ability to detect failures and undertake corrective action. They also needed to simulate sloshing propellant, leaks in pipelines, stuck valves, and a range of other faults. In addition, they wanted to run optimizations to identify the worst-case performance of the system should faults occur.

ESA and Airbus engineers sought to test their control algorithms on flight computer hardware as early as possible in development. As control algorithms grow in complexity, they push the limits of processor performance and other computing resources. The engineers needed to verify algorithm performance and resource utilization on a representative flight computer while the controller was being designed, when it would be easiest to correct problems.

Solution

ESA and Airbus engineers used Model-Based Design with MATLAB and Simulink to create the USACDF, which enables closed-loop simulation and verification of control algorithms with physical models.

Working in Simulink, the engineers were able to compensate for dynamic unbalance caused by uneven distribution of propellant. They coupled the plant model to a computational fluid dynamics (CFD) solver to analyze the effects of propellant sloshing via closed-loop simulations.

Using Simulink Design Optimization™ they performed optimizations to find the worst-case scenario of the separation process by identifying values for the mass, center-of-gravity offset, and other system uncertainties that maximize the pointing error of the system.

A mission and vehicle management state machine was developed in Stateflow^® to model the sequential decision logic for normal operations and failure modes.

The team added comments to the model and used Simulink Requirements™ to link elements of the model to system requirements defined in a Microsoft^® Word^® document. Later, the team used Simulink Report Generator™ to create documentation that incorporated the comments, the linked requirements, and the simulation results for each requirement.

The engineers used Simscape Multibody™ to create a 3D mechanical model of the separation mechanism and Simscape Fluids™ for models of the pipelines and valves for the cold gas and hydrazine thrusters. Their Simscape model included pipeline leaks, stuck valves, and other separation malfunctions. This enabled them to exercise their control algorithms more completely.

Using Embedded Coder^®, they generated C code from their controller model, and checked the code for run-time errors using Polyspace Bug Finder™. After verifying this code with software-in-the-loop tests, the team used it to conduct real-time tests on dSPACE^® hardware and later processor-in-the-loop (PIL) tests on ESA LEON2 processors.

The resulting USACDF is used to build demonstrators for complex orbital servicing mission operations concepts.

Results

Design iterations reduced from one week to one day. “With Model-Based Design I can complete in one day design iterations that would take a week with our former approach,” says Hans Strauch, senior GNC expert at Airbus. Bennani adds, “We need less iteration than we did before because we can perform simulations that span multiple domains.”
Failure modes modeled and eliminated. “Closed-loop simulations in Simulink enabled us to answer questions at the system level that we were previously unable to answer in such an exact way,” Bennani says. “We can explain to the system engineer where problems could arise during complex operations and show at a high level the effect of specific design choices.”
Comprehensive design framework established. “Model-Based Design enabled us to create a framework for designing flight controllers with state-of-the art robust control design algorithms, creating multidomain physical models, tuning the design through optimization, and generating code for PIL testing on target hardware—all in the same environment,” says Strauch.