When a payload separates from the launcher upper stage, even a small failure can cause unanticipated events. A broken spring or a misfiring pyrotechnic fastener, for example, can send the payload into an unplanned spin. In the past, a separate engineering group analyzed separation mechanics and provided the control engineers with written results.

ESA and Airbus wanted to simulate separation failures with a physical model in order to test the controller’s ability to detect failures and undertake corrective action. They also needed to simulate sloshing propellant, leaks in pipelines, stuck valves, and a range of other faults. In addition, they wanted to run optimizations to identify the worst-case performance of the system should faults occur.

ESA and Airbus engineers sought to test their control algorithms on flight computer hardware as early as possible in development. As control algorithms grow in complexity, they push the limits of processor performance and other computing resources. The engineers needed to verify algorithm performance and resource utilization on a representative flight computer while the controller was being designed, when it would be easiest to correct problems.

ESA and Airbus engineers used Model-Based Design with MATLAB and Simulink to create the USACDF, which enables closed-loop simulation and verification of control algorithms with physical models.

Working in Simulink, the engineers were able to compensate for dynamic unbalance caused by uneven distribution of propellant. They coupled the plant model to a computational fluid dynamics (CFD) solver to analyze the effects of propellant sloshing via closed-loop simulations.

Using Simulink Design Optimization™ they performed optimizations to find the worst-case scenario of the separation process by identifying values for the mass, center-of-gravity offset, and other system uncertainties that maximize the pointing error of the system.

A mission and vehicle management state machine was developed in Stateflow^® to model the sequential decision logic for normal operations and failure modes.

The team added comments to the model and used Requirements Toolbox™ to link elements of the model to system requirements defined in a Microsoft^® Word^® document. Later, the team used Simulink Report Generator™ to create documentation that incorporated the comments, the linked requirements, and the simulation results for each requirement.

The engineers used Simscape Multibody™ to create a 3D mechanical model of the separation mechanism and Simscape Fluids™ for models of the pipelines and valves for the cold gas and hydrazine thrusters. Their Simscape model included pipeline leaks, stuck valves, and other separation malfunctions. This enabled them to exercise their control algorithms more completely.

Using Embedded Coder^®, they generated C code from their controller model, and checked the code for run-time errors using Polyspace Bug Finder™. After verifying this code with software-in-the-loop tests, the team used it to conduct real-time tests on dSPACE^® hardware and later processor-in-the-loop (PIL) tests on ESA LEON2 processors.

The resulting USACDF is used to build demonstrators for complex orbital servicing mission operations concepts.

• Design iterations reduced from one week to one day. “With Model-Based Design I can complete in one day design iterations that would take a week with our former approach,” says Hans Strauch, senior GNC expert at Airbus. Bennani adds, “We need less iteration than we did before because we can perform simulations that span multiple domains.”
• Failure modes modeled and eliminated. “Closed-loop simulations in Simulink enabled us to answer questions at the system level that we were previously unable to answer in such an exact way,” Bennani says. “We can explain to the system engineer where problems could arise during complex operations and show at a high level the effect of specific design choices.”
• Comprehensive design framework established. “Model-Based Design enabled us to create a framework for designing flight controllers with state-of-the art robust control design algorithms, creating multidomain physical models, tuning the design through optimization, and generating code for PIL testing on target hardware—all in the same environment,” says Strauch.