Design, Development, Validation and Verification of the HERA GNC subsystem

Space missions like HERA, require fast and adaptive reactions to external stimuli that can only be obtained with higher level of on-board autonomy. Because of such requirements, Guidance Navigation and Control technologies are increasing in complexity and, therefore, demand a more structured validation plan, to be started already during the preliminary stages of the mission. The critical review of requirements allows for the derivation of GNC subsystem specification and for a preliminary design of GNC modes and functions necessary to achieve mission objectives. First step is functions unitary testing, but using previous experience and heritage, in HERA it has been possible to test the algorithms in a representative closed loop GNC prototype already in phase A-B1. Model-In-the-Loop simulations demonstrate the feasibility of the preliminary design and the robustness of the selected solutions using Monte Carlo test campaigns. A fast prototyping based on autocoding is performed as the following step, verifying the GNC code in Software-In-the-Loop tests. To demonstrate the feasibility of the design, the Processor-In-the-Loop step is then a key point of the incremental validation to verify the behaviour of the GNC code in a representative Hardware and to identify the computational resources required, through code profiling. At this stage it is possible that specific function/algorithm (e.g. Image Processing) turns out to be too demanding for a space qualified processor like a LEON. In this case, a HW-SW co-design is performed to get advantage of the HW acceleration that an FPGA can offer. An estimation of the required resources and HW units is an essential input for Spacecraft system to perform budget activities and interfaces between subsystems. In HERA an emulated on-board computer has been used to assess the computational cost of the GNC and IP functions and the HW-SW co-design has been implemented through a specific experimental unit, called Image Processing Unit (IPU). In the final stage of the incremental validation, Hardware-In-the-Loop is performed in the GNC Avionic Test bench, with engineering models of the on-board computers and of the navigation camera. Three environments have been foreseen for the HIL tests: the GNC-ATB placed in an optical test bench where the images are generated on a high-resolution screen and only a picture of it is taken; the SC-ATB in which the GNC Subsystem is integrated with all the other subsystems; the SC-PFM in which the integration is performed using the flight models the units. This paper will include the details on GMV DDVV approach adopted in HERA, which allows to perform end-to-end GNC simulations at very early phases of the mission to bring into considerations aspects normally not really considered in detail till later mission phases. The process goes from Matlab/Simulink implementation till the qualification of the subsystem in the GNC-ATB environment. GMV standard allows (through very fast iteration loops and full algorithms/SW coherence approach, using autocoding) algorithms updates/iteration till phases where they should be nominally frozen, gaining flexibility. This agile environment is considered to be essential in a tight schedule mission like HERA.