ESA GNC Conference Papers Repository

The terminal phase of a rendezvous is critical, as any fault can lead to a collision. Fault tolerance is thus essential, especially when the distance to the Earth prevents real-time ground monitoring and ground reactions. This paper deals with the terminal rendezvous between the Mars Sample Return (MSR) Orbiter and the Orbiting Sample (OS) around Mars. The overall fault tolerant approach is presented: robust Fault detection and isolation (FDI) algorithms, robust controller, and various strategies of reconfiguration. A robust model-based H-infinity/H- filter is used for the thruster fault detection, and Unknown Input Observers are used for the thruster fault isolation. The controller is designed with the structured H-infinity technique. The robustness is analyzed with m-analyses approaches. These elements are parts of the GNC (Guidance, Navigation, Control) fault tolerant Onboard Software demonstrator that is developed for the whole rendezvous. Some design challenges are provided, as well as the most interesting results obtained on the high-fidelity simulator.