ESA GNC Conference Papers Repository

The ExoMars program is part of a cooperation between ESA and Roscosmos, that foresees two missions to Mars with Thales Alenia Space Italia (TAS-I) as European Prime contractor. The first mission, to be launched in 2016 and currently closing the CDR process, is composed of a Trace Gas Orbiter (TGO) and of an Entry, Descent and Landing (EDL) Demonstrator Module (EDM). The main objectives of 2016 EDL Demonstrator are: 1) to demonstrate the European capability of landing on Mars and 2) to embark and validate EDL system technologies suitable for delivering science surface payloads. TAS-I is responsible for the GNC system of the EDM. This paper describes the aspects relevant to the validation and verification of the EDM GNC design and SW, according to three steps: analytical verification, simulation campaign and tests, organized in such manner to follow an incremental approach. For each of these steps the verification and validation rely on specific verification benches, each defined in such manner to answer to the peculiar need of the involved area. The analytic verification exploits a dedicated simplified EDM Surface Platform (ESP) simulator permitting the usage of every automatic tool of control design and robustness analysis on separate Attitude and Descent control loops but without neglecting the coupling among them. The simulation verification is based on a detailed modelisation of the system (End-to- End E2E simulator) aimed to implement in the course of the program, as soon as they are available, all the elements identifying the realistic behaviors of the system dynamics, at every level. The test verification uses two benches: the Software Validation Facility (SVF), dedicated to the ASW debugging and the Avionic Test Bench (ATB) more oriented to the verification of the ASW integrated with the real Hardware (CTPU, CAN bus, RTPU, Radar Emulator, IMU). This paper illustrates the architectures of these benches and reports some results of the verification and validation process, particularly related to the analytic verification, that exploits an integrated classical-modern approach to check the robustness of the GNC design both in terms of robust stability and robust performance.