DEPARTMENT OF THE AIR FORCE SMC PAMPHLET 800-4

Headquarters, Space and Missile
System Organization (AFMC)

Los Angeles Air Force Base, CA 90009-2960 16 May 1993

Acquisition Management

INDEPENDENT STABILITY AND CONTROL ANALYSES OF SPACECRAFT AND LAUNCH VEHICLES

This pamphlet recommends practices and serves as a guide for implementing the SMC Commander’s Policy on “Independent Stability and Control Analyses of Spacecraft and Launch Vehicles.” For each space and missile program, the vehicle and payload contractors have the primary responsibility for performing sufficient stability, control, and dynamics analyses to assure satisfactory dynamic performance of their respective portions of the vehicle. These analyses are to be validated by an independent contractor in order to assure their completeness and correctness. This pamphlet is intended for program management and the independent contractors to specifically determine the required baseline documentation and the most effective possible verification program.

1. INTRODUCTION:

a. The purpose of this document is to recommend practices and serve as a guide for implementation of SMC Commander’s Policy “Independent Stability and Control Analyses of Spacecraft and Launch Vehicles.” The elements of an “independent dynamic verification” (as the policy is referred to), schedules, management procedures, and data requirements are discussed.

b. For each program, the vehicle and payload contractors have the primary responsibility for performing sufficient stability, control, and dynamics’ analyses to assure satisfactory dynamic performance of their respective portions of the vehicle. The thrust of this policy is that, wherever possible, these analyses are to be validated by an independent contractor in order to assure their completeness and correctness, and insure against errors, omissions, and fallacious assumptions which may later impact the mission or launch success. The elements of an independent dynamic verification program are described in the following paragraphs, and management guidelines for implementing such a program are discussed in subsequent paragraphs.

c. Companion documents to this pamphlet are 1) MIL-M-38310B (USAF) on Mass Properties Control Requirements for Missile and Space Vehicles, and 2) AFSC/AFLC Pamphlet 800-5 on Software Independent Verification and Validation.

2. ELEMENTS OF AN INDEPENDENT DYNAMIC VERIFICATION PROGRAM.

This paragraph describes the elements of an independent dynamic verification program in terms general enough to be applicable to boosters and satellites. More detailed discussions of dynamic verification for these classes of vehicles are given in attachment 1.

a. Criteria. In order to provide the desired assurance of satisfactory dynamic performance, the tasks described below are structured to meet the following criteria for independence and completeness:

(1) Analytically derived models should be derived independently, from engineering drawings, schematic diagrams, circuit diagrams, etc.

(2) Tests used to generate models or to validate analytically derived models generally need not be repeated by the independent verification contractor; however he should concur in the test planning and execution, and should certify the authenticity and execution of the results. In a few special cases, where modeling fidelity is critical to evaluation of performance, it may be desirable to perform independent tests.

(3) Simulations and other analytical tools should be developed independently.

(4) All mission phases and events should be analyzed.

(5) All vehicle operating modes and mode transitions should be considered, including transition to and recovery from back-up modes, where appropriate (includes failure mode investigations).

(6) Dynamic performance should be evaluated over all reasonable ranges of system parameters as contractually defined.

(7) Results should be compared with vehicle and payload contractor results, and any significant differences resolved.

b. Tasks. The tasks comprising an independent dynamic verification can be grouped into the following categories: Model development and verification; Simulation tool development and dynamic performance verification by simulation; and Supporting analyses. These are discussed separately below:

(1) Model Development and Verification. If the dynamic verification activity is to yield a high level of confidence in vehicle dynamics and control performance, it is essential that the analytical models used accurately represent the vehicle and payloads as they are flown. Models must be developed for the vehicle and payload dynamics, operating environment, flexible-body effects, aerodynamics (including ablation and thermal effects), guidance and control components, mass properties, fluid-motion effects, and propulsion including reaction jet plume impingement on body and solar arrays and/or antennae. These models are developed by both analysis and test. Analytically derived models are developed from engineering drawings, component descriptions, functional and circuit diagrams, and other descriptive material provided by the vehicle and payload contractors. The models are derived in sufficient generality (in the case of vehicle dynamics, for example) that flexibility and fluid-motion effects, and detailed aerodynamics can be incorporated as they become available, without major reformulation of the models. In some cases, models are taken directly from test results (thrust-time profiles for rocket motors or attitude control thrusters, for example). In other cases test results are used only for verification and cross-checking of analytically derived models (filter transfer functions or control logic functional characteristics, for example). In cases where models based on theory and/or test involve considerable uncertainty, such as reentry aerodynamics, it is particularly important that the effects of these model uncertainties be evaluated.

(2) Simulation Tool Development and Dynamic Performance Verification by Simulation:

(a) Using the analytical models discussed in the previous section, several simulations applicable to all mission phases and tailored to various special purposes are developed. A very detailed simulation is normally required to validate high-frequency short-term dynamics. Simplified simulations are required for special purposes, such as fuel consumption and parameter variation studies, for which the slower-running detailed simulation would be prohibitively expensive. A mixed simulation, using flight equivalent control electronic/computers, is very useful for verifying detailed hardware models and for failure-mode investigations.

(b) Using these simulations, vehicle dynamic performance during all mission phases is investigated. This is a continuing process which starts as soon as the first versions of the simulations become operational, and continues as additional modeling sophistication is added. At each stage, the simulation results and vehicle design evolution guide the further development of the simulations. Operation over the anticipated range of parameter variations is studied in considerable detail. In the case of gimbaled or articulated payloads, the interactions between the payload dynamics and servos and the vehicle attitude dynamics and control system are evaluated, for both nominal and failed conditions. Operation in various failed modes is simulated, including transition to and recovery from these modes. Definition of the failed mode cases to be run requires consideration of the various types of failures which can occur, and is aided considerably by the detailed mechanization analysis used to develop the control hardware analytical models, and by the flight equivalent electronics and mixed-simulation results. Failure cases can also be identified from software flow diagrams.

(c) Vehicles which utilize on-board digital computers may present a requirement for flight software verification and validation. To the extent that guidance and control logic is implemented in the computer, this process interacts with dynamic verification. It consists of verification of software requirements, design, and code/data as well as modeling the computer and its software in sufficient detail to encompass all possible interactions with the system dynamics, and to verify satisfactory performance over the entire mission profile, including off-nominal conditions. Round-off and timing effects on the dynamics must be evaluated under worst-case conditions. Test cases must be constructed which exercise all software logic paths related to guidance and control functions, as part of the software validation. Vehicle perturbations including winds should be considered during validation. Flight software verification and validation is discussed in AFSC/AFLC Pamphlet 800-5.

(3) Supporting Analyses. The extent of the supporting analyses required depends on the newness and complexity of the design, and the familiarity of the contractor with this type of design. Control system stability studies are one commonly required type of supporting analysis. This type of study and the computer tools typically used for it (computerized linear analysis programs) are primarily intended to yield design information and a more detailed understanding of system operation. To perform such a study, the analytical models discussed in previous paragraphs are linearized and in some cases simplified, significant non-linearities such as thruster on-off characteristics are modeled by use of zero order hold or impulse depending on pulse width, and computerized linear-analysis programs are used to generate and plot the system stability characteristics. Parameters are varied over the expected ranges, stability margins are evaluated, and the conditions under which instability or limit cycles can occur are evaluated. Simulation runs are then made to verify and cross-check the key results of the stability analyses. In addition to stability analyses, various other types of studies are needed to investigate specific aspects of control and dynamic performance. For example, balancing and alignment error analyses may be required to determine the range of effective thrust misalignment which must be considered for an apogee kick motor.

3. SCHEDULE FOR INDEPENDENT DYNAMIC VERIFICATION:

a. Independent dynamic verification should begin as soon as the vehicle and payload configurations are sufficiently well defined to permit development analytical models. Normally, the necessary information is available by the time of the Preliminary Design review (PDR), at which time all feasibility and preliminary design analysis studies should be completed. The PDR data package should include the required data, and should be delivered just prior to PDR.

b. At PDR, much of the data supplied is preliminary, since detailed design of many of the components is not initiated until PDR, and tests have not yet been run. Mass properties, structural dynamical characteristics, and aerodynamics are based on analytical predictions. Although the data will be adequate to permit initiation of development of analytical models and simulations, these must be updated as later and more detailed data becomes available. By CDR, most of the improved models should be incorporated into the analyses and simulations. Shortly after CDR, when final design details presented in the CDR data package have been incorporated, the analyses and simulations are in a sufficiently mature state that verification runs can begin. These should verify system performance over a range of parameters which encompass any values which might later be measured in component or subsystem tests or modal surveys. The bulk of the verification runs should be completed as soon as possible after CDR, and before the vehicle enters qualification testing, to minimize the program impact of any changes resulting from the verification. If changes are required, these should be incorporated into the analyses and simulations, and the verification runs repeated as necessary.

c. When all test results are available, these should be reviewed to make certain that the dynamic verification is valid for the final measured system parameters for each vehicle, and analyses and simulation runs repeated as necessary.

4. MANAGEMENT PROCEDURES:

a. The requirements for an independent dynamic verification should be identified as an element in the overall Program Plan prior to its submission for approval, to assure the availability of adequate funding. Provision for the necessary services of all contractors in support of the dynamic verification must be made in their respective Statements of Work. In addition, suitable clauses are required in their contracts to insure their cooperation and to facilitate the independent dynamic verification contractor’s access to the required data.

b. Planning of the dynamic verification program should be initiated prior to the generation of the over-all Program Plan, to permit estimates of the funding and scheduling requirements. The first step in planning of a dynamic verification program is the determination of the scope and depth required to ensure adequate confidence of satisfactory dynamic performance. If anything other than a complete independent verification is planned (as outlined in Paragraph 2), this should be specifically called to the attention of the Commander, at which time the rationale for the decision should be presented. Considerations which may allow a verification activity reduced in scope from that discussed in Paragraph 2 are discussed in Paragraph 7.

c. After the required scope of the independent dynamic verification is determined, the effort should be planned in detail. It is important to insure at an early date that each participant’s tasks are defined accurately and scheduled realistically in accordance with the guidelines given in the previous section. The execution of an independent dynamic verification program involves exchanges of comprehensive data packages between contractors. Experience indicates that the efficient and orderly transmittal of such data requires careful coordination between the involved parties. The content and schedule of such data transmittals should be defined in detail at an early date, and should be understood clearly by all parties involved.

5. DATA REQUIREMENTS:

a. The following data is required as a minimum, for both vehicle and payloads, to conduct an independent dynamic verification. Detailed listings of these requirements should be placed on the appropriate contractor’s CDRL at program initiation:

(1) Basic descriptive data:

(a) Engineering drawings

(b) Physical and functional descriptions of all control and propulsion components

(2) Derived data:

(a) Mass properties

(b) Flexible modes

(c) Attitude Determination and Control block diagrams, control transfer functions and other functional characteristics

(d) Aerodynamic, thermodynamic, and propulsion data

(e) Selected material properties, such as ablation or erosion characteristics

(f) software flow charts

(g) flight code on magnetic medium

(3) Miscellaneous:

(a) Operational procedures and timelines

(b) Contingency-mode procedures

(c) Failure modes and effects analysis

(d) Test plans, procedures, and reports

b. Primary data deliveries consist of preliminary data in the PDR data package, and final design details in the CDR data package. Delivery of the other data listed above should be scheduled consistent with the program schedule. It is particularly important that design details and test results which become available between PDR and CDR be delivered as available, rather than waiting until CDR. Final data sets must be delivered in sufficient time that final verification simulations must be delivered in sufficient time that final verification simulations may be run prior to first flight.

c. Independent dynamic verification includes independent derivation of the derived data listed above. However, in order to initiate simulation development at an early data (PDR) the derived data supplied by the vehicle and payload contractors should be used, and replaced later by the independently derived data.

6. DOCUMENTATION.

As a minimum the following formal documentation associated with independent verification should be required (on appropriate CDRLs):

a. Data packages from program contractors to verification contractors containing as a minimum the data outlined in Paragraph 5:

(1) Preliminary data at PDR

(2) “Final” data at CDR

(3) Data update sufficiently prior to first flight to verify vehicle dynamics as vehicle will be flown.

b. Technical documentation from verification contractor to program director:

(1) Final technical plan for verification effort 1 month following PDR

(2) Monthly technical status reports

(3) Interim detailed technical report on verification tools and preliminary results CDR

(4) Verification results based on system CDR data package 3 months following CDR

(5) Final report on dynamic verification just preceding vehicle qualification testing

(6) Final dynamic certification one month prior to first flight with final parameters.

7. PRACTICAL CONSIDERATIONS RELATIVE TO SCOPE OF DYNAMIC VERIFICATION:

a. The discussion presented in Paragraph 2 describes the elements of an independent analysis intended to comply with the Commander’s Policy. Clearly, a rigorous adherence to the program described is not always appropriate and/or necessary. The real question is the degree to which all the elements of the independent verification effort must be applied on a specific program. This section provides some insight into the complexity of this decision and the possible options available to the program director.

b. In determining the scope of the independent verification, consideration must be given to the question of the complexity of the vehicle dynamics. For example, satellite configurations which are dynamically new configurations and/or complex satellite-payload configurations require the greatest depth of analysis for which there is no alternative to a complete independent dynamic verification effort comprising all the elements of Paragraph 2. Of equal importance is the experience of the vehicle contractor with regard to the vehicle control and dynamics. If the selected contractor has experience with the vehicle dynamics and control system design, he has analyses and simulation programs which are readily adaptable to the “new” vehicle. Moreover, he has in some sense validated his analyses and simulation programs, based upon previous flight experience with the selected control system and vehicle dynamics. In these instances, selected areas assessed to be critical would receive an independent analysis and the remaining design analyses would receive a careful review for completeness. A third consideration involves vehicle designs which are minor modifications to or extensions of existing flight-proven designs. In these cases, the design has been verified and the analyses performed for the original vehicle design validated. In these instances independent analysis would be required for the modifications to the vehicle using the previously developed simulations.

c. Taking the above factors into account, the determination of the scope and depth of an independent dynamic verification requires the evaluation of a number of additional aspects or parameters of a given design and/or configuration. Typical of the parameters or aspects which must be examined to determine the scope or depth of the verification effort are:

(1) Number of different control system types used and control modes required

(2) Pointing and/or rate accuracy of vehicle and payload

(3) Sensor and actuator hardware requirements (state of the art, pedigree)

(4) Mass properties (especially critical for spinning vehicles)

(5) Dynamic complexity such as number of bodies required to model vehicle and payload

(6) Potential interaction between control system and structural flexibility

(7) Ground testing capability of control systems and vehicle dynamics

(8) Type of control system redundancy employed and concept of back-up mode switching (i.e., autonomous vs. ground control)

(9) Flexibility and performance range of the guidance algorithms and targeting parameters

d. Based upon the evaluation of the above factors, the complexity of the above factors, the complexity of the design, contractor’s experience and the possible flight experience of the vehicle/control system, a range of options are available to the program director within the intent of the Commander’s Policy. These options are:

(1) Complete independent analysis containing all the elements of Paragraph 2.

(2) Perform independent analyses of critical changes to a given vehicle design. Review adequacy of all data, tests, and previous analyses.

(3) Review adequacy of analyses for a given design change to an existing flight-proven vehicle.

The selection of a particular option is the responsibility of the program director and must be justified by a careful review of all the factors described above. This justification should then be presented to the Commander or Vice-Commander for concurrence.

1 Attachment: Elements of an Independent Stability and Control Dynamic Verification Program for Satellites and Launch Vehicles

Attachment 1

ELEMENTS OF AN INDEPENDENT STABILITY AND CONTROL DYNAMIC VERIFICATION PROGRAM FOR SATELLITES AND LAUNCH VEHICLES

1.0 INTRODUCTION

The purpose of this attachment is to detail the effort called for in the Commander’s Policy requiring an independent, concurrent dynamic analysis on all satellites and launch vehicles for which SMC has mission responsibility. Ideally, the design of a vehicle control system should be checked against a complete dynamic analysis of the vehicle and payloads, the control system, the environment and their interactions plus simulation of system operations for all mission phases. In practice, there is no such thing as a complete dynamic analysis. It will always be possible to model the vehicle in more detail, investigate more parameter variations, and consider more potential failure modes. There are also state-of-the-art limitations on modeling fidelity, particularly in such areas as control nonlinearities, mechanical devices such as bearings, slip rings and gear trains, aerodynamics, and fluid (propellant) dynamics.

The dynamic verification program described below is appropriate for a major new operational satellite or launch vehicle program or major payload change, for which the dynamics and control involve significant differences from previous programs. A less complete verification program would be appropriate for a vehicle with a very high degree of dynamical similarity to others with successful flight histories, for modifications to existing vehicles or for noncomplex vehicles with straightforward missions. A decision as to the level of detail required to establish the desired level of confidence can be made only after a thorough technical review of the proposed design, its similarity to other vehicles, and an evaluation of the analytical, simulation, and flight data available on the other vehicles.

Additionally, the dynamic verification is for a vehicle which has special-purpose attitude determination and control electronics, as do most present and near future vehicles. Vehicles with the attitude determination and control logic mechanized in a general purpose digital computer may present an additional requirement for flight software validation, which is discussed in AFSC/AFLC Pamphlet 800-5.

2.0 BASIC ELEMENTS OF AN INDEPENDENT DYNAMIC VERIFICATION PROGRAM

An independent dynamic verification program can be considered to consist of the following elements:

a. model development and verification,

b. simulation development and dynamic performance verification by simulation,

c. supporting analyses.

The following discussion of these basic elements will be handled first for satellite vehicles and then for reentry vehicles and launch vehicles.

2.1 Discussion of elements of Independent Dynamic Verification Program for Satellites

2.1.1 Model Development and Verification

If the dynamic verification activity is to yield a high level of confidence in spacecraft dynamics and control performance, it is essential that the analytical models used accurately represent the spacecraft and payload(s) as they are built and flown. The several facets of the analytical model which are important to the dynamic verification are listed and discussed below.

2.1.1.1 Spacecraft Dynamics

The usual practice in developing a spacecraft dynamical model is to develop a rigid-body model which can be used for most of the simulation activity, but which is formulated in such a way that the spacecraft flexibility and fluid motion effects can be incorporated, when the necessary data becomes available, without completely reformulating the model. Using the spacecraft configuration description and drawings supplied by the contractor, the configuration to be analyzed is defined (i.e., how many separate bodies are to be included in the model, which are to be considered rigid and which flexible, what relative options are to be considered, etc.). Moving parts and flexibility within the payloads, as well as the satellite vehicle, must be considered to the extent that they may be dynamically significant. An appropriate set of coordinate systems and variables is chosen to describe the configuration and its motion, and the equations of motion are derived in terms of these variables. These equations are then checked, using various techniques such as alternate (independent) derivations.

At this point, it is necessary to tailor the model to the several different purposes for which it will be used. For example, the very detailed model which is typically used to verify short-term control response is usually inappropriate for use in studies involving several orbits of operation (fuel consumption studies, or momentum management for example). Using the assumptions applicable to each mission phase or situation to be analyzed, the equations of motion are simplified as much as possible without sacrificing fidelity, and are manipulated into forms suitable for computer solution. At this point they are ready for coding as the dynamics subroutines of the various simulations to be developed.

2.1.1.2 Operating Environment

In addition to the spacecraft dynamics, it is necessary to model several aspects of the environment in which the satellite operates. These include internal and external disturbance torque’s, orbit characteristics, sensor viewing geometry, and sensor inputs (horizon models, star catalog, etc.). Disturbance torque models are developed by analysis of the spacecraft configuration and characteristics, as supplied by the contractor, and their interaction with the environment (geomagnetic field, atmosphere, solar radiation), for which models are readily available. In some cases, it may be necessary to perform separate analyses to estimate the pertinent satellite characteristics, such as the magnetic moment. Disturbance torque’s caused by separation events are determined by dynamic analysis, using the spacecraft and separation interface drawings and specifications supplied by the contractor.

Models for the sensor viewing geometry are obtained by straightforward geometric analysis of the sensor configuration, mounting geometry, and orbit, as supplied by the contractor. Models of sensor inputs, such as horizon radiance profiles or star catalogs, are usually obtained by combining, adapting, and in some cases extending results available in the literature or developed on earlier programs.

2.1.1.3 Attitude Determination and Control Components

It is necessary to develop detailed models of the several attitude determination and control components which interact with the spacecraft dynamics. These include sensors, attitude determination and control electronics, electromechanical actuators, and thrusters. In an independent dynamic verification, models for these components are developed from several data sources. In the case of attitude determination and control electronics, the data sources are primarily schematic and circuit diagrams supplied by the contractor. In the case of attitude determination and thrusters, models are normally derived from test results. Models of sensors and electromechanical actuators are normally derived from analysis of the design as supplied by the contractor and in some cases from prototype test results. Payload actuators, such as gimbal servos, must be modeled, as well as the spacecraft control actuators. Consideration must be given to the attitude determination logic (algorithms) which derives a determination of vehicle state from the sensors. In addition, it may be necessary to build breadboard representations of control electronics or perform special lab tests on other components, such as actuators, precision bearings, or gear trains. As part of verification of the component models, the contractor’s component test plans and results are reviewed, as appropriate, to make certain that the models conform to the hardware as it is actually built.

2.1.1.4 Structural Dynamics

For the mission phases in which structural flexibility may have a significant impact on dynamics and control performance, it is necessary to develop analytical models of the vehicle and payload structural dynamics in forms compatible with the control analyses and simulations. In an independent dynamic verification, the models should be developed independently, from the contractor’s spacecraft and payload drawings. This involves identification of the portions of the structure for which flexibility must be considered, identification of the structural degrees of freedom which must be considered, formulation of finite-element mathematical models representing the structure, development of mass and stiffness matrices, computation of the flexible modes in a form compatible with the spacecraft dynamical model, and selection of the dynamically significant modes. The models thus developed must ultimately be verified by test. The test plans and results must be independently reviewed and approved.

2.1.1.5 Fluid-Motion Effects

The state-of-the-art in zero-g fluid motion modeling is such that useful models can be derived only for certain specific special cases. The present state-of-the-art does not permit a general model of zero-g behavior. It is necessary to evaluate the potential impact of fluid motion on spacecraft dynamics in the various phases of operation, and to develop the best models practical for the cases in which this may be important. Using drawings and engineering descriptions of the propellant tanks, plumbing and valves, models are developed to describe the possible modes of propellant motion within the tanks (slosh) and transfer between tanks. Where practical, analytical descriptions of the motion are generated and compared to any applicable test results. In cases where the potential motion is too complex to permit a practical analytical model, an attempt is made to find limiting-case solutions which can be used to bound the effects of propellant motion on satellite dynamics.

2.1.2 Simulation Development and Dynamic Performance Verification by Simulation

2.1.2.1 Simulation Development

Using the analytical models discussed in the previous sections, several simulations applicable to all mission phases and tailored to various special purposes are then developed. For example, in the UHF Follow-On dynamic verification, it is necessary to simulate the spinning phases (spinup, coast, spin axis tipping, AKM firing, and despin) as well as the acquisition, wheel spin-up, deployment, and on-orbit phase of operations. For the on-orbit phase it is necessary to develop a very detailed simulation which includes structural flexibility and a detailed model of the control system, to investigate control transient response, and also a substantially less detailed simulation to be used for long-term (several orbits) studies, such as fuel consumption or momentum management investigations. In this simulation, simplified models of the satellite dynamics and control system are used. A mixed simulation, using breadboard attitude determination and control electronics, is very useful for verifying detailed hardware models and for failure-mode studies.

Development of these simulations involves coding of the analytical models described in previous sections, debugging and checkout of the individual subroutines (dynamics, attitude determination and control components, etc.), incorporation of these subroutines in various combinations into the several required computer programs, and debugging and checkout of these programs.

2.1.2.2 Dynamic Performance Verification by Simulation

Using the several simulations referred to in the previous section, satellite dynamic performance during all mission phases is investigated. This is a continuing process which starts as soon as the first versions of the simulations become operational, and continues as additional modeling sophistication is added. At each stage, the simulation results and satellite design evolution guide the further development of the simulations. Satellite operation over the anticipated range of parameter variations is studied in considerable detail. In the case of gimbaled or articulated payloads, the interactions between the payload dynamics and servos and the spacecraft attitude dynamics and control system are evaluated, for both nominal and failed conditions. Operation in various failed modes is simulated, including transition to and recovery from the modes. Definition of the failed mode cases to be run requires consideration of the various types of failures which can occur, and is aided considerably by the detailed mechanization analysis used to develop the control hardware analytical models, and by the breadboard and mixed-simulation results.

2.1.3 Supporting Analyses

The extent of the supporting analyses required depends on the newness and complexity of the design, and the familiarity of the contractor with this type of design. Control system stability studies are one commonly required type of supporting analysis. This type of study and the computer tools typically used for it (computerized linear analysis programs) are primarily intended to yield design information and a more detailed understanding of system operation. To perform such a study, the analytical models discussed in previous sections are linearized and in some cases simplified, significant non-linearities such as thruster on-off characteristics and control system digital sampling effects are modeled by describing functions or Z transforms, and computerized linear-analysis programs are used to generate and plot the system stability characteristics. Parameters are varied over the expected ranges, stability margins are evaluated, and the conditions under which instability or limit cycles can occur are evaluated. Simulation runs are then made to verify and cross-check the key results of the stability analyses. In addition to stability analyses, various other types of studies are needed to investigate specific aspects of control and dynamic performance. For example, balancing and alignment error analyses may be required to determine the range of effective thrust misalignment which must be considered for an apogee kick motor.

On some programs, such as NATO III, the dynamical similarity to other satellites (DSCS II) and the similarity to other satellites flown by the same contractor (skynet) indicate that only minimal supporting analyses and design studies are required. In such a case, the primary emphasis in the dynamic verification can be on the simulation of the design as developed by the contractor and verification of its performance through the various phases of operation. In other cases, such as Milstar, although the control concept is relatively simple, the overall control system and large flexible body interaction dynamics are rather complex. Because of this complexity and the lack of similarity to previous spacecraft, the control analysis and dynamic verification process requires a substantial amount of learning. In such cases it is necessary to do a very substantial amount of supporting analysis and simulation. This serves the dual purpose of contributing to the design process and developing the analytical and simulation tools which will be used later for dynamic verification. In addition, such studies build the understanding of system operation which is needed for intelligent planning of the dynamic verification activities.

2.2 Discussion of Elements of Independent Dynamic Verification Program for Launch Vehicles

2.2.1 Model Development and Verification

If the dynamic verification activity is to yield a high level of confidence in launch vehicle dynamics and control performance, it is essential that the analytical models used accurately represent the launch vehicle as it is built, ground tested, and flown. The major facets of the analytical model and data base which are important to the dynamic verification are listed and discussed below.

2.2.1.1 Vehicle Dynamics

In a new development program the data base for the vehicle dynamics model improves as the vehicle configuration evolves. Consequently, the vehicle dynamics simulation program must be designed in such a manner that it can be readily modified as the hardware is developed and various test results become available. Flexibility in simulating a rigid body model or, on option, to include vehicle bending, fluid slosh effects and system nonlinearities, is very desirable.

It is often necessary to develop dynamic models with different degrees of complexity. For example, the very detailed model used to verify the linear stability analysis is normally inappropriate (because of excessive computer running time) for use in trajectory-type simulations. The former includes, among other things, bending/sloshing effects including bending motion interaction with the servo-actuators, engine inertia effects, and coupling between bending modes through the engine masses. On the other hand, a vehicle trajectory simulation includes such phenomena as system nonlinearities, time-varying parameters, noise, and cross-coupling effects.

2.2.1.2 Aerodynamics

Since the vehicle aerodynamics directly affect rigid body stability during the first stage of flight and, in addition, significantly affect the aerodynamic loads encountered during the maximum dynamic pressure (max q) region of flight, it is necessary to model the aerodynamic forces and moments imposed on the vehicle. These forces and moments also come into play during the separation sequence associated with staging. These models are derived from theoretical predictions and wind tunnel measurements, and may be updated as flight test data becomes available. The independent verification contractor should review the theoretical airloads predictions and the wind tunnel tests results to insure that proper procedures were followed. The prime contractor and verifier should mutually agree on the final aerodynamic modeling to be employed in their simulations.

2.2.1.3 Structural Dynamics

Structural flexibility and fluid slosh motion have a significant impact on the stability and control of the launch vehicle. Consequently, analytical models must be developed in forms that are compatible wit controls analyses and simulations. An independent verification of the structural dynamic models of the booster (all stages) as well as the payload must be made. For new vehicle developments the independent verification must necessarily involve truly independent modeling, with the prime contractor supplying the verifier with all appropriate test results for comparison with the resulting models. Ideally, the verifier would also have personnel monitoring the tests.

Structural dynamic modeling involves identification of the portions of the structure for which flexibility must be considered, identification of the structural degrees of freedom which must be considered, formulation of a finite-element mathematical model representing the structure, development of a mass and stiffness matrices, and computation of the bending modes resulting from coupling the payload to the to the appropriate booster stage. Here an accurate structural dynamics model of the payload is of utmost importance as booster experience has indicated that a low cantilever natural frequency of the payload can adversely affect overall vehicle stability by impacting the predicted bending modes. Additionally, an adequate description of tank geometry, plumbing and valves, and propellant loading is required to develop models which describe the possible modes of propellant motion within the tanks and transfer between tanks. Where practical, structural bending and fluid slosh data generated from the analytical models should be compared with comparable data generated by the contractor and with test data. Discrepancies would be resolved and mathematical models revised as necessary.

2.2.1.4 Guidance and Control Components

It is necessary to develop detailed models of the guidance and control components which inter- act with the launch vehicle dynamics. These include sensors, electronics and shaping networks, hydraulic actuators, and, when applicable,, solenoid valves and thrusters. In an independent dynamic verification, models for these components are developed from several data sources. In the case of guidance and control hardware and electronics, the data sources are the subcontractor specifications, circuit diagrams, and test results. In the case of actuators, models are derived from manufacturer specifications and test results. Occasionally breadboarding and laboratory testing of circuits and components may be desirable. As part of the verification of components models, the contractor’s component and subsystem test plans and results are reviewed, as appropriate, to make certain that the models conform to the hardware as it is actually built.

2.2.1.5 Flight Control Software

Most modern launch vehicles employ digital flight control systems. The attendant flight software may require a separate validation/verification effort. (Refer to AFSC/AFLC Pamphlet 800-5). If a separate validation/verification effort is required, the independent dynamic verification contractor must interact with all contractors involved with the development of the flight control system to be modeled in a “scientific” manner, i.e., where the flight control software equations are programmed but the actual flight control computer, with its peculiar timing and word length, is not modeled.

2.2.1.6 Mass Properties

An independent analysis and review of contractors’ mass properties supplemented where appropriate by independent development of mass properties entails the following: independently developing mass properties of selected detailed parts and subassemblies; checking contractor methods and calculations: verification of mass locations by examination of drawings and hardware; verifying adequacies of weight and inertial measurement techniques and accuracy and calibration of equipment; witnessing measurement of a sufficient number of mass properties to provide confidence in contractors’ techniques and personnel; from all of the above develop weight and inertia status of the launch vehicle/payload combination through all stages of flight.

2.2.1.7 Propulsion

While propulsion is primarily a performance parameter, it directly affects the control moment gain of the control system. Additionally, there are other ramifications of propulsion characteristics which are of significance from a controls standpoint. These include Liquid Injection Thrust Vector Control (LITVC), thrust buildup and tailoff, thrust vector misalignments, and plume impingement forces. Consequently, adequate modeling of the propulsion characteristics during all stages of flight is necessary. The independent contractor should perform appropriate analysis and review of the design contractor’s propulsion data and models, including correlation of the selected models with available test measurements.

2.2.2 Simulation Development and Dynamic Performance Verification by Simulation

2.2.2.1 Simulation Development

The analytical models of the launch vehicle discussed in the previous sections are combined with models of the flight environment (atmosphere, gravity, geodetic locations, etc.) and representations of the launch vehicle on-board flight software to form simulations of the entire launch system. The primary simulation used for system certification is a 6 degree-of-freedom simulation of the vehicle that includes the control system models as well as the guidance and navigation models. This simulation provides a full representation of the vehicle that allows determination of the dynamic trajectory performance of the launch system for nominal and dispersed conditions of the vehicle hardware and the flight environment. Since control system performance usually has a negligible effect on guidance and navigation performance, a 3 degree-of-freedom simulation that uses a simplified control system representation is normally developed to allow guidance and navigation studies independent of the control system design activity. Both of these simulations support system analysis for all phases of flight from liftoff to payload separation. Where program concerns make it desirable, the models developed above are also used as components, or starting points, in the development of specialized subsystem dynamic simulations to address specific design questions and concerns.

2.2.2.2 Dynamic Performance Verification by Simulation

Using the simulations referred to in the previous section, launch vehicle dynamic performance during all phases of flight is investigated. This is a continuing process that starts as soon as the first versions of the simulations become operational, and continues as additional modeling sophistication is added. At each stage the launch vehicle design evolution and simulation results guide further development of the simulations. System performance and stability are evaluated by means of appropriate nominal and perturbation runs, the latter including winds, engine excitation pulses, system dispersions, sensor noise, and external torques.

2.2.3 Supporting Analyses

The extent of the supporting analyses required depends on the newness and complexity of the design, and the familiarity of the contractor with this type of design. For a launch vehicle, the primary supporting analysis consists of a linear stability analysis. This type of study and the computer tools typically used for it (computerized linear analysis programs) are primarily intended to verify the control system design by yielding specific stability margin information which is then compared with a prescribed set of stability margin criteria for compliance. This procedure generally assures an adequate transient response of the system as well as sufficient pad to maintain stability under off-nominal conditions.

To perform such a study, a “time-slice” approach is utilized and several time points during each stage of powered flight are examined. A planar analysis is assumed and each control axis (pitch, yaw, roll) is examined separately. The various analytical models discussed previously are linearized and in some cases simplified. Structural bending and fluid slosh data must be processed prior to insertion in the analysis in order to determine the dynamically significant modes and to reduce the number of modes to a tractable quantity. Appropriate vehicle, structural dynamics, and control system data are then input to the available linear analysis program to obtain resultant open loop frequency responses and/or root locus plots.

Additional supporting analyses would include linear stability analysis with the guidance loop closed. Linear stability analysis using distributed air loads should be included to refine the aerodynamic gain margin predictions as well as tolerance studies at critical flight conditions to determine off-nominal performance.

For any new launch vehicle design the supporting analyses must include investigation of potential failure modes. This involves a thorough review of the vehicle design features and subsequent studies to ascertain the effects of anomalous subsystem operation on mission success. Nonlinear stability analyses should be conducted to determine the amplitude of potential autopilot limit cycles. These analyses are generally conducted in time domain using high fidelity nonlinear models of the hardware and software.