Fault Tolerant Controller Design to Ensure Operational Safety in Satellite Formation Flying K.K.T. Thanapalan, S.M. Veres, E. Rogers, S.B. Gabriel Abstract— The paper addresses the problem of fault tolerant control design that has the same effect as implicit control system reconfiguration for satellite formation flying to increase operational safety as it is important for successful missions. Actuator and sensor degradation can be detrimental for for- mation precision in terms of satellite relative positions and atti- tudes. In this paper model reference adaptive control (MRAS) and quaternion based adaptive attitude control (QAAC) is proposed as alternatives to fault determination and isolation. The adaptive systems approach is simpler as it avoids explicit modelling, decision making and control redesign. Redundancy based solution is used to protect against sensor deficiencies. Simulations illustrate the efficiency of the adaptive systems implemented for the control of the position and attitude of a single craft. I. I NTRODUCTION A reconfigurable approach to control law design is de- veloped for satellite formation flying which has recently become an important field of research in the space industry due to the benefits which can arise from this mode of operation. In particular, formation flying of several smaller satellites, instead of operating a single larger one, has the benefits of (i) a more cost effective synthetic aperture radar (SAR) for observations, (ii) graceful degradation: the failure of the on board system on one satellite does not necessarily result in failure of the whole mission, (iii) increased flexibil- ity since satellites can change/alter their specific roles, and (iv) smaller overall cost because of the reduced total mass put into orbit. SAR forms the basis of several missions to be launched by ESA (MicroSAR and TerraSAR programmes) and NASA (EO-1 programme). These advantages can only become available with the development and implementation of robust and reliable systems for controlling the formation. The on board controllers should be the simplest possible and still must allow for the broadest class of maneuvers with the maximum possible degree of efficiency. The control of satellites in formation is currently the subject of much research effort in the control systems community at large, see, for example, [5], [6], [10],[7], [8], [9], using a variety of configurations and control algorithms. For enhanced reliability, control topologies with decentralized capabilities are preferable. One possibility here is to replicate the same control hardware on each craft K.K.T Thanapalan, S.M. Veres and S.B. Gabriel are with the School of Control and Computational Engineering, University of Southampton, SO17 1BJ, UK, {s.m.veres}@soton.ac.uk E. Rogers is with the School of Electronics and Computer Science, University of Southampton, Southampton SO17 1BJ, UK, {etar}@ecs.soton.ac.uk and allow the software to determine which satellite is the leader and which are followers. For reconfiguration this paper addresses the generic problem of tracking a prescribed path by a follower relative to a leader satellite, and hence can be applied in various situations: for instance where there is a single leader and all the rest are followers or where each satellite follows the next in a chain. For a cluster of satellites, the term ‘formation keeping’ is used to describe the control mechanism which is employed to keep them in fixed relative positions in either the inertial or the local coordinate system in orbit. The term ’maneuver’ of one satellite relative to the other is used to describe the change in the relative position of two satellites in either of the coordinate systems. Clearly, what is formation keeping in one coordinate system could qualify for maneuver in another, and formation keeping in one coordinate system usually refers to the orbiting of a satellite around the leader in another coordinate system. By convention, the satellite that uses active control action is termed the slave or follower satellite and the other is termed the master or leader. The progress to date in this general area can be summa- rized by stating that basic feedback control laws which can meet the requirements are feasible. It is timely, therefore, to consider other requirements that are critical to the success of any proposed mission involving satellites flying in for- mation. In this paper the emphasis is on reconfiguration in the presence of operational faults. Here we take an adaptive control viewpoint and develop a possible solution, including the case when attitude dynamics are included. The performance of the algorithms developed are highlighted through simulation studies. II. BACKGROUND AND PROBLEM DEFINITION In what follows the problem to be considered is given to- gether with an overview of the relevant previous work. The purpose of reconfigurable satellite control system design is to achieve higher survivability even if faults occur during the operation. The possible faults and errors a mission could be required to survive include, for example, error by the operator, error in operational procedures, hardware degradation faults, design faults and environmental stress. Hence if assured, secure, and automated reconfiguration is possible then it could be possible to protect the overall mission against such faults and threats. Based on considerations such as those summarized above leads immediately to the requirement that the control system should have the ability to redesign or to recompute gains, in order to recover from any degradation type faults that may