Guidance, Navigation, and Control for the Dwarf Formation-Flying Mission

AAS 20-560

GUIDANCE, NAVIGATION, AND CONTROL FOR THE DWARF FORMATION-FLYING MISSION

Vincent Giralo,∗ Michelle Chernick,† Simone D’Amico‡

The Demonstration with Nanosatellites of Autonomous Rendezvous and Formation- Flying (DWARF) mission consists of a pair of identical 3U CubeSats which will act as a spaceborne testbed to further advance, rigorously validate, and embed new relative navigation and control technologies in order to meet the needs of future distributed space systems. This paper focuses on the design and implementation of the DWARF on-board Guidance, Navigation, and Control (GNC) system. The DWARF mission will demonstrate unprecedented real-time centimeter-level navigation accuracy on board and new safe, robust, and autonomous relative orbit control algorithms.

INTRODUCTION

Distributed space systems (DSS) employ multiple co-orbiting units to enable advanced missions in space science, technology, and infrastructure. As mission concepts become more complex, future space architectures must address new challenges in relative navigation and control accuracy, robustness, and safety. The Demonstration with Nanosatellites of Autonomous Rendezvous and Formation-Flying (DWARF) mission, developed by the Stanford Space Rendezvous Laboratory (SLAB) in collaboration with Gauss S.R.L. and King Abdulaziz City for Science and Technology (KACST), seeks to demonstrate advancements in relative navigation and control to meet the needs of future ambitious distributed space systems. The on-board dedicated Guidance, Navigation, and Control (GNC) payload consists of software developed by SLAB and is integrated on two identical and autonomous 3U CubeSats using commercial-off-the-shelf (COTS) hardware and a cold-gas propulsion system. The satellites, which are scheduled to launch in the first quarter of 2022, will fly in a LEO sun-synchronous orbit. Both spacecraft can assume the role of chief and deputy in order to balance fuel consumption and double the mission lifetime. The GNC software is split into two integrated modules, navigation and control. The navigation module employs carrier-phase differential Global Navigation Satellite System (GNSS) techniques to demonstrate real-time centimeter-level precision through the use of Integer Ambiguity Resolution (IAR) on board in the presence of fre- quent control maneuvers. The control module will perform safe, robust, and autonomous formation acquisition, keeping, and reconfiguration at separations between 100 meters and 100 kilometers. These capabilities will be demonstrated in flight for the first time, enabling future missions such as

∗Doctoral Candidate, Stanford University, Department of Aeronautics and Astronautics, Space Rendezvous Laboratory, Durand Building, 496 Lomita Mall, Stanford, CA 94305-4035 †Doctoral Candidate, Stanford University, Department of Aeronautics and Astronautics, Space Rendezvous Laboratory, Durand Building, 496 Lomita Mall, Stanford, CA 94305-4035 ‡Assistant Professor, Stanford University, Department of Aeronautics and Astronautics, Space Rendezvous Laboratory, Durand Building, 496 Lomita Mall, Stanford, CA 94305-4035

1 virtual telescopes,1,2 optical interferometers,3 on-orbit servicers for lifetime prolongation4 and as- sembly of larger structures in space.5 Specifically, these technologies have been identified by NASA and NSF as enablers for missions such as Starling,6–8 a swarm of four CubeSats demonstrating the capability to navigate in deep space without Global Positioning System (GPS), the Miniaturized Distributed Occulter/Telescope (mDOT),9 a precise formation of two SmallSats intending to directly image exoplanets and exozodii, the Space Weather Atmospheric Reconfigurable Multiscale Experiment (SWARM-EX),10 a swarm of three CubeSats that will study Earth’s upper atmosphere, and the Virtual Super-resolution Optics with Reconfigurable Swarms (VISORS),11, 12 a precise formation of two CubeSats that will perform solar observations of unprecedented resolution. These missions are all under study and development at SLAB and will directly benefit from the algorithms described in this paper. The concept of multiple spacecraft operating together was first demonstrated in the 1960s during the Gemini program, with advancements continuing through the Apollo program and the Space Shuttle.13 While these early demonstrations were rudimentary by current standards, they paved the way for recent spacecraft formation-flying and rendezvous missions that require more advanced autonomous navigation and control algorithms. Numerous science missions such as the Gravity Recovery and Climate Experiment (GRACE, 2002),14 the TerraSAR-X add-on for Digital Ele- vation Measurement (TanDEM-X, 2010),15 and the Magnetospheric Multiscale Mission (MMS, 2015)16, 17 used multiple spacecraft to conduct unprecedented experiments for gravity field recovery, synthetic aperture radar interferometry, and magnetospheric observation, respectively. Another class of formation-flying and rendezvous missions is technology demonstrations, such as PRISMA (2010),18, 19 CanX-4/5 (2014),20 and CPOD (2020).21 Advancements in DSS missions have demonstrated state-of-the-art navigation and control algorithms on board, while also moving from large, expensive spacecraft (GRACE, TanDEM-X) to smaller, cheaper nanosatellites (CanX-4/5, CPOD). Precision navigation for DSS has largely been enabled through the use of GNSS, such as GPS. GNSS-based absolute positioning accuracies of 1m have been demonstrated for a single spacecraft in real time, while relative navigation using differential GNSS (dGNSS) techniques provide greatly higher accuracy.13 By exploiting synchronous measurements from two receivers, common errors can be cancelled out, resulting in low-noise relative measurements. This technique was validated on board in real time on missions such as PRISMA, where an Extended Kalman Filter (EKF) showed precise relative positioning results of less than 10cm (3D, RMS) between two small spacecraft throughout most mission scenarios.18, 19, 22, 23 Similar results were obtained during the CanX-4/5 mission,20, 24, 25 demonstrating dGNSS for the first time on CubeSat avionics in flight. Navigation accuracies have been further improved by fixing the carrier-phase ambiguities to their integer values, a technique referred to as Integer Ambiguity Resolution. However, due to computational overhead and a lack a guarantee of correctly fixing the integers, IAR has never been performed in flight. GRACE used IAR in post-processing to demonstrate 1mm (1D range-only, 1σ) relative positioning accuracy at a separation of 200km when compared with the high-precision on-board K/Ka-band ranging system.14, 26, 27 More recently, advances in spacecraft avionics have allowed for more complex algorithms such as IAR to be run on board in real time. The Distributed Multi-GNSS Timing and Localization system (DiGiTaL) is a navigation payload for nanosatellites that achieves centimeter-level positioning accuracy and nanosecond-level time synchronization throughout ar- bitrarily sized swarms.28 A reduced-dynamics estimation architecture on board each individual satellite processes low-noise measurements from multiple GNSS constellations and frequencies to reconstruct the full formation state with high accuracy. DiGiTaL demonstrated successful IAR to

2 provide less than 1cm (1D, RMS) of relative positioning accuracy in real time for a swarm of four spacecraft over short baselines using full CubeSat avionics in the loop.29 The system was developed by SLAB in cooperation with Goddard Space Flight Center and Tyvak Nanosatellite Systems as part of the NASA Small Spacecraft Technology Program (SSTP). The DWARF mission will be the first in-flight demonstration of both DiGiTaL and online IAR. Advancements have also been made to push towards robust and autonomous control of spacecraft relative motion. An on-board relative control software aims to minimize the delta-v cost of a set of impulsive control actions while achieving a desired relative state in fixed time. Recent flight demonstrations of control software such as the Spaceborne Autonomous Formation Flying Experiment (SAFE) on PRISMA30 and the TanDEM-X Autonomous Formation Flying (TAFF) system15 cast the relative orbit reconfiguration problem into quasi-nonsingular relative orbit element (ROE) space. Use of the ROE state representation overcomes the limitations of the Cartesian-based linear models of relative dynamics like the Hill-Clohessy-Wiltshire equations (HCW) and Yamanaka-Ankerson (YA) equations, which are accurate only for small spacecraft separations. The ROE state allows for linearization of the equations that govern relative motion with minimal loss of accuracy. In addition, use of the ROE state provides a geometric intuition that can be exploited to derive simple geometric conditions for collision avoidance and safety, called relative eccentricity/inclination (E/I) vector separation.22 Typically, mission designers maintain safe separation using a relative spacecraft configuration called the safety ellipse,31 which is defined such that the relative motion in the radial-tangential/radial-normal (RT/RN) planes is bounded and periodic. The OSAM-1 (for- merly Restore-L) mission, set to launch in 2020, plans to use safety ellipses in their approach trajectory.4 However, D’Amico et al. showed that the minimum separation between the spacecraft over several orbits can be expressed analytically as a function of the ROE, and derived simple ex- pressions for the relationship between the relative eccentricity vector and relative inclination vector that ensure that the satellites will maintain a prescribed relative distance in the radial/cross-track plane. The method was implemented successfully in several missions such as GRACE,32 TanDEM- X/TerraSAR-X,33 and PRISMA.34 Though recent missions have employed the use of the ROE state representation, formation control implementation has been restricted to near-circular orbits. In particular, TAFF used pairs of along- track maneuvers separated by half an orbital period, which is optimal for in-plane control in near- circular orbits, but is infeasible in eccentric chief orbits.15 SAFE used additional radial and cross- track maneuvers, but radial control was only used in certain modes, and not optimally.18 To improve upon the state of the art in autonomous, on-board spacecraft relative orbit control, Chernick et al. developed globally energy-optimal closed-form impulsive control algorithms for orbits of arbitrary eccentricity.35 The solutions are derived using the domain-specific benefits of the ROE state representation and leveraging the geometric advantages of reachable set theory, a tool commonly used to assess cost-reachability and safety,36, 37 and only recently used in control itself.38 The maneuver planning algorithms do not assume the form of the maneuvers; unlike the aforementioned missions that are limited to near-circular orbits, Chernick’s relative control algorithms are robust to orbit regime and therefore employ radial, tangential, and normal (RTN) maneuvers to achieve an optimal reconfiguration solution, in-plane and out-of-plane alike. The DWARF mission is the first in-flight demonstration of these globally optimal control algorithms. In addition, DWARF will employ a newly developed collision avoidance method inspired by D’Amico’s method which guarantees passive safety throughout a reconfiguration, even if a maneuver fails. Finally, the new closed-form solutions are implemented in a model-predictive-control fashion to provide robustness

3 to dynamics, navigation, and control errors. This paper presents the architecture of the GNC payload for the DWARF mission. Following this introduction, an overview of the system is presented, with detailed description of each the navigation and control modules. A test case is examined, demonstrating the state-of-the-art capabilities in a scenario representative of the upcoming DWARF mission.

GNC SYSTEM OVERVIEW

This work presents the full architecture for a dedicated GNC payload that implements novel algorithms in ﬂight for the ﬁrst time. Figure1 details the DWARF payload, including communication with external subsystems. In addition to the software, the payload also consists of a GNSS receiver, two GNSS antennas, an Inter-Satellite Link (ISL), and a cold-gas propulsion system. The layout of the exterior hardware components on the 3U CubeSat is shown in Figure2.

DWARF GNC PAYLOAD TC DWARF GNC SOFTWARE

ADCS TM

TIME NAV CTRL ADCS Prop

To Other Prop ISL Spacecraft

GNSS Receiver

Figure 1: High-level Architecture of DWARF GNC Payload

GNSS antenna

LEOP TM/TC antenna Propulsion Deployable solar panel Secondary Omni-directional GNSS antenna ISL antenna LEOP TM/TC antenna

HSL antenna

(a) (b) Figure 2: Rendering of DWARF Satellite Detailing Hardware Component Layout

To perform these navigation and control tasks, DWARF requires inputs from various sources from the spacecraft. The system receives messages from the GNSS receiver that includes measurements and GNSS broadcast ephemeris data. It is also necessary to have attitude and maneuver information, the latter of which is either generated internally within the control subsystem of the DWARF payload or provided via telecommand. In addition, the GNC payload requires all of the above information from the other spacecraft which is received via the ISL. Finally, telecommands are sent to the payload from ground to set parameters and to trigger different modes of operation. As an output, DWARF provides absolute and relative orbit information, including both the orbit state and

4 associated covariance, and control maneuver commands for formation keeping and reconﬁguration. As described above, information necessary for ISL communication is sent to the other spacecraft, and telemetry data is generated to monitor the system and output to ground. Further details on both the navigation and control modules are provided in the following sections.

Navigation System

Navigation for DWARF is accomplished using DiGiTaL, which integrates a multi-GNSS receiver and antenna system with an ISL to provide centimeter-level relative positioning accuracy in real time. The DiGiTaL payload has a 0.5U CubeSat form factor, with a maximum power requirement of 3W and a mass of 225g.29 DiGiTaL shares synchronous low-noise measurements from receivers on each spacecraft through the ISL and forms powerful error-cancelling combinations in an EKF to precisely estimate absolute and relative orbits of the satellites. Figure3 shows the hardware architecture of DiGiTaL, as implemented in the DWARF payload. Two Tallysman TW3972E Embedded Triple Band GNSS antennas39 collect radiofrequency (RF) signals, pointing in anti-parallel directions to allow for near-omnidirectional coverage (see Figure 2). The RF switch is designed to select the signals from the most zenith-pointing antenna based on the available attitude information, maximizing the visibility of GNSS satellites. A NovAtel OEM628 High-Performance GNSS receiver,40 capable of receiving signals from multiple GNSS frequencies and constellations, processes the signals and provides raw measurements to the local ﬂight computer as well as to the remote spacecraft via the ISL.

Figure 3: Hardware Architecture of DiGiTaL System29

The software architecture of DiGiTaL is shown in Figure4. The system receives GNSS data and attitude information directly from the local (user) spacecraft, as well as the same information from the remote spacecraft via the ISL. This information is processed in the DiGiTaL Data Inter- face (DDIF) module, where measurements from the local and remote spacecraft are checked for validity and synchronicity. DDIF also uses the navigation solution provided from the on-board GNSS receiver to initialize its own navigation ﬁlter. All of this information is passed to the DiG- iTaL Orbit Determination (DOD) module, where the EKF estimates the absolute inertial state of each spacecraft, subject to the tight relative constraints provided from dGNSS. In addition, DOD provides estimates of the on-board receiver’s clock offset with respect to GNSS system time which is used to measure the time synchronicity of the two spacecraft. In general, the DiGiTaL Swarm Determination (DSD) module fuses the output from the local and remote instances of DOD to form a state estimate of the entire swarm. While the DWARF mission consists of only two spacecraft, DSD will still be demonstrated in-ﬂight by fusing the estimates from both instances of DOD to recreate the ”swarm” state. Due to their complexity, DOD and DSD are run with a sample time of 30 seconds. However, navigation solutions can be provided at a faster rate via the DiGiTaL Orbit Prediction (DOP) module, which interpolates the spacecraft states through the use of orbit polynomials formed within the numerical integration of DOD. Further details on the orbit determination

5 process are provided below.

Telemetry & Telecommands User S/C GNSS Time for Synchronization

GNSS Data Orbit Swarm Orbit GNSS Interface Determination Determination Predicton S/C Data GNSS Subset Swarm Swarm (DDIF) Data (DOD) State & (DSD) State & (DOP) State for Covaiance Orbit User AOCS Coefficients Subsystem Attitude & Maneuvers Attitude & Maneuvers GNSS GNSS Subset GNSS GNSS Data from Time State from Time Time Subset Swarm

Intersatellite Link

Subset S/C Swarm S/C GNSS Data GNSS Subset State DOD Attitude & Maneuvers AOCS

Figure 4: High-level Software Architecture of DiGiTaL System29

The EKF in DOD estimates the absolute inertial position, r, and velocity, v, of each spacecraft in the J2000 reference frame, eliminating both the need for an explicit relative state and the need to deal with rotating reference frames during the time update. To propagate each state, DOD uses a reduced-dynamics architecture, where only a 20×20 spherical harmonic gravity model is used14 in order to reduce computational load. To account for unmodelled dynamics, empirical accelerations, aemp, are estimated as a first-order Gauss-Markov process. The reduced-dynamical equations are numerically integrated with a fourth-order Runge-Kutta scheme, including a Richardson step to provide orbit polynomials that are then are used to interpolate the state during the time update of the filter. The variational equations are also integrated, allowing for computation of a state transition matrix (STM) to linearly update the covariance matrix.22 In the presence of maneuvers, the state is propagated to the time of the maneuver, where the commanded delta-v is added to the state and additional process noise is added to the velocity entries of the covariance matrix. Note that maneuvers are treated as true impulses, represented as an instanta- neous change in velocity. The orbit polynomial coefficients used in DOP are also updated to reflect the maneuver.22 Following this, the time update proceeds as normal. The full estimation state for each spacecraft is given as h c c c c c d d d d dci x = r v aemp cδt N r v aemp cδt N , (1) where superscripts c and d denote chief and deputy, or local and remote, respectively. In addition to the position, velocity, and empirical accelerations, the state includes the GNSS receiver clock offset from GNSS time, cδt and the carrier-phase biases, N. The clock offset is denoted as as vector because each GNSS constellation operates on a separate time scale, requiring a different offset with respect to each constellation. Note that the state is identical for each spacecraft, with the exception of the carrier-phase bias in the secondary state. These are estimated as the single-difference between

6 chief and deputy, or N dc = N d − N c, described in more detail below. This allows for the single- difference bias to be ﬁxed from IAR, while still allowing for the un-differenced ambiguities to be estimated as ﬂoat values. The key to success of orbit determination in DiGiTaL is the use of dGNSS in combination with IAR. The raw code and phase measurements are modelled by

ρpr(t) = ||r(t) − r(t − τ)GNSS|| + c (δt − δtGNSS) + I + pr (2)

ρcp(t) = λΦ = ||r(t) − r(t − τ)GNSS|| + c (δt − δtGNSS) − I + λN + cp. (3)

Here, r represents the phase center of the receiving antenna and rGNSS is the phase center of the GNSS satellite’s broadcasting antenna. Because GNSS systems operate in an Earth-fixed frame and the estimated position is an inertial quantity, reference frame transformations between inertial and Earth-fixed frames are required, taking into account precession and nutation of the Earth. The clock offsets of the receiver clock and the GNSS satellite clock are given by δt and δtGNSS, respectively, and the ionospheric path delay is given as I. The carrier-phase bias is included as N, multiplied by the wavelength λ. The signal time-of-flight is modelled as τ, and the measurement noise is given by , which is on the order of 10cm for code and 1mm for phase. Measurement combinations are formed from the code and phase measurements from each receiver into the coarse Group And Phase Ionospheric Correction (GRAPHIC) data type, given by ρ + ρ N ρ = pr cp = ||r(t) − r(t − τ) || + c (δt − δt ) + λ + , (4) gr 2 GNSS GNSS 2 gr and the precise single-difference carrier-phase (SDCP) data type, given by d c dc dc dc ρsdcp = ρcp − ρcp = ||r(t) − r(t − τ)GNSS|| + cδt + λN + sdcp. (5) The SDCP measurments are formed as differences of carrier-phase measurements from two receivers, represented by c and d, tracking the same GNSS service vehicle, creating a relative measurement between the receiving antennae’s phase centers with millimeter-level noise. In this formu- lation, (·)dc = (·)d − (·)c. Once the measurements are processed, the filter performs the additional step of IAR using the Modified Least-Squares Ambiguity Decorrelation Adjustment (mLAMBDA) method.41 To fix the ambiguities, float-valued double-differenced carrier-phase (DDCP) ambiguities are formed by dif- ferencing two SDCP ambiguities from two GNSS satellites, or k j Nddcp = Nsdcp − Nsdcp, (6) where superscripts j and k represent different GNSS satellites. The DDCP ambiguities are then fixed to their integer values by mLAMBDA. By selecting a single reference GNSS satellite j to difference all others with, the SDCP ambiguities can be resolved and inserted back into the state. At this time, the ambiguities are treated as deterministic by zeroing out the corresponding rows and columns in the covariance matrix. As discussed above, the un-differenced ambiguities in the estimation state are left as stochastic quantities. To increase the robustness of the IAR process, a series of checks are performed including the Success Rate Test42 and the Discrimination Test,43 as well as the novel Residual Test.29 This final test checks the measurement residuals before and after the ambiguities are fixed to ensure that IAR did not incorrectly set the ambiguities, which would be seen as a bias in the post-fit residual of the corresponding measurement.

7 Control System

The DWARF control system is implemented as a regularly called ﬁnite state machine within the framework of the GNC payload and is deﬁned as a set of states, transition conditions, and actions. Figure5 represents the states as blue boxes with their associated actions highlighted in blue directly to the right.

NO_CONTROL 0 Flag to turn on control received

I NI T_CONTROL 1 Control initialized from ground

If mode is KEEP, If mode is KEEP, and guidance command received internal command received switch to RECONFI G

- Find optimal maneuver scheme(s) PLAN_CONTROL 2 - Choose maneuver scheme that satisfies constraints - Translate to thruster board commands Queue of upcoming control events (event _queue) is not empty

I N_CONTROL_WI NDOW 3 In control window, but no maneuver in progress

Maneuver occurs within next timestep

ATTI TUDE_CONTROL 4 Satellite must rotate to align thruster with maneuver direction Thrusters aligned with maneuver direction, no errors

- Send command to thrusters MANEUVER_I N_PROGRESS 5 Thr ust er s - Remove maneuver information from queue Maneuver completed, no errors, all thrusters off

ATTI TUDE_TO_NOM 6 Satellite must rotate back to nominal attitude Attitude control end

Empty Waiting event _ Yes reconfiguration Yes GOTO 2 queue? commands?

No No If mode is RECONFI G, Switch mode to KEEP GOTO 3 GOTO 1 If mode is KEEP, Stay in mode

Figure 5: Compact state machine for on-board maneuver-planning and control. The reconfig_list holds all received guidance commands, and the event_queue holds all upcoming attitude and relative orbit control events including timing information.

There are three modes, NONE, RECONFIG, and KEEP, associated with no control, reconfiguration control, and formation keeping, respectively. KEEP is the default mode for the controller, which is only changed if a reconfiguration command is received from ground. The state machine is the same for formation keeping and reconfiguration/acquisition, but the source of guidance commands changes: external for reconfiguration/acquisition, internal for keeping. Otherwise, the controller plans and executes formation keeping maneuvers according to a set formation keeping window and nominal relative (orbit element) state. In addition, there are seven states, labeled 0 to 6, associated with actions that are briefly described in the compact state machine in Figure5. The action is performed whenever the state machine is called and until the transition condition, denoted to the right of the black horizontal lines in Figure5, is satisfied. Much of the maneuver planning within the control software occurs in the PLAN_CONTROL state. As discussed previously, the software utilizes the in-plane and out-of-plane globally-optimal closed- form control solutions developed by Chernick et al.35 leveraging reachable set theory and the ROE

8 state representation. The planner is robust to orbit regime and produces maneuver schemes that are provably optimal.35 For in-plane control, the maneuvers include both radial and tangential components, which makes them robust to all orbit regimes, while for out-of-plane, the maneuvers occur in the normal direction. The maneuver schemes use the minimum required number of impulses, which is three for in-plane control, and one or two for out-of-plane control. The locations of the maneuvers are dependent on which ROE change dominates the required delta-v usage for a given reconfiguration. For example, in a near-circular orbit where the relative eccentricity vector dominates, the maneuvers occur at half orbit multiples from the mean argument of latitude that aligns with the phase of the desired change. In reconfiguration cases that cannot be reached optimally, the same algorithms can be used to generate quantifiably sub-optimal solutions. The PLAN_CONTROL state also handles performance bounds, collision avoidance, and failure mitigation. Using relative state covariance data from the navigation module, the controller uses a new method to assess maneuver scheme performance. Given a desired confidence level and a covariance matrix, an n-dimensional bounding box is fitted to an n-dimensional error ellipsoid to determine if performing a reconfiguration is viable (if a given maneuver scheme will achieve the desired end state within reasonable bounds).35 From there, the controller must also ensure that the proposed maneuver scheme does not cause a collision between the spacecraft. The controller uses a set of conditions based on relative E/I vector separation to check that the deputy (controlled) spacecraft does not enter a configured “keep-out-area” (KOA) around the chief (reference) spacecraft, which assures that they do not collide, even in the case of a maneuver failure. If the maneuver planner fails to meet those conditions, it attempts to re-plan the reconfiguration for a configured number of ‘pings’ to the state machine. If it cannot successfully re-plan that reconfiguration in time, the controller returns automatically to autonomous formation keeping. Maneuver replanning is also used as a failure mitigation method to counter the effects of perturbations, maneuver execution errors, and navigation uncertainty. After the first in-plane maneuver, using the difference between the achieved ROE and expected ROE, the planner modifies the remaining maneuver vectors while keeping the maneuver times constant. This replanning process occurs continuously on a diminishing time horizon until all maneuvers have been executed. It should be noted that the navigation module uses a Cartesian-based inertial state for ease of use with GNSS, in particular GPS, which operates in the World Geodetic System (WGS) 84 Earth-fixed frame. However, the control module operates using an orbital element state to take advantage of geometric properties and slowly varying dynamics. Therefore, it is necessary for a transformation to take place between the navigation and control modules for both the absolute and relative states. This is done using well-known Cartesian to osculating Keplerian orbital element transformations, followed by a transformation to mean orbital elements, including J2 effects, which uses an itera- tive approach with a Newton-Raphson solver using the Jacobian of the nonlinear transformation.44 Then, the quasi-nonsingular ROE are constructed by their definition in Eq. (3) in Chernick et al.’s paper35 for use in maneuver planning.

VALIDATION

To validate the on-board software, extensive testing is conducted at Stanford University’s GNSS and Radiofrequency Testbed for Autonomous Navigation of DSS (GRAND),45 shown in Figure6. This system was designed to enable testing of GNSS-based navigation systems in both a hardware- in-the-loop (HIL) environment, including receivers, ISLs, and ﬂight computers, and a software-in- the-loop (SIL) environment. For SIL testing of DWARF, a high-ﬁdelity orbit propagator generates

9 translational and rotational trajectories through numerical integration of the equations of motion. These trajectories are input in a GNSS Receiver Emulator, which outputs raw measurements and navigation solutions representative of the NovAtel OEM628 receiver40 in the DWARF payload. Effects of broadcast ephemeris errors and atmospheric delays, as well as sensor noise, are accounted for in the emulator. The DWARF payload then receives the GNSS data for processing. Based on the navigation solution and telecommanded reconﬁguration messages, control maneuvers are planned and incorporated in the navigation ﬁlter, in addition to being looped back into the truth propagator. The navigation and control algorithms are developed in C/C++ and incorporated into the simulation environment through Simulink s-functions, allowing for a seamless transition from a simulation environment to an on-board microprocessor.

Orbit/Attitude Dynamics GNSS RF Signal GNSS Measurement GNC Software and Actuator Simulation Generation Generation Algorithms Simulation

GSoNfStwSa rSeo GftwNaSrSe Workstation State Receiver Space MATLAB/Simulink Rendezvous Lab Vector Emulator Cold-Gas Satellite Software IFEN GNSS 3 Propulsion (S ) Signal Simulator Emulator RF Flight Computer Signal Microprocessor GNSS Receiver Control Septentrio GNSS GNSS Commands Live Antenna Data Control Acceleration

Figure 6: GRAND testbed conﬁguration. Red line indicates data ﬂow for DWARF testing45

Maneuvers are included in the orbit propagator as perturbing accelerations spread over multiple timesteps and centered on the commanded maneuver time. Performance degrades if the length of the maneuver application increases because the maneuver no longer approximates an impulse. However, with a 4 mN thruster as is typical in many SmallSat applications, a burn time of 1 minute is more than enough to meet the maneuver requirements of the DWARF mission, and for that control application time, performance does not degrade signiﬁcantly. In fact, performance does not degrade signiﬁcantly for maneuvers that span a longer time, such as 5 minutes, though long maneuvers would not be necessary on DWARF. In addition, the aforementioned maneuver re-planning scheme will help to mitigate any small control performance issues.

Test Scenario

The capabilities of the DWARF GNC payload will be demonstrated in a representative mission example in a LEO, sun-synchronous orbit. The system will perform formation keeping around a set nominal relative state until a ground-commanded reconfiguration is received. The goals of the navigation module for this demonstration are to show convergence of the navigation solution within one orbit and position errors less than 1cm (3D RMS) in the presence of reconfiguration and formation keeping maneuvers. The goal of the control module is to demonstrate that the control maneuvers achieve the desired ROE configurations with meter-level accuracy while maintaining a minimum separation of at least 50 meters in the RN-plane and satisfying delta-v maxima and minima restric- tions imposed on the system. The test scenario will also show that the controller is able to mitigate the aforementioned maneuver execution error and navigation uncertainty using maneuver replanning as compared to the control error when maneuvers are not replanned. In the Results section, the control accuracy will be measured by comparing the achieved ROE to the desired ROE for each of

10 the keeping and reconfiguration phases. The ground truth simulation of this scenario propagates two identical spacecraft as defined in Table1 using the forces listed in Table2. To increase fidelity, the scenario simulates noisy sen- sors and imperfect actuators. The NovAtel OEM628 GNSS Receiver Emulator provides code and phase measurements to the system with white noise of 20cm and 1mm, respectively. Precise GNSS ephemerides from archived International GNSS Service (IGS) data are used for measurement generation, while broadcast ephemerides with meter-level error are provided to the flight software.46 Additionally, imperfect maneuver execution is simulated by applying a pointing error chosen from a normal distribution with a standard deviation of 1.5 degrees.

Table 1: Spacecraft parameters used in ground truth simulation

Parameter Value Mass 4 kg Effective Drag Area 0.09 m2 Coefficient of Drag 2 Effective SRP Area 0.06 m2 Coefficient of Reflectivity 1.8

Table 2: Force models used in ground truth simulation

Force Model Gravity ﬁeld GGM01S (120x120)14 Atmospheric drag Harris-Preister47 Cannonball spacecraft model47 Solar radiation pressure Flat plate model47 Conical Earth shadow model47 Geomagnetic and solar ﬂux data NOA daily KP AP indices Third-body perturbation Analytical Sun and Moon47 DE340 (all planets)48 Relativistic corrections First-order corrections for special and general relativistic effects47

A 24-hour experiment takes place beginning March 1, 2018 00:00:00.0 UTC. For the entirety of the experiment, the chief orbit is passive, with initial mean orbital elements given by

T α = a e i Ω ω M = 6969km 0.003 97.98◦ 25.85◦ 239.25◦ 343.59◦ . (7)

The scenario deﬁnition is divided into four phases which represent different modes of the deputy orbit with respect to the chief. During Phase 0, the navigation system will initialize its state from the GNSS receiver and begin to ﬁlter measurements, followed by the activation of IAR. The actual absolute and relative states are not yet known. The desired relative state at the end of Phase 0 is T δααnom,0 = aδa aδλ aδex aδey aδix aδiy = 0 −1000 0 300 0 600 m. (8)

Phase 1 begins when the simulation has progressed for approximately one half orbit, when the navigation system has had sufﬁcient time to converge. The ROE at this point are found to be T δαα0 = −0.9481 −994.8811 0.7364 301.8681 0.1557 599.1719 m. (9)

11 To demonstrate the system’s formation keeping capabilities, maneuvers are internally planned and executed to maintain the ROE given in Eq. (8) on a scheduled 2.5 orbit cycle. Phase 2 begins when a reconﬁguration command is received from ground. As long as there are no errors and it is safe to change state, formation keeping is halted and the state is immediately changed to RECONFIG. The desired relative orbit elements are given by

T δααf,des = 0 −500 185 501 4.5 626 m. (10)

This reconﬁguration is to be completed within 2.5 orbits.

When the new desired state is reached, Phase 3 begins. The new nominal state becomes δααf,des in Eq. (10), and the controller returns to KEEP mode about this state. This formation is kept for the remainder of the experiment. Table3 outlines the timing of the experiment.

Table 3: Experiment timing for demonstration of formation keeping and reconﬁguration

Phase Time since sim. Current relative state Desired relative state Duration Mode start (hours) (m) (m) (orbits) 0 0 - - - OFF 1 0.75 Initial (Eq. (9)) Nominal (Eq. (8)) 2.5 KEEP 2 2.25 Nominal (Eq. (8)) Eq. (10) 2.5 RECONFIG 3 6.3-24 New nominal (Eq. (10)) New nominal (Eq. (10)) 2.5 KEEP

The relative motion of the deputy spacecraft in the RT- and RN-planes of the chief are shown in Figure7. The black dot represents the chief spacecraft. The dashed line circle represents a RN- plane keep-out region of 50 meters in radius. As shown, the controller logic chose only keeping and reconﬁguration schemes that satisﬁed the given collision avoidance constraint.

(a) RT (b) RN Figure 7: Planar Relative Motion

Results

Figure8 shows the relative position and velocity estimate errors. Covariance bounds (3 σ) are included, as well as statistics calculated directly from the steady-state estimate error. After a brief initialization period, IAR is activated and the estimate reaches steady state. This is shown in the plots just before the one-hour mark, demonstrating a marked decrease in both the error variance

12 and uncertainty bounds. At this point, the navigation system shows sub-centimeter level positioning error (3D RMS), consistent with HIL testing by Giralo et al.29 After steady-state is achieved, 97.8% of ambiguities are fixed. This high value is due to strict verification checks and data editing procedures. It is also important to note the effect of maneuvers on the state estimate, denoted by vertical red lines. The velocity uncertainty bounds increase at these times due to the addition of process noise to account for maneuver execution errors. The relative velocity error stays within these inflated bounds after the maneuver before settling back to steady-state. The effect on the relative position is only present for large reconfiguration maneuvers.

(a) Relative Position Error (b) Relative Velocity Error Figure 8: Relative state estimate errors, with vertical red lines indicating execution of maneuvers.

The associated measurement residuals can be seen in Figure9. It’s interesting to note the difference in performance before and after IAR is activated. Due to the loss of the free parameter in each measurement (the float ambiguity), the filter cannot freely adjust to minimize the residuals below the noise level. Therefore, the appearance of inflated post-fit residuals is actually the filter being more consistent with the expected noise of each measurement, indicating a healthy filter. In particular, the SDCP residuals show millimeter-level noise.

(a) GRAPHIC (b) Single-Difference Carrier-Phase Figure 9: Measurement Residuals

To measure reconfiguration accuracy, the ROE achieved at the end of the commanded reconfiguration (Phase 2) are compared to the desired ROE. It is shown that reconfiguration accuracy is

13 high even in the presence of perturbations (given in Table2), navigation uncertainty, and maneuver execution errors. The analysis is repeated for the same simulation twice: including maneuver replanning on a diminishing horizon and excluding replanning. This comparison is used to demonstrate the effectiveness of maneuver replanning on achieving high reconﬁguration accuracy. Figure 10 shows the evolution of the four in-plane ROE throughout the experiment. The blue lines represent the path of each of the ROE when maneuvers are replanned on a diminishing horizon, while the orange lines represent the ROE without any maneuver replanning. The vertical dashed lines denote times at which maneuvers are executed (for the case where maneuvers are replanned only). Notice that the out-of-plane ROE, the relative inclination vector, are not shown. This is because relative inclination vector changes require only a single maneuver, and are therefore not replanned.

(a) Relative semi-major axis (b) Relative mean longitude

(c) Relative eccentricity vector, x-component (d) Relative eccentricity vector, y-component Figure 10: Evolution of ROE during simulation.

As shown in Figure 10, the paths diverge, meaning there is a significant difference between the ROE when replanning is active vs. when it is not. The difference is most obvious in Figure 10b, which shows the evolution of the relative mean longitude, aδλ. The relative mean longitude drifts at a rate proportional to the value of the relative semi-major axis. As given in Eq. (10), the desired relative semi-major axis at the end of the reconfiguration was zero, in which case the relative mean longitude would not drift at all. When the maneuvers are replanned, the relative semi-major axis achieved at the end of the reconfiguration is closer to zero, and the corresponding aδλ drift rate is

14 much lower than in the no-replanning case. This signiﬁcant reduction of error is indicated in Table 4. Table 4: Reconﬁguration accuracy in simulation

Metric Relative orbit element

aδa aδλ aδex aδey aδix aδiy Desired ROE (m) 0 -500 185 501 4.5 626 Maneuver replanning on Achieved ROE (m) 0.09 -499.12 183.87 500.71 3.37 625.14 Absolute Error (m) 0.09 0.88 1.13 0.29 1.13 0.86 Maneuver replanning off Achieved ROE (m) 0.96 -520.58 183.56 502.34 3.52 625.32 Absolute Error (m) 0.96 20.58 1.44 1.34 0.98 0.68

As in Figure 10, the largest error in Table4 when maneuvers are not replanned is in the relative mean longitude. With replanning off, the achieved state in aδλ is 20 meters away from the desired state. With replanning on, it is less than 1 meter away. In general, the absolute error with maneuvers replanned is less than 1.5 meters for all ROE. Notice that in Table4, the components of the relative inclination vector have almost the same error in both cases. As discussed earlier, this is because in general only one maneuver occurs to correct the relative inclination vector, so the same replanning technique cannot be used. In addition to reconﬁguration accuracy, it is also important to measure the accuracy during the keeping phase. In Phase 3, the simulation proceeded through three full phases of formation keeping, aiming to maintain the ROE achieved at the end of Phase 2, which are given in the ﬁrst row of Table 4. Table5 lists the ROE achieved at the end of each keeping window and the associated absolute error in meters. Table 5: Formation keeping accuracy in simulation

Metric Relative orbit element

aδa aδλ aδex aδey aδix aδiy Achieved ROE (m) 0.05 -499.80 183.11 501.73 4.33 626.14 Absolute Error (m) 0.05 0.20 1.89 0.73 0.17 0.14 Achieved ROE (m) -0.03 -499.85 183.04 501.81 4.57 626.14 Absolute Error (m) 0.03 0.15 1.96 0.81 0.07 0.02 Achieved ROE (m) 0.16 -501.19 183.31 501.59 4.46 626.14 Absolute Error (m) 0.16 1.19 1.69 0.59 0.04 0.18

As demonstrated in Table5, the absolute error is less than two meters for all ROE.

Data Gap A contingency scenario is also considered, demonstrating the capabilities of the system to con- tinue operations even in the case where GNSS measurements are unavailable. Without measurements, the navigation filter cannot refine the state but continues to perform time updates by numerically integrating the equations of motion. The goal of this test is to demonstrate continued functionality, orbit prediction performance, and re-convergence of the filter upon reception of new measurements.

15 To demonstrate these goals, the previous test scenario is augmented by introducing two periods of measurement outages. The first is a short data gap, lasting 100 seconds (three calls to the filter). The second is a longer gap, lasting 45 minutes, which is roughly half of an orbit period. During these periods, both receivers are experiencing a loss of measurements. The test is only run for 4 hours to focus on the performance during the data gaps. Figure 11 shows the relative position and velocity navigation errors throughout this test. During each data gap, the covariance is inflated due to the addition of process noise. This inflation is indicative of a filter performing only the time update. During the short data gap, position errors remain small, with 2.5cm error in both the radial and tangential components at the end of the outage. Since this period is short, there is no noticeable effect on the relative velocity error. During the large data gap, the errors are more prominent, with the largest position error component being 0.2m in the tangential direction. At the end of this longer period, the maximum velocity component error is 0.25mm/s in the tangential direction. When measurements return, the filter re-initializes and the performance is on par with the filter before IAR is activated. However, successful IAR occurs again within 5 calls to the filter, resulting in a quick reconvergence back to steady state.

(a) Relative Position Error (b) Relative Velocity Error Figure 11: Relative state estimate errors in the presence of data gaps, with vertical red lines indicating execution of maneuvers and gray boxes indicating periods of measurement outages.

CONCLUSIONS This work presents the Guidance, Navigation, and Control system for the DWARF mission, due to launch in 2022. Developed by the Stanford Space Rendezvous Lab in collaboration with Gauss S.R.L and KACST, DWARF will advance the state of the art for distributed space systems through on-board demonstrations of novel navigation and control algorithms. The GNC payload will be integrated on two identical 3U CubeSats, where commercial-off-the-shelf hardware is used to reduce power and cost. The navigation subsystem will be the first in-flight demonstration of the Distributed Multi-GNSS Timing and Localization system. Differential GNSS techniques use synchronous low-noise measurements to form powerful error-cancelling combinations that enable precise relative state estimates. The precision provided by DiGiTaL allows for integer ambiguity resolution to be performed in real time on CubeSat avionics, producing centimeter-level relative positioning estimates. DWARF will also demonstrate this capability on orbit for the first time. The control subsystem on-board DWARF will demonstrate the accuracy and robustness of the

16 globally optimal impulsive control algorithms developed by Chernick.35 Maneuvers are planned such that they achieve a desired reconfiguration optimally and maintain a safe separation according to user-set parameters. The planner is integrated into a state machine that continuously replans maneuver magnitudes, which improves accuracy and mitigates failures. A software-in-the-loop experiment using a high-fidelity orbit propagator simulated two spacecraft, with prescribed phases of acquisition, formation keeping, and reconfiguration. A GNSS receiver emulator used this orbit information to generate realistic measurements used for navigation. The control system generated actuation commands based on the navigation solution and the phase of the scenario that were used in both the ground propagation and the navigation filter. Or- bit determination results demonstrated less than 1cm of relative positioning error (3D RMS). The experiment also demonstrated that the system attains the desired relative state within 1.5 meters of the commanded state in both formation keeping and reconfiguration, and that maneuver replanning provides a significant increase in reconfiguration accuracy in the presence of perturbations, error, and uncertainty. Further evaluation and stress-testing of the GNC system is ongoing in an effort to ensure flight readiness, especially in corner cases and contingency scenarios. In particular, an extensive hardware- in-the-loop testing campaign is planned, where the GRAND testbed will use an IFEN GNSS Signal Simulator to stimulate the Novatel OEM628 receiver, and the DWARF software will execute on an 800MHz Endeavour flight computer. DWARF is scheduled for launch in 2022. When available, flight data will be analyzed to show the in-flight demonstration of the work described in this paper.

ACKNOWLEDGEMENTS The authors would like to thank Taqnia International for sponsoring this work and the King Ab- dulaziz City for Science and Technology (KACST) for the DWARF project execution and support.

REFERENCES [1] S. D’Amico, A. Koenig, B. Macintosh, and D. Mauro, “System design of the Miniaturized Distributed Occulter/Telescope (mDOT) science mission,” 33rd Annual Conference on Small Satellites, Logan, Utah, August 3–8, 2019, pp. 1–20. [2] J. Kolmas, P. Banazadeh, A. W. Koenig, B. Macintosh, and S. D’Amico, “System design of a miniaturized distributed occulter/telescope for direct imaging of star vicinity,” 2016 IEEE Aerospace Confer- ence, Big Sky, Montana, March 5–12, 2016, pp. 1–11. [3] O. Montenbruck, G. Allende-Alba, J. Rosello, M. Tossaint, and F. Zangerl, “Precise orbit and baseline determination for the SAOCOM-CS bistatic radar mission,” Navigation: Journal of The Institute of Navigation, Vol. 65, No. 1, 2018, pp. 15–24. [4] M. Vavrina, C. Eugene Skelton, K. D Deweese, B. Naasz, D. Gaylor, and C. D’souza, “Safe Ren- dezvous Trajectory Design for the Restore-L Mission,” 29th AAS/AIAA Space Flight Mechanics Meet- ing, Ka’anapali, HI, January 2019. [5] B. Sullivan, D. Barnhart, L. Hill, P. Oppenheimer, B. L. Benedict, G. Van Ommering, L. Chappell, J. Ratti, and P. Will, “DARPA phoenix payload orbital delivery system (PODs):“FedEx to GEO”,” AIAA SPACE 2013 Conference and Exposition, San Diego, California, September 10–13, 2013, pp. 1–14. [6] H. Sanches, D. McIntosh, H. Cannon, C. Pires, J. Sullivan, B. O’Connor, and S. D’Amico, “Starling1: Swarm Technology Demonstration,” 32rd Annual Conference on Small Satellites, Utah State University, Logan, UT, August 4-9 2018. [7] J. Kruger and S. D’Amico, “Autonomous Angles-Only Multi-Target Tracking for Spacecraft Swarms,” 2020 AAS/AIAA Astrodynamics Specialist Conference, August 9-13 2020. South Lake Tahoe, Califor- nia. [8] J. Sullivan, A. Koenig, J. Kruger, and S. D’Amico, “Generalized Angles-Only Navigation Architec- ture for Autonomous Distributed Space Systems,” Journal of Guidance, Control, and Dynamics, 2020. Submitted.

17 [9] S. Damico, A. Koenig, B. Macintosh, and D. Mauro, “System Design of the Miniaturized Distributed Occulter/Telescope (mDOT) Science Mission,” 33rd Annual Conference on Small Satellites, Utah State University, August 3-8 2019. [10] NSF, “Collaborative Research: CubeSat Ideas Lab: Space Weather Atmospheric Reconfigurable Multi- scale Experiment (SWARM-EX) CubeSats,” Award Abstract # 1936665, 2019. [11] NSF, “Collaborative Research: CubeSat Ideas Lab: VIrtual Super-resolution Optics with Reconfig- urable Swarms (VISORS),” Award Abstract # 1936663, 2019. [12] A. Koenig, S. D’Amico, and G. Lightsey, “Formation-Flying Orbit and Control Concept for the VI- SORS Mission,” AIAA Scitech 2021 Forum, January 11-15 2021. Nashville, Tennessee. Submitted. [13] S. D’Amico and R. Carpenter, “Satellite formation flying and rendezvous,” Global Positioning System: Theory and Applications (B. Parkinson and J. Spilker, eds.), ch. 50, 2018. [14] B. D. Tapley, S. Bettadpur, M. Watkins, and C. Reigber, “The gravity recovery and climate experiment: Mission overview and early results,” Geophysical Research Letters, Vol. 31, No. 9, 2004. [15] J.-S. Ardaens and D. Fischer, “TanDEM-X Autonomous Formation Flying System: Flight Results,” IFAC Proceedings Volumes, Vol. 44, No. 1, 2011, pp. 709 – 714. 18th IFAC World Congress. [16] L. B. Winternitz, W. A. Bamford, S. R. Price, J. R. Carpenter, A. C. Long, and M. Farahmand, “Global positioning system navigation above 76,000 km for NASA’s magnetospheric multiscale mission,” Nav- igation: Journal of The Institute of Navigation, Vol. 64, No. 2, 2017, pp. 289–300. [17] M. Farahmand, A. Long, and R. Carpenter, “Magnetospheric multiscale mission navigation performance using the goddard enhanced onboard navigation system,” Proceedings of the 25th International Symposium on Space Flight Dynamics, 2015, pp. 19–23. [18] S. D’Amico, J. Ardaens, and R. Larsson, “Spaceborne autonomous formation-flying experiment on the PRISMA mission,” Journal of Guidance, Control, and Dynamics, Vol. 35, No. 3, 2012, pp. 834–850. [19] J.-S. Ardaens, S. D’Amico, and O. Montenbruck, “Final commissioning of the PRISMA GPS navigation system,” 22nd International Symposium on Spaceflight Dynamics, San Jose dos Campos, Brazil, February 28–March 4, 2011, pp. 1–16. [20] N. Roth, Navigation and control design for the CanX-4/-5 satellite formation flying mission. PhD thesis, University of Toronto, Toronto, Canada, 2010. [21] C. W. Roscoe, J. J. Westphal, and E. Mosleh, “Overview and GNC design of the CubeSat Proximity Operations Demonstration (CPOD) mission,” Acta Astronautica, Vol. 153, 2018, pp. 410–421. [22] S. D’Amico, Autonomous formation flying in low earth orbit. PhD thesis, Delft University of Technol- ogy, Delft, Netherlands, 2010. [23] S. D’Amico, J. Ardaens, S. De Florio, O. Montenbruck, S. Persson, and R. Noteborn, “GPS-based spaceborne autonomous formation flying experiment (SAFE) on PRISMA: initial commissioning,” AIAA/AAS Astrodynamics Specialist Conference, Toronto, Canada, August 2–5, 2010, pp. 1–15. [24] G. Bonin, N. Roth, S. Armitage, J. Newman, B. Risi, and R. E. Zee, “CanX–4 and CanX–5 Precision Formation Flight: Mission Accomplished!,” 29th AIAA/USU Conference on Small Satellites, August 8–13, 2015, pp. 1–15. [25] N. Roth, B. Risi, C. Grant, and R. Zee, “Flight results from the CanX-4 and CanX-5 formation flying mission,” Proceedings of the Small Satellites, Systems & Services Symposium (4S), Valletta, Malta, May 30–June 3, 2016, pp. 1–15. [26] W. Bertiger, Y. Bar-Sever, S. Bettadpur, C. Dunn, B. Haines, G. Kruizinga, D. Kuang, S. Nandi, L. Ro- mans, M. Watkins, et al., “GRACE: millimeters and microns in orbit,” Institute of Navigation GPS, Portland, Oregon, September 24–27, 2002. [27] R. Kroes, Precise relative positioning of formation flying spacecraft using GPS. PhD thesis, Delft University of Technology, Delft, Netherlands, 2006. [28] S. D’Amico, R. Hunter, and C. Baker, “Distributed timing and localization (DiGiTaL),” ARC- EDAA-TN45564, 2017, https://damicos.people.stanford.edu/sites/g/files/ sbiybj2226/f/digital_factsheet_2019.pdf. [29] V. Giralo and S. D’Amico, “Distributed multi-GNSS timing and localization for nanosatellites,” Navi- gation, Vol. 66, No. 4, 2019, pp. 729–746. [30] S. D’Amico, S. D. Florio, R. Larsson, and M. Nylund, “Autonomous Formation Keeping and Recon- figuration for Remote Sensing Spacecraft,” 21st International Symposium on Space Flight Dynamics, September 2 - October 2 2009. Toulouse, France. [31] B. Naasz, “Safety Ellipse Motion with Coarse Sun Angle Optimization,” NASA Goddard Space Flight Center Flight Mechanics Symposium, Greenbelt, MD, 2005. [32] O. Montenbruck, M. Kirschner, S. D’Amico, and S. Bettadpur, “E/I-Vector Separation for Safe Switch- ing of the GRACE Formation,” Aerospace Science and Technology, Vol. 10, No. 7, 2006, pp. 628–635.

18 [33] S. D’Amico and O. Montenbruck, “Proximity Operations of Formation Flying Spacecraft using an Ec- centricity/Inclination Vector Separation,” Journal of Guidance, Control and Dynamics, Vol. 29, No. 3, 2006, pp. 554–563. [34] G. Gaias, S. D’Amico, and J.-S. Ardaens, “Generalized Multi-Impulsive Maneuvers for Optimum Spacecraft Rendezvous in Near-Circular Orbit,” International Journal of Space Science and Engineer- ing, Vol. 3, No. 1, 2015, pp. 68–88, 10.1504/IJSPACESE.2015.069361. [35] M. Chernick and S. D’Amico, “Closed-Form Optimal Impulsive Control of Spacecraft Formations Using Reachable Set Theory,” Journal of Guidance, Control, and Dynamics, 2020. Accepted. https://arxiv.org/abs/2002.07832v2. [36] R. E. Allen, A. A. Clark, J. A. Starek, and M. Pavone, “A machine learning approach for real-time reachability analysis,” 2014 IEEE/RSJ International inproceedings on Intelligent Robots and Systems, Sept 2014, pp. 2202–2208, 10.1109/IROS.2014.6942859. [37] N. X. Vinh, E. G. Gilbert, R. M. Howe, D. Sheu, and P. Lu, “Reachable domain for interception at hyperbolic speeds,” Acta Astronautica, Vol. 35, No. 1, 1995, pp. 1 – 8, https://doi.org/10.1016/0094- 5765(94)00132-6. [38] C. Zagaris and M. Romano, “Applied Reachability Analysis for Spacecraft Rendezvous and Docking with a Tumbling Object,” 2018 Space Flight Mechanics Meeting, Kissimmee, Fl, January 8-12, 2018. [39] Tallysman, A Tallysman Acutenna TW3972E High Gain Embedded Triple Band GNSS Antenna + L- band Correction Services, 2016. TW3972E. [40] NovAtel, OEM 628 High Performance GNSS Receiver, 2016. D15588. [41] X. W. Chang, X. Yang, and T. Zhou, “MLAMBDA: a modiﬁed LAMBDA method for integer least- squares estimation,” Journal of Geodesy, Vol. 79, No. 9, 2005, pp. 552–565. [42] S. Verhagen, The GNSS integer ambiguities: Estimation and validation. PhD thesis, Delft University of Technology, Delft, Netherlands, 2004. [43] S. Verhagen, “Integer ambiguity validation: An open problem?,” GPS Solutions, Vol. 8, No. 1, 2004, pp. 36–43. [44] K. Alfriend and P. Gurﬁl, Spacecraft Formation Flying: Dynamics, Control and Navigation. Astrody- namics Series, Elsevier/Butterworth-Heinemann, 2010. pp. 46. [45] V. Giralo and S. D’Amico, “Development of the Stanford GNSS navigation testbed for distributed space systems,” Institute of Navigation, International Technical Meeting, Reston, Virginia, January 29– February 1, 2018, pp. 837–856. [46] J. M. Dow, R. E. Neilan, and C. Rizos, “The international GNSS service in a changing landscape of global navigation satellite systems,” Journal of geodesy, Vol. 83, No. 3-4, 2009, pp. 191–198. [47] O. Montenbrook and E. Gill, Satellite Orbits, Vol. 2. Springer, 2000. [48] W. M. Folkner, J. G. Williams, D. H. Boggs, R. S. Park, and P. Kuchynka, “The planetary and lunar ephemerides DE430 and DE431,” Interplanetary Network Progress Report, Vol. 196, No. 1, 2014.