Mars Sample Recovery Helicopter Aerial Mode Commander Design Using Executable Models

As our knowledge of other worlds deepens, space exploration projects must support increasingly sophisticated payloads, tolerate more extreme environments, and generally manage more engineering complexity to push the envelope. The growing technical demands of these projects pose unique challenges to systems engineering in managing risk as nuanced designs are communicated across diverse teams. To meet this challenge, systems engineering practices must evolve to better support intentional architecture and the communication/ infusion of that architecture into downstream development, integration, and testing. For instance, the needed behaviors of a system must be articulated early in the project lifecycle, and those behaviors drive design and testing (and cost). Using formalized models of the behaviors, we can catch errors in design early, better communicate requirements to developers, provide a framework for the implementation of the behavior, and feed-forward the behavioral needs into test cases and operations. The formalized modeling approach preserves the design intent and constraints in ways that are more robust and potentially time-efficient than more traditional documentation and interface handoffs often are. This paper explores a case study of the use of behavioral modeling in a mode commander for aerial flight of a Sample Recovery Helicopter (SRH) mission concept that was designed to retrieve and deliver sample tubes to the Sample Retrieval Lander (SRL) as a part of the planned Mars Sample Return (MSR) mission. In particular, we describe the application of model-based systems engineering with executable system modeling for describing the behavior of the Aerial Mode Commander of the helicopter. Descriptive and behavioral models are used in this context to: 1) provide consistency and tighter integration between flight system description and flight software implementation, 2) enable early detection of any unexpected/undesired behavior by tracking the system states for different mission scenarios, 3) qualify the comprehensiveness of the behavioral descriptions via simulations. The execution of the system model enabled the dynamic evaluation of the system behavior, qualification of mode commander design, and validation of scenarios and test cases. Formal methods are leveraged to represent the system and validate its behavior by visualizing and simulating different mission scenarios and test cases. Interactions between aerial mode commanders are explicitly defined using SysML, which provides rigor and flexibility to adequately capture the level of detail needed to reduce ambiguities in design, ultimately leading to a more consistent and reliable system. Model patterns are constructed to address specific flight computer interactions and fault behaviors. Early validation of system behavior offered resources for a streamlined transition from design to implementation, leading to more robust and efficient flight software that performs as expected across various mission scenarios.