A model-driven framework for supervised reconfiguration of satellite schedulers

Abstract Satellite operations rely on schedulers that must satisfy strict timing, dependency, and resource constraints. In current industrial practice, these scheduler configurations are often defined manually and remain largely static after deployment, making updates labor-intensive and limiting adaptation to changing operational conditions. This paper presents a model-driven decision-support framework organized around a Digital Twin instance for the supervised runtime reconfiguration of satellite scheduler configurations in safety-critical systems. The framework combines an Ecore-based scheduler metamodel, graphical modeling support, EVL-based validation, telemetry-driven monitoring, simulation-assisted optimization, and interpreter-based generation of deployable scheduler configurations. In this way, the same scheduler model is preserved throughout design-time specification, validation, optimization, supervision, and runtime configuration generation, while keeping final deployment under human control to ensure certification constraints are met. We demonstrate the approach on an anonymized industrial scheduling scenario derived from a commercial satellite case provided by Thales Alenia Space Italia. We evaluate the framework through two complementary activities: a focus group with six TAS-I experts, used as an expert resonance study to assess usefulness, understandability, and industrial plausibility, and a toolchain-level validation of the MDE pipeline, measuring model loading, constraint checking, configuration generation, and traceability. The results indicate that the framework may reduce manual scheduling effort, support traceable and consistent reconfiguration decisions, and help engineers reason about controlled adaptation of scheduler configurations to runtime evidence without altering the certified switching logic of the onboard platform.