# Slosh attenuation via Reference Governor-based adaptive control for space operations under actuators constraints

Guido Magnani, Mario Cassaro, Jean-Marc Biannic, Hélène Evain, Laurent Burlion

► To cite this version:

Guido Magnani, Mario Cassaro, Jean-Marc Biannic, Hélène Evain, Laurent Burlion. Slosh attenuation via Reference Governor-based adaptive control for space operations under actuators constraints. IFAC Journal of Systems and Control, 2025, 33, 10.1016/j.ifacsc.2025.100321. hal-05215962

HAL Id: hal-05215962

https://hal.science/hal-05215962v1

Submitted on 20 Aug 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Full length article

# Slosh attenuation via Reference Governor-based adaptive control for space operations under actuators constraints☆

Guido Magnani<sup>a</sup>, Mario Cassaro<sup>a</sup>, Jean-Marc Biannic<sup>a</sup>, Hélène Evain<sup>b</sup>, Laurent Burlion<sup>c,*</sup>

## ARTICLE INFO

**Article history:**

Received 21 February 2024

Received in revised form 6 June 2025

Accepted 12 June 2025

Available online 18 June 2025

**Keywords:**

Sloshing disturbance

Satellite attitude control

Adaptive control

Reference Governor

## ABSTRACT

This paper deals with satellite attitude control in the presence of actuator constraints and unmodeled disturbances. A model reference adaptive control law enhances the satellite control strategy to compensate for the perturbations and ensure precise user-defined closed-loop system performance. This result is consequently employed to build a scalar robust reference governor to enforce the system constraints with limited conservatism. The methodology is illustrated on a single-axis satellite in the presence of sloshing and flexible appendages disturbances, and equipped with reaction wheels subject to torque and angular momentum saturation.

© 2025 The Author(s). Published by Elsevier Ltd. This is an open access article under the CC BY license (http://creativecommons.org/licenses/by/4.0/).

## 1. Introduction

The space environment's uncertainties, coupled with the limited capabilities of the spacecraft actuators, often compel the attitude control system to make significant compromises in performance to guarantee safe operations. This challenge is particularly pronounced in long-duration missions, where the dynamics induced by a substantial amount of fuel propellant can lead to instability and mission loss unless carefully considered in the control design phase, Hoffman, Ebert, Femiano, Freeman, Gay, Jones, Luers, and Palmer (1999). To account for this problem, most spacecraft employ passive solutions and introduce membranes and bladders in the tank to mitigate the low-frequency propellant motion, Dodge (1971), Tam, Dommer, Wiley, Mosher, and Persons (2002). This solution does not rely on any accurate sloshing model, which is notably difficult to study in microgravity, but comes at the price of increasing weight, cost, and complexity of manufacturing. Another widespread strategy consists of limiting the satellite angular rate during operations and introducing breaks between impulsive maneuvers to avoid fuel excitation. Despite the effective liquid motion handling, the resulting mission availability and the satellite agility are no longer exploited.

Therefore, active control solutions, capable of ensuring fuel slosh suppression and actuation constraint enforcement are desirable.

In this regard, robust control techniques have been shown capable of addressing the problem of suppressing the sloshing dynamics, Biannic, Bourdelle, Evain, Moreno, and Burlion (2019), Bourdelle, Biannic, Evain, Moreno, et al. (2019), and have been merged with reference governor techniques to enforce the actuation constraints, Bourdelle, Biannic, Evain, Pittet, et al. (2019), Magnani, Biannic, Cassaro, Evain, and Burlion (2022). Despite the promising approach, both the control law and the governor design rely on sloshing models and lack of generality. On the other hand, adaptive control laws can potentially achieve similar disturbance suppression while relaxing assumptions on the uncertainties. Cassaro, Biannic, and Evain (2022) presents a minimal control synthesis solution to guarantee precise attitude tracking in the presence of multiple unmodeled dynamics, including fuel sloshing and flexible appendages perturbations; however, preventing the actuators' saturation in such a control framework that included an adaptive control law remained an unresolved issue.

In this work, a control architecture combining a model reference adaptive control (MRAC) law and a reference governor (RG) is proposed. By tracking some desired reference dynamics, the MRAC-based control law accounts for the unmodeled perturbations, see Arabi and Yucelen (2017), Arabi, Gruenwald, Yucelen, and Nguyen (2018), while an RG is in charge of monitoring the system constraints and intervenes whenever there is a risk of saturation, Garone, Di Cairano, and Kolmanovsky (2017). As compared to other constraint prevention schemes that aim at computing the optimal control signal, e.g. model

<footnote><sup>a</sup> DTIS, ONERA, Université de Toulouse, 31000, Toulouse, France</footnote>

<footnote><sup>b</sup> CNES, Toulouse, France</footnote>

<footnote><sup>c</sup> Rutgers University, New Brunswick, NJ, USA</footnote>

<footnote>☆ The work of the first four authors was supported by CNES and ONERA. Burlion was supported by NSF Grant 2308283 and by the U.S Air Force Research Lab University Nanosatellite Program through award number CP0088980.</footnote>

<footnote>* Corresponding author.</footnote>

<footnote>E-mail addresses: guido.magnani@onera.fr (G. Magnani), Mario.Cassaro@onera.fr (M. Cassaro), Jean-Marc.Biannic@onera.fr (J.-M. Biannic), Helene.Evain@cnes.fr (H. Evain), laurent.burlion@rutgers.edu (L. Burlion).</footnote>
predictive control, reference governors act before the closed-loop system and filter a desired reference only in case the system constraints are predicted not to be satisfied. As a consequence, RGs do not modify the stability properties of an existing closed-loop system and are particularly attractive for applications that already integrate an established control strategy. In addition, their typical limited computational cost makes them suitable for real-time implementations on systems with low computational capabilities. Since the RG prediction strictly relies on the available closed-loop system model, when dealing with uncertain systems, particular attention has to be devoted to ensuring robust constraints' enforcement. To this scope, most works introduce a term accounting for the uncertainty, assumed to be bounded. Next, they propagate it along the prediction horizon and satisfy constraints for the resulting set of trajectories, see Casavola, Mosca, and Angeli (2000). This approach might result in being over-conservative and may not allow predicting on a large horizon, restricting the RG applicability. To address this issue, more recent works considered merging reference governors and closed-loop systems that integrate an adaptive control law. Zhao, Kolmanovsky, and Hovakimyan (2023) and Magnani, dos Reis de Souza, et al. (2023) rethink the design of the governor safety sets based on the adaptive law performance guarantees. In the first, the authors propose an RG device merged with an $L_1$ adaptive control strategy to handle state uncertainties. In the latter, an MRAC law merged with a command governor extends the work to time-dependent uncertainties, but the governor optimization problem formulation remained QP, limiting the interest for real-time implementations. In this work, we reduce the computational cost of Magnani, dos Reis de Souza, et al. (2023) by redefining the RG optimization problem, and we propose to include a set-theoretic model reference adaptive control law in the closed-loop system, see Arabi et al. (2018), to guarantee strict user-defined performance. In addition, we illustrate the methodology applied to a geostationary satellite subject to sloshing and flexible appendage dynamics, assumed unknown in the control design phase. Pertinent discussions and future perspectives conclude the paper.

The paper is organized as follows: Section 2 formally states the problem and clarifies the controller objectives. Section 3 describes the proposed control framework. In Section 4, the proposed control architecture is applied to a consequent case study. Finally, in Section 5 conclusions and future perspectives are provided.

In this paper, we follow the notation of Arabi and Yucelen (2017) which we briefly summarize here. Given a $n \times n$ positive definite matrix $P$, $\lambda_{\min}(P)$ (resp. $\lambda_{\max}(P)$) is the minimum (resp. maximum) eigenvalue of $P$, $\|P\|_2 = \sqrt{\lambda_{\max}(P^T P)}$ denotes the induced 2-norm of $P$, and $\|x\|_p = \sqrt{x^T P}x$ is the weighted Euclidean norm of $x \in \mathbb{R}^n$ with the matrix $P$.

Given a vector $\theta \in \mathbb{R}^n$ where each component $\theta_i$ is constrained within the bounded interval $[\theta_i^{\min}, \theta_i^{\max}]$. Let $\nu > 0$ be small enough so that $\min_{i=1,\dots,n} \frac{\theta_i^{\max} - \theta_i^{\min}}{2} > \nu$, then, the projection operator $\text{Proj} : \mathbb{R}^n \times \mathbb{R}^n \rightarrow \mathbb{R}^n$ is defined component-wise by:

$$ \text{Proj}(\theta, y) = \begin{cases} \left(\frac{\theta_i^{\max} - \theta_i}{\nu}\right) y_i & \text{if } \theta_i > \theta_i^{\max} - \nu \ \& \ y_i > 0 \\ \left(\frac{\theta_i - \theta_i^{\min}}{\nu}\right) y_i & \text{if } \theta_i < \theta_i^{\min} + \nu \ \& \ y_i < 0 \\ y_i & \text{otherwise} \end{cases} $$

where $y \in \mathbb{R}^n$. The same definition is generalized to matrices using the following operator:

$$ \text{Proj}_m(\Theta, Y) = [\text{Proj}(\theta_1, y_1), \dots, \text{Proj}(\theta_m, y_m)] $$

where $\theta_i \in \mathbb{R}^n$ (resp. $y_i \in \mathbb{R}^n$) is the $i$th column vector of the matrix $\Theta \in \mathbb{R}^{n \times m}$ (resp. $Y \in \mathbb{R}^{n \times m}$).

<figure><img src="image_2.png" /><figcaption>Fig. 1. Satellite and actuators scheme.</figcaption></figure>

## 2. Problem formulation

### 2.1. Satellite dynamics

The system consists of a satellite subject to sloshing and flexible appendages perturbations, as well as actuator saturations. The coupling between the three axes of the satellite is considered negligible, and therefore a single-axis control problem is investigated. The open-loop dynamics read:

$$ J\ddot{\theta}(t) = u_{\text{RW}}(t) + \delta(x_p(t), t) \quad (1) $$

where $J = 1000 \text{ kg m}^2$ and $\theta(t)$ (rad) denote the inertia and the satellite attitude respectively. $\delta(x_p(t), t)$ (N m) embeds all the disturbances acting on the system and depends in general on the system state $x_p(t) \in \mathbb{R}^{n_p}$, while the control input is the torque $u_{\text{RW}}(t)$ (N m) realized by the reaction wheels. Their dynamics are modeled in the Laplace domain as a first-order system with a time constant $\tau = 0.5 \text{ s}$:

$$ \frac{u_{\text{RW}}(s)}{u(s)} = \frac{1}{0.5s + 1} \quad (2) $$

The actuators are subject to symmetric saturations on the commanded input torque $u(t)$ and on the angular momentum $h(t)$ ($u_{\max} = 0.5 \text{ N m}$, $h_{\max} = 10 \text{ kg m}^2 \text{ s}^{-1}$). From a control design perspective, the angular momentum saturation has to be strictly avoided. Indeed, if the maximum momentum is reached, the wheels can no longer be accelerated and the control torque drops to zero. Fig. 1 precises the open-loop dynamic. Finally, the disturbance torque $\delta(x_p(t), t)$ is included following the models proposed in Chretien and Manceaux-Cumer (2001) and Magnani, Biannic, Cassaro, Evain, and Burlion (2022), where the authors propose a superposition of poorly damped and low-frequency linear time-invariant second-order dynamics, i.e. $\delta(x_p(t), t) = \Gamma_{S,F} = \sum_i \Gamma_{S_i,F_i}$, that strictly depend on $\ddot{\theta}(t)$, the angular acceleration of the satellite. Three sloshing and four flexible modes are considered. The modes dynamics reads:

$$ \Gamma_{S_i,F_i}(s) = \frac{s^2}{s^2 + 2\xi_{S_i,F_i}\omega_{S_i,F_i}s + \omega_{S_i,F_i}^2} L_{S_i,F_i}\ddot{\theta}(s) \quad (3) $$

where $L_{S_i,F_i}$ are the modal contribution components, $\omega_{S_i,F_i}$ the pulsations and $\xi_{S_i,F_i}$ the damping ratios of the ith flexible/slosh mode. According to experimental data from Bourdelle, Burlion, et al. (2019), these parameters are chosen as $L_{S_i} \in [30, 50]$, $\omega_{S_i} \in [0.1, 0.3]$, $\xi_{S_i} \in [0.001, 0.03]$, $L_{F_i} \in [50, 300]$, $\omega_{F_i} \in [0.6, 10]$, $\xi_{F_i} \in [10^{-4}, 10^{-3}]$. It is assumed that the fluid is initially at rest and that its mass variation is negligible during a single maneuver.

### 2.2. Problem statement

The satellite dynamics are written in a state-space representation using the matrices $A_p \in \mathbb{R}^{n_p \times n_p}$ and $B_p \in \mathbb{R}^{n_p \times n_m}$ as

$$ \dot{x}_p(t) = A_p x_p(t) + B_p(u(t) + \delta(x_p(t), t)), \quad x_p(0) = x_{p0}, \quad (4) $$

where $x_p(t) \in \mathbb{R}^{n_p}$ denotes the state vector and is assumed available for feedback, $x_p(0) \in \mathbb{R}^n$ is the initial state vector, $u(t) \in \mathbb{R}^{n_m}$ is the control input, and $\delta(x_p(t), t) \in \mathbb{R}^{n_m}$ is the
<figure><img src="image_3.png" /><figcaption>Fig. 2. RG-MRAC control strategy.</figcaption></figure>

matched uncertainty that can depend on both states and time. The matrices $A_p \in \mathbb{R}^{n \times n}$ and $B_p \in \mathbb{R}^{n \times n_m}$ describe the known linear time-invariant dominant dynamics of the plant, and the couple $(A_p, B_p)$ is assumed controllable.

**Assumption 1.** The uncertainty $\delta(x_p(t), t)$ is assumed to be parameterized as

$$ \delta(x_p(t), t) = W^\top(t)\sigma(x(t)), \quad (5) $$

where $W(t) \in \mathbb{R}^{n_s \times n_m}$ denotes a bounded unknown weight matrix (i.e., $\|W(t)\|_2 \le w, t \ge 0$) with a bounded time rate of change (i.e., $\|W(t)\|_2 \le \dot{w}, t \ge 0$), with $w, \dot{w}$ real positive constants and $\sigma(x(t)) : \mathbb{R}^n \to \mathbb{R}^s$ denotes a known basis function of the form $\sigma(x(t)) = [\sigma_1(x_p(t)), \sigma_2(x_p(t)), \dots, \sigma_{n_s}(x_p(t))]$. Note that, by letting one element of the basis function be a constant (i.e., $\sigma_1(x_p(t)) = 1$), this parametrization can capture exogenous time-dependent uncertainties. The control objective is to track a desired attitude reference $r(t) \in \mathbb{R}^{n_r}$ defined by $r(t) = \theta_r(t)$. To this purpose, we also introduce the matrix $C_p \in \mathbb{R}^{n_r \times n_p}$ to define the system output $y_p(t) = \theta(t) = C_p x_p(t)$. Finally, the actuator constraints are described by $y_c(t) = [u(t) h(t)]^T = C_c x_p(t) + D_c r(t) + D_{w_c} \delta(x_p(t), t)$, $C_c \in \mathbb{R}^{n_c \times n_p}$, $D_c \in \mathbb{R}^{n_c \times n_m}$. Then, the system constraints are satisfied if

$$ y_c(t) \in \mathcal{Y}, \quad \forall t \ge 0, \quad (6) $$

where $\mathcal{Y}$ is a convex and compact set defined by a set of linear inequalities, with $0 \in \text{int} \mathcal{Y}$.

**Problem:** Design a control that guarantees the tracking of a reference $r(t) \in \mathbb{R}^{n_r}$ despite plant uncertain dynamics while enforcing the system constraints.

### 3. Proposed solution

The proposed control framework is illustrated in Fig. 2. Three main elements are included: a nominal controller proven to stabilize the LTI known plant dynamics of (4), an MRAC algorithm to compensate for the system's unmodeled dynamics, and an RG scheme to enforce the closed-loop system constraints. The resulting control input $u(t)$ is the sum of the nominal and of the adaptive contributions, $u_n(t) \in \mathbb{R}^m$ and $u_a(t) \in \mathbb{R}^m$, respectively:

$$ u(t) = u_n(t) + u_a(t). \quad (7) $$

#### 3.1. Nominal control design

The nominal controller computes the control signal $u_n$ to ensure the desired performance in nominal conditions, i.e., $\delta(x_p(t), t) = 0$. To design the nominal control law, we define the tracking error $e_y(t) = y_p(t) - r(t)$, and we augment the system

state $x_p(t)$ including the dynamics of the integral of the tracking error. The resulting augmented state dynamics read

$$ \dot{x}(t) = Ax(t) + B(u(t) + \delta(x_p(t), t)) + B_c r(t), \quad x(0) = x_0, \quad (8) $$

where $x(t) = [x_p^T(t) \quad e_{y1}^T(t)]^T \in \mathbb{R}^n$ is the augmented state, with $n = n_p + n_r$ and $e_{y1}(t)$ is the integral of the output tracking error, i.e., $\dot{e}_{y1}(t) = e_y(t)$. The augmented system open-loop matrices are computed as

$$ A = \begin{bmatrix} A_p & 0_{n_p \times r} \\ C_p & 0_{r \times n_p} \end{bmatrix}, \quad B = \begin{bmatrix} B_p \\ 0_{n_r \times m} \end{bmatrix}, \quad B_c = \begin{bmatrix} 0_{n_p \times r} \\ -I_{n_r \times n_r} \end{bmatrix}. \quad (9) $$

Hence, $y = [C_p \quad 0_{n_r \times n_r}] = Cx$, and $A \in \mathbb{R}^{n \times n}$, $B \in \mathbb{R}^{n \times n_m}$, $B_c \in \mathbb{R}^{n \times n_m}$, and $C \in \mathbb{R}^{n_m \times n}$, In nominal conditions, i.e., $\delta(x_p(t), t) = 0$, the system dynamics read

$$ \dot{x}(t) = Ax(t) + Bu(t) + B_c r(t), \quad x(0) = x_0, \quad (10) $$

For the sake of clarity and without loss of generality, we consider a simple feedback law defined by the static gain $K_x \in \mathbb{R}^{n \times n}$. The tuning can be achieved via an LQR approach or any classical PID control technique, see Khatoon, Gupta, and Das (2014). Then, the nominal control law simply reads

$$ u_n(t) = -K_x x(t). \quad (11) $$

To define the desired dynamics we want our system to track, we include the nominal control law proposed in (11) in Eq. (10) considering $u(t) = u_n(t)$:

$$ \begin{aligned} \dot{x}_r(t) &= Ax_r(t) + Bu_n(t) + B_c r(t) \\ &= A_r x_r(t) + B_c r(t), \end{aligned} \quad (12) $$

where $x_r(t) \in \mathbb{R}^n$ describes the reference state that we desire to track. The matrices $A_r \triangleq (A - BK_x) \in \mathbb{R}^{n \times n}$ and $B_c$ define the desired dynamics that the plant would achieve in nominal conditions. Note that to ensure the system stability, the nominal control gain $K_x$ is chosen such that the matrix $A_r$ is Hurwitz. Finally, including the nominal control law in (8), we obtain

$$ \dot{x}(t) = A_r x(t) + B(u_a(t) + \delta(x_p(t), t)) + B_c r(t). \quad (13) $$

The mathematical problem of compensating the disturbance $\delta(x_p(t), t)$ is accounted for by the adaptive control law.

#### 3.2. MRAC design

The MRAC law is included in the control framework to compensate for the remaining unmodeled dynamics that make the system trajectories deviate from the desired dynamics specified in (12). Given the uncertainty parametrization as in (5), (13) leads us to conclude that we look for an adaptive mechanism of the form

$$ u_a(t) = -\hat{W}^\top(t)\sigma(x(t)), \quad (14) $$

where $\hat{W}(t) \in \mathbb{R}^{s \times m}$ defines an estimate of $W(t)$. If $W(t)$ is precisely estimated, then the error $e(t) = x(t) - x_r(t)$ converges to zero, and the system (4) tracks the desired dynamics defined in (12). The two MRAC strategies proposed in Arabi et al. (2018) are employed and compared. In the following, we recall the basics and the main results of the two.

##### 3.2.1. Standard MRAC

The most common adaptive mechanism of the MRAC strategy selects $\hat{W}(t)$ in accordance to

$$ \dot{\hat{W}}(t) = \gamma \text{Proj}_m(\hat{W}(t), \sigma(x(t))e^\top(t)PB), \quad t \ge 0, \quad (15) $$

where $\gamma \in \mathbb{R}^+$ is a user-defined parameter called learning rate defining the force of the adaptive mechanism, and the matrix
$P \in \mathbb{R}^{n \times n}$, whose existence is ensured since $A_r$ is Hurwitz, is a positive definite matrix solution of the Lyapunov equation

$$A_r^\top P + P A_r + Q = 0, \qquad (16)$$

where $Q \in \mathbb{R}^{n \times n}$ is a user-defined positive definite matrix. Finally, the projection operator $\text{Proj}_m$ is used to force the estimation of $\hat{W}(t)$ to lie within the known bounds $\hat{W}_{\max} = w$. (15) guarantees that

$$\|e(t)\|_2 \le \sqrt{\frac{\lambda_{\max}(P)\eta^2 + \gamma^{-1}\tilde{w}^2}{\lambda_{\min}(P)}}, \quad t \ge 0, \qquad (17)$$

with $\eta \triangleq \sqrt{\frac{2\gamma^{-1}w\tilde{w}}{\lambda_{\min}(Q)}}$ and $\tilde{w} = \hat{W}_{\max} + w$. In addition,

$$\|u_a(t)\|_2 \le \hat{W}_{\max} \bar{\sigma}, \quad t \ge 0, \qquad (18)$$

assuming $\|\sigma(x(t))\|_2 \le \bar{\sigma}$, and hence,

$$\begin{aligned} \|u(t)\|_2 &\le \|K_x\|_2 x(t) + \hat{W}_{\max} \bar{\sigma}, \\ &\le \|K_x\|_2 (\|x_r(t)\|_2 + \|e(t)\|_2) + \hat{W}_{\max} \bar{\sigma}, \end{aligned} \qquad (19) \\ t \ge 0. $$

### 3.2.2. Set-theoretic MRAC

Given the system (13), the set-theoretic model reference adaptive control architecture (STMRAC) allows the error bound $\|e(t)\|_P = \sqrt{e^\top(t)Pe(t)}$ to be less than a-priori, user-defined worst-case performance bound $\epsilon$. Hence, the performance bounds depend solely on some user-defined design parameters and not on the knowledge of the unknown matrix $W$ as for the standard MRAC, see (17). Define a generalized barrier Lyapunov function satisfying the properties specified in Arabi et al. (2018)

$$\phi(\|e(t)\|_P) = \frac{\|e(t)\|_P^2}{\epsilon - \|e(t)\|_P}, \quad \|e(t)\|_P \in \mathcal{D}_{\epsilon}, \qquad (20)$$

with $\mathcal{D}_{\epsilon} = \{\|e(t)\|_P : \|e(t)\|_P \in [0, \epsilon)\}$, whose partial derivative with respect to $\|e(t)\|_P$ reads

$$\phi_d(\|e(t)\|_P) = \frac{\epsilon - \frac{1}{2}\|e(t)\|_P}{(\epsilon - \|e(t)\|_P)^2}, \quad \|e(t)\|_P \in \mathcal{D}_{\epsilon}. \qquad (21)$$

By selecting

$$\dot{\hat{W}}(t) = \gamma \text{Proj}_m(\hat{W}(t), \phi_d(\|e(t)\|_P)\sigma(x(t))e^\top(t)PB), \\ t \ge 0, \qquad (22)$$

one can prove that $\|e(t)\|_P \le \epsilon$, and finally,

$$\|e(t)\|_2 \le \frac{\epsilon}{\sqrt{\lambda_{\min}(P)}}, \quad t \ge 0. \qquad (23)$$

Note that $\phi_d(\|e(t)\|_P)$ can be seen as an error-dependent learning rate. Note that (18) and (19) also hold for the STMRAC.

## 3.3. RG design

After recalling a few preliminaries about the scalar RG strategy, this section illustrates the proposed robust RG. To limit the typical robust governor conservatism, the approach proposes to build the RG problem by employing the MRAC/STMRAC performance guarantees. In addition, the computational cost of the strategy presented in Magnani, dos Reis de Souza, et al. (2023) is largely reduced by redefining the optimization problem to make it become LP.

<figure><img src="image_4.png" /><figcaption>Fig. 3. Reference Governor.</figcaption></figure>

### 3.3.1. Scalar reference governor preliminaries

Reference governors function as a pre-filter between an input reference signal $r(t)$ and a closed-loop system that is proven to guarantee the desired performance in the absence of constraints. The purpose of the governor block is to monitor the system's state and input constraints and to intervene if there is a potential risk. The governor-based control scheme is illustrated in Fig. 3.

Assuming a model for the discrete closed-loop system dynamics is available for a sampling time $T_s$, the RG block is accessed every $T_s$ seconds to evaluate if, given the current closed-loop state $x_d(j) = x(t)$, measured or estimated, the current desired reference $r(j) = r(t)$ guarantees future constraint enforcement. If not, then $r(j)$ is modified into $v(j)$. Then, $v(t)$ will result being a piece-wise constant signal $v(t) = v(jT_s)$, $\forall t \in [jT_s, (j+1)T_s)$. The future system evolution is predicted via the discrete-time model

$$\begin{aligned} x_d(k+1) &= A_d x_d(k) + B_d v(k), & x_d(k=0) &= x_d(j), \\ y_{c_d}(k) &= C_d x_d(k) + D_d v(k), \end{aligned} \qquad (24)$$

where $x_d(k) \in \mathbb{R}^n$ is the discrete state vector corresponding to $x(t)$ in continuous time, $v(k) \in \mathbb{R}^{n_r}$ is the modified reference assumed to be constant along the prediction horizon, $y_{c_d}(k) \in \mathbb{R}^n_c$ gathers the state and input constraints specified by $y_c$ in continuous time, and the matrices $A_d \in \mathbb{R}^{n \times n}$, $B_d \in \mathbb{R}^{n \times n_r}$, $C_d \in \mathbb{R}^{n_p \times n}$, $D_d \in \mathbb{R}^{n_p \times n_r}$ model the closed-loop system evolution. State and input constraints must be satisfied all along the prediction, i.e.,

$$y_{c_d}(k) \in \mathcal{Y}, \quad \forall k \in \mathbb{Z}_+ \qquad (25)$$

where $\mathcal{Y}$ is defined as in (6). Then, based on the predicted trajectory, the reference governor selects the best approximation $v(j)$ of the desired reference $r(j)$ such that, if maintained constant, constraints are ensured to be enforced from time $t$ onward.

Assuming there exists an initial signal $v(j=0)$ satisfying constraints all along the system evolution, the scalar reference governor criteria for the selection of the signal $v(j)$ is formulated using the scalar parameter $\kappa(j)$:

$$v(j) = v(j-1) + \kappa(j)(r(j) - v(j-1)) \qquad (26)$$

where $0 \le \kappa(j) \le 1$. If the RG predicts that the reference $r(j)$ does not lead to constraints violation, then $\kappa(j) = 1$, and $v(j) = r(j)$. Otherwise, if constraint violation is at risk, the governor selects the highest value of $\kappa(j)$ that guarantees their enforcement. According to (26), the resulting current modified reference $v(j)$ will be such that $v(j) \in [v(j-1), r(j)]$. In the extreme case, $\kappa(j) = 0$ and $v(j) = v(j-1)$. In this event, the system applies the reference $v(j-1)$, computed at the previous time step, which proved to ensure constraint enforcement from time $j-1$ onward. Safety and recursive feasibility are therefore intuitively proven. The maximal output admissible set (MOAS), $O_\infty$, is introduced to formally describe the governor problem:

$$O_\infty = \{(v(j), x_d(j)) : y_{c_d}(k|v(j), x_d(j)) \in \mathcal{Y}, \forall k \in \mathbb{Z}_+\}. \qquad (27)$$

Then, RG computes $v(j)$ such that $(v(j), x_d(j)) \in P$, with $P \subseteq O_\infty \subset \mathbb{R}^{n_r} \times \mathbb{R}^n$. The set $O_\infty$ gathers all states $x_d(j)$ and constant inputs, $v(j+k) = v(j)$, such that constraints are ensured to be
satisfied in the future evolution of the system. P can coincide with $\tilde{O}_{\infty}$, but for computational reasons a tightened version $\tilde{O}_{\infty}$ of the set $O_{\infty}$ is generally adopted so that the associated steady-state output $y_{ss}(k \to \infty)$ respects constraints with a nonzero margin $\epsilon > 0$. The expression of $y_{ss}(k \to \infty)$ is obtained considering that when $k \to \infty$, $x_d(k+1) = x_d(k) = x_d(k \to \infty)$ and $x_d(k \to \infty) = A_d x_d(k \to \infty) + B_d v$. Rearranging to solve for $x_d(k \to \infty)$:

$$ 
\begin{aligned}
(I - A_d)x_d(k \to \infty) &= B_d v \\
x_d(k \to \infty) &= (I - A_d)^{-1} B_d v.
\end{aligned} 
\qquad (28) 
$$

Finally, substituting (28) in (24),

$$ y_{ss}(k \to \infty) = (C_d(I - A_d)^{-1}B_d + D_d)v. \qquad (29) $$

Then, the related $\tilde{O}_{\infty}$ is defined as $\tilde{O}_{\infty} = O_{\infty} \cap O^{\epsilon}$, where $O^{\epsilon} = \{(v(j), x_d(j)) : (C_d(I - A_d)^{-1}B_d + D_d)v(j) \in (1 - \epsilon)\}$. Hence, the governor computes the signal $v(j)$ such that $(v(j), x_d(j)) \in \tilde{O}_{\infty}$. It can be shown that $\tilde{O}_{\infty}$ is non-empty and positively invariant, which means that if $(v(j), x_d(j)) \in \tilde{O}_{\infty}$, when applying $v(j)$ to the system, then also $(v(j), x_d(j+1)) \in \tilde{O}_{\infty}$. Thanks to the positive invariance of $\tilde{O}_{\infty}$, $v(j) = v(j-1)$ always satisfies constraints and hence recursive feasibility is proven under the condition that there exists a known signal $v(j=0)$ such that $(v(j=0), x_d(j=0)) \in \tilde{O}_{\infty}$. See Garone et al. (2017), Gilbert and Tan (1991) for details. Then, the governor solves the following optimization problem at each time step:

$$ 
\begin{array}{ll}
\underset{\kappa \in [0, 1]}{\text{maximize}} & \kappa \\
\text{subject to} & v(t) = v(t-1) + \kappa(r(t) - v(t-1)) \quad (30) \\
& (v(t), x(t)) \in \tilde{O}_{\infty}.
\end{array}
$$

In this notation, the property of recursive feasibility guarantees that the value of $\kappa(j) = 0$ remains a feasible solution of the optimization problem in (30) assuming a feasible solution exists at the initial time. Since only the scalar parameter $\kappa(j)$ is optimized online, the computational complexity of this approach is minimal. The reduced computational cost is a key feature of the scalar governor and makes it very interesting compared to other predictive control techniques that might result in being heavier and not implementable in real-time, e.g. model predictive control. In addition, the governor acts as a pre-filter and does not interfere with the closed-loop stability properties. As a result, governors are particularly interesting for those applications that already implement an established controller but lack of an optimal technique to monitor state and input constraints. Finally, assuming that $\mathcal{Y}$ is compact, $A_d$ is Schur, and the pair $(A_d, C_d)$ is observable, it can be shown that $\tilde{O}_{\infty}$ is a finitely determined polytope (Gilbert & Tan, 1991). In other words, there exists a finite index $k^*$ such that

$$ \tilde{O}_{\infty} = \{(v(j), x_d(j)) : y_{cd}(k|v(j), x_d(j)) \in \mathcal{Y}, k = 0, \dots, k^*\} \cap O^{\epsilon}. \qquad (31) $$

As a result, the scalar reference governor optimization problem can be easily formulated to be explicitly solvable, further reducing its computational cost. To do so, we remark that if $\mathcal{Y}$ is a polytope, then it can be written as $\mathcal{Y} = \{y_{cd} : Hy_{cd} \le h\}, h > 0$. By knowing that $\sum_{i=0}^{k-1} A_d^i = (I - A_d^k)(I - A_d)^{-1}$ and considering a constant $v$ along the $k^*$ time steps of the prediction horizon, (24) can be easily rewritten as

$$ 
\begin{aligned}
x_d(k) &= A_d^k x_d(j) + \sum_{i=0}^{k-1} A_d^i B_d v \\
&= A_d^k x_d(j) + (I - A_d^k)(I - A_d)^{-1} B_d v, \\
y_{cd}(k) &= C_d A_d^k x_d(j) + C_d (I - A_d^k)(I - A_d)^{-1} B_d v + D_d v.
\end{aligned} 
\qquad (32) 
$$

Rearranging (32) including (26), $\tilde{O}_{\infty}$ can be expressed as

$$ \tilde{O}_{\infty} = \{(v(j), x_d(j)) : a + b\kappa(j) \le c\}, \qquad (33) $$

with

$a =$

$$ 
\begin{bmatrix}
HD_d & HC_d & \\
HC_d B_d + HD_d & HC_d A_d & \\
\vdots & \vdots & \\
HC_d(I - A_d^{k*})(I - A_d)^{-1}B_d + HD_d & HC_d A_d^{k*} & \\
HC_d(I - A_d)^{-1}B_d + HD_d & 0 & \\
\end{bmatrix}
\begin{bmatrix}
v(j-1) \\
x_d(j) \\
\end{bmatrix},
$$

$$ b = \begin{bmatrix} HD_d \\ HB_d C_d + HD_d \\ \vdots \\ HC_d(I - A_d^{k*})(I - A_d)^{-1}B_d + HD_d \\ HC_d(I - A_d)^{-1}B_d + HD_d \end{bmatrix} (r(j) - v(j-1)), $$

$$ c = \begin{bmatrix} h \\ h \\ \vdots \\ h \\ (1 - \epsilon)h \end{bmatrix}. $$

It is worth noting that $k^*$ corresponds to the iteration where calculating subsequent rows of matrices $a$ and $b$ no longer produces any new, non-redundant linear inequalities. This condition can be verified using linear programming (Garone et al., 2017; Kolmanovsky & Gilbert, 1998). Finally, the RG solution for $\kappa(j)$ is explicitly found setting

$$ 
\begin{align} 
\kappa_U &= \min_{i: b_i > 0} \left\{ \frac{c_i - a_i}{b_i} \right\}, 1 \notag \\ 
\kappa_L &= \max_{i: b_i < 0} \left\{ \frac{c_i - a_i}{b_i} \right\}, 0 \tag{34} 
\end{align} 
$$

$$ \kappa = \begin{cases} \kappa_U & \text{if } \kappa_L \le \kappa_U \text{ and } a_i \le c_i \\ 0 & \text{for all } i \text{ such that } b_i = 0 \\ 0 & \text{otherwise} \end{cases} $$

where the subscript $i$ denotes the $i$th row of the corresponding matrix, $i = 1, \dots, k^*$.

### 3.3.2. MRAC-based reference governor

The scalar reference governor just presented does not account for possible unmodeled disturbances or dynamics acting on the system. However, with a simple manipulation of the equations we have just discussed, and introducing appropriate assumptions on the unknown dynamics, one can easily enforce constraints even for partially unknown closed-loop systems. This is classically achieved by designing robust governors, in which the prediction is made considering all possible effects of the unknown terms, see Garone et al. (2017). Similarly, we propose a solution that limits the robust governor conservatism by exploiting the model reference adaptive control performance guarantees presented in Eqs. (17), (18), and (23). Combining adaptive control with governor strategies is a relatively novel approach, that is particularly attractive for constrained uncertain systems, see Magnani, dos Reis de Souza, et al. (2023) and Zhao et al. (2023), where $\mathcal{L}_1$ adaptive control is merged with a reference governor. Let the following set of operations be introduced:

**Definition 3.1.** Let $\mathcal{P}, \mathcal{Q} \subset \mathbb{R}^n$, the Pontryagin Difference is defined as:

$$ \mathcal{P} \oplus \mathcal{Q} = \{p : p + q \in \mathcal{P}, \forall q \in \mathcal{Q}\}. \qquad (35) $$
**Definition 3.2.** Let $\mathcal{P}, \mathcal{Q} \subset \mathbb{R}^n$, the Minkowski Sum is defined as:

$$ \mathcal{P} \oplus \mathcal{Q} = \{p+q: p \in \mathcal{P}, q \in \mathcal{Q}\}. \quad (36) $$

Next, we define as reachable sets the sets gathering all the possible evolution of a variable. The MRAC/STMRAC performance guarantees are employed to build the MRAC-based robust governor. The reachable sets $\mathcal{F}_{k+1}^{\mathcal{X}_d}$ of the state $x_d(k)$ along the prediction horizon are computed as

$$ \mathcal{F}_{k+1}^{\mathcal{X}_d} = \{x_{r_d}(k+1)\} \oplus \mathcal{E}_x, \quad (37) $$

where $\mathcal{E}_x$ takes into account the mismatch between $x_d(k)$ and $x_{r_d}(k)$ in accordance to the MRAC bounds on the error $e(t)$ as defined in (17) and (23). Therefore, $e(k) \in \mathcal{E}_x \ \forall k \in [1, k^*], \forall t \ge 0$. Note that the size of $\mathcal{E}_x$ does not grow along the prediction horizon, unlike in the standard robust RG strategy (Kolmanovsky & Gilbert, 1998). Note also that the trajectory of the nominal state $x_{r_d}(k)$ is perfectly known. Similarly, define $u_d(k)$ as the discrete-time signal representing the control input $u(t)$ as defined in (7). The mismatch $e_u(t)$ between the control input $u(t) = -K_x x(t) + u_a(t)$ and the nominal control signal $u_r(t) = -K_x x_r(t)$ can be computed as

$$ e_u(t) = -K_x e(t) + u_a(t). \quad (38) $$

In accordance to (18) it follows that

$$ \|e_u(t)\|_2 \le \|K_x\|_2 \|e(t)\|_2 + \hat{W}_{\max} \bar{\sigma}. \quad (39) $$

Then, the control input reachable set results being

$$ \mathcal{F}_{k+1}^{\mathcal{U}_d} = \{-K_x x_r(k+1)\} \oplus \mathcal{E}_u, \quad (40) $$

where $\mathcal{E}_u$ takes into account the mismatch $e_u(t)$. Finally, the reachable sets $\mathcal{F}_k^{\mathcal{Y}_{cd}}$ of the constraints $y_{cd}(k)$ along the prediction horizon are computed as

$$ \mathcal{F}_k^{\mathcal{Y}_{cd}} = \{y_{c,r_d}(k)\} \oplus C_{cd} \mathcal{E}_x \oplus D_{w_{cd}} \mathcal{E}_u, \quad (41) $$

where $y_{c,r_d}(k) \in \mathbb{R}^{n_c}$ gathers the state and input constraints in nominal conditions. Then, the governor computes at each time step the signal $v(j)$ such that $(v(j), x_d(j))$ belongs to

$$ \tilde{O}_{\infty} = \{(v, x(t)): \mathcal{F}_k^{\mathcal{Y}_{cd}} \in \mathcal{Y}, \forall k \in [1, k^*]\} \cap O^e, \quad (42) $$

or, equivalently, $v(j)$ such that

$$ \begin{gathered} (v(j), x_d(j)) \in \tilde{O}_{\infty} = \{(v(j), x_d(j)): \\ y_{c,r_d}(k) \in \bar{\mathcal{Y}} = \mathcal{Y} \oplus C_{cd} \mathcal{E}_x \oplus D_{w_{cd}} \mathcal{E}_u, \\ v(j) \in O^e, \forall k \in [1, k^*]\}. \end{gathered} \quad (43) $$

Assuming $\bar{\mathcal{Y}}$ is a nonempty, convex, and compact set, if an admissible command $v(j=0)$ such that $(v(j=0), x_d(j=0)) \in \tilde{O}_{\infty}$ exists at $t=0$, then, the new $\tilde{O}_{\infty}$ is a non-empty, finitely-determined, and positively-invariant polytope. Hence, the property of recursive feasibility still holds. Finally, the RG optimization problem can be simply rewritten to be explicitly solvable as in (33) by modifying the matrix $c$ that now takes into account the mismatch between the reference model and the real system:

$$ c = \begin{bmatrix} h - C_{cd} \|e(t)\|_2 I_{n_r \times 1} - D_{w_{cd}} \|e_u(t)\|_2 I_{n_r \times 1} \\ h - C_{cd} \|e(t)\|_2 I_{n_r \times 1} - D_{w_{cd}} \|e_u(t)\|_2 I_{n_r \times 1} \\ \vdots \\ h - C_{cd} \|e(t)\|_2 I_{n_r \times 1} - D_{w_{cd}} \|e_u(t)\|_2 I_{n_r \times 1} \\ (1 - \epsilon)(h - C_{cd} \|e(t)\|_2 I_{n_r \times 1} - D_{w_{cd}} \|e_u(t)\|_2 I_{n_r \times 1}) \end{bmatrix}. \quad (44) $$

# 4. Numerical simulation

## 4.1. Simulation setup

The proposed methodology is illustrated on the system presented in (1) with $x_p(t) = [\theta(t), \dot{\theta}(t), \ddot{\theta}(t)]^\top$, $x_p(0) = [0, 0, 0]^\top$

<figure><img src="image_5.png" /><figcaption>Fig. 4. Tracking performance (RG vs MRAC-RG).</figcaption></figure>

<figure><img src="image_6.png" /><figcaption>Fig. 5. Tracking performance (RG vs STMRAC-RG).</figcaption></figure>

setting $dt = 0.001s$. A solution for the three axes problem can be easily implemented following Magnani, Cassaro, Biannic, Bodet, and Evain (2024) and considering the low-coupling assumption between the axes. The nominal control gain $K_x = [20.82 \ 211.75 \ 100.79 \ 1]$ is tuned via an LQR algorithm setting the LQR matrices to be $Q_{LQR} = I_{n \times n}$ and $R_{LQR} = I_{m \times m}$. The parameters for the MRAC algorithms tuning are $Q = I_{m \times m}$, and $\sigma(x(t)) = [\dot{\theta}(t), 1]^\top$. For a precise compensation of the uncertainty, $\gamma$ and $\epsilon$ are selected as $\gamma = 10^6$, and $\epsilon = 10^{-6}$. The RG sampling time is set to $dt_{RG} = 0.01s$, while 3000 steps are used to approximate $\tilde{O}_{\infty}$, which corresponds to a prediction window of 30s. The reference attitude to track is set to $r = 57.29 \ \text{deg} = 1 \ \text{rad}$.

## 4.2. Simulation results

Figs. 4–10 show the simulation results with a standard RG, the MRAC-based RG, and the STMRAC-based RG. The MRAC and STMRAC disturbance compensation are shown separately in Figs. 4 and 5, because their curves superpose. Due to the uncertainty, the standard RG cannot guarantee constraints enforcement and the actuators’ saturation leads to loss of control, see Figs. 6–7. In Fig. 8, it is shown that the disturbance compensation permits the signal $T_{tot}(t) = u_{RW}(t) + \delta(x_p(t), t)$, actuating the satellite body, to track the nominal desired control law signal $u_N$. Finally, the MRAC and STMRAC performance are shown to respect the expected guarantees in Fig. 9 and Fig. 10. Thanks to the STMRAC formulation, the expected error between the system and the reference model is selected a-priori by the user. Note that the MRAC
<figure><img src="image_7.png" /><figcaption>Fig. 6. Constrained states and input evolution (RG vs MRAC-RG).</figcaption></figure>

<figure><img src="image_8.png" /><figcaption>Fig. 7. Constrained states and input evolution (RG vs STMRAC-RG).</figcaption></figure>

<figure><img src="image_9.png" /><figcaption>Fig. 8. MRAC-RG: Control input VS $\delta(x_p(t), t)$.</figcaption></figure>

learning rate $\gamma = 10^6$ guarantees an error bound in the order of $10^{-4}$, while setting $\epsilon = 10^{-6}$ guarantees $\|e(t)\|_2 \le 2 \times 10^{-6}$, even if the resulting error-dependent learning rate $\phi_d(\|e(t)\|_P)$ is smaller than the selected $\gamma$.

<figure><img src="image_10.png" /><figcaption>Fig. 9. MRAC-RG and STMRAC-RG: $\|e(t)\|_2$.</figcaption></figure>

<figure><img src="image_11.png" /><figcaption>Fig. 10. STMRAC-RG: $\|e(t)\|_P$ and $\phi_d(\|e(t)\|_P)$.</figcaption></figure>

## 5. Conclusions

In this paper, a control framework to address the problem of ensuring accurate and safe satellite attitude control under multiple sources of disturbance and actuators' constraints is addressed. Specifically, the objective is to attenuate the fuel sloshing and flexible appendages disturbances, while avoiding the reaction wheels saturation. The solution combined a model reference adaptive control law with a robust reference governor. The prior allowed for precise reference tracking despite the unmodeled dynamics, the latter enforced the state and input constraints by solving an optimization problem at each time step. Compared to the standard robust governor, thanks to the performance guarantees of the adaptive law, the proposed governor is shown capable of handling larger disturbances with lower conservatism. Two different adaptive controllers are compared. Recursive feasibility and closed-loop system stability are established. Future works will study possible extensions of the RG-MRAC architecture to unmatched uncertainties, as in Yucelen and Haddad (2011), and will include time delays and will consider the implementation of
the control scheme on a satellite high-fidelity simulator. Further-
more, a suboptimal design using three scalar RGs (suitable when
the inter-axis coupling is low) will be explored, potentially offer-
ing advantages for applications such as satellite mission guidance
profile design (Magnani et al., 2024).

CRediT authorship contribution statement

**Guido Magnani:** Writing – original draft, Software, Methodology. **Mario Cassaro:** Writing – review & editing, Software, Methodology. **Jean-Marc Biannic:** Software, Methodology, Conceptualization. **Hélène Evain:** Writing – review & editing, Data curation, Conceptualization. **Laurent Burlion:** Writing – review & editing, Validation, Supervision, Formal analysis.

Declaration of competing interest

The authors declare that they have no known competing finan-
cial interests or personal relationships that could have appeared
to influence the work reported in this paper.

Data availability

No data was used for the research described in the article.

References

Arabi, E., Gruenwald, B. C., Yucelen, T., & Nguyen, N. T. (2018). A set-theoretic model reference adaptive control architecture for disturbance rejection and uncertainty suppression with strict performance guarantees. *International Journal of Control*, *91*(5), 1195-1208. http://dx.doi.org/10.1080/00207179.2017.1312019.

Arabi, E., & Yucelen, T. (2017). A generalization to set-theoretic model reference adaptive control architecture for enforcing user-defined time-varying performance bounds. In *2017 American control conference* (pp. 5077–5082).
http://dx.doi.org/10.23919/ACC.2017.7963742.

Biannic, J.-M., Bourdelle, A., Evain, H., Moreno, S., & Burlion, L. (2019). On robust LPV-based observation of fuel slosh dynamics for attitude control design. *IFAC-PapersOnLine, 52*(28), 170–175. http://dx.doi.org/10.1016/j.ifacol.2019.12.369, 3rd IFAC Workshop on Linear Parameter Varying Systems LPVS 2019.

Bourdelle, A., Biannic, J.-M., Evain, H., Moreno, S., Pittet, C., & Burlion, L. (2019). Propellant sloshing torque $H_\infty$-based observer design for enhanced attitude control. *IFAC-PapersOnLine, 52*(12), 286–291.

Bourdelle, A., Biannic, J.-M., Evain, H., Pittet, C., Moreno, S., & Burlion, L. (2019). Modeling and control of propellant slosh dynamics in observation spacecraft with actuator saturations. In *8th European conference for aeronautics and space sciences*.

Bourdelle, A., Burlion, L., Biannic, J.-M., Evain, H., Moreno, S., Pittet, C., et al. (2019). Towards new controller design oriented models of propellant sloshing in observation spacecraft. In *AIAA SciTech 2019 forum*. http://dx.doi.org/10.2514/6.2019-0115.

Casavola, A., Mosca, E., & Angeli, D. (2000). Robust command governors for constrained linear systems. *IEEE Transactions on Automatic Control*, *45*(11), 2071–2077. http://dx.doi.org/10.1109/9.887628.

Cassaro, M., Biannic, J.-M., & Evain, H. (2022). Adaptive minimal control synthesis for satellite attitude control in presence of propellant sloshing and flexible appendices. In *2022 European control conference* (pp. 193–198). http://dx.doi.org/10.23919/ECC55457.2022.9838221.

Chretien, J.-P., & Manceaux-Cumer, C. (2001). Minimal LFT form of a spacecraft built up from two bodies. In *AIAA guidance, navigation, and control conference and exhibit*. http://dx.doi.org/10.2514/6.2001-4350.

Dodge, F. T. (1971). *Engineering study of flexible baffles for slosh suppression (NASA CR-1880): Tech. rep.*

Garone, E., Di Cairano, S., & Kolmanovsky, I. (2017). Reference and command governors for systems with constraints: A survey on theory and applications. *Automatica*, *75*, 306–328. http://dx.doi.org/10.1016/j.automatica.2016.08.013.

Gilbert, E. G., & Tan, K. T. (1991). Linear systems with state and control constraints: the theory and application of maximal output admissible sets. *IEEE Transactions on Automatic Control*, *36*(9), 1008–1020. http://dx.doi.org/10.1109/9.83532.

Hoffman, E. J., Ebert, W., Femiano, M., Freeman, H., Gay, C., Jones, C., et al. (1999). *The near rendezvous burn anomaly of December 1998: Tech. rep.*, Applied Physics Laboratory, Johns Hopkins University.

Khatoon, S., Gupta, D., & Das, L. K. (2014). PID & LQR control for a quadrotor: Modeling and simulation. In *2014 international conference on advances in computing, communications and informatics* (pp. 796–802). http://dx.doi.org/10.1109/ICACCI.2014.6968232.

Kolmanovsky, Ilya, & Gilbert, Elmer G. (1998). Theory and computation of disturbance invariant sets for discrete-time linear systems. *Mathematical Problems in Engineering*, *4*(4), 317–367.

Magnani, G., Biannic, J. M., Cassaro, M., Evain, H., & Burlion, L. (2022). Reference governor based solution for satellite attitude control in presence of multiple disturbances and actuator saturations. In *9th European conference for aeronautics and space sciences*.

Magnani, G., Biannic, J.-M., Cassaro, M., Evain, H., & Burlion, L. (2022). Reference governor-based solution for satellite attitude control in presence of multiple disturbances and actuator saturations. In *9th European conference for aeronautics and space sciences*. http://dx.doi.org/10.13009/EUCASS2022-4473.

Magnani, Guido, Cassaro, Mario, Biannic, Jean-Marc, Bodet, Aurélien, & Evain, Hélène (2024). Scalar reference governor bank for loosely cross-coupled MIMO systems: application to satellite attitude control. In *2024 European control conference* (pp. 2685–2690).

Magnani, G., dos Reis de Souza, A., Cassaro, M., Biannic, J. M., Evain, H., & Burlion, L. (2023). Command governor-based adaptive control for constrained linear systems in presence of unmodelled dynamics. In *2023 American control conference* (pp. 2387–2392). http://dx.doi.org/10.23919/ACC55779.2023.10156442.

Tam, W., Dommer, K., Wiley, S., Mosher, L., & Persons, D. (2002). Design and manufacture of the MESSENGER propellant tank assembly. In *38th AIAA/ASME/SAE/ASEE joint propulsion conference & exhibit*.

Yucelen, Tansel, & Haddad, Wassim M. (2011). A derivative-free output feedback adaptive control architecture for minimum phase dynamical systems with unmatched uncertainties. In *Proceedings of the 2011 American control conference* (pp. 4183–4188). http://dx.doi.org/10.1109/ACC.2011.5991355.

Zhao, P., Kolmanovsky, I., & Hovakimyan, N. (2023). Integrated adaptive control and reference governors for constrained systems with state-dependent uncertainties. *IEEE Transactions on Automatic Control*, 1–16. http://dx.doi.org/10.1109/TAC.2023.3339499.