## 4 GNC/FDIR System Design and Analysis
### Guidance and Passive Safety
The drivers for choosing this over a more dedicated type of trajectory are the following:  
* Passive safety, which is ensured through a proper definition of ROE, as better explained later;
* Fuel consumption, which is lower than any forced motion trajectory. This strategy allows inspection over the full orientation of the target if it is tumbling, which is a reasonable assumption in the ADR case. The ROE trajectories' extensive testing is performed in Monte Carlo campaigns, as discussed later in Section 5. As mentioned, another aspect ensured by ROEs is the passive safety of the trajectory when the relative eccentricity and the relative inclination vectors are collinear [37; 38], as depicted in Figure 13. In passively safe trajectories, the relative trajectory of the servicer with respect to the client ensures that the servicer does not enter a safety envelope around the client, even in the case of a total loss of the controllability of the servicer, with no specific action needed to avoid a collision. Figure 12: Example of ROE trajectory. Figure 13: Passive safety with ROEs. Collinear relative eccentricity and inclination result in a passively safe trajectory (**a**), while perpendicular relative inclination and eccentricity result in an unsafe trajectory (**b**) that crosses the target trajectory (V-bar). A well-known property of ROEs is that they remain within the same region, in terms of radial and normal separation (see Figure 3), if no actuation is performed and assuming no perturbations, thus satisfying the exclusion of zones. Note that a walking safety ellipse can be obtained with \(\delta a\
eq 0\). The nominal trajectories for Client Phasing and Far Rendezvous are shown in Figure 14.  
The ROE trajectories are modified through impulsive maneuvers. The instantaneous change of ROEs \(\Delta\delta\mathbf{\kappa}\) due to the impulsive change in the chaser velocity \(\delta\mathbf{v}\) in LVLH can be derived from Gauss' Variational equations under the assumptions \(a_{c}\simeq a\) and \(e=0\)[36]:  
\[\Delta\delta\mathbf{\alpha}=\Gamma\delta\mathbf{v},\;\Gamma=\frac{1}{na} \begin{bmatrix} 2&0&0\\ 0&0&2\\ 2\cos u&0&-\sin u\\ 2\sin u&0&\cos u\\ 0&-\cos u&0\\ 0&-\sin u&0\end{bmatrix} ,\;\delta\mathbf{v}= \begin{pmatrix}\delta v_{V}\\ \delta v_{H}\\ \delta v_{R}\end{pmatrix} .\]  
where \(n\) is the mean anomaly of the target orbit. A minimum number of three maneuvers along a V-bar are required to achieve an arbitrary reconfiguration in the plane defined by R-bar and V-bar. Therefore, the final ROEs \(\delta\mathbf{\alpha}_{F}\) after the maneuvers are computed as the following:  
\[\delta\mathbf{\alpha}_{F}=\Phi_{0,F}\delta\mathbf{\alpha}_{0}+ \begin{bmatrix}\Phi_{1, F}\Gamma_{1}&\Phi_{2,F}\Gamma_{2}&\Phi_{3,F}\Gamma_{3}\end{bmatrix}\begin{bmatrix} \delta v_{1}\\ \delta v_{2}\\ \delta v_{3}\end{bmatrix} \]  
where \(\Phi_{i,F}\), \(i=0,1,2,3\), is the state transition matrix computed between the \(i\)th time instant and the final time \(F\). This equation is analytically solved, when the final ROEs are fixed, to find the maneuvers' magnitude and their timing [36]. As formulated in [11], the ROEs are dimensioned to include margins for navigation errors, actuation errors, and orbit perturbations, for a predefined amount of time that ensures the implementation of corrective actions from an external entity. In complement, the validation of passive safety is performed in Monte Carlo simulations, as presented in the following section.