Safety Control for Satellite Formation Flying via High-Order Control Barrier Functions

Abstract

In satellite formation flying, maintaining a predefined safety distance between the reference satellite and its accompanying satellites is critical to prevent collisions—a requirement that traditional control methods fail to satisfy. This paper proposes a novel safety control algorithm that enforces the relative position constraint as a formal safety condition. Specifically, we construct a high-order control barrier function (HOCBF) tailored to the dynamics of satellite formations, which defines a safety set that guarantees collision avoidance. By formulating and solving a quadratic programming problem embedded with the HOCBF, we obtain a safe controller that ensures the forward invariance of the safety set. Simulation results demonstrate that our controller effectively maintains the required safety distance and prevents collisions under various disturbance scenarios, outperforming conventional methods in terms of response speed and robustness. These findings confirm the practical advantages of the proposed approach for safe satellite formation flying.

1. Introduction

Satellite formation flying allows for coordinated missions where multiple satellites work together to achieve objectives that a single satellite could not accomplish [1]. Compared with single-satellite missions, satellite formation technology can improve system mission flexibility, redundancy, and overall performance through joint observation, data sharing, and functional collaboration among multiple satellites. This technology has demonstrated wide application prospects in various fields such as earth observation, scientific exploration, communications, and navigation [2,3,4].

To achieve the coordinated operation of multiple satellites within a formation, precise control of the relative motion between satellites is required. Dynamic modeling of relative motion is the foundation for realizing formation control. The Clohessy–Wiltshire equations are a set of classical linear relative motion dynamic equations used to describe the relative motion between formation satellites on near-circular orbits [5]. Due to their linearization characteristics and the existence of analytical solutions, the Clohessy–Wiltshire equation has low computational complexity and is widely used in orbit control problems for formation flying. However, the Clohessy–Wiltshire equation assumes that the motion of formation satellites relative to the leader satellite is a linear system, neglecting higher-order nonlinear terms. In cases where formation satellites are far apart or operate for extended periods, the errors resulting from the linear assumptions can significantly increase. To address the limitations of the Clohessy–Wiltshire equation, researchers have proposed a series of modification schemes, such as adopting nonlinear dynamic models or using numerical integration methods to combine linear and nonlinear terms for correction. For nonlinear dynamic problems, decomposition methods are commonly used to separate the linear and nonlinear terms in the dynamic equations and solve them using high-precision numerical methods to ensure the accuracy and stability of the control system. This method can effectively reduce system errors and meet the requirements of high-precision formation control [6]. Numerous formation flying control design results have also been found in the literature when the nonlinear dynamics are considered [7,8,9,10]. To name a few, the authors of [11] provided a neural network-based adaptive sliding mode control scheme for satellite formation flying, and the negative effects of uncertainties together with external disturbances on the relative position and attitude were handled. A second-order sliding mode controller was developed for satellite formation flying in [12], where the derivation of the switching function of the sliding mode controller was not used. Alternatively, the authors of [13] designed a nominal controller by applying Udwadia and Kalaba’s approach, based on which adaptive laws and robust control schemes have been designed to deal with system uncertainty and possible initial condition deviation from the constraints. Considering the collision avoidance of satellites, several safety control schemes have been reported; see, for example, [14,15,16,17].

Although related safety control results for satellite formation flying exist in the literature, a more effective approach, namely, control barrier function-based safety control, has not been fully exploited. This method can handle complex safety constraints and strictly guarantee global safety. Ames et al. in [18] provided an introduction of the control barrier function and discussed its application of designing safety control schemes. Using the control barrier function method, great progress has been made in safety control [19,20,21]. A control barrier function-based safety control algorithm was developed for a constrained robot in [22]. When Gaussian process and measurement noises were considered, the authors of [23] presented a framework for constructing control barrier functions for stochastic systems, based on which safety control schemes were provided. To deal with the situation in which the relative degree of the control barrier function with respect to the targeting dynamic system is greater than one, high-order control barrier functions have been constructed, and corresponding safety control can be designed based on such functions [24,25,26]. Facing the complicated external environment, it is necessary to develop safety control schemes for satellite formation flying to avoid collisions by using the control barrier function, which can effectively deal with the complex safety constraints.

Inspired by advances in control barrier functions and the need to ensure satellite safety, this paper investigates the safety control problem of satellite formation flying. A control barrier function-based safety control scheme is devised to strictly ensure the safety of satellites. The main contributions of this paper can be summarized as follows.

(1) A high-order control barrier function is constructed for a dynamic model of satellite formation flying. The safe set is defined based on the constructed control barrier function.

(2) An optimization problem, where the Lie derivative of the high-order control barrier function is added as the constraint, is clearly formulated. The safety controller can be obtained by solving the optimization problem in a real-time manner.

The remainder of this paper is organized as follows. Section 2 describes the problem formulation and preliminaries. The safety control design results are provided in Section 3. Section 4 presents the simulation results to show the effectiveness of the proposed safety control scheme, and the paper is concluded in Section 5.

2. Problem Formulation and Preliminaries

This section mainly discusses how to establish the model of the satellite formation flying and introduces some preliminaries of safety control based on the control barrier function. Following this description, the purpose of this paper is presented. The details are given in the rest of the section.

2.1. Dynamic Model of Satellite Formation

A satellite formation consists of two or more satellites that work collaboratively to accomplish a common task. The key to formation flying is the control of the relative position and velocity between satellites, which requires precise dynamic models. The study of satellite formation dynamics primarily focuses on describing and predicting the relative motion among the satellites that comprise the formation. Each satellite in the formation is influenced by various gravitational forces, and the interactions of these forces determine the satellites’ trajectories.

As shown in Figure 1, assume that the reference satellite is operating in a circular orbit with a radius $r=\parallel \mathbf{r}\parallel$. The $OXYZ$ coordinate system represents the Earth-centered inertial frame, while the $O_2{X}_2{Y}_2{Z}_2$ coordinate system is the reference satellite’s orbital frame. The $O_2{Y}_2$ axis points from the Earth’s center towards the reference satellite, the $O_2{X}_2$ axis points in the opposite direction of the reference satellite’s motion, and the $O_2{Z}_2$ direction is determined by the right-hand screw rule. In the orbital coordinate system, the position vector of the accompanying satellite is represented as $\mathbf{r}={\left[xyz\right]}^{\top }$. When neglecting the influence of gravitational forces, the Lagrangian function for the motion of the accompanying satellite relative to the reference satellite is described as

$$\begin{array}{ccc}\hfill L& =& {\displaystyle \frac{m}{2}}\left[{(\dot{x}-\omega y-\omega r)}^2+{(\dot{y}+\omega x)}^2+{\dot{z}}^2\right]+{\displaystyle \frac{\mu m}{d}},\hfill \end{array}$$

(1)

where $d=\sqrt{x^2+{(y+r)}^2+z^2}$, $\mu$ is the gravitational constant of the earth, m is the mass of the orbiting satellite, and $\omega$ is the orbital angular velocity of the central body.

Substituting Equation (1) into the Lagrange equation yields the following dynamics model for the satellite formation:

$$\begin{array}{ccc}\hfill \left[\begin{array}{c}\ddot{x}-{\omega }^{2}x-2\omega \dot{y}\\ \ddot{y}\\ \ddot{z}\end{array}\right]& =& {\displaystyle \frac{\mu }{d^3}}\left[\begin{array}{c}x\\ y+r\\ z\end{array}\right].\hfill \end{array}$$

(2)

It can be observed that Equation (2) is nonlinear, and due to the fact that the relative distance between the reference and accompanying satellites is much smaller than the orbital radius of the primary star, the model in (2) exhibits weak nonlinearity.

By performing a Taylor expansion on the nonlinear terms and retaining the lower-order terms, the nonlinear model (2) can be linearized as follows.

$$\begin{array}{ccc}\hfill \left[\begin{array}{c}\ddot{x}\\ \ddot{y}\\ \ddot{z}\end{array}\right]& =& \left[\begin{array}{c}2\omega \dot{y}\\ 3{\omega }^{2}y-2\omega \dot{x}\\ -{\omega }^{2}z\end{array}\right].\hfill \end{array}$$

(3)

The linearized dynamic model (3) has become a commonly used tool in research on satellite formation dynamics and control due to its concise mathematical form. However, when formation satellites require significant orbital maneuvers and adjustments, the prediction accuracy of the linear model drops significantly, making it difficult to accurately describe the actual motion of the system. Additionally, since the linearization assumption neglects second-order and higher-order nonlinear terms, it may lead to instability in the system under certain conditions. Therefore, when dealing with complex space environments where nonlinear effects are prominent, the linear model has limited applicability and fails to meet the requirements for high-precision control.

In this paper, the nonlinear Equation (1) is equivalently rewritten as a combination of a linear part and a nonlinear part. The following equivalent expression of Equation (1) is obtained.

$$\begin{array}{ccc}\hfill \left[\begin{array}{c}\ddot{x}\\ \ddot{y}\\ \ddot{z}\end{array}\right]& =& \left[\begin{array}{c}2\omega \dot{y}\\ 3{\omega }^{2}y-2\omega \dot{x}\\ -{\omega }^{2}z\end{array}\right]+\left[\begin{array}{c}{\omega }^{2}x\\ -2{\omega }^{2}y-r{\omega }^2\\ {\omega }^{2}z\end{array}\right]\hfill \\ & & -{\displaystyle \frac{\mu }{d^3}}\left[\begin{array}{c}x\\ y+r\\ z\end{array}\right].\hfill \end{array}$$

Considering the control input of the accompanying satellite, the above equation can be described as

$$\begin{array}{ccc}\hfill \left[\begin{array}{c}\ddot{x}\\ \ddot{y}\\ \ddot{z}\end{array}\right]& =& \left[\begin{array}{c}2\omega \dot{y}\\ 3{\omega }^{2}y-2\omega \dot{x}\\ -{\omega }^{2}z\end{array}\right]+\left[\begin{array}{c}{\omega }^{2}x\\ -2{\omega }^{2}y-r{\omega }^2\\ {\omega }^{2}z\end{array}\right]\hfill \\ & & -{\displaystyle \frac{\mu }{d^3}}\left[\begin{array}{c}x\\ y+r\\ z\end{array}\right]+\left[\begin{array}{c}{u}_1\\ u_3\\ u_5\end{array}\right],\hfill \end{array}$$

(4)

where $u_1$, $u_3$, and $u_5$ are the control input of the accompanying satellite, respectively. (Here, the subscripts of the control inputs are set as 1, 3, and 5 for facilitating the following descriptions).

For satellite formation flying, one can design a simple PID controller to tune the position of the accompanying satellite. However, taking into account the physical dimensions of the accompanying satellite and the reference satellite, it is necessary to avoid collisions between the accompanying satellite and the reference satellite when the position of the accompanying satellite is driven to that of the reference satellite. The traditional PID control and even some intelligent control methods cannot satisfy such a requirement. To this end, a safety control scheme is devised in this paper. Before proceeding, the related preliminaries are first given.

2.2. Control Barrier Function

In this paper, the control barrier function is introduced to design a safety controller for the satellite formation flying. Some preliminaries concerning the safety control based on the control barrier function is provided.

Consider the following control affine nonlinear system:

$$\begin{array}{c}\hfill \dot{x}=f\left(x\right)+g\left(x\right)u,\end{array}$$

(5)

where $x\in \mathcal{D}\subset {\mathcal{R}}^n$ is the system state, and it is forward complete. u is the control input to be designed. The nonlinear functions $f\left(x\right)$ and $g\left(x\right)$ are locally Lipschitz.

For System (5), define the set $\mathcal{C}$ as

$$\begin{array}{ccc}\hfill \mathcal{C}& =& \left\{x\in {\mathcal{R}}^n:h\left(x\right)\ge 0\right\}\hfill \end{array}$$

(6)

where $h\left(x\right)$ is a continuously differentiable function.

Before proceeding further, the following definitions are given to explain the forward invariant, barrier function, and control barrier function.

Definition 1. 

If any initial value $x\left(t_0\right)\in \mathcal{C}$ can make $x\left(t\right)\in \mathcal{C}$ for any $t\ge t_0$, the set $\mathcal{C}$ is forward invariant.

If the function $h\left(x\right)$ satisfies Definition 2, the function $h\left(x\right)$ is a barrier function of System (5).

Definition 2. 

If there exists a $\mathcal{K}$ class function $\alpha (·)$ such that $\dot{h}\left(x\right)+\alpha \left(h\left(x\right)\right)\ge 0$ holds $\forall x\in \mathcal{C}$, the function $h\left(x\right)$ is a barrier function of System (5).

Per the descriptions mentioned above, Definition 3 provides the definition for the control barrier function.

Definition 3. 

For the defined set $\mathcal{C}$, if there exists a $\mathcal{K}$ class function $\alpha (·)$ such that the following inequality holds, the function $h\left(x\right)$ is a control barrier function of System (5).

$$\begin{array}{c}\hfill L_{f}h\left(x\right)+L_{g}h\left(x\right)u+\alpha \left(h\left(x\right)\right)\ge 0,\end{array}$$

(7)

where $L_{f}h\left(x\right)$ and $L_{g}h\left(x\right)$ are the Lie derivative operations, and the expressions are given as below.

$$\begin{array}{ccc}\hfill L_{f}h\left(x\right)& =& {\displaystyle \frac{\partial h\left(x\right)}{\partial x}}f\left(x\right),L_{g}h\left(x\right)={\displaystyle \frac{\partial h\left(x\right)}{\partial x}}g\left(x\right).\hfill \end{array}$$

If the relative degree of the Lie derivative of the control barrier function with regard to System (5) is one, according to Theorem 2 in [27], there exists a control input u such that the set $\mathcal{C}$ is forward invariant for System (5).

Per the aforementioned discussion, one can describe the safety constraints for System (5) by constructing a control barrier function $h\left(x\right)$, based on which the safety set $\mathcal{C}$ can be defined, namely,

$$\begin{array}{ccc}\hfill \mathcal{C}& =& \left\{x\in \mathcal{D}\subset {\mathcal{R}}^n:h\left(x\right)\ge 0\right\},\hfill \\ \hfill \partial \mathcal{C}& =& \left\{x\in \mathcal{D}\subset {\mathcal{R}}^n:h\left(x\right)=0\right\},\hfill \\ \hfill \mathrm{Int}\left(\mathcal{C}\right)& =& \left\{x\in \mathcal{D}\subset {\mathcal{R}}^n:h\left(x\right)>0\right\},\hfill \end{array}$$

where $\partial \mathcal{C}$ is the boundary of the set $\mathcal{C}$, and $\mathrm{Int}\left(\mathcal{C}\right)$ is the inner of the set $\mathcal{C}$.

Then, one can calculate the safety controller u by solving the following optimization problem.

$$\begin{array}{cc}\hfill min\parallel u\parallel & \\ \hfill s.t.& \\ \hfill L_{f}h\left(x\right)+L_{g}h\left(x\right)u+\alpha \left(h\left(x\right)\right)\ge 0.\end{array}$$

Once the controller u is obtained in a real-time manner by solving the above problem, the safety of System (5) can be guaranteed. Obviously, the stability of System (5) is not considered in the above problem. If one adds the constraint on the control Lyapunov function, both the safety and stability of System (5) can be preserved. For more details, one can refer to the literature, for example, [28,29].

The aim of this paper is to design a safety controller for the accompanying satellite and avoid collisions between the reference satellite and the accompanying satellite. Specifically, one problem to be solved is to construct an appropriate control barrier function for the provided formation flying model. The other lies in devising a safety control algorithm for the accompanying satellite.

To clearly formulate the control problem to be solved based on the previous description, it can be summarized as follows. Constructing an appropriate control barrier function and defining the safe set for System (4), one should design a controller, which can enable the states of System (4) to satisfy the safe set all the time.

3. Safety Control Design

This section mainly discusses how to solve the problems mentioned above and design a safety controller for the accompanying satellite. A high-order control barrier function is first designed based on the satellite formation flying model. Then, a quadratic programming based safety control problem is formulated to calculate the safety controller. The details are presented below.

3.1. High-Order Control Barrier Function Design

Before discussing how to design the control barrier function, System (4) is rewritten as the state space form. Defining $x_1=x$, $x_2=\dot{x}$, $x_3=y$, $x_4=\dot{y}$, $x_5=z$, and $x_6=\dot{z}$, one can rewrite System (4) as

$$\begin{array}{ccc}\hfill {\dot{x}}_1& =& x_2,\hfill \\ \hfill {\dot{x}}_2& =& 2\omega x_4+{\omega }^2{x}_1-{\displaystyle \frac{\mu }{d^3}}{x}_1+u_1,\hfill \\ \hfill {\dot{x}}_3& =& x_4,\hfill \\ \hfill {\dot{x}}_4& =& {\omega }^2{x}_3-2\omega x_2+r{\omega }^2-{\displaystyle \frac{\mu }{d^3}}\left(x_3+r\right)+u_3,\hfill \\ \hfill {\dot{x}}_5& =& x_6,\hfill \\ \hfill {\dot{x}}_6& =& -{\displaystyle \frac{\mu }{d^3}}{x}_5+u_5,\hfill \end{array}$$

(8)

where $x_i\in \mathcal{D}\subset \mathcal{R}$, $(i=1,2,3,4,5,6)$, and $\mathcal{D}$ is the set of safety positions of the accompanying satellite.

To facilitate the following description, a compact form of (8) is described as

$$\begin{array}{ccc}\hfill {\dot{x}}_i& =& x_{i+1},\hfill \\ \hfill {\dot{x}}_{i+1}& =& f_i\left(x\right)+u_i,i=1,2,3,4,5,\hfill \end{array}$$

(9)

where $x_i\in \mathcal{D}\subset \mathcal{R}$, and $f_i\left(x\right)$ is determined based on (8).

To guarantee the safety of the satellite formation flying system, and considering the sizes of both the reference satellite and the accompanying satellite, the position variables must satisfy $x_1\ge {\iota }_1$, $x_3\ge {\iota }_2$, and $x_5\ge {\iota }_3$ simultaneously, where ${\iota }_j$ $(j=1,2,3)$ are the safety distances of the reference satellite and the accompanying satellite. Then, the following control barrier functions are defined for System (9).

$$\begin{array}{ccc}\hfill h_1\left(x\right)& =& x_1-{\iota }_1,\hfill \\ \hfill h_3\left(x\right)& =& x_3-{\iota }_2,\hfill \\ \hfill h_5\left(x\right)& =& x_5-{\iota }_3.\hfill \end{array}$$

According to the above description and the results in [18], the safety set $\mathcal{C}$ can be defined as $\mathcal{C}={\mathcal{C}}_1\bigcup {\mathcal{C}}_3\bigcup {\mathcal{C}}_5$, where ${\mathcal{C}}_i$ $(i=1,3,5)$, respectively, represents the superset of the control barrier functions $h_l\left(x\right)$. Furthermore, ${\mathcal{C}}_l$ is defined as

$$\begin{array}{ccc}\hfill {\mathcal{C}}_i& =& \left\{x_i\in \mathcal{D}\subset \mathcal{R}:h_i\left(x\right)\ge 0\right\},\hfill \\ \hfill \partial {\mathcal{C}}_i& =& \left\{x_i\in \mathcal{D}\subset \mathcal{R}:h_i\left(x\right)=0\right\},\hfill \\ \hfill \mathrm{Int}\left({\mathcal{C}}_i\right)& =& \left\{x_i\in \mathcal{D}\subset \mathcal{R}:h_i\left(x\right)>0\right\},\hfill \end{array}$$

where $\partial {\mathcal{C}}_i$ denotes the boundary of the set ${\mathcal{C}}_i$, and $\mathrm{Int}\left({\mathcal{C}}_i\right)$ is the inner of the set ${\mathcal{C}}_i$.

According to Definition 1, for the initial position of the satellite formation $x_i\left(0\right)\in {\mathcal{C}}_i$, if one can design a safety controller u such that $x_i\left(t\right)\in {\mathcal{C}}_i$ holds for $\forall t>0$, the safety set $\mathcal{C}$ is forward invariant. In this case, the safety constraint of the satellite formation flying can be guaranteed.

To preserve the forward invariant property of the safety set $\mathcal{C}$, calculate the Lie derivative of the control barrier function $h_i\left(x\right)$ along System (9). The Lie derivative of the control barrier function $h_i\left(x\right)$ is required to satisfy the following inequality.

$$\begin{array}{c}\hfill \underset{u_i\in U}{inf}\left[L_f{h}_i\left(x\right)+L_g{h}_i\left(x\right)u_l+\alpha \left(h_i\left(x\right)\right)\right]\ge 0,\end{array}$$

where $\alpha (·)$ is a $\mathcal{K}$ class function.

By directly computing the Lie derivative of the control barrier function, it is clear that $L_g{h}_i\left(x\right)u_i=0$, which means the control input $u_i$ does not exist in the expression of the Lie derivative of the control barrier function $h_i\left(x\right)$. Accordingly, the Lie derivative of the first-order control barrier function cannot be directly utilized as constraints to calculate the safety controller. A high-order control barrier function needs to be constructed to ensure that the safety set is forward invariant.

As seen from System (9), if one calculates the Lie derivative twice for the control barrier function $h_l\left(x\right)$ along the trajectory of System (9), $L_g{h}_i\left(x\right)u_i\ne 0$ holds. Namely, the relative degree of the control barrier function $h_i\left(x\right)$ with regard to System (9) is 2. The relative degree of the control barrier function with regard to System (9) is greater than 1. To construct the control barrier function for System (9), define the following functions.

$$\begin{array}{ccc}\hfill H_{0,i}\left(x\right)& =& h_i\left(x\right),\hfill \\ \hfill H_{1,i}\left(x\right)& =& {\dot{H}}_{0,i}\left(x\right)+{\alpha }_{1,i}\left(H_{0,i}\left(x\right)\right),\hfill \\ \hfill H_{2,i}\left(x\right)& =& {\dot{H}}_{1,i}\left(x\right)+{\alpha }_{2,i}\left(H_{1,i}\left(x\right)\right),\hfill \end{array}$$

where ${\alpha }_{1,i}(·)$ and ${\alpha }_{2,i}(·)$ are $\mathcal{K}$ class functions.

Furthermore, the following sets can be defined based on the above functions.

$$\begin{array}{ccc}\hfill {\mathcal{C}}_{0,i}& =& \left\{x_i\in \mathcal{R}:{\mathcal{H}}_{0,i}\left(x\right)\ge 0\right\},\hfill \\ \hfill {\mathcal{C}}_{1,i}& =& \left\{x_i\in \mathcal{R}:{\mathcal{H}}_{1,i}\left(x\right)\ge 0\right\},\hfill \\ \hfill {\mathcal{C}}_{2,i}& =& \left\{x_i\in \mathcal{R}:{\mathcal{H}}_{2,i}\left(x\right)\ge 0\right\}.\hfill \end{array}$$

If there exist $\mathcal{K}$ class functions ${\alpha }_{1,i}(·)$ and ${\alpha }_{2,i}(·)$ such that ${\mathcal{H}}_{2,i}\ge 0$ hold for $\forall x_i\in \bigcup ({\mathcal{C}}_{0,i}\bigcap {\mathcal{C}}_{1,i}\bigcap {\mathcal{C}}_{2,i})$, the function $h_i\left(x\right)$ is a secoond-order differential higher-order barrier function with regard to System (9), and the set $\bigcup ({\mathcal{C}}_{0,i}\bigcap {\mathcal{C}}_{1,i}\bigcap {\mathcal{C}}_{2,i})$ is forward invariant.

For System (9), considering the set $\bigcup ({\mathcal{C}}_{0,i}\bigcap {\mathcal{C}}_{1,i}\bigcap {\mathcal{C}}_{2,i})$ and the functions ${\mathcal{H}}_{0,i}$, ${\mathcal{H}}_{1,i}$, ${\mathcal{H}}_{2,i}$, if there exist $\mathcal{K}$ class functions ${\alpha }_{1,i}(·)$ and ${\alpha }_{2,i}(·)$ satisfying the following inequality:

$$\begin{array}{ccc}& & L_f^2{h}_i\left(x\right)+L_g{L}_f{h}_i\left(x\right)u_i+L_f{\alpha }_{1,i}\left(H_{0,i}\left(x\right)\right)\hfill \\ & & +{\alpha }_{2,i}\left({\dot{H}}_{0,i}\left(x\right)+{\alpha }_{1,i}\left(H_{0,i}\left(x\right)\right)\right)\ge 0,\hfill \end{array}$$

where the function $h_i\left(x\right)$ is a control barrier.

Accordingly, designing a control barrier function $h_i\left(x\right)$ for System (9) yields the following safety control input set:

$$\begin{array}{ccc}& & \left\{u_i:L_f^2{h}_i\left(x\right)+L_g{L}_f{h}_i\left(x\right)u_i+L_f{\alpha }_{1,i}\left(H_{0,i}\left(x\right)\right)\right.\hfill \\ & & \left.+{\alpha }_{2,i}\left({\dot{H}}_{0,i}\left(x\right)+{\alpha }_{1,i}\left(H_{0,i}\left(x\right)\right)\right)\ge 0\right\}.\hfill \end{array}$$

3.2. Quadratic Programming-Based Safety Control

Based on the high-order control barrier function designed in the above subsection, this subsection introduces how to solve for a safety controller that guarantees forward invariance of the safe set, i.e., ensuring the safety of satellite formation flights. During the design of safety control, it is necessary to ensure the stability of satellite formation flights as much as possible. Currently, various control methods can be utilized to design controllers that guarantee stability, such as traditional control methods like PID control, PD control, sliding mode control, and deep reinforcement learning algorithms. Any of these control methods can be employed to design a baseline controller that ensures the stability of satellite formation flights. In this section, aiming at System (9), the PD control method is adopted to design a controller that guarantees the system stability. The PD controller is formulated as follows.

$$\begin{array}{ccc}\hfill u_1& =& K_{p1}{x}_1+K_{d1}{x}_2,\hfill \\ \hfill u_3& =& K_{p2}{x}_3+K_{d2}{x}_4,\hfill \\ \hfill u_5& =& K_{p3}{x}_5+K_{d3}{x}_6,\hfill \end{array}$$

where $K_{p1}$, $K_{d1}$, $K_{p2}$, $K_{d2}$, $K_{p3}$, and $K_{d3}$ are controller gains to be designed.

Then, the safety control problem for the satellite formation flying can be solved by solving the following optimization problem.

$$\begin{array}{cc}\hfill min\parallel u_{safe}-u_{PD}\parallel & \hfill \\ \hfill \mathrm{s}.\mathrm{t}.& \hfill \\ \hfill L_f^2{h}_i\left(x\right)+L_g{L}_f{h}_i\left(x\right)u_i+L_f{\alpha }_{1,i}\left(H_{0,i}\left(x\right)\right)\\ \hfill +{\alpha }_{2,i}\left({\dot{H}}_{0,i}\left(x\right)+{\alpha }_{1,i}\left(H_{0,i}\left(x\right)\right)\right)\ge 0.\end{array}$$

(10)

Based on the description of the aforementioned quadratic programming problem, it can be seen that the objective is to make the safety controller $u_{safe}$ approximate the PD controller $u_{PD}$ as much as possible under the constraints of the high-order control barrier function. In this scenario, the stability of the system can be ensured as much as possible, and when there is a conflict between stability and safety, the solved controller can effectively guarantee the safety of the satellite formation.

Furthermore, if a baseline controller is not designed, the safety controller can also be solved by introducing constraint conditions of the control barrier function and the control Lyapunov function. To prioritize safety, relaxation factors must be introduced into the constraints of the control Lyapunov function. The specific formulation of the optimization problem is similar to the aforementioned optimization problem and will not be described in detail here.

4. Simulation Results

This section provides the simulation results to show the effectiveness of the proposed safety control scheme. Comparisons with the PD control and model predictive control (MPC) methods without using control barrier functions are also given to illustrate the necessity of considering safety constraints.

This section verifies the effectiveness of the satellite formation flight safety control method proposed in this paper through computer simulations and demonstrates the advantages of our method by comparing it with the PD control and model predictive control (MPC) methods without using control barrier functions.

In the simulations, the orbital radius is assumed to be 8000 km, and on the basis of this, the constant orbital angular velocity of the parent satellite can be calculated using the gravitational constant of the Earth. The parameters of the PD controller are as follows.

$$\begin{array}{ccc}\hfill K_{p1}& =& 0.07,K_{d1}=0.1,\hfill \\ \hfill K_{p2}& =& 0.05,K_{d2}=0.2,\hfill \\ \hfill K_{p3}& =& 0.04,K_{d3}=0.2.\hfill \end{array}$$

For the parameters used in MPC, the values of the diagnose weighting matrices Q and R are set, respectively, as 0.2 and 0.1. The constraints of the control inputs belong to $[-5,5]$, and the horizon is set as 2. The initial conditions are set the same as those in PD and safety control.

The initial relative positions and velocities of the reference satellite and the accompanying satellite are stochastically chosen from an interval, that is, $x_1$, $x_3$, and $x_5$ $\in \left[10100\right]$, and $x_2$, $x_4$, and $x_6$ $\in \left[01\right]$. The parameters ${\iota }_j$ $(j=1,2,3)$ are set to 10, which denotes the dimensions of the satellite. In this case, the relative positions $x_1$, $x_3$, and $x_5$ should be greater than 10 to satisfy the safety constraint.

To begin with, three simulations were conducted using the traditional PD controller. The initial conditions were chosen from the intervals mentioned above. Figure 2, Figure 3, and Figure 4 depict the response curves of relative positions during satellite formation flying based on PD control, respectively. Figure 5, Figure 6 and Figure 7 present the corresponding response curves of the control inputs under the initial conditions. The state trajectories shown in these figures indicate that, although theoretically the PD controller can guarantee stability, during the process of approaching stability, there are instances where the position variables fall below a safe distance, resulting in collisions between satellites. This leads to the inability to ensure the safety of the satellites during formation flying. These simulation results show that it is necessary to design a safety control scheme for satellite formation flying.

The simulation results of the MPC scheme are illustrated in Figure 8, Figure 9, Figure 10, Figure 11, Figure 12 and Figure 13. Specifically, Figure 8, Figure 9 and Figure 10 present the relative position trajectories of satellite formation flying under the proposed MPC framework, while Figure 11, Figure 12 and Figure 13 depict the corresponding control inputs across three distinct initial conditions.

As evidenced by Figure 8 and Figure 9, the satellite formation system achieves collision-free trajectories without requiring an auxiliary safety controller under the first two initial configurations. However, when subjected to the third stochastically perturbed initial condition (Figure 10), the MPC scheme alone fails to guarantee safety constraints, resulting in critical proximity violations. This divergence highlights the necessity of integrating a dedicated safety-critical controller to ensure robustness against initialization uncertainties in satellite formation flying.

Subsequently, the safety-critical controller proposed in this work is implemented to rigorously validate its efficacy. To ensure a fair comparative analysis, identical initial conditions to those in the preceding PD and MPC simulations are adopted. A baseline PD controller, pre-designed for stability assurance, serves as the benchmark for performance evaluation. The safety controller is synthesized by numerically solving the constrained optimization problem formulated in Equation (10), which systematically enforces state constraints through barrier functions.

Figure 14, Figure 15 and Figure 16 present the relative position trajectories between the reference and accompanying satellites under three operational scenarios, while Figure 17, Figure 18 and Figure 19 detail the corresponding temporal profiles of safety control signals. Simulation results conclusively demonstrate that the integrated control architecture achieves the following:

• Constraint Satisfaction: Maintains all relative positions within predefined safety boundaries throughout the formation maneuver (see safety margins in Figure 14, Figure 15 and Figure 16).
• Stability Guarantee: Achieves asymptotic convergence to desired formation configurations without compromising transient performance.
• Computational Feasibility: Generates real-time implementable control actions, as evidenced by the smooth signal profiles in Figure 17, Figure 18 and Figure 19.

These collective outcomes substantiate the dual capability of the proposed scheme in simultaneously enforcing safety constraints and preserving closed-loop stability, thereby addressing a critical gap in existing satellite formation control paradigms.

The proposed high-order control barrier function-based safety control method effectively ensures the safety of satellite formation flying under the tested scenarios. By formulating safety constraints as a QP problem, the method enforces forward invariance of the safe set, preventing collisions. However, the following factors may influence its practical applicability:

• Sensitivity to Model Uncertainties: The approach assumes an accurate representation of satellite dynamics. Unmodeled perturbations, such as atmospheric drag, solar radiation pressure, or inaccuracies in thruster modeling, may affect performance. Future work will explore incorporating adaptive estimation techniques or robust control modifications to address such uncertainties.
• Computational Complexity: The QP-based safety control formulation requires real-time optimization. While the method is computationally feasible for the tested cases, high-dimensional formations or real-time implementations on resource-limited onboard processors may pose challenges. Efficient optimization solvers or approximation methods could enhance practical deployment.
• Actuator Constraints: The method assumes that control inputs can be implemented without saturation. In real-world scenarios, actuator limits may restrict the feasibility of computed control inputs, potentially leading to constraint violations. Introducing actuator-aware constraints within the optimization framework could mitigate this issue.
• Robustness to Initial Conditions: The presented results demonstrate feasibility across selected cases, but a broader Monte Carlo analysis is needed to statistically validate robustness across diverse initial conditions. This will be included in future studies to establish a more comprehensive understanding of the method’s applicability.

Future work will focus on extending the robustness of the approach by incorporating adaptive safety constraints and uncertainty estimation techniques.

5. Conclusions

The safety control problem of satellite formation flying is investigated in this paper. A high-order control barrier function-based safety control scheme is proposed to guarantee not only stability but also safety. By considering the characteristics of the satellite formation flying model, a high-order control barrier function is constructed, based on which the safety set of satellite formation flights is defined. By adding the designed high-order control barrier function as a constraint, an optimization problem is formulated; solving this, the safety controller is obtained and the forward invariant property of the safety set is guaranteed. Finally, simulation results are provided to validate the proposed safety control scheme in this paper. When there exist unknown uncertainties and an imperfect communication network [30,31,32], the proposed safety control scheme cannot be directly used since the exact value of the Lie derivative of the constructed control barrier function cannot be computed. To solve such a problem, neural networks or unknown input observers will be introduced to estimate these unknown uncertainties, and a model will be provided to describe the imperfect communication network. By combining these methods, a safety control design problem under these complicated situations will be considered as future work.