A multidisciplinary design tool for robotic systems involved in sampling operations on planetary bodies

The analysis of robotic systems (e.g. landers and rovers) involved in sampling operations on planetary bodies is crucial to ensure mission success, since those operations generate forces that could affect the stability of the robotic system. This paper presents MISTRAL (MultIdisciplinary deSign Tool for Robotic sAmpLing), a novel tool conceived for trade space exploration during early conceptual and preliminary design phases, where a rapid and broad evaluation is required for a very high number of configurations and boundary conditions. The tool rapidly determines the preliminary design envelope of a sampling apparatus to guarantee the stability condition of the whole robotic system. The tool implements a three-dimensional analytical model capable to reproduce several scenarios, being able to accept various input parameters, including the physical and geometrical characteristics of the robotic system, the properties related to the environment and the characteristics related to the sampling system. This feature can be exploited to infer multidisciplinary high-level requirements concerning several other elements of the investigated system, such as robotic arms and footpads. The presented research focuses on the application of MISTRAL to landers. The structure of the tool and the analysis model are presented. Results from the application of the tool to real mission data from NASA’s Phoenix Mars lander are included. Moreover, the tool was adopted for the definition of the high-level requirements of the lander for a potential future mission to the surface of Saturn’s moon Enceladus, currently under investigation at NASA Jet Propulsion Laboratory. This case study was included to demonstrate the tool’s capabilities. MISTRAL represents a comprehensive, versatile, and powerful tool providing guidelines for cognizant decisions in the early and most crucial stages of the design of robotic systems involved in sampling operations on planetary bodies.


Introduction
Robotic systems such as landers and rovers have been a crucial component for the exploration of planetary bodies since the beginning of the space exploration history. The Soviet Union's lander Luna 9 was the first human-made object performing a soft landing on the surface of a planetary body (i.e. the Moon) in 1966. Since then, fleets of robotic systems have explored the Solar System, touching down on several planetary bodies, and pushing the limits of our knowledge of Solar System.
Robotic exploration began with several missions to the Moon continuing to the present day, from the US and Soviet Union's probes of the 1960s and 1970s to the more recent Chinese missions Chang'e 3 and its follow-up Chang'e 4 [1,2]. In the inner Solar System, several of the Soviet Union's lander missions visited Venus in the 1970s and 1980s, such as the probes of the Venera and Vega programs. A notable case is represented by the US Pioneer Venus Multiprobe that delivered one large and three smaller probes to the surface of Venus. One of the probes survived on the surface for over one hour. Among planetary bodies, Mars was a historic privileged target of space exploration with several missions including orbiters, rovers and landers. In 1971, Soviet Union's probes Mars 2 and Mars 3 were the first probes achieving the surface of Mars, both carrying a small tethered rover. Because of some malfunctions, they were not able of returning useful data. In 1976, the US landers Viking 1 and 2 were the first probes returning useful data from the surface of Mars [3], followed by the US landers Mars Pathfinder in 1997 [4] and Phoenix in 2008 [5]. The US InSight lander, which touched down in late 2018, is the most recent of a long series of Mars lander missions [6]. In the outer Solar System, Saturn's moon Titan was the only planetary body of the outer Solar System visited by a landing mission to date. The European lander Huygens, part of the Cassini-Huygens mission, touched down on Titan in 2005 [7]. About small Solar System bodies, various landing missions also visited comets and asteroids. In 2001, the NEAR spacecraft performed the first landing on a small Solar System body, asteroid 433 Eros. The European mission Rosetta first delivered a lander, named Philae, on the surface of the comet 67P/ Churyumov-Gerasimenko in 2014 [8]. On the other hand, MASCOT and MINERVA-II were the first landers/hoppers landing on asteroid Ryugu as part of the Japanese mission Hayabusa 2 in late 2018 [9].
Proposed future missions include significant robotic contributions for planetary science in either the inner and the outer Solar System, including planetary bodies such as Mars, comets, asteroids and ocean worlds [10]. Among ocean worlds, Saturn's moon Enceladus and Jupiter's moon Europa are the target of several mission proposals with the aim of finding potential life traces [11,12]. Table 1 provides an overview of the main robotic lander configurations adopted in space exploration. The overview includes information on the configuration of legs and body and the Robotic Arm (RA), manipulator or deployable that perform the mission tasks.
Since the beginning of space exploration, robotic systems (e.g. landers and rovers) were used for performing surface imaging and collecting data about the environment by using scientific instruments. As a result, surface and subsurface sampling and sample collection soon became one of the primary goals of robotic missions, mainly for in-situ analysis but also for sample return to Earth. Sampling operations can be performed by using several tools such as scoops, drills, backhoes, etc. Such tools might be fixed to the lander or supported and carried around by a RA in several configurations, as shown in Table 1. The RA configuration is selected to fulfill mission requirements (e.g. performing sampling or sensing at different locations on the surface). The RA has the purpose of placing the sampling tool in the desired spot on the surface while providing, together with the whole robotic system, reaction against the forces generated during the sampling operation. To guarantee a nominal sampling operation, crucial to mission success, it is required that the forces generated by the sampling system do not affect the stability of the whole system. The traditional approach for investigating various concepts for a robotic mission involved in sampling operations relies on the preliminary definition of a set of potential sampling tool candidates [28]. Therefore, ad-hoc analyses on the stability of the whole robotic system need to be performed every time a design parameter (e.g. physical and geometrical characteristics of the robotic system, properties related to the environment, physical and geometrical features of the sampling tool) is modified [29][30][31]. At a higher level, the same process must be repeated every time a new sampling tool and a new configuration of the whole robotic system is investigated. Existing literature focuses on the sampling tool design [32,33], not including the influence of the whole robotic system and the surrounding environment. On the other hand, COTS simulation tools, such as multi-body dynamics tools, allow addressing complex systems. However, using such tools for building a full design space that includes the variation of several parameters is significantly time consuming and requires a not negligible workload. Such tools would not be suited for rapid preliminary evaluation of the design space for several different configurations and boundary conditions, which is a typical need for studies that require broad trades as typically done in Concurrent Engineering Facilities. COTS simulation tools are well suited for detailed design of a very restricted number of solutions. In order to make this process more time-effective and reliable, a systematic effort is required to provide a flexible and comprehensive tool to help define the high-level requirements of a robotic system involved in sampling operations. This paper presents MISTRAL (MultIdisciplinary deSign Tool for Robotic sAmpLing), a novel tool conceived for trade space exploration during early conceptual and preliminary design phases, where a rapid and broad evaluation is required for a very high number of configurations and boundary conditions. The tool rapidly determines the preliminary Design Envelope (DE) of a sampling apparatus to guarantee the stability condition of the whole robotic system. The tool implements a 3D (three-dimensional) analytical model capable to reproduce several scenarios, being able to accept various input parameters, such as physical and geometrical characteristics of the robotic system, properties related to the environment (i.e. gravity, physical and geometrical properties of the terrain) and features related to the sampling system (i.e. geometry, applied forces). Moreover, the model includes coupling effects among those parameters. This feature can be exploited to infer multidisciplinary high-level requirements concerning several other elements of the investigated system, such as RAs, footpads, and wheels. In this context, the DE is a graphical representation of the parameter variation, a key element for obtaining a comprehensive and rapid overview of the design space. Once the design space is defined by using MISTRAL, high-level trade-offs are conducted to narrow the range of variables. At this point, more detailed evaluation of sampling operation can be conducted on a narrower range of design variables by performing further studies that exploit more accurate models, simulation tools and experimental tests. These further activities help to identify design branches that will be the subject of a series of medium to low-level trade-offs and selections down to specific design points to analyze and test at very high detail, until a single, final solution is identified and verified. The presented research focuses on the application of MIS-TRAL to landers, even if the flexibility of the tool opens the way of a future extension of its use to the analysis of rovers.
The remainder of this paper is organized according to the following structure. Section 2 presents the structure of the tool and the logic behind it, while Sect. 3 provides a detailed description of the analysis model implemented by the tool. Section 4 introduces the application of the tool to real mission data from the Phoenix Mars lander. MISTRAL has been adopted for the definition of the high-level requirements of the lander for a potential future mission to the surface of Saturn's moon Enceladus, currently under investigation at NASA Jet Propulsion Laboratory. Section 5 presents this case study to demonstrate tool's capabilities. Finally, Sect. 6 closes the paper with conclusions and future developments.

Structure of the tool
MISTRAL is conceived as a tool to determine the preliminary DE of a sampling apparatus to guarantee the stability condition of the whole robotic system according to the investigated scenario.
The process starts with the scenario definition as shown by Fig. 1, where the user inputs all relevant parameters to characterize the scenario under investigation. The first group of inputs includes physical and geometrical properties of the robotic system. In the case of considering a lander, geometrical properties include main dimensions and positioning of body, legs, and robotic arm. Physical properties include the mass of the lander and the position of its center of mass. The second group of inputs includes the properties of the environment, such as the local gravitational acceleration and the characteristics of the terrain in terms of friction and slope distribution. The third group of inputs includes the physical and geometrical properties of the sampling system. Parameters such as the geometry of the sampling system and the applied forces can be provided. The fourth group of inputs includes the required margins for the stability of the whole robotic system.
The second phase of the process is the scenario analysis. The analysis model takes the user inputs for evaluating the stability condition by solving a set of equations characterizing the equilibrium condition of the robotic system, as extensively explained in Sect. 3. In the case of considering a lander, the equilibrium condition depends on the reaction forces the terrain applies to the footpads. The reaction forces are related to several parameters, such as the lander weight which depends on its mass and on local gravitational acceleration, the morphology and the physical characteristics of the terrain (i.e. slope distribution and friction), the sampling force applied to the terrain and the way it is applied, which depends on sampling tool geometry. The tool performs an optimization process to determine the maximum allowed magnitude of the sampling force that prevents the lander changing its equilibrium state, according to the stability margins provided by the user. The stability margins are defined with respect to the reaction forces required to keep the equilibrium condition of the lander.
This process outputs the DE of the sampling apparatus according to the scenario under investigation. The DE refers to a delimited range of the parameters within which the lander keeps its static equilibrium condition with the defined stability margins.

Analysis model
The 3D analytical model was developed to study the static equilibrium of a lander with the aim of determining the DE within which the sampling system should be designed. The model provides an indication on the maximum allowed magnitude of the sampling force that prevents the lander changing its equilibrium state. To achieve this goal, the model computes the three Cartesian components of the reaction forces acting on each lander's footpad. The evaluation of the reaction forces enables the determination of the DE of the sampling apparatus according to the investigated scenario. The DE refers to a delimited range of the parameters within which the lander keeps its static equilibrium condition with the defined stability margins. Rotational stability is not explicitly addressed because it is usually anticipated by the lifting of the legs, which is a stability limit addressed. E.g. to get a single leg supporting most of the weight, the other legs must lift off the ground first. By preventing the legs from lifting off the ground, rotational stability issues are usually avoided. Nevertheless, rotational stability will be explicitly considered for the inclusion in the tool in future developments.
The presented approach allows the evaluation of the lander's reaction to generic external loads having components along the three Cartesian axes, meaning that: • The lander's weight F p has three components. This is the effect of the ground slope angles about X axis g and Y axis g , as shown in Figs. 2, 3, 4, 5. • The sampling force F has three components. This considers three effects. The first one is the effect of the inclination of the sampling force with respect to the ground. The second one is the effect of placing the sampling spot off-axes, as shown in Figs. 2, 3, 4, 5. The third one is the effect of the local ground slope angles about X axis s and Y axis s . The local ground slope angles are related to the local geometry of the ground at the sampling spot, which in turn influences the orientation of the sampling force. • The Center of Gravity ( C G ) of the lander is off-axes.
As shown in Table 1, several lander configurations were historically addressed. This paper considers a 3-legged lander equipped with three footpads arranged as a regular triangle shape, and a 4-legged lander equipped with four footpads arranged as a square. This is consistent with some of the most common architectures for legged landers. To easily link the position of the footpads to the geometric characteristics of the lander body, it was assumed that the 3-legged lander has a hexagonal body, while the 4-legged lander has an octagonal body. It should be noted that any shape of the lander body can be used, since it is only an easy method to link the geometric characteristics of the lander to the position of its footpads, which in turn determines the effect of the reaction forces on the lander stability. It should be noted also that any arrangement of the legs can be studied by adjusting the position of the footpads. As an example, it would be possible to select the three main loaded legs in a legged lander with more than three legs (e.g. 4-legged lander), and switch between them to explore the DE assuming the borderline case has a single leg comes to no load (i.e. a 4-legged lander always tilts slightly, although soft regolith mediates this). Hereafter, bold printing indicates vectors while non-bold printing indicates scalars.
R n x,y,z are the Cartesian components of the reaction force acting on the n-th lander's footpad (n = 1, 2, 3, 4).
Given the assumption on the lander's body shape (i.e. hexagon for the 3-legged lander, octagon for the 4-legged lander) and footpads arrangement (i.e. regular triangle for the 3-legged lander, square for the 4-legged lander), the position of the footpads is defined via the parameters D x 1,2 and D y for the 3-legged lander, and D g for the 4-legged lander. It should be noted that those parameters are linked to the geometric parameters D , d and L g , defining the general configuration of the lander's body and footpads (Fig. 2, 3 , 4, 5, 6, 7, 8, 9).  R Ax,y define the position of the RA on the lander's deck. Such geometric parameters define also the origin of the Robotic Arm Reference Frame (RARF).
F sx,y,z are the Cartesian components of the sampling force F s . The sampling force is applied to the sampling spot, localized with respect to LRF and RARF via the geometric parameters P x,y and P x 1 ,y 1 , respectively. Equation (1-2) relate geometric parameters P x,y , P x 1 ,y 1 and R Ax,y .
In Figs. 2 and 6, the line joining the origin of RARF to the sampling spot represents a plane containing the RA and perpendicular to the XY plane. The sampling force F s lies on the sampling force plane, which is oriented according to both the position of the RA and the local geometry of the ground at the sampling spot. (1) (2) P y = R Ay + P y 1 is the angle of the sampling force F s with respect to the ground, located in the sampling force plane.
The vector components of the sampling force F s are computed by defining the local ground slope angles about X axis s and Y axis s of RARF. A rotation matrix is defined for the rotation about the X axis, Y axis and the Z axis, according to Eq. (3-5) respectively. The rotation matrices are applied to the base sampling force vector S = F s [cos , 0, sin ] to obtain its components, according to Eq. (6).
The vector components of the lander's weight F p are computed by defining the general ground slope angles about X axis g and Y axis g of LRF. A rotation matrix is defined for both the rotation about the X axis and the Y axis, according to Eqs. (7)(8), respectively. The rotation matrices are applied to the base weight vector W = 0, 0, −F w to obtain the vector components of the lander's weight, according to Eq. (9). F w = mg is the base weight force, where m is the lander's mass and g is the gravitational acceleration.
Equations (10)(11) show the vector form of the systems of equations to compute the reaction forces acting on the footpads for a 3-legged and a 4-legged lander, respectively. Lines 1-2 in Eqs. (10)(11) derive from the free body diagrams and represent equilibrium conditions with respect to LRF. Line 3 in Eq. (10) represents the geometric conditions imposed by assuming that the lander behaves as a rigid body. This means that the relative distance between the footpads does not change. The geometric conditions bring to the assumption that the regular triangle shape does not change. There are several ways to define a regular triangle. The one selected is to impose that each side of the triangle has a constant length equal to the other ones, as shown in Fig. 10.
Free body diagram and main geometric parameters (YZ plane view) for the 4-legged lander. Qualitative scheme, not to scale Lines 3-5 in Eq. (11) represent the geometric conditions imposed by assuming that the lander behaves as a rigid body. This means that the relative distance between the footpads does not change. The geometric conditions bring to the assumption that the square shape does not change. There are several ways to define a square. The one selected is to impose that each diagonal has a constant length equal to the other one (line 3). Moreover, the two diagonals are imposed to be perpendicular each other, similarly for the sides of the square (line 4), as shown in Fig. 11. Finally, all the footpads are imposed to lie on the same plane (line 5). This is obtained by imposing that the determinant of matrix A (i.e. the matrix defining the equation of a plane passing though the four footpads) is equal to zero.
Reaction force vector acting on n-th footpad F s = F s x , F s y , F s z Sampling force vector   4 Constant adopted to simplif the notation, dependent on lander geometric parameters D, d (Figs. 6,7,8,9) In order to exploit the geometric conditions in Eqs. (10)(11), it is required to link those equations with the variables to be computed (i.e. the reaction forces R ). For this reason, the point of contact between each footpad and the ground was modeled via three springs along the three Cartesian axes. It is assumed that the springs have all the same constant stiffness k . Given this assumption, it was found that the physical solution of Eqs. (10-11) is independent on the value of the spring stiffness. The reactions forces can be related to the displacement d of the lander's footpads via Eq. (12).
The goal is the evaluation of the maximum allowed magnitude of the sampling force F s that prevents the lander changing its equilibrium state. Therefore, the sampling force F s represents the independent variable, while the reaction forces represent the dependent variable. Equations (10)(11) were symbolically solved to get the explicit dependence of the reaction forces from the sampling force, R n = f (F s ) . The maximum allowed sampling force is defined such that the reaction forces R n do not overcome a certain pre-defined limit force. According to Eqs. (13)(14), the limit force is computed by defining a margin for the reaction forces. The limit force L xy is applied to prevent the lander from sliding in the XY plane. The limit force L z is applied to prevent the lander from lifting off the XY plane (i.e. the ground).
The limit force L xy is defined by applying a margin M xy with respect to the friction force F a , which is the boundary for the incipient motion of the lander. According to Eq. (15), the friction force is defined with respect to the Z component (12) R = kd of the n-th reaction force through the coefficient of friction between the lander's footpad and the ground. The limit force L z is defined by applying a margin M z with respect to a pre-defined minimum value for the Z component of the reaction force (K z ).
Margins M xy and M z can get any positive real value, where a value equal to 0 means a margin of 0%, a value of 1 means a margin of 100%, etc.
The limit force L xy depends on the sampling force F s through the Z component of the reaction force R n z . On the other hand, the limit force L z is pre-defined.
The maximum allowed magnitude of the sampling force F s , named F s max , is evaluated by minimizing the objective functions defined by Eqs. (16)(17). Fig. 12 Example of convex objective functions 1 3 The objective functions are convex, meaning that they have a single global minimum (Fig. 12). The minimization problem is defined according to Eqs. (18)(19).
The minimization problem is solved by using the MAT-LAB function fminbnd, which finds the minimum of a single-variable function on a fixed interval [34,35]. As a conservative approach, the minimum value among the two computed by solving the minimization problems is selected, according to Eq. (20). F s max is obtained with respect to a specific condition, since all the parameters (i.e. environmental, physical, geometrical) except the sampling force F s are defined prior solving the minimization problem. At different environmental, physical or geometrical conditions correspond different values of F s max . By exploring the parameters' space, it is possible to derive the DE of the lander. Three kinds of parameters are used to define the DE: dependent, independent and boundary.
The dependent parameters represent the output whose variation is used to determine the static equilibrium condition. In this case, the dependent parameters are the reaction forces R n acting on the lander's footpads. The margin M xy on the value of the friction force F a is used to define the limit L xy of the DE in the XY plane. In fact, the friction force determines the boundary for the incipient motion of the lander. On the other hand, the margin M z on the null value of the Z component of the reaction force is used to define the limit L z of the DE along the Z axis. In fact, the null value represents the boundary for the incipient lifting of the lander.
The independent parameters represent inputs that affect the dependent parameters, in this case represented by the magnitude of the sampling force F s .
The boundary parameters represent all the inputs not directly involved in the minimization process. Such parameters include. By changing the boundary parameters, it is possible to explore several environmental conditions as well as several physical and geometrical configurations related to both lander and sampling (Fig. 13). Among potential sampling tools, it should be mentioned that highly dynamic systems such as drills are probably less suited to the application of the technique presented in this paper.  (Fig. 14). The ISAD is composed by a scoop capable of excavating trenches, a scraper blade for hard soils and a rasp tool [36,37]. Several trenches were excavated and resistive forces during backhoe operations were derived. The highest forces registered during mission operations are shown in Table 2.
The procedure aims to check that the force peaks lie inside the DE of the Phoenix lander. Therefore, the first step is the computation of the DE. The values of the model parameters are shown in Table 3.
It was assumed that the body of the Phoenix lander has a regular hexagonal shape. Given this assumption, the length of the body's side (D) was derived from [39].
The length of the leg's projection in the XY plane L g was assumed from [37] by considering a proportion with respect to the lander's deck diameter [39].
The X, Y components of the C G position C G x,y were assumed coincident with the LRF origin, while the Z component C G z was assumed by considering the lander's height [39]. The lander's mass was derived from [39].
The sampling system of the Phoenix lander is a backhoe. The inclination of the sampling force with respect to the ground ( ) was derived from [38] and converted according to the convention of Fig. 13.
A 100% margin on XY, Z components of the reaction forces M xy,z were assumed.
The slope of the ground was assumed only about Y axis g , while the slope about X axis g was assumed negligible. The local slopes at the sampling spot ( s , s ) were also assumed negligible.
The footpad-to-ground coefficient of friction ( ) was derived from the angle of internal friction of the soil ( ) through the Coulomb's law = tan [40]. Since the angle of internal friction is 38° ± 5° [38], the coefficient of friction was found varying in the range 0.65 ÷ 0.93.
The sampling spot was assumed varying within the RA workspace derived from [37]. The workspace is delimited by an upper and a lower ends, and by an inner and an outer circular sectors centered in the RARF origin (Fig. 16). The inner and outer circular sectors have a radius of 1.52 m and 2.14 m, respectively. The radius of the outer circular sector was derived from [37], while the radius of the inner circular sector was assumed by considering a proportion with respect to the outer radius. The upper and lower ends were assumed spanning across a 90° angle.
The configuration assumed for the Phoenix lander is shown in Figs. 15, 16. Such a configuration might be considered a worst-case scenario, since the lander is pulled downhill by the RA.
The obtained DE is shown in Fig. 17, where each line represents the locus of the points where the magnitude of the sampling force F s is maximum, according to the defined margin. The DE was defined with respect to the ground slope since this environmental parameter is particularly crucial for  Total force in excavation plane [38] surface operations. Several max-F s lines were obtained by changing the variable parameters within the defined ranges. The DE is defined as the area underlying a max-F s line. The DE of the Phoenix lander was selected as the area underlying the lowest max-F s line, considered as a worst-case scenario (light blue area in Fig. 17).
In order to plot the mission data points reported in Table 2, they have to be first converted to represent the total magnitude of the sampling force, according to the input required by the DE. Since the original Stone Soup point represents the total force in the excavation plane, it was assumed that it already represents the required input. On the other hand, the original Dodo-Goldilocks points F s o represent the normal force, so they have to be converted into the required input through the inclination of the sampling force with respect to the ground ( ) . The new value F s n is obtained through the equation F s n = F s o ∕sin . The values of the plotted data points are reported in Table 4.   The ground slope selected to plot the validation points has a value of 7°, reported as the average value at the landing site of the Phoenix lander [41,42]. Figure 17 shows that the mission data points lie inside the DE of the Phoenix lander, confirming the quality of the approach, even considering the worst-case scenarios.

Application to a potential future mission
This Section presents the application of the tool to a potential future landing mission to the surface of Saturn's moon Enceladus with the aim to collect surface samples by using a scoop-like sampling system. Such a potential future mission is currently under investigation at NASA Jet Propulsion Laboratory. In such a context, the tool was adopted to derive high-level requirements on the sampling system and to infer high-level requirements on the lander system [28].
Enceladus is one of the most promising places in the Solar System that might potentially host life beyond Earth.
The Cassini mission strongly suggested the presence of hydrothermal activity and observed material from the subsurface ocean being ejected by plumes and then settling on the surface [28].
The very low surface gravity of Enceladus represents a new challenge for surface sampling. Even small forces applied to the lander could weaken its equilibrium state, potentially causing the lander to lift or slide downhill. Therefore, a critical task is the evaluation of the effect of the forces the sampling system might apply to the lander while performing the sampling operations.  Two lander configurations were studied, a 3-legged and a 4-legged lander. A sensitivity analysis was conducted to determine which among the boundary parameters have low sensitivity and can thus be considered constant. The boundary parameters having a high sensitivity were then considered variable parameters. By exploring the space of the variable parameters, it is possible to derive the DE.
The configuration under investigation is shown in Figs. 18, 19, 20. Such a configuration might be considered a worst-case scenario, since the lander is pushed downhill by the RA. The RARF was assumed being coincident with the LRF. The sampling force plane is aligned with the X axis, so the Y component of the sampling force is negligible. Moreover, since the sampling system considered is a scoop, the main component of the sampling force is along the X axis. This means that the goal is to avoid the lander to slide downhill, so the friction force along X axis is the driver to calculate the max sampling force within the defined margin.
The chosen values of the model parameters are shown in Table 5.
The DEs obtained are shown in Figs. 21, 22. DE plots were conceived to rapidly assess the high-level requirements of a sampling system. However, the benefits of using such a tool are much greater. Since the model used to build the DE considers the coupling among the sampling parameters, the lander parameters, and the environmental parameters, it is possible to use the plots to infer high-level requirements concerning other lander systems.
From plots of Figs. 20, 21 it is possible to derive a requirement for the lander's footpads, a critical system for lander's stability. By assuming a lander's mass of 500 kg and a 4-m-long RA, it is possible to derive that a coefficient of friction equal to 0.5 allows an incredibly low maximum F s (i.e. about 2 N). By increasing the coefficient of friction to 0.75 it is possible to sustain a maximum F s four times greater (i.e. about 8 N) (Fig. 23). A higher coefficient of friction can be achieved by adding small heated pins with the purpose of increasing resistance to lander's footpad sliding. This turns into a requirement for both the sampling system (i.e. maximum allowed sampling force) and the lander system (i.e. footpad-to-ground coefficient of friction).
This example shows how powerful the tool is despite its simplicity, allowing for a broad and rapid overview of the design space, together with the most important parameters at play for systems design.

Conclusions
Primary goals of robotic missions include sampling and sample collection for in-situ analysis or sample return to Earth. The analysis of robotic systems such as landers and rovers involved in sampling operations on planetary bodies is crucial to ensure mission success, since those operations generate forces that could affect the stability of the robotic system. The traditional approach for addressing such a problem involves iterative ad-hoc analyses to be repeated every time a new sampling tool, a new configuration of the whole robotic system or a new set of parameters defining the surrounding environment need to be evaluated. In order to make this process more time-effective and reliable, a systematic effort is required to provide a flexible and comprehensive    tool to help defining the high-level requirements of a robotic system involved in sampling operations. This paper presented MISTRAL, a novel tool conceived for trade space exploration during early conceptual and preliminary design phases, where a rapid and broad evaluation is required for a very high number of configurations and boundary conditions. The tool rapidly determines the preliminary DE of a sampling apparatus to guarantee the stability condition of the whole robotic system. The 3D analytical model implemented by the tool has shown the capability of reproducing several scenarios, being able to accept various input parameters, including the physical and geometrical characteristics of the robotic system, the properties related to the environment (i.e. gravity, physical and geometrical properties of the terrain) and the features related to the sampling system (i.e. geometry, applied forces). Despite its primary scope, the benefits of using MISTRAL are much greater. It was shown that DE plots can be used to infer high-level  requirements concerning other lander's systems, such as the RA, the footpads, etc. This comes directly from the ability of the model of considering the multidisciplinary coupling effects among the sampling parameters, the lander parameters, and the environmental parameters.
The tool has been applied to real mission data from Phoenix Mars lander. Moreover, MISTRAL has been adopted for the definition of the high-level requirements of the lander for a potential future mission to the surface of Saturn's moon Enceladus, currently under investigation at NASA Jet Propulsion Laboratory. This case study was presented to demonstrate tool's capabilities.
In conclusion, MISTRAL represents a comprehensive, versatile and powerful tool providing guidelines for cognizant decisions in the early and most crucial stages of the design of robotic systems involved in sampling operations on planetary bodies. Future developments include the possibility to analyze other lander configurations (i.e. body, legs and RA configuration). Moreover, quasi-static and dynamic analyses will be included providing the capability to analyze robotic systems equipped with dynamic sampling tools such as drills. Future versions of the tool will provide the possibility to consider the flexibility of the legs. The mass of moving parts of the RA and the tools attached at its tip (e.g. sampling tools) will be also included, alongside the analysis of rotational stability. Future activity will also include a tool validation campaign through experimental tests and/or simulation results. These improvements will pave the way of an extension of the tool to the analysis of rovers involved in sampling operations.