1. The laws that broke in interesting ways

Isaac Asimov’s I, Robot is not really about robots. It is about the rules we give them, and the edge cases where the rules do not fit. The Three Laws sound simple until a robot has to choose between two humans, or until a robot becomes confused about what harm means. The stories are memorable because the laws are almost right. The desktop’s ADCS software is simpler than a positronic brain, but the same principle applies: the control law must be written clearly, and the safe mode must know what to do when the control law is no longer sure.

Entry 262 chose the actuators. This entry writes the rules that connect sensors to actuators, and the rules that take over when something fails.

2. The attitude estimator

The first rule is the estimator. It takes the sensor measurements and produces the best guess of the current attitude and angular rate. The usual tool is an extended Kalman filter or a multiplicative extended Kalman filter, because attitude is naturally represented by quaternions rather than by ordinary vectors.

The filter fuses:

  • Star tracker quaternions as the primary attitude update.
  • Gyro rates for propagation between star tracker updates.
  • Sun sensor direction for an additional attitude constraint, especially when the star tracker is unavailable.
  • Magnetometer vector for a coarse attitude update and rate damping.
  • GPS position and velocity to compute the nadir vector and the local magnetic field model.

The filter must also know when a sensor is lying. If the star tracker returns a quaternion that disagrees with the gyro by a large margin, the filter should reject that update rather than trust it. This is called outlier rejection or residual editing, and it is what prevents one bad measurement from corrupting the whole attitude estimate.

3. The control law

The second rule is the controller. It compares the estimated attitude to the commanded attitude and computes the torque needed to close the gap. A common structure has two nested loops:

  • Inner loop: rate control using the gyro. This loop is fast and stabilises the body against disturbances.
  • Outer loop: attitude control using the star tracker and other attitude sensors. This loop is slower and drives the body toward the commanded pointing.

For the desktop, a proportional-derivative controller on attitude error plus a proportional controller on rate error is a reasonable starting point. The wheel commands are computed from the desired torque and the wheel Jacobian, which encodes the geometry of the wheel assembly.

The controller must also manage wheel momentum. As the wheels absorb external torques from gravity gradient, aerodynamic drag, and solar radiation pressure, they speed up. The controller monitors wheel speeds and requests momentum dumping from the magnetorquers when a threshold is reached.

4. Coarse and fine control

The desktop needs different levels of control depending on the mode:

  • Detumble: use magnetorquers and possibly thrusters to reduce high angular rates. No precise attitude reference is needed; only the rate must come down.
  • Sun acquisition: use Sun sensors and magnetorquers to point the solar arrays roughly at the Sun. This is a coarse mode with low power demand.
  • Nadir pointing: use wheels for fine control, with star tracker updates and magnetorquer unloading.
  • Target tracking: use wheels for agile following, with higher-rate command generation and possible thruster assist for fast slews.
  • Safe mode: return to Sun acquisition, disable non-essential loads, and wait for ground command or autonomous recovery.

The transitions between these modes are part of the control design. A slew from nadir to target is not just a change of setpoint; it is a temporary mode with its own rate limits and actuator authority.

5. Safe mode

Safe mode is the set of rules that run when the normal rules cannot be trusted. The trigger might be:

  • A sensor disagreement larger than the filter can handle.
  • A reaction wheel reaching its speed limit or reporting a fault.
  • A power bus undervoltage.
  • A computer reset or watchdog timeout.
  • A ground command explicitly requesting safe mode.

When safe mode activates, the desktop should:

  1. Stop all non-essential activity, including imaging and downlink.
  2. Attempt Sun acquisition using coarse Sun sensors and magnetorquers.
  3. Keep the solar arrays illuminated to maintain power.
  4. Keep radiators shaded from the Sun and Earth as much as possible.
  5. Transmit a beacon with telemetry until ground contact is restored.
  6. Attempt autonomous recovery only when the fault condition has cleared.

Safe mode is deliberately simple. It trades pointing accuracy for survival. The goal is not to continue the mission; the goal is to avoid losing the spacecraft.

6. Fault detection and isolation

Before safe mode triggers, the ADCS should detect and isolate faults. Common techniques include:

  • Residual monitoring: compare predicted sensor values to actual values. A persistent residual suggests a sensor or actuator fault.
  • Wheel current monitoring: a wheel drawing too much current may have a bearing problem.
  • Magnetorquer command verification: check that the magnetometer responds in the expected direction when a magnetorquer is fired.
  • Star tracker health: count valid star matches and reject trackers with low confidence.
  • Gyro sanity checks: compare integrated gyro rates to attitude updates from other sensors.

When a fault is isolated, the ADCS can reconfigure. A failed wheel can be removed from the control allocation. A failed magnetorquer can be compensated by the others. A failed star tracker can be replaced by Sun sensor and gyro propagation until the tracker recovers or a redundant unit takes over.

7. Ground interaction

Some faults require ground intervention. The ADCS should report enough telemetry for the operator to diagnose the problem: attitude estimate, sensor residuals, wheel speeds, commanded torque, fault flags, and mode history.

The desktop should also accept ground commands to enter safe mode, to reset the attitude estimate, to reconfigure the actuator set, and to upload new controller gains if needed. In the early mission, ground interaction will be frequent. As the spacecraft proves itself, more autonomy can be delegated to onboard software.

What this changes

  • The desktop’s ADCS uses an extended Kalman filter to fuse star tracker, gyro, Sun sensor, magnetometer, and GPS data.
  • A nested attitude-rate control law commands the reaction wheels for precision pointing.
  • Magnetorquers handle momentum dumping and coarse safe-mode recovery.
  • Thrusters provide high-authority detumble and slew assist.
  • Safe mode is a simple survival state: Sun acquisition, power-positive, beacon, wait for ground.
  • Fault detection and isolation allow graceful reconfiguration rather than immediate safe mode entry.
  • The next entry will close the ADCS arc and decide what to define next.