1. The arklet that must know how to fall back

Neal Stephenson’s Seveneves returns as the recalled work because the arklets and Endurance must maintain attitude and relative position through damage and conflicting priorities. A spacecraft ADCS is not a single controller but a set of modes, each appropriate to a different phase of life and level of health.

This entry reads about GNC modes and fault protection.

2. Common ADCS modes

A NOS3 ADCS walkthrough describes four typical modes:

  • Passive mode: ADCS control is off; actuators are driven manually or not at all.
  • Sunsafe mode: the platform uses sun sensors and magnetorquers to point solar arrays roughly at the Sun and stop rotation. It is the basic survival mode.
  • Inertial mode: the platform holds a fixed attitude relative to inertial space.
  • BDOT mode: a detumbling mode that uses magnetorquers to reduce angular rate by reacting against Earth’s magnetic field.

A Lumelite ADCS paper adds mission-specific modes:

  • Sun pointing: for solar energy harvesting.
  • Nadir pointing: for Earth observation.
  • Target pointing: for pointing at a specific ground or celestial target.

3. Mode transitions

Transitions between modes are triggered by ground command or by onboard conditions. A Portuguese small-satellite requirements document states that safe pointing mode should use only magnetic torquers, that mode transitions can be ground-commanded or autonomous, and that autonomous transitions must be inhibitable from ground.

The principle is: the platform should be able to retreat to a safe mode on its own, but ground should always be able to override or prevent an unwanted retreat.

4. Fault detection, isolation, and recovery

An ESA presentation on AOCS/GNC autonomy and FDIR describes fail-operational strategies to recover critical failures. A paper on GPS satellite ADCS notes that if the spacecraft senses loss of attitude knowledge or a wheel failure, it enters a safe-hold mode, points solar panels at the Sun, and awaits ground commands.

Modern GPS III satellites improve this with cross-strapped sensors and actuators and more advanced algorithms, reducing ground intervention. The desktop should aim for a similar evolution: start with ground-assisted recovery, then add autonomy as it proves itself.

5. What can go wrong

Common GNC faults include:

  • Sensor fault: a star tracker reports an impossible attitude, or an IMU develops a bias.
  • Actuator fault: a reaction wheel seizes, a magnetorquer shorts, or a thruster leaks.
  • Software fault: the filter diverges, or a mode transition is triggered by a false alarm.
  • Environmental fault: an unexpected disturbance torque exceeds the actuator capability.
  • Cascading fault: a recovery action triggers a second fault, such as a fast slew that saturates the wheels.

6. What this changes

  • The desktop’s ADCS must be organized into clear modes with defined transitions.
  • Safe mode must be survivable with reduced actuation, typically sun-pointing using magnetorquers.
  • Fault detection, isolation, and recovery must be designed into the GNC from the start.
  • The next entry will synthesize the GNC reading arc into requirements for the desktop.