1. When the platform forgets which way is up

Neal Stephenson’s Seveneves returns as the recalled work because the arklets and Endurance must maintain attitude through damage, propulsion failures, and conflicting priorities. A GNC fault in orbit is uniquely dangerous: without attitude knowledge or control, the platform loses solar power, thermal balance, communications lock, and eventually any ability to recover.

This entry explains why the attitude determination and control fault recovery test matters.

2. Why the GNC system needs its own fault injection

The GNC reading arc established that the desktop should use a multi-sensor, multi-actuator architecture with mode-based control and safe-mode entry. The autonomous pointing management arc decided that the platform should switch pointing goals and schedule slews on its own. Both are design claims. The ADCS fault recovery test is the experiment that validates them.

Without ADCS fault testing, the desktop might discover these problems only after launch:

  • A star tracker loses lock and the filter drifts until the attitude estimate is wrong.
  • A reaction wheel seizes and the remaining wheels saturate trying to compensate.
  • An IMU bias develops slowly and poisons the attitude estimate over days.
  • A magnetometer is corrupted by a payload current and produces a false reference vector.
  • A safe-mode transition is triggered by a transient sensor glitch and cannot be reversed.

3. The failures that only appear when GNC is stressed

ADCS fault injection exposes behaviors that do not appear in nominal testing:

  • A sensor fusion filter takes too long to detect a bad measurement and converges to a wrong attitude.
  • A redundant wheel is commanded after a primary wheel fails, but the control law was tuned for the old inertia.
  • A detumbling sequence works from 10 degrees per second but not from the 50 degrees per second seen after a deployment anomaly.
  • A pointing change aborts correctly but leaves the platform in an attitude that overheats a radiator.
  • Ground cannot diagnose the fault because the attitude telemetry is inconsistent or missing.

4. What this test must cover

The attitude determination and control fault recovery test must exercise:

  • Single and multiple sensor faults: star tracker, sun sensor, IMU, magnetometer.
  • Single and multiple actuator faults: reaction wheel, magnetorquer, thruster.
  • Filter divergence and recovery.
  • Wheel saturation and momentum dumping.
  • Safe-mode entry and exit.
  • Recovery of attitude knowledge from a lost-state condition.

The goal is to prove that the platform can detect a GNC fault, reconfigure, and recover attitude control without ground intervention for faults within the designed set.

5. What this changes

  • Attitude determination and control fault recovery testing is identified as the next qualification step for the desktop.
  • The test must verify detection, reconfiguration, and recovery, not just fault tolerance.
  • The next entry will define the test matrix.