1. The fault that had to be survived
Andy Weir’s The Martian returns as the recalled work because Mark Watney’s survival depends on systems tolerating faults that would be trivial if a human could just walk over and reset them. The desktop cannot be walked over. The ADCS fault recovery test matrix is the inventory of sensor and actuator faults that the platform must survive without human intervention.
This entry defines the attitude determination and control fault recovery test matrix.
2. Test setup
The test uses a flight-representative ADCS software stack with sensor and actuator models, or a hardware-in-the-loop simulator with real sensors and actuators on a test fixture. Faults are injected into individual sensors, actuators, and the filter state. The platform is expected to detect, reconfigure, and recover for faults within the matrix. Attitude error, actuator commands, mode transitions, and recovery actions are recorded continuously.
3. The test matrix
| Case | Scenario | Fault | Expected outcome |
|---|---|---|---|
| 1 | Star tracker lost lock | Tracker reports no solution or high uncertainty | Filter continues using other sensors; tracker is marked degraded. |
| 2 | Star tracker false solution | Tracker reports an incorrect attitude | Bad measurement is rejected by residual test; filter does not diverge. |
| 3 | IMU bias drift | Gyro bias slowly increases | Bias is estimated and compensated; attitude error stays within bounds. |
| 4 | Magnetometer corruption | Field vector offset by onboard interference | Measurement is flagged inconsistent and down-weighted. |
| 5 | Sun sensor fault | Sun vector reported incorrectly | Fault is detected during eclipse cross-check or via filter residual. |
| 6 | Reaction wheel seizure | One wheel stops responding | Redundant wheel takes over; momentum is redistributed. |
| 7 | Reaction wheel runaway | One wheel accelerates unexpectedly | Wheel is disabled before it saturates or damages bearings. |
| 8 | Magnetorquer fault | One torquer shorted or open | Remaining torquers compensate for momentum dumping. |
| 9 | Filter divergence | Filter covariance becomes inconsistent | Divergence is detected; filter is reset or reinitialized from a known attitude. |
| 10 | Safe-mode entry and exit | Commanded or fault-triggered safe mode | Platform enters sun-safe mode, stabilizes, and exits to nominal mode cleanly. |
4. What is measured
For each case the test records:
- Detection time and classification accuracy.
- Attitude error during and after the fault.
- Whether the platform maintained the required pointing goal.
- Whether reconfiguration was successful.
- Recovery time and method.
- Whether momentum remained within acceptable bounds.
- Whether the platform returned to a stable state.
- Whether ground received a coherent event report.
5. What this changes
- The ADCS fault recovery test has a concrete matrix.
- The matrix links back to the GNC reading and autonomous pointing management arcs.
- The next entry will define pass and fail criteria.