1. When the station must keep its bearing

Stanisław Lem’s Solaris returns as the recalled work because the station must maintain its orientation and core functions even when the ocean below produces phenomena that violate every assumption. The desktop’s ADCS must do the same: keep the platform pointed safely even when sensors lie or actuators fail.

This entry defines success and failure for the attitude determination and control fault recovery test.

2. Minimum success

The test passes if:

  • Single sensor faults are detected and the attitude estimate remains within mission tolerances using remaining sensors.
  • Bad sensor measurements are rejected before they cause filter divergence.
  • Single reaction wheel faults are compensated by redundant wheels or alternative actuators.
  • Runaway or seized wheels are isolated before they cause momentum saturation or structural damage.
  • Magnetorquer faults are compensated by remaining torquers.
  • Filter divergence is detected and recovered without loss of attitude knowledge.
  • Safe-mode entry and exit are clean and stable.
  • Ground receives a coherent event report after each injected fault.

This minimum says the desktop’s ADCS can absorb common GNC faults.

3. Full success

A stronger result would add:

  • Multiple simultaneous sensor faults are handled without ground intervention.
  • The platform continues mission pointing, not just safe-mode pointing, after actuator reconfiguration.
  • Recovery is fast enough that customer payloads do not lose their windows.
  • The platform autonomously schedules momentum dumping after an actuator fault.
  • Fault injection results match predictions from GNC analysis.
  • No single GNC fault requires a platform reboot to recover.

This stronger result supports a claim that the desktop’s ADCS is robust enough for extended autonomous operation.

4. Failure modes

The test fails if any of the following occur:

  • A single sensor fault causes the attitude estimate to diverge beyond mission tolerance.
  • A bad sensor measurement is accepted and corrupts the filter.
  • A reaction wheel fault causes loss of attitude control or momentum saturation.
  • A runaway wheel is not isolated in time.
  • A magnetorquer fault prevents momentum dumping or safe-mode control.
  • Filter divergence is not detected or cannot be recovered.
  • Safe-mode entry is unstable or cannot be exited cleanly.
  • Recovery actions are not logged or are incomprehensible to ground.

Each failure mode points to a fix in sensor selection, filter design, actuator redundancy, control law, or fault detection logic.

5. What this changes

  • The ADCS fault recovery test has clear pass and fail criteria.
  • The criteria separate detection from reconfiguration and from graceful recovery.
  • The next entry will close the test arc.