1. The burn that had to be survived
Andy Weir’s The Martian returns as the recalled work because Mark Watney’s improvised rocket modifications always include a way to undo: if the MAV hack makes ascent worse, he can still abort and try again. The desktop cannot be rewired by hand, so its propulsion software must contain the same reversibility: a burn must be verifiable before it starts and stoppable before it becomes unrecoverable.
This entry defines the propulsion fault recovery and maneuver verification test matrix.
2. Test setup
The test uses a flight-representative propulsion subsystem or a high-fidelity simulator with programmable thruster models, valve models, pressure sources, and propellant tanks. Faults are injected into thrusters, valves, regulators, pressure sensors, and the maneuver execution logic. The platform is expected to detect, terminate or reconfigure, and recover for faults within the matrix. Thrust command, tank pressure, valve state, attitude, orbit estimate, and recovery actions are recorded continuously.
3. The test matrix
| Case | Scenario | Fault | Expected outcome |
|---|---|---|---|
| 1 | Thruster failed ignition | Commanded burn produces no thrust | Missed burn is detected; platform re-plans or falls back to backup thruster. |
| 2 | Thruster degraded thrust | Actual thrust is 50% of commanded | Burn is terminated early or extended; total impulse is reconciled with orbit estimate. |
| 3 | Thruster stuck-on | Thruster continues firing after cutoff command | Burn is stopped by isolation valve; attitude is recovered. |
| 4 | Thruster erratic thrust | Thrust fluctuates unpredictably | Burn is aborted; platform diagnoses faulty thruster and reconfigures. |
| 5 | Valve stuck closed | Flow cannot reach thruster | Burn is flagged failed; alternate flow path or thruster is selected. |
| 6 | Valve stuck open | Propellant leaks past closed valve | Leaking branch is isolated; deorbit reserve is protected. |
| 7 | Pressure regulator drift | Feed pressure is outside nominal band | Burn is adjusted or aborted before thrust deviates beyond tolerance. |
| 8 | Tank pressure anomaly | Pressure sensor reports out-of-range value | Faulty sensor is ignored or marked; remaining sensors are used for decision. |
| 9 | Maneuver verification failure | Pre-burn attitude or power checks fail | Burn is held; platform reorients or recharges, then reattempts. |
| 10 | Burn abort and re-plan | Abort triggered mid-burn | Thrust terminates safely; platform computes recovery maneuver from actual state. |
| 11 | Propellant isolation | Leak detected in one branch | Leaking branch is isolated; usable propellant is re-evaluated. |
| 12 | Safe-mode inhibition | Propulsion fault triggers safe mode | All burns are inhibited; platform stabilizes and awaits ground or pre-defined recovery. |
4. What is measured
For each case the test records:
- Detection time and classification accuracy.
- Whether the burn was stopped or reconfigured safely.
- Whether attitude remained controllable during and after the fault.
- Whether propellant loss was contained.
- Recovery time and method.
- Whether the platform returned to a stable orbit and attitude.
- Whether ground received a coherent event report.
5. What this changes
- The propulsion fault recovery and maneuver verification test has a concrete matrix.
- The matrix links back to the propulsion reading and autonomous orbit maintenance arcs.
- The next entry will define pass and fail criteria.