1. The ship that had exactly enough fuel

Tom Godwin’s “The Cold Equations” returns as the recalled work because it is the most brutal statement of an engineering margin. A small emergency shuttle has exactly enough fuel for exactly one pilot and exactly the payload he was sent to retrieve. A stowaway appears. The equations do not care about her story. The story is famous for its cruelty, but engineers remember it for the truth underneath: a power or energy budget that is already at the limit leaves no room for surprise.

This entry asks why the desktop needs a ground test of its autonomous power management.

2. Why reading and wondering are not enough

Entries 741 through 744 established how LEO power systems work: solar cells, batteries, converters, budgets, and fault protection. Entries 745 through 748 established that the desktop should manage generation, storage, demand, and faults autonomously. Both arcs are necessary but not sufficient. A state-of-charge estimator is only as good as its calibration. A load-shedding policy is only as good as the faults it has actually seen. An autonomy layer that has never been exercised in anger may freeze when the bus voltage drops.

The test must answer three questions:

  • Does the power manager’s model of the battery, array, and loads match reality well enough to make safe decisions?
  • Does the autonomy correctly shed load, throttle operation, and enter survival modes when generation drops or a fault appears?
  • Does the system recover gracefully when generation returns or the fault clears?

3. What happens without the test

A power manager can fail in ways that are invisible until the spacecraft is on orbit:

  • a state-of-charge estimator that reads 40% when the battery is actually at 10%;
  • a load-shedding table that drops a heater before a non-critical payload, causing a thermal fault instead of a science gap;
  • a forecast that misses an eclipse because the orbit propagator is using the wrong epoch;
  • a current-limit setting that is too slow to stop a bus collapse;
  • a recovery sequence that turns loads back on before the battery has recharged enough, causing a second undervoltage;
  • a mode transition that conflicts with an ADCS safe mode, leaving the platform tumbling and power-starved.

Each of these is cheaper to find in a test than after launch.

4. What the test protects

The autonomous power management test protects:

  • The desktop: from entering a death spiral of undervoltage, thermal collapse, or battery damage.
  • The mission: from losing customer data because the autonomy shut down the wrong subsystem.
  • The customers: from unexpected service interruptions caused by conservative but untested safe modes.
  • The operators: from discovering too late that the autonomy cannot handle the scenarios the requirement documents promised it would.

5. What this changes

  • The power phase needs a closing test arc, not just reading and wondering.
  • The test must cover estimation accuracy, forecasting, load scheduling, fault response, mode transitions, and recovery.
  • The next entry will define the test matrix.