1. The question left open

Entry 867 split the health monitor into two data paths: a real-time safety watchdog and a slower planning path for ground operators. Entry 868 asks what the watchdog should actually watch, and what it should do when it sees something wrong.

A solar sail is not a chemical rocket. You cannot shut down the engine. Light pressure is always on. The question is not “stop thrusting” but “how to thrust while damaged” or “how to park the sail in a state that does not make things worse.”

2. What failure looks like

From the instrument suite in Entry 865, the watchdog has access to:

  • Camera correspondence: whether the sail’s features still match the expected shape.
  • Witness-coupon reflectivity: whether the coating is darkening faster than predicted.
  • Thermal map: whether hot spots are appearing or growing.
  • Acceleration residual: whether the actual thrust matches the commanded attitude.
  • Boom/strut strain or tension: if such sensors exist.
  • Power and thermal bus health: secondary signs of sail orientation or damage.

Each of these maps to a different failure mode. Camera correspondence loss could mean a large tear or a boom collapse. A sudden thermal spike could mean a local coating loss or a puncture that lets light through to the back side. A gradual reflectivity drop is ageing, not an emergency. An acceleration residual could be a wrinkle, a torn quadrant, or an attitude-control problem.

3. Hypervelocity impact signatures

Polyimide films under hypervelocity impact show a central penetration surrounded by radial cracking. At cryogenic temperatures the damage is more brittle; at elevated temperatures the film can dome, delaminate, or flow around the crater. Sears (2014) discusses fracture mechanics for sail membranes and notes that a pre-existing crack or impact site can propagate if the local stress exceeds a critical value.

For the watchdog, this means a puncture is not necessarily a mission-ending event. A small hole in a 1 km² sail reduces area by a negligible amount. The danger is that the hole becomes a tear, or that the torn region flaps and induces attitude oscillations, or that the local coating damage creates a thermal runaway spot.

The signature to watch is therefore not “hole detected” but “hole plus temperature rise” or “hole plus shape change.” A puncture that stays cold and stable is a log entry. A puncture with a growing hot zone or a propagating tear is an emergency.

4. A three-tier response hierarchy

Borrowing from spacecraft FDIR practice, the responses can be organized by severity.

Tier 1 — Continue and log. Gradual reflectivity drop within predicted bounds; small, stable hot spots; minor wrinkle growth. The watchdog records the data, the planner path flags it for the next comm pass, and thrusting continues. This is the normal state of a multi-year sail.

Tier 2 — Reduce load and reconfigure. A tear or hot spot that is growing but contained; an acceleration residual that suggests a partial quadrant failure; a boom relaxation that changes the sail shape. The watchdog commands a reduction in sail angle or a rotation that lowers the stress on the damaged region. It also switches the thrust model to a degraded parameter set and notifies ground. The goal is to keep the mission alive while limiting further damage.

Tier 3 — Safe mode. Loss of camera correspondence across a large region; rapid temperature excursion; uncontrolled attitude rate; acceleration residual far outside bounds. The watchdog enters a Sun-pointing or spin-stabilized safe mode, cancels active thrust maneuvers, and calls for ground intervention. For a sail, the safe-mode attitude is not obvious: Sun-pointing maximizes power and thermal stability but also keeps light pressure on the damaged membrane. A better safe mode might be edge-on to the Sun if the spacecraft can hold it, but that requires active control. Spin stabilization is often the simplest fallback because it averages solar pressure and provides gyroscopic stiffness.

5. What safe mode means for a sail

Standard spacecraft safe mode points solar panels at the Sun, antennas at Earth, and waits. A sail cannot do this cleanly because the sail itself is a large surface that interacts with the Sun. Venigall’s thesis on multi-spacecraft trajectory optimization notes that a solar-sail safe mode is interesting precisely because thrust does not drop to zero until the spacecraft is reoriented.

For the minimoon tug, the safe-mode options are:

  • Spin-stabilized Sun-pointing: simple, power-positive, but keeps the damaged sail under full illumination. Good for preserving the bus and communications.
  • Edge-on to the Sun: minimizes light pressure and thermal load on the sail, but requires active three-axis control and may be unstable depending on boom geometry.
  • Feathered partial sail: if the sail has articulation, collapse or reef one damaged quadrant while keeping the others taut. Complex, but potentially the best damage-limiting option.

The watchdog does not need to choose the perfect safe mode. It needs to choose a mode that prevents escalation and keeps the spacecraft contactable. Edge-on or feathered are aspirational; spin-stabilized Sun-pointing is the conservative default.

6. Recovery is not always possible

The New Horizons spacecraft carries about 170 predefined autonomy rules for safe mode and encounter-mode transitions. Solar-sail fault management would need a smaller set, because the sail’s failure modes are fewer but more consequential. A torn membrane cannot be rebooted. A darkened coating cannot be replaced by software.

The honest recovery actions are therefore:

  • For ageing: update the thrust model and accept reduced performance.
  • For localized damage: reconfigure attitude to unload the damaged region.
  • For catastrophic tear or boom failure: enter safe mode, assess whether the remaining sail area is still useful, and either continue a degraded mission or abandon the capture.

There is no magical “heal sail” command. The fault-management system buys time and limits damage; it does not repair the material.

7. The Weir echo

Andy Weir’s The Martian is an engineer’s log of contingency after contingency. Mark Watney does not have a single recovery plan; he has a sequence of partial fixes, each of which creates a new problem. Duct tape and canvas become life support. A rover becomes a long-distance vehicle. A discarded ascent vehicle becomes a message buoy.

The sail watchdog is a smaller, automated version of the same mindset. It does not expect the sail to be pristine. It expects things to go wrong and tries to keep the mission alive with whatever is left. The difference is that Watney could improvise with his hands; the watchdog must improvise with pre-loaded rules and a few degrees of attitude freedom.

8. What this changes

Entry 867 said the monitor needs a fast safety path. Entry 868 fills in the response side: not every anomaly is a safe-mode event, and safe mode for a sail is not the same as safe mode for a conventional spacecraft. The hierarchy lets the tug continue thrusting through minor degradation, unload damaged regions when possible, and only abandon active control when the sail’s shape or thermal state is out of bounds.

For the keeper arc, this means the tug’s fault-management specification should define tiered responses tied to measurable signatures, not to abstract “failure” labels. It also means the safe-mode attitude must be chosen with the sail in mind, not copied from a standard Earth-pointing spacecraft.

9. Next curiosity

If the sail is damaged badly enough that the capture trajectory is no longer achievable, what does the tug do with the rock? Does it have a disposal trajectory? Can it park the rock in a safe heliocentric orbit and wait for a rescue mission? Or is the only option to let it go?