Fault-tolerant control-a case study of the Orsted satellite

The increasing operational requirements for on-board autonomy in satellite control systems necessitates structural methods that support the design of a complete and reliable supervisory system. This paper presents the design strategy used to develop a supervisor for the attitude control system of the Danish Orsted satellite. The main topic is handling of faults arising in on-board instrumentation, i.e. how to detect faults and how to prevent propagation into failures with potential mission loss as a consequence. Formal methods are used to ensure complete coverage of all potential fault types and to guarantee that the design criteria are met in the final implementation.