Recovery has to rejoin a moving schedule
A 2018 JPL paper explored limited autonomy for Europa Clipper: a prepared recovery timeline could restore a suitable spacecraft state after a fault, then return control to the planned observations. The normal and recovery timelines had to be checked together. This is a historical design study, not a report of a recovery performed in flight. [1]
- Normal plan: reduce data rate
- Fault: that command is missed
- Recovery: check state before rejoining
The clock keeps advancing
In one deliberately simplified scenario, a reboot causes an instrument to miss a command to reduce its data rate. Restoring the lower rate afterward can be too late to prevent a modeled buffer overflow. The authors explicitly exaggerated the storage constraint to expose the problem; it was not a measured spacecraft failure. [1]
A checked model has a boundary
The prototype, ARTcritic, searched for conflicts across possible fault times. Its assurance depended on the spacecraft model and the details included. A recovery that works in the model is evidence about that model, not proof that every physical fault has been covered. [1]
Go a little deeper
Optional reading · about 1 more minute
An everyday analogy
Hypothetical example: A robot watering plants restarts while a valve is open. “Continue the schedule” is ambiguous: should it repeat the missed close command or move to the next pot? A recovery plan must define the state it expects before normal work resumes. This is an illustration, not a tested robot.
The useful question
Our interpretation: Ask what must be true at the handoff from recovery to normal operation. “The software restarted” answers less than “the system reached the state that the next command assumes.”
Original sources
Attributed synthesis, not original reporting. Examples labeled hypothetical or illustrative are explanatory. Reviewing a source does not independently validate its findings.
- Schaffer, Chien and Ferguson: Validation of Fault-Tolerant Plans for Europa Clipper ↗
2018 paper; introduction, prototype scope and ICEMAG scenario read September 23, 2026. Historical model study; not current flight-software verification.