{"id":"9dd4fd59-89c7-45a9-83b4-5c84585b8517","arxiv_id":"2509.02527","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"An MPC controller with a new eMPC-based terminal set stabilizes underactuated spacecraft after multiple thruster failures by driving them onto a controlled orbit around the target trajectory.","lead":"This paper designs a spacecraft controller that keeps a damaged satellite flying safely even when several thrusters fail. It steers the satellite onto a small controlled orbit and can guide it to a repair station or a safe deorbit path.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Eqs. (10a) and (13b) are mutually inconsistent: the reference feedforward should enter as tilde{R}^T M tilde{R} u_ref, not M u_ref, so e=0 is not an equilibrium for nonzero u_ref.","rationale":"The reader's weakest assumption (Assumption 1) is a scope restriction, and the monotonicity gap in Theorem 2 is repairable because asymptotic stability of e_k already implies c_k - chi_k -> 0, so the position bound follows without strict monotone decrease. The inconsistency between (10a), (12), and (13b) is more load-bearing: the discrete-time model used in the MPC and in the stability proof does not match the reference tracking setup, so Theorem 1's asymptotic stability claim is not established as written. The open-source implementation and experiments are valuable evidence that the intended scheme can work, but they do not fix the equation-level contradiction. I would therefore move from CONDITIONAL to REJECT for the current version; if the authors correct the error dynamics and re-verify the terminal ingredients under the corrected model, the contribution would be worth reconsidering.","tokens_in":14120,"tokens_out":28781,"duration_ms":256276,"concrete_test":"Using the paper's 3D parameters (m=16.8, J=diag(0.2,0.3,0.25), r=0.58, omega_d=0.6) and a non-identity attitude R(q) from the simulation initial condition, with an admissible nonzero u_ref, compute phi(0, tilde{R} u_ref) from (10a) and compare it with the correct error update obtained by applying (7) and subtracting the Assumption 3 reference. The two differ by (tilde{R}^T M tilde{R} - M)u_ref, which is nonzero for generic R. Equivalently, symbolically verify that tilde{R}^T M tilde{R} != M for M as in (8); this settles whether the predictive model in (13) matches the physical error dynamics. If nonzero, re-derive (10a) and re-check Lemma 1 and Theorem 1.","verdict_should_be":"REJECT","load_bearing_attack":"Assumption 3 defines the reference as evolving under the orbit dynamics with input tilde{R} u_ref. The control law (12) and the prediction constraint (13d) use the same tilde{R} u_ref as the feedforward part of the total orbit input. However, the error dynamics (10a) define phi(e,u) = e + delta[e_{[4:6]}; tilde{R}^T(f(e_omega)+M u) - M u_ref]. Substituting u = u_o + tilde{R} u_ref, as is done in (13b), yields an extra term (tilde{R}^T M tilde{R} - M)u_ref in the velocity/angular-error update. Because M in (8) does not commute with tilde{R}=diag(R,I_3) for a generic attitude R, this term is nonzero: at e=0, u_o=0, the predicted next error is nonzero for any nonzero u_ref, so the origin is not an equilibrium of the closed-loop error dynamics. The terminal invariance and stability arguments in Lemma 1 and Theorem 1 rely on exact cancellation of f(e_omega) and of the reference feedforward; with (10a) as written that cancellation is not exact. Theorem 2 inherits the problem because it uses Theorem 1. This is an internal algebraic inconsistency in the central model, not merely a restrictive assumption.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes a model predictive controller for a spacecraft with known thruster failures. The key idea is to exploit Assumption 1, the existence of a torque-free force vector inside the input set, to place the spacecraft on a small circular orbit, and then to control the orbit center rather than the spacecraft position directly. The controller solves MPC problem (13) for the orbit error dynamics (10) using a terminal set built from an explicit MPC of a double integrator and a linear angular-rate feedback. The authors claim recursive feasibility and asymptotic stability of the orbit error (Theorem 1) and a bounded positional tracking error with radius r_s >= r + beta (Theorem 2). Numerical 2D experiments on the ATMOS platform and a 3D simulation illustrate the approach.","tokens_in":14416,"tokens_out":17948,"duration_ms":168990,"significance":"If the main theorem were correct, this would be a meaningful advance over prior work: it handles coupled translational and rotational dynamics under multiple thruster failures with input constraints, avoids the small zero terminal set of earlier underactuated MPC designs, and provides larger terminal sets via explicit MPC. The open-source implementation and ATMOS experiments are concrete strengths. However, the central algebraic derivation connecting the error dynamics to the MPC and terminal controller is currently inconsistent, and the proof of Theorem 2 contains an unjustified monotonicity claim. The contribution is therefore promising but not yet established as written.","major_comments":[{"comment":"The error dynamics and the MPC/terminal control law are algebraically inconsistent. Equation (10a) defines the second block of phi(e,u) as \\tilde{R}^T (f(e_omega) + M u) - M u_ref, while constraint (13b) evaluates this map at u = u_o,s + \\tilde{R}_s u_s^ref, and the terminal controller (14) contains the same + \\tilde{R} u_ref term. Substitution yields the extra term (\\tilde{R}^T M \\tilde{R} - M) u_ref in the velocity-error update. Since M in (8) does not commute with \\tilde{R} = diag(R, I_3) for a generic attitude, this term is nonzero: at e=0 and u_o=0, the one-step prediction is nonzero whenever u_ref is nonzero, so the origin is not an equilibrium of the closed-loop error dynamics. The cancellations leading to the linear dynamics (15), the terminal invariance (19), and the Lyapunov decrease in Proposition 1 and Theorem 1 all rely on the erroneous cancellation. This is the central load-bearing step and must be corrected; a local notational fix is not sufficient.","section":"Section III-B, Eq. (10a) and (13b)"},{"comment":"The proof asserts that \\|c_{k+1} - \\chi_{k+1,[1:3]}\\| < \\|c_k - \\chi_{k,[1:3]}\\| on the strength of Theorem 1. Theorem 1 proves asymptotic stability of the full error vector e_k = (e_p,k, e_omega,k); it does not imply that the position component e_p,k,[1:3] decreases monotonically. The eventual bound \\|p_r(t) - \\chi_{[1:3]}(t)\\| <= r_s can be obtained by a limsup argument from e_p,k -> 0 and Assumption 4, so the step should be replaced rather than assumed. As written, the proof is logically invalid.","section":"Section IV-D, proof of Theorem 2"},{"comment":"The orbit dynamics derivation uses the identity d/dt R^T = R^T omega^times, which is not consistent with the standard quaternion kinematics in (1). With R the rotation from body to global frame, \\dot{R} = R omega^times and hence \\dot{R}^T = -omega^times R^T, not R^T omega^times. This changes the sign of the R^T omega^times r_diamonds term in the definition of v and of the cross-coupling terms in (7). Unless a nonstandard convention is explicitly introduced and consistently used in the quaternion kinematics, the claimed cancellation in (5) and the controllability statement following (7) need to be re-derived. Please state the convention and redo the derivation.","section":"Section III-A, Eq. (7)"}],"minor_comments":[{"comment":"The phrase 'u_k^ref in N' should read u_k^ref in U_chi subset R^6; the surrounding notation 'u^k_ref,k in N' is also garbled.","section":"Assumption 2"},{"comment":"The text says the blue terminal set corresponds to the proposed controller (14) and the red one replaces the eMPC part with an LQR, while the figure caption says 'Red: Linear controller. Cyan: eMPC controller.' Please reconcile the color descriptions.","section":"Figure 3 and Section V"},{"comment":"The statement 'Qe = I5x5' is unclear because the full error state is nine-dimensional; since this is a simplified planar model, the dimensions of all matrices in the 2D implementation should be stated explicitly.","section":"Section V, 2D implementation"},{"comment":"The optimization problem (22) contains malformed expressions, in particular the term with subscript 2 and the terms 'm u_max' and 'sqrt(f_max)' that are not consistent with (18)-(21). Please provide a readable and correct statement of the constraints.","section":"Section IV-B, Eq. (22)"}],"recommendation":"major_revision","confidential_remarks":"The paper relies on self-citations [15], [19], and [22] for load-bearing items: the inter-sample bound beta, the experimental platform, and the terminal-set comparison. The editor may wish to ask the authors to state explicitly how [15] yields the beta bound under the present assumptions and to confirm that the ATMOS experiment is reproducible from the provided repository. The algebraic inconsistency in the error dynamics should be resolved before further review."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a genuinely clever way to handle stuck thrusters—put the spacecraft on a small orbit so the fault-induced force becomes part of the orbit dynamics, then track with MPC. The eMPC terminal set with feedback linearization is a real improvement over the zero-terminal-set approach in [7], and the ATMOS experiments plus open-source code give it credibility. I'd send it to a serious referee.\n\nThe soft spots matter. The biggest is in the equations. In (10a) the error dynamics subtract M u_ref, but the control law (12) and the constraint (13b) feed in \\tilde R u_ref as part of the input. Plugging one into the other leaves an extra (\\tilde R^T M \\tilde R - M) u_ref term. That term is zero only if u_ref has no torque components; in general e=0 is not an equilibrium, and the cancellation that Lemma 1 and Theorem 1 rely on is not exact. The fix is straightforward in principle—the feedforward should appear as \\tilde R^T M \\tilde R u_ref, and you probably need to restrict u_ref's angular part or keep it in the reference dynamics—but as printed, the central theorem doesn't follow from the written equations. This is an internal algebraic issue, not a missing assumption.\n\nSecond, Assumption 1 (existence of a torque-free interior input aligned with a principal axis) does a lot of work, and the paper gives no general characterization of which failure patterns satisfy it. The 2D claim for up to three failures is argued, but the 3D example is hand-picked. That limits the fault-tolerance claim.\n\nThird, the proof of Theorem 2 uses a strict monotonicity of the position error that asymptotic stability doesn't guarantee. That particular step is not load-bearing—the result follows from convergence plus the triangle inequality—but it should be cleaned up.\n\nThe comparative claim about larger terminal sets is cited to a thesis; I didn't recompute it, but it looks plausible given the eMPC saturations.\n\nBottom line: the idea is good, the experiments help, and with the feedforward term corrected and Assumption 1's scope made precise, this would be a solid paper. I'd send it to peer review, with a strong request to fix (10a) before final. If you work on FTC or MPC, worth reading alongside the code.","headline":"Clever orbit-based FTC idea and solid experiments, but the printed error dynamics have a feedforward inconsistency that hits the stability proof; needs fixing before I'd trust Theorem 1.","tokens_in":14978,"tokens_out":16175,"would_cite":false,"duration_ms":135113,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A spacecraft with multiple failed thrusters can still track a reference trajectory by steering a virtual orbit center, provided one torque-free bias input remains available.","keywords":["fault-tolerant control","model predictive control","spacecraft control","underactuated spacecraft","actuator failures","terminal set","explicit MPC","trajectory tracking"],"falsifier":"Give a spacecraft whose failure pattern satisfies all of Assumptions 1–3, then solve the terminal-set sizing problem (22) numerically; if the constraints are infeasible for every $\\hat{u}_{\\max}$ and $e_{\\max}$, or if a closed-loop simulation of the proposed MPC loses feasibility or fails to converge after a finite number of steps, the claimed stability certificate is disproved.","tokens_in":13891,"feed_emoji":"🛰️","tokens_out":12710,"duration_ms":106047,"temperature":0.7,"pith_summary":"This paper claims that a spacecraft with several known thruster failures can still track a reference trajectory with a guaranteed stability certificate, as long as one torque-free bias input lies strictly inside the set of achievable thruster inputs. The central trick is to stop steering the spacecraft's position directly: the bias input $u_v$ that Assumption 1 guarantees is reinterpreted as the centripetal force of a small orbit, so the spacecraft continuously orbits a virtual center, and the controller stabilizes the orbit center instead. The authors prove that the resulting MPC problem is recursively feasible and that the orbit error dynamics are asymptotically stable, while the physical spacecraft position converges to a tube of radius $r_s \\ge r + \\beta$ around the reference. If correct, this gives a single control law that can keep a damaged spacecraft on a safe path for servicing or deorbiting without full actuation.","feed_headline":"Faulty spacecraft stay on course by orbiting a virtual center","feed_subtitle":"A single MPC law keeps a damaged spacecraft tracking a reference path with a proved stability margin.","key_machinery":"The load-bearing object is the orbit transformation (4), $c = p_r + R^T r_\\diamond$, together with the centripetal balance condition (5), $f = m \\omega_d^2 r_\\diamond$. These two equations rewrite the faulty spacecraft as a fully controllable orbit system (7) in which the bias input $u_v$ no longer acts as a disturbance: because $u_v \\in \\mathrm{Int}(U_r)$, the shifted input set satisfies $0 \\in \\mathrm{Int}(U)$, so the orbit error dynamics (10) are controllable. The second mechanism is the terminal pair: the feedback-linearizing terminal controller (14) cancels the nonlinear term $f(e_\\omega)$ and reduces the position error to the double integrator (15a), stabilized by an offline-computed explicit MPC law (an explicit MPC is a parametric quadratic program solved offline into a piecewise-affine feedback law), with the terminal set sized through the convex program (22).","core_discovery":"On the paper's own terms, the discovery is that underactuation from actuator failures does not have to be treated as a tracking obstruction: it can be absorbed into the geometry of a periodic orbit. Given Assumption 1, the authors fix a body-frame vector $r_\\diamond = [0, r, 0]^T$ and choose an orbit angular velocity $\\omega_d$ so that the bias input satisfies $f = m \\omega_d^2 r_\\diamond$ (5); the orbit center $c = p_r + R^T r_\\diamond$ (4) then has error dynamics (10) that are controllable because $0 \\in \\mathrm{Int}(U)$. They build a terminal set $T = \\hat{X}_f \\times E$ and terminal cost $l_T$ using a feedback-linearizing terminal controller (14) whose linear position part is an explicit MPC law, and prove in Theorem 1 that the closed-loop orbit error $e_{k+1} = \\phi(e_k, \\mu_k^{MPC})$ is asymptotically stable while (13) remains recursively feasible. Theorem 2 converts this into the spacecraft-level guarantee $\\|p_r(t) - \\chi_{[1:3]}(t)\\| \\le r_s$ with $r_s \\ge r + \\beta$ as $t \\to \\infty$.","pith_inferences":["The same orbit-compensation idea should transfer to any vehicle with a persistent unidirectional thrust bias, such as a rotorcraft with a stuck propeller, as long as the reduced error dynamics remain controllable; the paper itself only demonstrates spacecraft cases.","Assumption 1 is a polytope-containment condition, so a designer could precompute all failure sets that admit a torque-free interior force and switch the controller on only for those, making the fault-tolerant property testable offline.","If the bias force magnitude drifts during operation (for example through mass loss), the balance condition (5) is violated; an adaptive variant that re-computes $r$ and $\\omega_d$ online would be a natural extension.","Because the position bound is $r_s \\ge r + \\beta$, choosing the orbit radius $r$ is a direct trade-off between input feasibility and tracking accuracy: larger orbits ease feasibility but widen the guaranteed tube."],"forward_implications":["If the assumptions hold, the MPC needs no runtime re-verification: recursive feasibility from $k=0$ is enough to guarantee feasibility at every later step.","The orbit-center tracking error goes to zero asymptotically, so the damaged spacecraft settles into a bounded tube of radius $r_s \\ge r + \\beta$ around the reference instead of drifting away.","The method handles trajectory tracking, not just setpoint stabilization, so the same controller can steer a faulty spacecraft along a collision-free path toward servicing or deorbiting.","The eMPC-based terminal set is larger than the standard LQR-based terminal set, which enlarges the region of attraction and lets the designer shape it through (22).","The controller remains valid with known (detected) failures and does not require the spacecraft to remain fully actuated."],"supporting_citations":[{"why":"Prior MPC scheme for underactuated spacecraft with input constraints that this work extends by replacing the zero terminal set with a larger terminal set.","marker":"[7]"},{"why":"Quadrotor result motivating the idea of controlling a vehicle on an orbit after partial loss of actuation.","marker":"[11]"},{"why":"Explicit MPC survey that supplies the offline parametric solution used for the terminal controller.","marker":"[13]"},{"why":"Nonlinear-systems theorem used to bound the inter-sample deviation $\\beta$ in Assumption 4.","marker":"[14]"},{"why":"Corridor MPC paper showing how the bound $\\beta$ in Assumption 4 can be obtained.","marker":"[15]"},{"why":"MPC textbook chapter used to choose terminal cost and terminal set for the linear subsystem in the eMPC problem (16).","marker":"[16]"},{"why":"Polytope decomposition result used to express the Minkowski difference in the terminal-set constraints (22).","marker":"[17]"},{"why":"Convex optimization reference used to formulate the terminal-set sizing problem (22).","marker":"[18]"},{"why":"Open-source free-flyer platform used for the 2D experiments.","marker":"[19]"},{"why":"Nonlinear MPC stability theorem invoked in the proof of Theorem 1.","marker":"[24]"}],"fun_headline_variants":["Faulty spacecraft orbit a virtual center to stay on course","Actuator failures absorbed by orbiting a virtual point","MPC makes damaged spacecraft track paths via virtual orbit","Orbiting a virtual center keeps faulted spacecraft on track","Single MPC law steers faulty spacecraft around a virtual point"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Assumption 1, that after the known failures there exists a torque-free bias input aligned with a principal axis and strictly inside the achievable input set, is the load-bearing premise; if the only available bias lies on the boundary or carries residual torque, the orbit construction and the stability proof no longer go through.","fun_headline_variants_meta":{"raw":{"variants":["Faulty spacecraft orbit a virtual center to stay on course","Actuator failures absorbed by orbiting a virtual point","MPC makes damaged spacecraft track paths via virtual orbit","Orbiting a virtual center keeps faulted spacecraft on track","Single MPC law steers faulty spacecraft around a virtual point"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000254,"raw_usage":{"total_tokens":1539,"prompt_tokens":888,"completion_tokens":651,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":504,"completion_tokens_details":{"reasoning_tokens":570}},"tokens_in":504,"tokens_out":651,"duration_ms":6292,"temperature":1.0,"reasoning_tokens":570,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T16:37:49.737227+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Give a spacecraft whose failure pattern satisfies all of Assumptions 1–3, then solve the terminal-set sizing problem (22) numerically; if the constraints are infeasible for every $\\hat{u}_{\\max}$ and $e_{\\max}$, or if a closed-loop simulation of the proposed MPC loses feasibility or fails to converge after a finite number of steps, the claimed stability certificate is disproved.","supporting_citations":[{"cited_title":"Autonomous thruster failure recovery on underactuated spacecraft using model predictive control","cited_arxiv_id":null,"evidence_quote":"Prior MPC scheme for underactuated spacecraft with input constraints that this work extends by replacing the zero terminal set with a larger terminal set."},{"cited_title":"Stability and control of a quadro- copter despite the complete loss of one, two, or three propellers","cited_arxiv_id":null,"evidence_quote":"Quadrotor result motivating the idea of controlling a vehicle on an orbit after partial loss of actuation."},{"cited_title":"A survey on explicit model predictive control","cited_arxiv_id":null,"evidence_quote":"Explicit MPC survey that supplies the offline parametric solution used for the terminal controller."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Nonlinear-systems theorem used to bound the inter-sample deviation $\\beta$ in Assumption 4."},{"cited_title":"Corridor MPC: Towards optimal and safe trajectory tracking","cited_arxiv_id":null,"evidence_quote":"Corridor MPC paper showing how the bound $\\beta$ in Assumption 4 can be obtained."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"MPC textbook chapter used to choose terminal cost and terminal set for the linear subsystem in the eMPC problem (16)."},{"cited_title":"Decomposition of polytopes using inner parallel bodies","cited_arxiv_id":null,"evidence_quote":"Polytope decomposition result used to express the Minkowski difference in the terminal-set constraints (22)."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Convex optimization reference used to formulate the terminal-set sizing problem (22)."},{"cited_title":"Gr ¨une et al","cited_arxiv_id":null,"evidence_quote":"Nonlinear MPC stability theorem invoked in the proof of Theorem 1."}],"review_version":1}