Satellite Mission Digital Twin

Kepler's equation is solved by Newton–Raphson — three to four iterations at LEO eccentricities — and the perifocal state rotated to ECI by the classical 3-1-3 sequence.

J2 is roughly a thousand times larger than every other perturbation in LEO and produces the two effects an operator actually sees: the ground track walking west each revolution, and the orbit plane regressing.

State at time t is computed directly from the epoch elements, never by accumulating steps. Propagation is therefore exact with respect to step size, which is what makes changing the simulation speed unable to change the trajectory.

Frames: ECI (TEME-like — precession and nutation are not modelled), ECEF via a single GMST rotation using the IAU-1982 polynomial, and geodetic on the WGS-84 ellipsoid via Bowring's method plus one Newton refinement.

The spacecraft's illumination is the fraction of the solar disc not occulted by the Earth, derived from two-circle lens-area geometry across four regimes: full sun, umbra, annular and penumbra.

This matters because a 550 km orbit crosses the penumbra in ten to fifteen seconds. A cylindrical shadow would snap generation from 100% to 0% in a single tick, producing a square-wave power profile no operator would find credible.

The solar ephemeris is the Astronomical Almanac low-precision series — accurate to about 0.01° in direction, roughly three orders of magnitude better than the array-pointing model it feeds, so it is not the limiting error.

Beta angle — the angle between the Sun vector and the orbit plane — is displayed because it explains why eclipse duration changes over days of simulated time.

Generation is P = A · η · f_pack · G · Φ · cos θ · D · k_T, where Φ is the illumination fraction from the eclipse model and k_T carries the cell temperature coefficient — this is the thermal-to-power coupling made explicit.

Array temperature is solved at radiative equilibrium rather than integrated: a deployed panel has very small thermal mass relative to its radiating area and settles in seconds.

The battery is an explicit Euler integrator on stored energy. Capacity is 520 W·h nameplate multiplied by health, and state of charge is energy divided by capacity.

Degradation therefore preserves energy, not state of charge. Shrinking usable capacity leaves the stored joules untouched, so the reported percentage rises at the instant of injection and then falls about 1.5× faster under the same load.

Each component node integrates C·dT/dt = Q + k(T_structure − T_node), where Q is the electrical power dissipated in that component. Essentially all electrical power a spacecraft consumes ends up as heat, so the load breakdown maps directly onto the thermal sources.

The structure node adds three environmental fluxes — direct solar and Earth albedo, both gated by illumination, and Earth infrared, present day and night — and radiates against the 2.725 K cosmic background.

Earth IR is why the spacecraft settles at a survivable temperature during eclipse rather than cooling toward 2.7 K.

Above its warning limit a node's performance derates linearly to 0.35 at its critical limit, which makes 'degraded performance' a measurable effect rather than a label. A throttled on-board computer degrades attitude-control performance as a second-order consequence.

Visibility is computed from geometry, never a timer. The station-to-spacecraft vector is rotated into the station's local East-North-Up frame and the elevation read off; the link is attempted only above the 5° horizon mask.

That is why contacts occur in clusters of consecutive orbits separated by multi-hour gaps as the ground track walks away from Cairo — a pattern a timer cannot reproduce. Pass boundaries are found by coarse scan plus bisection, landing on the mask to within 0.05°.

Atmospheric loss scales as 1/sin(elevation) — the flat-slab approximation — so a 6° pass is meaningfully worse than one overhead. The achievable rate is clamped to the modem's 2 Mbps ceiling, which is why the rate holds at maximum through the middle of a good pass and rolls off near acquisition and loss of signal.

Telemetry accumulates on board at four frames per second whenever the link is down and drains at the achieved rate when it is up, so a long outage leaves a backlog that takes real contact time to clear.

Integration is semi-implicit (symplectic) Euler — rate first, then angle from the updated rate. Explicit Euler would inject energy and slowly diverge even with a healthy controller.

The disturbance torque is deterministic, modelled as fixed-phase harmonics of the argument of latitude — gravity-gradient at twice per revolution, aerodynamic at once per revolution. It is a repeatable function of where the spacecraft is, not a random draw, so two runs from the same configuration produce identical attitude histories.

A healthy wheel has roughly 875× margin over the disturbance environment — 0.028 N·m against 3.2 × 10⁻⁵ N·m — so degrading it to even a few percent still holds attitude comfortably, and the test suite asserts exactly that.

The physically meaningful failure is therefore a wheel that stops producing torque and dumps its stored momentum into the body, after which nothing can arrest the resulting rate. That is what the attitude fault does.

Shedding may resolve the condition without the operational cost of a safe-mode entry, so the response ladder tries that first.

Safe mode is latched. It is entered at 20% state of charge but will not clear until 45%, thermals are nominal and pointing is inside the warning limit — held for 120 s. A payload shed for power reasons is not restored until state of charge recovers a further 8% above the threshold that shed it.

The consequence is deliberate: if a fault leaves the energy balance unable to reach 45%, the spacecraft stays in safe mode indefinitely and waits for the ground. That is correct behaviour, and it is what makes clearing a fault in the demonstration mean something.

The project is explicit that this is illustrative. Real spacecraft FDIR involves layered monitors, command authorisation, redundancy management and recovery sequencing that this does not attempt.

An edge detector reports only transitions, so 'battery below 30%' is logged once, at the moment it happened, rather than on every subsequent tick while the condition holds.

Both directions of a condition must be queried through a single edge() call — calling rising() and then falling() on the same key silently breaks the falling edge, because each records the new value as a side effect.

That was a real bug in development. It suppressed every 'satellite exited eclipse' event until it was found by asserting that eclipse entries and exits balance.

The saved Unity scene contains exactly one GameObject with a bootstrap component. Everything else is constructed in code, so the scene can be reviewed in a diff, regenerated from a clean checkout, and cannot break when a .unity file is re-serialised by a different editor version.

Earth's rotation is not recomputed client-side. It is recovered from the azimuth difference between the ECI and ECEF positions of the same frame, so the planet's orientation can never drift away from the server's and put the ground track in the wrong place.

One Unity unit is 1000 km. Earth's equatorial radius is 6.378 units; a 550 km orbit sits at 6.928. The spacecraft model is drawn at exaggerated scale so it is visible — its position is exact, its size is not.

The interface refreshes at 10 Hz against a 5 Hz telemetry stream, writing only to existing text and image components. Nothing is allocated or instantiated per frame.