OPERATIONAL · ACTIVE
Scenario
ADCS GYRO RECOVERY
Data Source
SYNTHETIC DATA
Backend
NOT CONNECTED
Spacecraft Health
NO LINK
Evaluation
NOT EVALUATED
OPERATOR DASHBOARD
00:00:00 UTC
SIMULATED
Battery 28.4V
Temp 74°C
IMU NOMINAL
Gyro NOMINAL
Comms ONLINE
Attitude LOCKED
RWA 4210 RPM
OBC NOMINAL
Solar 11.8A
Attitude Dev —
DEMO / REPLAY — SCRIPTED, NOT LIVE Select a Mission Incident
SELECT INCIDENT
Mission Replay Library
Watch historical spacecraft incidents replay in real time — telemetry, causal chain, and AI recovery
SIMULATION — scripted demo data. Arm the backend for a real analysis.
SENTINEL
v1.0 · ESA SpaceHack 2025 · AI Spacecraft Recovery Copilot
Three Novel Claims
01
What this is. A research prototype exploring whether LLM-assisted reasoning, grounded in retrieved engineering standards and constrained by a deterministic safety validator, can support ground-segment FDIR triage. It is not a flight system and has not been used on a spacecraft.
02
Standards context. ECSS-E-ST-70-11C specifies that recovery is undertaken under ground control. SENTINEL is designed as a ground-segment decision-support tool within that constraint. It does not uplink commands, and every proposed command requires operator authorisation. Compliance with the standard has not been assessed.
03
Dataset status. The repository contains a synthetic crash-dump corpus generated by simulation/fault_simulator.py, plus a small number of payloads derived from the public ESA Anomaly Detection Benchmark. Synthetic and real-derived data are labelled separately. No dataset has been published.
P1 · DataSynthetic corpus
Anomaly detection
Evaluation metrics
P2 · AI/MLReAct agent
RAG pipeline
Safety validator
P3 · FrontendReact dashboard
DAG visualization
UI/UX polish
P4 · IntegrationFastAPI backend
Deployment
Pitch deck
Mission State
LLM ENGINE
GEMINI 2.5 FLASH
FDIR PIPELINE
ACTIVE
TELEMETRY
LIVE FEED
SAFETY VALIDATOR
DETERMINISTIC
ECSS PROCEDURES
VERIFIED
SCROLL TO SCRUB
Autonomous Recovery Copilot
SENTINEL
Ground-Segment FDIR Copilot · Research Prototype
Assisting Safe Mode
Diagnosis and Recovery
NOT EVALUATED
Diagnosis Time
NOT EVALUATED
Time Saved
NOT EVALUATED
Diagnostic Accuracy
Current Reality
The Cost of Manual Recovery

When a spacecraft enters safe mode, every day offline costs millions in lost science data, mission delays, and operational overhead.

MAVEN
2022 · Mars Atmospheric Mission
3
Months Recovery
SOHO
1998 · Solar Observatory
4
Months Recovery
ESA Standard
Current Protocol
Ground
Controlled Recovery Only
The research question
Can ground-segment FDIR triage
be meaningfully accelerated?
SENTINEL HAS NOT YET BEEN EVALUATED AGAINST THIS QUESTION
Mission Simulator · Panel 1
Crash Dump Input

Select a preset incident or paste raw telemetry JSON. SENTINEL's AI agent will ingest and diagnose in real time.

🧭
Gyro SEU
IMU Single-Event Upset
MAVEN 2022 · CRITICAL
CRITICAL
☀️
Solar Array Fault
EPS Bus Undervoltage
SOHO-class · HIGH
HIGH
🖥️
OBC Watchdog
Software Memory Overwrite
Mars Global Surveyor · HIGH
HIGH
Telemetry JSON Payload
AI Investigation
Simulation — Scripted Demo
Simulated Safe Mode
T+00:00:00
Telemetry Stream
Ingesting Telemetry
Scanning simulated telemetry window...
⚠ Telemetry Feed Lost
Connection to backend timed out after 90s.
Running in mock-data fallback mode.
AI Agent Reasoning Trace
SENTINEL Reasoning
ReAct loop initializing...
⚠ Agent Unreachable
LLM backend did not respond within 90s.
Falling back to mock reasoning trace.
Panel 5 · Mission Cost Calculator
Safe Mode Financial Impact
Illustrative model — operator inputs only
Days in Safe Mode: 30
1d30d60d90d120d
Mission Class
Without SENTINEL
$1,500,000
Mission loss (science + ops)
Science data lost: $900K
Operations overhead: $450K
Recovery labor: $150K
VS
With SENTINEL
NOT EVALUATED
Diagnosis latency has not been measured
Anomaly detected: NOT EVALUATED
Root cause: NOT EVALUATED
Recovery plan: NOT EVALUATED
Time Saved
NOT EVALUATED
Requires a measured diagnosis time to compute
SAVINGS REALIZED
NOT EVALUATED
Causal Analysis
Failure Propagation Chain

An illustrative causal chain showing how a single sensor anomaly could cascade into safe mode entry. This graph is fixed demo content, not inferred from telemetry, and its node confidences are NOT EVALUATED.

ADCS
SubsystemADCS
ConfidenceNOT EVALUATED
IndicatorsNOT EVALUATED
SeverityCRITICAL
SourceSCRIPTED DEMO
Run the simulation above to watch the failure chain build node by node in real time →
Mission Log · Simulated
Event Timeline

Chronological fault progression for the scripted scenario. Entries are pre-written and revealed on a fixed timer — they are not derived from telemetry.

ANOMALY INTELLIGENCE
Incident: GYRO-SEU-2024-47
Preset: Gyro SEU
09:12:01 UTC
IMU-A drift begins
SENSOR
09:12:04 UTC
Angular rate exceeds 3σ envelope
ANOMALY
09:12:05 UTC
Attitude estimation error: 2.14°
CRITICAL
09:12:06 UTC
Reaction wheel saturation 71%
CRITICAL
09:12:08 UTC
OBC watchdog triggered — Safe mode entry
SAFE MODE
09:12:08 UTC
SENTINEL AI investigation started
AI ACTIVE
09:12:16 UTC
Scripted demo trace complete — no validated diagnosis produced
DEMO END
SATMON-Style
Anomaly Intelligence Hub

Subsystem risk heatmap and health radar for the selected scripted scenario. The bar and radar shapes are illustrative demo values; anomaly confidence and evidence counts are NOT EVALUATED because no model computes them yet.

▣ Subsystem Risk Heatmap
ADCS
96%
OBC
61%
TCS
35%
EPS
22%
COMMS
10%
◎ System Health Radar
RED ZONE = COMPROMISED · OUTER = NOMINAL
⚠ Detected Anomaly
IMU Sensor Failure
—
Confidence
NOT EVALUATED
Risk Level
CRITICAL
Subsystem
ADCS
Telemetry violations: NOT EVALUATED · Incident matches: NOT EVALUATED
Satellite Digital Twin · Simulated
Subsystem Health Map

Click any subsystem to inspect its telemetry and highlight related causal nodes in the failure graph. All values shown are simulated demo data from the scripted scenario — not measurements from a spacecraft.

ADCS Attitude Control TCS Thermal EPS Power System COMMS SIMULATED SAFE MODE +Z −Z −Y +Y
ADCS
Attitude & Determination Control
FAULT
IMU_ANGULAR_RATE: ±0.92°/s
ATTITUDE_ERROR: EXCEEDS LIMIT
RWA_SATURATION: 87%
STAR_TRACKER: DEGRADED
EPS
Electrical Power System
NOMINAL
BATTERY_SOC: 78.4%
SOLAR_CURRENT: 12.3A
BUS_VOLTAGE: 28.1V
COMMS
Communications
NOMINAL
LINK_STATUS: LOCKED
SIGNAL_SNR: 34.2 dB
TELEMETRY: STREAMING
TCS
Thermal Control System
WARNING
TEMP_ADCS_BOARD: +62°C (LIMIT +65)
HEATER_STATUS: ACTIVE
RADIATOR_EFF: 91%
Recovery Sequence · Scripted Example
Example Recovery Plan

An illustrative recovery sequence written by hand to show the intended output shape. These steps were not generated by SENTINEL, have not passed safety validation, and carry no measured success probability.

✓
Switch to Backup IMU
Success rate: NOT EVALUATED Risk: LOW (unvalidated)
Transition attitude control from the degraded primary IMU-A to the redundant IMU-B. This bypasses the faulty sensor without disrupting power or communications.
Duration ~8 min
Autonomy Full AI
Requires No ground uplink
02
Reinitialize Navigation Filter
Success rate: NOT EVALUATED Risk: MEDIUM (unvalidated)
Reset the extended Kalman filter with updated star tracker measurements to re-establish accurate attitude knowledge after the IMU switchover.
Duration ~12 min
Autonomy AI + Confirm
Requires Star tracker lock
Requires human review before execution — ECSS-E-ST-70-11C §6.3.2
03
Desaturate Reaction Wheels
Success rate: NOT EVALUATED Risk: LOW (unvalidated)
Fire magnetorquers to offload accumulated angular momentum from saturated reaction wheels, restoring full ADCS authority.
Duration ~20 min
Autonomy Full AI
Requires Magnetometer nominal
04
Validate Telemetry & Exit Safe Mode
Success rate: NOT EVALUATED Risk: MONITORED (unvalidated)
Run a 5-minute telemetry health check across all critical subsystems. If all thresholds pass, command transition back to normal mission mode.
Duration ~5 min
Autonomy Operator Confirm
Requires All systems nominal
Safe mode exit requires operator authorisation — autonomous command uplink BLOCKED pending human confirm
Mission Impact
The SENTINEL Advantage
Without SENTINEL
NOT EVALUATED
Days Recovery
Ground-controlled
Manual telemetry review
Human-only diagnosis
Week-long procedures
→
With SENTINEL
NOT EVALUATED
Seconds to Diagnosis
Autonomous AI agent
Real-time causal reasoning
ESA database matching
Instant recovery plan
Time Saved
NOT EVALUATED
Reduction in Recovery Time
Reference Incidents · Static Content
Publicly Documented Mission Events

A fixed, hand-written reference list of publicly reported spacecraft anomalies, included for context. SENTINEL does not currently match telemetry against an incident database, and no similarity score is computed.

MAVEN
2022 · Mars Reconnaissance
NOT
EVALUATED
Similarity
IMU angular rate sensor failure caused attitude estimation drift, triggering autonomous safe mode entry after exceeding pointing limits.
IMU FailureADCSSafe ModeAttitude Drift
SOHO
1998 · Solar Observatory
NOT
EVALUATED
Similarity
Gyroscope anomaly combined with erroneous ground command led to loss of attitude control and a 4-month recovery requiring precise solar heating manoeuvres.
GyroscopeADCSGround Error4 Month Recovery
Mars Global Surveyor
2006 · Mars Orbit
NOT
EVALUATED
Similarity
Software memory overwrite corrupted attitude knowledge, leading to battery failure and eventual spacecraft loss. An earlier diagnosis could have prevented total loss.
Software FaultEPSMission Loss
Kepler
2013 · Planet Hunter
NOT
EVALUATED
Similarity
Reaction wheel failure caused loss of precise pointing, triggering emergency mode. Engineers devised an innovative solar-pressure stabilisation solution.
Reaction WheelADCSK2 Recovery
How SENTINEL would
explain a diagnosis
SCRIPTED EXAMPLE · NOT MODEL OUTPUT
Sensor
IMU-A Primary · Accelerometer Channel 2
Reading
±0.92°/s sustained over 47 seconds — 3.1σ above nominal envelope
Significance
Primary trigger for attitude estimation fault. Matched identical drift signature in MAVEN 2022 ESA incident report.
NOT EVALUATED
Subsystem
Reaction Wheel Assembly · Wheels 1 & 3
Reading
Momentum approaching saturation at 87%. Compensation commands increasing — consistent with unresolved attitude error
Significance
Secondary evidence corroborating ADCS root cause. Not an independent failure — downstream consequence of IMU drift.
NOT EVALUATED
Match
MAVEN 2022 Safe Mode Event — ESA ESAC Incident Database
Vectors
14-dimensional telemetry feature vector. Cosine similarity 0.87 across IMU drift, RWA response, star tracker degradation.
Significance
Prior incident resolved via backup IMU switch in 43 minutes. Outcome provides strong prior for recovery plan step 1.
NOT EVALUATED
Trigger
OBC Watchdog — Attitude Error Limit Exceeded for >30s
Chain
IMU drift → bad attitude estimate → attitude error grows → OBC exceeds threshold → autonomy initiates safe mode
Significance
Causal chain is complete and unambiguous. No alternative hypotheses with >20% posterior probability remain.
NOT EVALUATED
Technical Architecture
How SENTINEL Works

An autonomous AI pipeline that sits between the spacecraft and mission control — diagnosing, reasoning, and planning without waiting for a ground pass.

Telemetry Ingestion
Crash-dump JSON intake · Pydantic validation
Anomaly Detection
Z-score against nominal ranges (no temporal model)
Procedure Retrieval
ChromaDB over 2 ECSS PDFs · keyword KB fallback
LLM Reasoning Agent
Gemini · schema-enforced JSON · one repair retry
Causal Chain
LLM-authored chain · no causal inference engine yet
Safety Validator
Deterministic command whitelist + constraint checks
Mission Operator
Reviews output · SENTINEL does not uplink commands
SENTINEL v1.0 — research prototype
SIMULATION · SYNTHETIC DATA · NOT CONNECTED TO ANY SPACECRAFT