Guidance, navigation and control: know, decide, act
GNC—guidance, navigation and control—contains three distinct jobs. Navigation estimates the vehicle state. Guidance decides what state or trajectory should be pursued. Control commands actuators to reduce the error. Keeping those jobs separate makes both design and fault diagnosis clearer.
1. Separate navigation, guidance and control
Navigation estimates position, velocity, attitude and sensor biases. Guidance generates a desired trajectory or state. Control converts error into actuator commands. If navigation is wrong, a perfectly functioning controller can drive the spacecraft away from the real target while believing it is correcting an error.
Guidance, navigation and control form one loop but answer three different questions. Navigation estimates the actual state—position, velocity, attitude and often sensor biases. Guidance converts mission intent into a trajectory or attitude reference. Control commands actuators to reduce the difference between estimated state and reference. That separation is diagnostic: a spacecraft can track a bad reference perfectly, meaning control may be healthy while guidance is wrong. If the reference is correct but the state estimate drifts, navigation is the suspect. An explainable architecture preserves these boundaries in telemetry, fault messages and degraded modes so the crew knows which part of the chain has lost credibility.
2. Inertial sensors propagate motion but drift
An IMU combines gyroscopes and accelerometers. Integrating their measurements propagates attitude, velocity and position, but sensor bias accumulates. A constant acceleration bias b = 10⁻⁴ m/s² over t = 1,000 s creates roughly Δv = b t = 0.1 m/s of velocity error. Position error grows even more strongly. Inertial navigation therefore needs external updates.
An inertial measurement unit senses specific force and angular rate. Velocity, position and attitude are obtained by integrating those measurements over time, which means sensor bias is integrated as well. An accelerometer error of only 100 micro-g—about 0.000981 m/s²—would accumulate roughly 0.85 m/s of velocity error after 15 minutes in a deliberately simple one-dimensional calculation. Real navigation adds rotations, gravity models and filtering, but the lesson remains: an IMU is excellent for short-term continuity, not for providing absolute truth by itself for days. External measurements must periodically constrain the estimate, and their uncertainty must also be represented.
3. Star trackers provide an absolute attitude reference
A star tracker matches an observed star field to a catalogue and estimates orientation. It can be extremely accurate yet unavailable near bright bodies or in prohibited Sun angles. Gyroscopes bridge gaps between stellar solutions. The architecture combines high-rate propagation with intermittent absolute reference.
A star tracker recognises star patterns and provides a precise absolute attitude reference. Its availability still depends on field of view, stray light, temperature, angular rate and catalogue quality. Sun intrusion or occultation can remove a valid solution without any hardware failure. Software must therefore distinguish ‘no solution now’ from ‘sensor dead’. During an outage, the IMU propagates attitude with growing uncertainty. When star-tracker data returns, the first measurements should be checked before full reintegration. That controlled transition prevents a single bad reacquisition from creating a large attitude command and makes recovery an evidence-based process rather than an automatic switch.
4. State estimation combines a model with uncertain measurements
An estimator predicts the state from dynamics and then corrects that prediction with measurements and uncertainty models. The measurement-minus-prediction residual is valuable for fault detection. An overconfident model can reject valid sensor evidence; an overpermissive model can follow noise.
Exercise A — intuitive weighting
Two sensors report 100 and 104, but the first is known to be much more precise. Is 102 automatically the best estimate?
No. A weighted estimate gives more influence to the measurement with lower uncertainty. A simple average silently assumes equal quality.
A state estimator combines a dynamic prediction with uncertain measurements. The important idea is not the filter’s name but the balance between model and evidence. A noisy measurement should move the estimate only a little; a precise, consistent measurement can correct it strongly. The innovation or residual compares the expected measurement with what was received. An improbable residual can indicate a bad sensor, an incorrect model or an unmodelled manoeuvre. Covariance represents estimated uncertainty and correlation. GNC should therefore publish both state and confidence, because the same position estimate might be good enough for antenna pointing and completely inadequate for terminal descent.
5. Observability asks whether a state can actually be known
A system can carry many sensors yet be unable to distinguish two candidate states if they produce the same measurements. A change in geometry, attitude or sensing technology may make the state observable. Observability belongs to the combination of dynamics and measurements rather than to sensor count alone.
Observability asks whether available measurements can actually separate the states being estimated. Many sensors do not automatically create independent information. Repeating a range-only measurement, for example, can leave several positions geometrically compatible if there is no angular information or helpful vehicle motion. A second line of sight or a change in geometry can make the state observable. Before adding a sensor, the engineer asks which previously ambiguous state it constrains. This prevents superficial redundancy in which several instruments share the same blind direction, reference or error model and therefore fail together when the geometry becomes unfavourable.
6. Guidance must request a reachable reference
“Go to the safe site” is incomplete. Guidance considers vehicle dynamics, thrust limits, forbidden corridors and remaining reserve. An impossible reference simply drives the controller into saturation. Good guidance selects a physically reachable target inside the current capability envelope.
Guidance must request a reference that the vehicle can physically reach. A mathematically smooth path may still demand acceleration, angular rate or propellant beyond actuator capability. Guidance therefore includes thrust limits, allowable attitude, obstacles, propellant reserve and navigation margin. During descent, a late divert can saturate engines or force an attitude that degrades sensors. A sound design first computes a reachable set and then selects a reference inside it. Control should not be expected to make an impossible command possible. This is one of the most important boundaries between trajectory planning and feedback control.
7. Control closes the error loop
In a basic representation, e = r − y compares reference r with measured output y. A proportional command might be u = K e. K is controller gain and u actuator command. Larger gain is not automatically better; delay, noise, actuator limits and unmodelled dynamics can make an aggressive loop oscillate.
Exercise B — proportional command
An attitude error is 2 degrees and a teaching controller uses K = 0.5 command units per degree. What raw command results?
u = K e = 0.5 × 2 = 1 command unit. Real design must then check sign, units, saturation and closed-loop dynamics.
Control closes the loop by turning error into command. Even a simple proportional example, u = K × e, shows the trade: too little gain K gives slow correction; too much can excite delays, structural flexibility, sensor noise or actuator saturation. Real vehicles add integral and derivative terms, filters, limiters and actuator dynamics. Stability therefore means more than ‘the error eventually reaches zero’. Engineers also check overshoot, settling time, robustness to uncertain parameters and behaviour under noisy measurements. A survival mode may deliberately accept poorer pointing accuracy in exchange for wider stability margin and simpler logic.
8. Actuators saturate and carry resources
Reaction wheels can accumulate momentum and reach speed limits. Thrusters consume propellant and have minimum impulse characteristics. The controller needs these constraints in its model. Demanding more from a saturated actuator does not create more control authority.
Actuators carry their own resources and limits. A reaction wheel stores angular momentum until saturation; a thruster consumes propellant and has a minimum impulse bit; a gimbal has travel and rate limits; a magnetorquer depends on a local magnetic field and is not a deep-space attitude solution. GNC must know these boundaries. As wheels approach saturation, momentum unloading transfers angular momentum through another actuator. Operations must schedule that activity so it does not corrupt a precision observation or manoeuvre. Control authority is therefore a budgeted mission resource, much like energy or propellant.
9. GNC fault management needs independent evidence
FDIR can use residuals, cross-sensor consistency, expected dynamics and health flags. Three identical sensors may still fail together through shared software, calibration or environment. Diversity across inertial, stellar, radio, optical and terrain-relative references can be more valuable than blind replication.
GNC fault management is more than majority voting among three sensors. Identical sensors can share software, power, catalogue data or environmental sensitivities and therefore fail from one common cause. Stronger FDIR compares evidence of different kinds: inertial, stellar, solar, radio and expected dynamics. It also checks time history. A sudden jump in one sensor while others and actuators remain coherent is different from a slow common drift that may indicate a bad model. Isolation must preserve enough information for the next safe mode; otherwise fault management can create the very loss of control it was meant to prevent.
10. Failure scenario: star tracker unavailable during a manoeuvre
The vehicle propagates attitude on gyroscopes while uncertainty grows. A proper degraded-mode requirement says how long that propagation remains acceptable, which activities are suspended and what alternate measurement can re-establish absolute reference. “Fly inertially” is not complete until its validity envelope is quantified.
During a manoeuvre without a star tracker, the IMU can preserve attitude for a limited period, but uncertainty grows. The spacecraft needs a predeclared accuracy requirement for each activity. Coarse solar pointing may tolerate several tenths of a degree while a precision burn may not. If estimated uncertainty crosses the manoeuvre threshold, the correct action can be to stop and reacquire an absolute reference rather than continue on dead reckoning. Training should include sensor recovery, consistency testing, controlled filter reintegration and proof that actuators did not saturate during the outage. Recovery is complete only when the state and its confidence again satisfy the mission requirement.
Guided case — an estimator that becomes overconfident
Imagine an attitude estimator whose covariance steadily shrinks because star-tracker measurements have been very stable. A stray-light condition then creates a small persistent bias that the filter model does not represent. If software has become overconfident, it may reject a correct inertial observation as ‘inconsistent’. The danger is not only sensor noise but a poor representation of uncertainty. Diagnosis therefore compares innovation, sensor context and independent references before isolating a channel.
One recovery strategy temporarily inflates uncertainty, reduces star-tracker weighting and uses Sun sensing or radio geometry to discriminate the hypotheses. The filter is not merely a precision algorithm; it is an arbiter of confidence. Robust missions monitor the statistical consistency of residuals over time rather than watching only the state estimate itself.
The exercise asks students to distinguish three failures: a bad measurement, an incorrect dynamic model and an unrealistically small covariance. All three can create the same symptom—a large residual—but require different responses. That distinction prevents the team from replacing the most visible sensor when the real problem may be in software or assumptions.
11. Mini-project: build a GNC evidence chain
- Select attitude, altitude or position as the controlled quantity.
- List sensors that observe it directly or indirectly.
- Define the guidance reference.
- Identify the actuator.
- Add one saturation and one lost sensor.
- Explain detection, isolation and the degraded state.
The final diagram should trace information all the way from measurement to physical effect.
12. Mission lab — detect inertial drift without creating a false alarm
A gyro bias of only 0.01 degrees per hour looks negligible. After 24 hours without an absolute update, a first-order attitude error scale is 0.24 degrees. The relation Δθ ≈ b × t uses Δθ for angle error, b for angular bias per unit time and t for elapsed time. A real navigation filter estimates bias and attitude together, but the simple multiplication shows why periodic absolute references matter.
Now assume the star tracker and IMU begin to disagree slowly. Good FDIR first checks geometry and context: is the star field partially blocked, is the tracker near a thermal or Sun-avoidance limit, did the IMU just experience a high-dynamics manoeuvre? A third independent reference—Sun sensing, radio geometry or another optical observation—may resolve the disagreement. Immediately declaring the IMU faulty could discard the only healthy source.
State estimates should carry confidence. An attitude solution with growing uncertainty may remain adequate for solar-array pointing while no longer meeting a precision manoeuvre requirement. Operational limits therefore belong to activities, not to a single universal “navigation valid” flag.
This idea extends to position and velocity. The same estimated state can be acceptable for a coarse communication pointing mode and unacceptable for terminal descent. GNC health must be judged against the current mission need.
13. Stability, saturation and controlled return to nominal
An actuator that saturates cannot deliver more authority simply because the controller asks harder. Integrating controllers can continue accumulating error while saturated, producing overshoot when authority returns. Anti-windup, reference limiting or mode switching are examples of remedies. The main lesson is that control laws live inside physical amplitude, rate, energy and thermal limits.
Sensor recovery also needs a transition. A star tracker that comes back after an outage can be compared against propagated attitude, checked for residual consistency and gradually accepted. An abrupt switch to a measurement with an unnoticed offset can create a command transient. Return-to-service criteria should state allowable residual, required observation duration and what happens if disagreement reappears.
For a design review, trace one complete off-nominal loop: sensor fault, detector evidence, confidence change, guidance restriction, actuator command, safe-state entry, new measurement, recovery decision and restored mission activity. If any link is described only as “software handles it,” the GNC case is incomplete.
Sources and references
Verified primary supplement: NASA NTRS — State-of-the-Art Small Spacecraft Technology
Engineering studio — connect angular error to safety
At 8 km from a target, an angular error of 0.15° corresponds to θ = 0.15×π/180 ≈ 0.00262 rad. For small angles, lateral error is approximately x = Rθ = 8,000×0.00262 ≈ 21 m. Here R is range in metres and θ is angle in radians. The calculation shows why an apparently tiny sensor error can become tens of metres on the ground.
The scenario then adds 200 ms of processing latency and limits one actuator to 80% of nominal authority. The student decides whether the error remains observable and recoverable before the next decision gate. At least two independent checks are required — for example filter innovation and consistency with an optical measurement — followed by a criterion that triggers a more conservative trajectory.