Real flight software watches every telemetry point against pre-launch upper/lower limit values. A single sample outside limits is not enough to act on — sensor noise and transients would trigger false alarms constantly — so the check requires the value to stay out of limits for a debounce hold time τ before it counts as a real violation:
violating(t) = |x(t) − x_nominal| > L_limit
trigger = violating held continuously for ≥ τ (τ here: 0–8 s)
Once the hold timer expires, the Fault Detection, Isolation & Recovery (FDIR) logic autonomously commands the safing sequence: the vehicle slews to a fixed sun-pointing safe attitude (maximizes solar-array power, the one resource everything else depends on), sheds every non-essential load, and switches the low-gain omni antenna for a robust — if low-bandwidth — link so ground control can diagnose the fault without racing the clock. This is the same three-stage reflex used on essentially every uncrewed spacecraft when contact with ground control is not guaranteed in real time.
- Bus Overheat / Undervoltage / Attitude Tumble — inject one telemetry excursion at a time; the strip chart trace turns amber while it is outside limits but still within the hold window, then red once the hold timer expires and safing fires.
- Debounce hold time — shorten it to see safing fire almost instantly on any blip (realistic false-alarm risk); lengthen it to see a real fault run longer before the vehicle protects itself.
- Manual override — simulates a ground-commanded inhibit: limit checking still runs and logs violations, but autonomous safing is suppressed, exactly as an operator can do during a planned high-risk maneuver.
- Drag the radar view — rotates the viewing frame around the vehicle, the 2D equivalent of orbiting a camera; it never changes the physics, only the vantage point.