I&#x27;d love to see a full post-mortem. It <i>smells</i> like something was very off in either the hardware design or software configuration, but not knowing their architecture, it&#x27;s very hard to say with any certainty what could have been improved. A couple of questions I have:<p>- other systems I know of that care deeply about their attitude have multiple redundant sensors in place to &quot;vote&quot; on a consensus output in case one or more of them fails. Was that the case in this hardware design? If not, why not? If yes, how did the collective answer end up a constant error?<p>- did they have other sensors (such as a strain gauge) that could have been integrated into the model to spot-check this kind of failure mode? A rule like &quot;If the satellite &#x27;feels&#x27; like it&#x27;s tearing itself apart, stop accelerating&quot; could perhaps have been useful (on the other hand, it&#x27;d leave the craft vulnerable to other known failure modes, such as &quot;thruster stuck in the on position and must be countered by another thruster to keep the craft stable,&quot; which almost killed one of the U.S. manned missions).