[patrickmckeen]

The problem

The simulation's "true" magnetic field and the estimator's field model are the same IGRF evaluation, so a magnetometer in a simulation is only ever wrong by its own noise and bias, and a torquer always produces exactly the torque the model predicts. On a real spacecraft the model itself is wrong: IGRF leaves out the crustal and external fields, and the difference at low Earth orbit is typically 100 to 300 nT, changing slowly as the spacecraft moves. That error is in the environment, so it is the same for every magnetometer on board and the torquers act on it too; what is off is the filter's prediction of both. Any study of magnetometer-based attitude accuracy or magnetic control without it is optimistic.

What this adds

FieldModelError(std, correlation_time): an error field in the inertial frame, one independent first-order Gauss-Markov process per axis, with the given standard deviation in tesla and correlation time in seconds. It starts in its stationary distribution, decays towards zero over the correlation time and is topped up each step so its standard deviation stays where configured, for any step length. Reasonable values for low Earth orbit are a few hundred nanotesla and a few hundred seconds (the time to move a few hundred kilometres), and the docstring says so. This is a stand-in for a model error, not a model of it: it has the right size and the right slowness, nothing more.

The satellite owns it: Satellite(field_error=FieldModelError(...)). It is stepped once per plant step with the other error models (update_errors), and the whole plant sees the same realisation:

• every magnetometer reads the model field plus the error (rotated into the body frame), in its clean reading too, since this is the environment and not the device, with the Jacobian following;
• the magnetorquers and the magnetic disturbances (act_torque, dist_torques, and so the dynamics) act on the model field plus the error. The plant's orbital state is replaced by a copy with the offset field inside those two methods, so the caller's orbital state is never touched.

The estimator's clone of the satellite has no error field, on the satellite or its sensors, because the model error is by definition what the model does not have. A magnetometer can still be given a FieldModelError directly when used on its own.

This stacks on #235.

Tests

testing/test_sensors/test_field_model_error.py, 6 tests: the error field is stationary with the configured standard deviation and lag-one correlation and its axes are independent (20 000 steps); three magnetometers sharing one instance read one consistent error at one epoch and it steps once when the epoch changes; the analytic Jacobian matches a central-difference Jacobian with the error and a misalignment in place; the estimator's clone has no error field; the validation; and, at satellite level, that the readings, the torquer torque, the magnetic disturbance torque and the dynamics all use the same true field while the estimator's clone uses the model field, with the caller's orbital state untouched and one realisation per step. The full suite passes.

🤖 Generated with Claude Code

[github-actions]

Test Results

1 604 tests  +6   1 602 ✅ +6   3m 49s ⏱️ + 1m 58s
    1 suites ±0       2 💤 ±0 
    1 files   ±0       0 ❌ ±0 

Results for commit cd2ab4d. ± Comparison against base commit 2be7599.

♻️ This comment has been updated with latest results.

[nscheuer]

I would prefer different field models for the estimator and the environment rather than introducing a new class that is hyperspecific for this problem