Planning For Satellite Actuator Failures: A Falsification Approach Towards Certification of Contingency Controllers