Summary of events and issues leading to the loss of Hitomi?

Question

Hitomi was an Astrophysics science satellite in LEO with four X-ray telescopes, for imaging and spectroscopy of soft and hard X-rays. A paper based on some of the data collected during it's short operational life was just published in Nature.

This JAXA Press Release links to this JAXA PDF.

edit: Here is the June 8, 2016 updated JAXA PDF, much longer and more thorough. There is also a brief synopsis in Nature, but I'm not sure if it is reliable - the title, "Software error doomed Japanese Hitomi spacecraft" is misleading to say the least.

Just as in aviation and transportation, an understanding and reporting of events and issues leading to loss of spacecraft is invaluable to the entire community to help avoid losses in the future. Space is hard.

For example, I give several links to the two near-loss and recoveries of SOHO in 1998 here, including the thorough Roberts 2002 report. There were many lessons learned there.

Can someone help summarize the JAXA report here to an easier to understand, if less precise explanation? It seems to be a combination of things, instructions, maneuvers, design, stresses... Could it be said that a realistic worst-case scenario was simply not properly anticipated?

From Gizmodo:

From Space.com

Answer 1

So summarizing the larger report here, JAXA breaks the failure into 4 distinct events. These all occurred after a normal attitude adjustment.

1. A failure in the attitude control system (ACS) determined that the satellite was still rotating, while in fact the maneuver had already been completed. The ACS is made up of two systems, an onboard angular velocity sensor, and a star tracker. After the maneuver was complete, there was a process to correct the differences in measurements between the two systems, but this process was cut short, and the onboard computer assumed that there must be a problem with the the star tracker (which was actually showing the correct attitude), and ignored it.
2. Only relying on the now incorrectly calibrated angular velocity sensors, the satellite activated its reaction wheels to counter the velocity that it was sensing, but was not actually occurring.
3. The angular momentum limitation was exceeded, and the computer determined that there must be a problem with the reaction wheels. A system that controls attitude via thrusters was activated. Somehow this control system malfunctioned as well, and actually increased the speed of rotation.
4. Structural elements exceeded load limits and broke off.

In the end, there is a much more detailed breakdown of events that could have been better, and they primarily focus on potentially better design that could have prevented failure 1 and 3.

The critical failure seems to be in #3. While the ACS could have had more redundancies, #3 is supposed to be the backup system that catches any malfunction in the reaction wheels. There were data entry errors in this system, and incomplete verification and testing both on the part of the contractor that developed it and JAXA.

Some more details on #3 on page 62 and page 80. I've pulled out some quotes from both sections.

• JAXA held discussions with the support company and decided to change the thruster control parameters according to the actual properties of the thrusters. The company started the process. Note that this operation (changing the parameters) was not described in the documents prepared prior to launch that regulated the operational plan. In addition, details of this operation (which parameters are changed and how) were not shared between the support company and JAXA.
• There were errors in data input by the support company when the updated thruster control parameters were calculated. Accordingly, inappropriate parameters were derived.
• The support company was busy with duties on that day. One reason for this was that the company had to perform a task that was not described in the document governing the operational plan. This situation led to miscommunication of operational instructions between staff members of the company. Thus, a part of required verification was not implemented.
• JAXA, which was in charge of operations, did not confirm the preparation process for changing the thruster control parameters. Then, JAXA, without noticing the omission of the verification, ordered the implementation of the operation.
• Operational procedure plans were updated daily, congesting the workload of operational support companies involved with the ACS
• All tools for parameter setting were positioned as tools for use by experienced developers during development and testing, so no manuals were prepared and no operational training was conducted. There was also no overall manual of procedures for the parameter setting and simulation process.
• In the end, JAXA did not verify the operational preparation status of parameter changes for thruster control.