3
$\begingroup$

Hitomi was an Astrophysics science satellite in LEO with four X-ray telescopes, for imaging and spectroscopy of soft and hard X-rays. A paper based on some of the data collected during it's short operational life was just published in Nature.

This JAXA Press Release links to this JAXA PDF.

edit: Here is the June 8, 2016 updated JAXA PDF, much longer and more thorough. There is also a brief synopsis in Nature, but I'm not sure if it is reliable - the title, "Software error doomed Japanese Hitomi spacecraft" is misleading to say the least.

Just as in aviation and transportation, an understanding and reporting of events and issues leading to loss of spacecraft is invaluable to the entire community to help avoid losses in the future. Space is hard.

For example, I give several links to the two near-loss and recoveries of SOHO in 1998 here, including the thorough Roberts 2002 report. There were many lessons learned there.

Can someone help summarize the JAXA report here to an easier to understand, if less precise explanation? It seems to be a combination of things, instructions, maneuvers, design, stresses... Could it be said that a realistic worst-case scenario was simply not properly anticipated?

From Gizmodo:

enter image description here

From Space.com

enter image description here

$\endgroup$
10
  • $\begingroup$ I'm not sure your comparison with the aeronautic industry is valid. Aircraft are so what standardized mass prodded designs compare to a one of a kind hitomi. $\endgroup$
    – Antzi
    Commented Jul 8, 2016 at 6:42
  • 1
    $\begingroup$ I'm sorry I mixed up with an other question. Let me grab more coffee. $\endgroup$
    – Antzi
    Commented Jul 8, 2016 at 7:25
  • 1
    $\begingroup$ Interestingly enough, Coffee is at >= 98.75% made of rocket fuel combustion products ! $\endgroup$
    – Antzi
    Commented Jul 8, 2016 at 7:48
  • 1
    $\begingroup$ Briefly, it sounds like its attitude sensing system falsely showed that the spacecraft was rotating, so the attitude control system started applying torque to stop the rotation. Presumably the false sensed rotation didn't change, so the ACS kept trying, spinning the satellite up until it flew apart. Ouch. $\endgroup$ Commented Jul 8, 2016 at 12:52
  • 1
    $\begingroup$ @OrganicMarble I see.. OK I've found a more recent and much more thorough JAXA report, and a synopsis from Nature with a funky title and phrases like "Tiny motors known as reaction wheels began to turn..." - see edit: above. $\endgroup$
    – uhoh
    Commented Jul 8, 2016 at 13:54

1 Answer 1

7
$\begingroup$

So summarizing the larger report here, JAXA breaks the failure into 4 distinct events. These all occurred after a normal attitude adjustment.

  1. A failure in the attitude control system (ACS) determined that the satellite was still rotating, while in fact the maneuver had already been completed. The ACS is made up of two systems, an onboard angular velocity sensor, and a star tracker. After the maneuver was complete, there was a process to correct the differences in measurements between the two systems, but this process was cut short, and the onboard computer assumed that there must be a problem with the the star tracker (which was actually showing the correct attitude), and ignored it.
  2. Only relying on the now incorrectly calibrated angular velocity sensors, the satellite activated its reaction wheels to counter the velocity that it was sensing, but was not actually occurring.
  3. The angular momentum limitation was exceeded, and the computer determined that there must be a problem with the reaction wheels. A system that controls attitude via thrusters was activated. Somehow this control system malfunctioned as well, and actually increased the speed of rotation.
  4. Structural elements exceeded load limits and broke off.

In the end, there is a much more detailed breakdown of events that could have been better, and they primarily focus on potentially better design that could have prevented failure 1 and 3.

The critical failure seems to be in #3. While the ACS could have had more redundancies, #3 is supposed to be the backup system that catches any malfunction in the reaction wheels. There were data entry errors in this system, and incomplete verification and testing both on the part of the contractor that developed it and JAXA.

Some more details on #3 on page 62 and page 80. I've pulled out some quotes from both sections.

  • JAXA held discussions with the support company and decided to change the thruster control parameters according to the actual properties of the thrusters. The company started the process. Note that this operation (changing the parameters) was not described in the documents prepared prior to launch that regulated the operational plan. In addition, details of this operation (which parameters are changed and how) were not shared between the support company and JAXA.
  • There were errors in data input by the support company when the updated thruster control parameters were calculated. Accordingly, inappropriate parameters were derived.
  • The support company was busy with duties on that day. One reason for this was that the company had to perform a task that was not described in the document governing the operational plan. This situation led to miscommunication of operational instructions between staff members of the company. Thus, a part of required verification was not implemented.
  • JAXA, which was in charge of operations, did not confirm the preparation process for changing the thruster control parameters. Then, JAXA, without noticing the omission of the verification, ordered the implementation of the operation.
  • Operational procedure plans were updated daily, congesting the workload of operational support companies involved with the ACS
  • All tools for parameter setting were positioned as tools for use by experienced developers during development and testing, so no manuals were prepared and no operational training was conducted. There was also no overall manual of procedures for the parameter setting and simulation process.
  • In the end, JAXA did not verify the operational preparation status of parameter changes for thruster control.
$\endgroup$
3
  • $\begingroup$ Oh, I see, actually this is very helpful! For your #3, can you cite a subsection number or page number in the report? Thanks! $\endgroup$
    – uhoh
    Commented Jul 8, 2016 at 15:41
  • 1
    $\begingroup$ @uhoh Yeah, I've added in some quotes from page 62 and 80 about the specific failures in regard to #3 $\endgroup$
    – M.A.H.
    Commented Jul 8, 2016 at 15:53
  • 1
    $\begingroup$ This is an amazing answer - thank you for taking the time to dig-in and sort through the various issues and write a clear discussion and summary! $\endgroup$
    – uhoh
    Commented Jul 8, 2016 at 15:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.