Design of an Autonomous Decision Support System for High-Level Planning in Nano Satellites Using Logic Programming

Transcription

1 Design of an Autonomous Decision Support System for High-Level Planning in Nano Satellites Using Logic Programming Saliha Serdar Space Engineering, masters level 2017 Luleå University of Technology Department of Computer Science, Electrical and Space Engineering

2 Design of an Autonomous Decision Support System for High-Level Planning in Nano Satellites Using Logic Programming Master Thesis in the course of the study programme "Master in Space Science and Technology" by Saliha Serdar born on April 24 th 1991 in Groß-Gerau Submitted on: October 11 th 2016 Julius-Maximillians-University Department of Computer Science Aerospace Information Technology Prof. Dr.-Ing. Hakan Kayal Prof. Dr. Dietmar Seipel Luleå Tekniska Universitet Department of Computer Science Electrical and Space Engineering Prof. Dr.Eng. Reza Emami

3 Statutory declaration I confirm that this Master s thesis is my own work and I have documented all sources and material used. This thesis was not previously presented to another examination board and has not been published. Würzburg,

4 Contents Abstract Acknowledgment Acronyms iv v vi 1 Introduction 1 2 State of the Art On-Board Autonomous Science Investigation System for Opportunistic Rover Science - OASIS Autonomous Exploration for Gathering Increased Science - AEGIS Autonomous Science Target Identification and Acquisition - ASTIA Multi-Rover Integrated Science Understanding System - MISUS Autonomous Sciencecraft Experiment - ASE Project for On-Board Autonomy - PROBA Conclusion of the State of the Art Theory Definition of Decision Support System - DSS Logical Programming Language - Prolog Analytic Hierarchy Process - AHP Detailed Approach of the Analytical Hierarchy Process Super Decision Software Advantages of AHP over the Simple Scoring Model Spacecraft Mission Design SONATE Orbital Design Spacecraft Subsystems On-Board Computer - OBC Power System

5 Contents ii Attitude Determination and Control System - ADCS Thermal Control System Telemetry, Tracking and Command System - TT&C Payload Definition, Analysis and Evaluation of Spacecraft Failures Definition of Failures OBC Failures Power System Failures Thermal Control System Failures ADCS Failures TT&C Failures Payload Failures Analysis of the Defined Failures Definition of the Characteristics of Power System Failures Determining the Degree of Impact of Power System Failures Results of the Failure Rating Event Analysis Defining the Features of the Events Predictability Repetition in one Cycle Level of Intensity Strangeness Combination of Event Features Determining the Importances of Events Decision Support System Defining the Facts and Rules Facts Rules Implementation in Prolog Facts in Prolog Rules in Prolog Queries in Prolog Results and Future Work Results of the Work Future Work

6 Contents iii 9 Conclusion 73 Appendix 74 A On-Board Computer Failure Analysis B Power System Failure Analysis C Thermal Control System Failure Analysis D Attitude Determination and Control System Failure Analysis E Telemetry, Tracking & Command Failure Analysis F Payload Failure Analysis G Event Tree H Èxypnos System Code for Power System Failures List of Figures List of Tables References i ii iv

7 Abstract Low-level decisions in space missions, like maximizing the contact duration or bringing the spacecraft in safe mode in case of anomalies, are autonomously made by the spacecraft, whereas high-level and critical decisions are still taken by humans. Due to communication delays in interplanetary or even interstellar missions, this leads to the limitation of spacecraft operations in case of unexpected situations. Unexpected situations can be either the detection of unforeseeable short lived events or even on-board failures. In this given conditions the spacecraft have to take quick decisions to not miss the event or loss the spacecraft. Higher demands are imposed to spacecraft autonomy, if an event is detected and an on-board failure occurs at the same time. The presented work deals exactly with the last stated problem, which requires autonomy in high-level planning. A decision should be taken between either investigating the event or repairing the failure. Thereby the unique scientific measurements, that can result from the detected event, as well as the impact of the failure are considered. In order to reach this objective an approach of rule-based decision support system, also referred to as a expert system, is designed for nano satellites. For this purpose, events and on-board failures are defined, analyzed and converted from objective ratings into numerical values by applying the Analytical Hierarchy Process. Since the logical programming language Prolog is an appropriate language for experts systems, a part of the developed system is implemented in Prolog, to verify its use in space related expert systems.

8 Acknowledgment First of all I want to thank my master thesis advisors Prof. Dr.-Ing. Hakan Kayal and Prof. Dr. Dietmar Seipel of the department of computer Science at the University Würzburg. Prof. Kayal supported me during my thesis with his expert knowledge concerning aerospace technology and Prof. Seipel, as a Prolog expert, introduced me in Prolog. I would also like to thank Florian Kempf (research assistant at the University Würzburg) for inspiring me with new ideas, that helped me to make great progresses in my thesis. Finally, I must express my very profound gratitude to my parents, to my partner and to my friends for providing me with unfailing support and continuous encouragement throughout my years of study and through the process of researching and writing this thesis. This accomplishment would not have been possible without them. Thank you. Saliha Serdar

9 Acronyms ADCS ADIA++ AEGIS AHP ANP ASAP ASE ASTIA CASPER Attitude Determination and Control System Autonomous Diagnostic System for nano satllites Autonomous Exploration for Gathering Increased Science Analytical Hierarchy Process Analytical Network Process Autonomous Sensor And Planning Autonomous Sciencecraft Experiment Autonomous Science Target Identification and Acquisition Continuous Activity Scheduling, Planning, Execution and Re-planning ChemCam Chemistry and Camera CI DSS EDAC EO-1 ESA ESD FDIR FIDO Consistency Index Decision Support System Error Detection and Correction Earth Observing-1 European Space Agency Electrostatic Discharge Fault Detection Isolation and Recovery Field Integrated Design and Operations GESTALT Gird-based Estimation of Surface Traversability Applied to Local Terrain GRB Gamma Ray Bursts

10 Acronyms vii HG HMNAO HW JPL KS KSTIS LG LIBS LS μasc MBU MEL MER MISUS NASA OASIS OBC OBSW PCDU PPS PROBA PROLOG PS RCS RI High Gain Her Majesty s Nautical Almanac Office Hardware Jet Propulsion Laboratory Knowledge System Knowledge based Science Target Identification System Low Gain Laser Induced Breakdown Spectrometer Language System micro Advanced Stellar Compass Multiple Bit Upset Mars Exploration Laboratory Mars Exploration Rover Multi-Rover Integrated Science Understanding System National Aeronautics and Space Administration On-Board Autonomous Science Investigation System for Opportunistic Rover Science On-Board Computer On-Board Software Power Control and Distribution Unit Problem-Processing System Project for On-Board Autonomy Programming in Logic Presentation System Reaction Control System Random Index

11 Acronyms viii RIA RMI SEB SEE SEL SEU SSTV STFC SV TDL TID Rock Identification Agent Remote Micro Imager Single Event Burnout Single Event Effects Single Event Latch-up Single Event Upset Slow Scan Television Science & Technology Facilities Council Science Values Task Description Language Total Ionizing Dose TOMS-EP Total Ozone Mapping Spectrometer in NASA s Earth Probe series TT&C USNO Telemetry Tracking and Command System United States Naval Observatory

12 1 Introduction Intelligent systems are becoming more and more a part of our daily life. Examples therefore are the digital assistances (e.g. Siri and Amazon Echo), autonomously driving cars (e.g. Google Chauffeur), computer games (to create challenges for the player), medical diagnosis systems (MYCIN [1]) and much more. But what exactly is the definition of intelligent systems? According to Gudwing (2000) [2] intelligent systems have the ability to work in a changing environment. Also in the space area intelligent systems are getting meaningful, but require a certain degree of autonomy. In a common mission, commands are uploaded to the spacecraft during the contact time window by the ground station. Afterwards they are executed sequentially by the spacecraft at a predefined time. Until the next contact, the spacecraft operates blind according to the uploaded commands. In case of unexpected situations, the spacecraft is not able to reschedule the commands in order to respond to changes. This can lead to significant drawbacks, if an unexpected event, which might be interesting to investigate, is missed by the spacecraft. Another difficulty is given regarding to the health status of the spacecraft. Failures and anomalies can be monitored by the ground station only during contact time. Of course the spacecraft is not totally alone with its failures and anomalies, there is a system called Fault Detection Isolation and Recovery (FDIR) on-board the spacecraft. As the name suggests, FDIR has the task to detect, isolate and recover the occurring failures. However the isolation and recovery parts are extremely limited to only a few operations, like power down of the affected component, releasing the redundant element if the operating one failed or as the last invention change the state of spacecraft to safe mode [3]. With increasing distances between spacecraft and ground station, the stated operational limitations of spacecrafts are also increasing. For example a one way contact duration between mars rovers and ground stations takes approximately 20 minutes. Due to this fact teleoperation of mars rovers are impossible to realize. Since in case of an unexpected situations, e.g. slipping of the rover, there are no possibilities given to react in real-time. This is overcome with the supervised autonomy, where the destination is transmitted by the ground station and the rover decides autonomously about the interim goals. Some degree of autonomy is as well given in satellite missions, e.g. in NASA s EO-1 mission, where the spacecraft is able to respond to unexpected events (2.5) and in ESA s PROBA mission, in which the low level autonomy like pointing the camera to the desired position (2.6) are available. However the EO-1 spacecraft is

13 1 Introduction 2 a medium sized satellite with a mass of 572kg, which leads to high costs in development as well in launch. The satellites of the PROBA mission are small satellites with a mass range of 100kg up to 300kg, but still expensive and deliver a low level of autonomy. Currently the department of Computer Science - Chair VIII of the University Würzburg is developing SONATE, a nano satellite which will be able to detect unexpected events and reschedule the command plan in order to investigate them. Additionally it will have the ability to diagnose its own health status. Detecting events and rescheduling the commands are the tasks of the payload ASAP, whereas the fault diagnosis will be done by ADIA++. Both payloads will operate autonomously, without an intervention from Earth. This project is funded by the German Federal Ministry of Economy Affairs and Energy, represented by the German Space Agency [4]. In the presented work a system, named Èxypnos System (éxypnos comes from the Greek and means intelligent), for high-level planning is designed. It will assist the spacecraft in critical decision making situations, which will increase the degree of autonomy. Here the critical situations are delimited by the occurrence of on-board failures and simultaneous detection of unexpected events. Thereby the decision have to be taken between either to apply a corrective measure to repair the failure or to investigate the detected event. The system is designed based on an invented nano satellite, called ÈxypnosSat, which is inspired by SONATE. The designed system is an outline of an autonomous decision support system (DSS) for the above specified circumstances. Since the designed DSS will act like a domain expert, such systems are also called expert systems. For this objective the logical programming language Prolog is chosen due to its declarative proceeding, which suits well in expert systems. The focus of this work is placed to the analysis of on-board failures and unexpected events. Failures and unexpected events are converted from objective ratings into numerical values according to their degree of impact and importance respectively. Therefor the multi-criteria decision making approach Analytical Hierarchy Process (AHP) is applied. Based on these analyses an illustrative example of the power subsystem is implemented in Prolog to verify its use as well in space related expert systems. The structure of the thesis is carried out as follows: As a first step a brief overview of the state of the art of autonomous and intelligent systems in the space area will be given in Section 2. Afterwards in Section 3, the theoretical background of DSS, Prolog and the applied decision making approach, AHP will be declared. In Section 4 the design of the invented ÈxypnosSat will be outlined followed by its failure analysis in 5 and the analysis of unexpected events in 6. After the failure and event analyses, the DSS will be designed in Section 7 and implemented in the logical programming language Prolog. Finally the results and future works will be discussed in Section 8 and in Section 9 the conclusion of the done work will be drawn.

14 2 State of the Art Before designing the intelligent decision support system a research of already existing intelligent systems in space is made and presented in this chapter. There is no differentiation made between rovers and spacecrafts. Since the field of high autonomous spacecrafts is limited, the size and mass ranges of the investigated rovers and spacecrafts are as well not specified. In Section intelligent systems in rovers will be addressed. Autonomous satellites will be stated in 2.5 and 2.6. After the state of the art of intelligent systems in space are outlined, a summarized review will be given in the Section On-Board Autonomous Science Investigation System for Opportunistic Rover Science - OASIS Increased traveled distance of planetary rovers can increased the chance to gain high qualitative scientific knowledge. While NASA s first successful Mars rover, Sojourner, covered a distance about 100m in the whole life time, one of NASA s Mars Exploration Rovers, Opportunity, covered up to date about 43km. This major step forward in rover missions was realized with the autonomous driver software GESTALT (Gird-based Estimation of Surface Traversability Applied to Local Terrain). It provides the rover the ability to drive autonomously through the Martian surface to the desired destination. One problem here is, that with increased traveled distance the transmission time slots between Earth an Mars remain constant and are used in most cases for decision making purposes (e.g. detecting a rock of scientific interest is done by the ground control system). The consequent of this procedure is that in a long journey of the rover, most of the traversed terrains remain undiscovered [5]. In order to use the limited transmission time slots meaningful by transmitting more scientific data instead of commanding the rover, the OASIS system was developed by the engineers of NASA s Jet Propulsion Laboratory (JPL). OASIS is able to recognize and analyze autonomously targets and events of scientific interest on-board the rover. Terrain features and events which requires further investigation can be directly identified by the rover. This system was tested

15 2.2 Autonomous Exploration for Gathering Increased Science - AEGIS 4 successfully by the FIDO 1 rover [5]. The OASIS system first detects predefined features based on the image data. These features are predefined by the scientific team members of the mission. After detecting features there are two ways possible for the further actions. Either an image segmentation can be done to categorize the sky and rocks followed by the extraction of the features or the characteristics are extracted directly from the input image. If this is done, the features, e.g. of rocks, will be analyzed and afterwards prioritized to define new scientific goals in case of interesting observation. Four different options are given to determine the target of scientific interest: - Detected Event: sets flag if an event of interest is captured - Key Target Signature: recognizes properties, that are predefined by scientists - Novelty Detection: recognizes properties with high deviation from usual values - Representative Sampling: identifies rocks that are representative for the traveled region to gain characteristics of this region OASIS has also the ability to reschedule the command sequence when an interesting feature is detected, to monitor the actual state of the rover and to execute the rescheduled commands. Rescheduling of commands and monitoring rovers actual state is provided by the CASPER 2 system [6]. The execution of the commands are performed by the system, called TDL 3 [6]. Both systems, CASPER and TDL are integrated in OASIS. 2.2 Autonomous Exploration for Gathering Increased Science - AEGIS AEGIS is a software, which is also developed by NASA s JPL for planetary rovers. It is a part of the OASIS framework and allows the rovers to determine autonomously targets of scientific interest, in order to point the remote-sensing instruments. With AEGIS it is possible to increase the efficiency of the mission. Since a common target selection by scientist on Earth can take several days due to the transmission delay and during this time the rover has to stand at the same position for several days. The target selection with AEGIS is done on the basis of predefined criteria and constraints by human experts [7], that are uploaded to the rover. The strategy of this software in the first instance is to analyze images on-board, which are provided by the navigation cameras of the rover. The result of this analysis is identification of potential targets. Based on this analysis relevant targets are extracted and prioritized depending 1 is a prototype rover on Earth for testing purposes 2 Continuous Activity Scheduling, Planning, Execution and Re-planning 3 Task Description Language

16 2.3 Autonomous Science Target Identification and Acquisition - ASTIA 5 on their features (e.g. shape, size and surface reflectance). The prioritization is done thereby with the weighted sums each detected characteristics. The rating values of the characteristics are predefined constrains integrated in the memory of the rover. The relevant target with the highest priority is then chosen as the most interesting goal for scientific investigation [7]. AEGIS was first uploaded to one of NASA s Mars Exploration Rover (MER) Opportunity in December 2009 in order to select targets for the narrow field of view Panoramic Camera, called PanCam. It is used to gain high-resolution color images of Martian sky and surface [8] to obtain geological and physical properties of Mars citeestlin2012. After quite some time, in July 2016, the AEGIS software was also uploaded to NASA s Mars Exploration Laboratory (MEL) rover Curiosity. Here the software is as well used to select targets of scientific interest with the navigation camera, but it points an other remote-sensing instrument, the Laser Induced Breakdown Spectrometer (LIBS) and the Remote Micro Imager (RMI) of Chemistry and Camera (ChemCam) instrument. The challenge compared with Opportunity is to select fine-scaled targets in order to point LIBS and RMI, since the diameter of LIBS is 0.3mm-0.5mm and the field-of-view of RMI is 1.15 [9]. 2.3 Autonomous Science Target Identification and Acquisition - ASTIA The European Space Agency (ESA) makes also first steps towards on-board autonomy with the intended ExoMars rover, which was planned to launch at first in 2018 and later changed to 2020 [10]. The British government agency, Science & Technology Facilities Council (STFC), developed an OASIS like system (2.1), called ASTIA. It will identify targets of scientific interests and analyze surface sample autonomously on-board. To reach the on-board autonomy, the ASTIA system is made up of several components: the Rock Identification Agent (RIA), the Knowledge based Science Target Identification System (KSTIS), the 3D Vision Agent and the Arm Agent [11]. After images are taken, RIA identifies the rocks with their relative centroids. This is an important key feature for the further investigation with the 3D Vision Agent, where the 3D coordinates of the target are extracted by stereo vision methods [11]. To rank the recognized targets according to their geological importances the KSTIS software is involved [12]. It is a fuzzy knowledge based expert system, developed together with experts from the field of geology. With respect to rock features (structure, texture and composition), KSTIS classifies detected rocks with Mamdani s fuzzy-set method. The output of KSTIS are Science Values (SV) for each detected target representing its importance [11], [12]. The Arm Agent makes it possible to collect samples with the intended manipulator

17 2.4 Multi-Rover Integrated Science Understanding System - MISUS 6 of ExoMars rover. The Arm Agent involves the inverse kinematics of the robotic arm, to reach the desired target for sampling purposes. 2.4 Multi-Rover Integrated Science Understanding System - MISUS In planetary missions a cooperation between several roves would increase new scientific discoveries. These rovers must have the ability to communicate and cooperate with each other to accomplish the entire mission. NASA is developing such a system, named Multi-Rover Integrated Science Understanding System (MISUS), to fulfill the imposed requirements. The essential requirements are highly autonomous rovers, to reach a maximum efficiency of rover operations with minimizing the communication with the ground station for decision making purposes. As a consequence, the rovers have to take their own decisions on-board. The ability of cooperations of multiple rovers will be provided by the MISUS software. It s main functions will be data analysis and distributed planning and scheduling. Data analysis will involve a machine-learning module to identify interesting features and discover them with setting new scientific goals. With this module the rocks can be analyzed and clustered regarding to their geological features. After clustering the investigated rocks, they can be prioritized relating to their importances, equivalent to the OASIS system (2.1). The main difference between MISUS and OASIS is given in the distributed planning and scheduling module. Similar like in OASIS the CASPER software will reschedule the mission plan if an interesting event or feature is detected. However in MISUS the planning software is divided in central planner, where one global mission is generated for all rovers and distributed planner, where each rover has a specific mission plan. Both modules are controlled by the continuous planning software CASPER. 2.5 Autonomous Sciencecraft Experiment - ASE Up to the recent past, spacecrafts were not able to take decisions autonomously on the basis of observations. Autonomy is an important feature for interplanetary and interstellar explorations, since phenomenas with a very short appearance period can be missed, due to the delayed command transmissions. The ASE software, developed by NASA, enables satellites to fulfill their missions completely autonomously. The autonomy involves to analyze scientific data and to plan the next steps of the observation [13]. To recognize unexpected events autonomously, the images are analyzed with respect to the differences of previous investigated images. Implemented

18 2.6 Project for On-Board Autonomy - PROBA 7 algorithms make it possible to detect events (e.g. melt of ice, lava flow) and to discover them. In oder to reach this autonomy, ASE is divided in the following components [14]: - On-board science algorithms: to analyze interesting events, features, - Robust execution management software: to make it possible to execute plans, - CASPER software to reschedule mission plans. Since 2003, the ASE software is uploaded to NASA s first spacecraft of the New Millennium Program, Earth Observing-1 (EO-1) [14], which was launched in the year 2000 [15]. The aim of this mission is to design and test new space application technologies [16]. EO-1 has a total mass 4 of 572kg [15] and is able to detect and discover dynamical events on Earth autonomously. Events of scientific interests for this mission are thermal anomalies, clouds, flood scene and changed environment [16]. As a result of on-board autonomy the down-link data for decision making is decreased and the down-link of highest science data is increased [16]. 2.6 Project for On-Board Autonomy - PROBA ESA is also willing to develop spacecrafts with on-board autonomy, which is the intension of the Project for On-Board Autonomy (PROBA) mission that is a part of the Technological Demonstration Program. With PROBA the operation by the ground station should be minimized. Actual flying spacecrafts of this mission are PROBA-1, PROBA-2 and PROBA-V and planned mission for the end of the year 2018 is the PROBA-3[17]. The first satellite PROBA-1, launched in October, 2001, is an Earth observation satellite with the aim to test and demonstrate on-board autonomy[18]. The provided autonomy of PROBA-1 includes low level operations and resource management, camera pointing and scanning based on input data 5, planning and execution of payload operations and communication with ground station[18]. PROBA-2 is the successor of PROBA-1 and was launched in November, 2009 [19]. The mission of PROBA-2 is Sun observation for space weather purposes. The autonomy of PROBA-1 is adopted and extended with an autonomous star tracker, named micro Advanced Stellar Compass (μasc). The last realized PROBA mission, PROBA-V was launched in May, 2013 and is able to detect and differentiate autonomously land and sea[18]. This mission was also adopted and extended based on previous PROBA spacecrafts. The V in PROBA-V stands for vegetation and therefore the interesting areas are lands. A land-sea mask, a given map where lands and seas are marked, 4 total mass is with propellant 5 the input data are geographical coordinates, latitude and longitude

19 2.7 Conclusion of the State of the Art 8 makes it possible to differentiate between land and sea autonomously on-board. The estimation from the actual position up to the position 10 minutes in the future is possible. The camera switching is done autonomously by the spacecraft by means of the land-sea mask. The switching ON of the cameras can be done either by detecting land or by passing through a predefined geographical coordinate. As usual in spacecrafts, a Failure Detection, Isolation and Recovery (FDIR) system is also on board of PROBA-V. Once an anomaly or failure is detected by FDIR and the spacecraft is in the autonomous observation mode (called nominal mode), the following three possibilities for isolation and recovery are given: - power cycle resource, - switch to redundant resource, - switch to system safe mode in case no redundant resource is available at that moment. If it is possible to overcome the anomaly with the first or the second solution, then the spacecraft will stay still in the nominal observation mode. The next planned spacecraft of the PROBA series is PROBA-3 and it will be the first step of the ESA towards formation flying. It is intended to launch two satellites in high elliptical orbits 6 to fly them in precise formation with accurate pointing capability [20]. Acquired knowledge form previous PROBA mission will be deployed in this mission as well, especially the on-board autonomy. 2.7 Conclusion of the State of the Art The research delivers the result, that both rovers and satellites have not the ability to handle autonomously in critical situation, e.g. an failure occurrence and event detection at the same time. Besides the autonomous navigation which is required in interplanetary missions, the autonomy of rovers are limited by target detection based on predefined features by experts. In case of on-board anomaly and detection of an event of scientific interest, the operators on Earth have to intervene. If e.g. a target is visible for a short time, a unique scientific measurement can be missed in this situation due to communication delay. The same problem is also given in EO-1 and PROBA satellites. Irrelevant what kind of strangeness the event has, e.g. the FDIR system of the satellites will change form observation mode into safe mode if the problem can not be fixed or the ground station have to interact with the satellites. Furthermore it is noticeable that intelligent systems are implemented up to now only in spacecrafts with high mass ranged from approximately 1000kg (e.g. Curiosity rover) to 100kg (PROBA-1). Spacecrafts with high masses are always coupled with high costs and therefore the mission is risk-aver. 6 high elliptical orbit: low altitude perigee and high altitude apogee

20 2.7 Conclusion of the State of the Art 9 Based on this research, it can be stated, that the spacecraft autonomy in critical situations is an unexplored area. Concluded to this investigation an untouched field will be addressed by designing an intelligent system for nano satellites, that will support the spacecraft with a decision in case of critical situations. As stated before, a critical situation is specified by concurrently occur of failures and unexpected events. The basic concept of target selection by rovers, where the features are rated by values, is taken up and will be applied in the designed system.

21 3 Theory In this chapter fundamentals will be presented and help to understand the designing process of the developed decision support system. In Section 3.1 the definition of an decision support system will be introduced firstly, followed by declaration of Prolog terms in Section 3.2. The theory of the applied multi criteria decision making approach, Analytical Hierarchy Process (AHP) is addressed in Section 3.3. This section involves the description of the used software Super Decision for the AHP method as well the reason why the AHP is preferred over the known simple scoring model. 3.1 Definition of Decision Support System - DSS Decision making is a challenging task especially in complex systems. Furthermore a right decision making involves always an expert in the process. A system which supports and improves the judgment of decision makers and experts is provided by a so called decision support system (DSS). The problems involving a DSS, are usually unstructured or semi-structured, meaning that the problem can change rapidly its state and is not predictable [21]. A DSS is able to provide rapidly decision, when it is required in time critical problems. A specific definition of a Decision Support System is not given, that leads to not clearly defined characteristics [21]. According to BURSTEIN (2008) [22], the main components of a DSS are the language system (LS), the presentation system (PS), the knowledge system (KS) and the problem-processing system (PPS). The LS defines the commands, which can be translated by the DSS, whereas in PS the output vocabulary of the DSS is defined. The KS involves all informations about the problem stored partially in a database. The last listed component PPS is a problem solver component of a DSS. Furthermore there exist several classifications of DSS frameworks like text-oriented, databaseoriented, spreadsheet-oriented and still more, which can be found in [22]. For this work a rule-oriented DSS is intended. In a rule-oriented or rule-based DSS, the decision is taken based on predefined rules. These rules can be either extended by humans manually or in case of artificial neutral network, the system can define rules based on actions and results. If the rules

22 3.1 Definition of Decision Support System - DSS 11 are extended by the system itself, than the system is called a learning system. A rule-based DSS is also categorized as expert system, since the experts knowledge is imitated in the rules [22]. This is used in case of the human expert is not available at the moment, if a time critical decision have to be taken [22]. An other factor for the absence of human experts are high costs, since a expert system can replace a human expert. The replacement underlines the difference between an expert system and a DSS, since in a DSS the expert is not replaced, but supported, whereas in expert system the expert is replaced. Rule-Based Decision Support System - Expert Systems The designed system in this work is a rule-based system and therefore a detailed definition of rule-based systems will be introduced. According to NEGNEVITSKY (2011) [1], the development of a rule-based system involves a domain expert, knowledge engineer, programmer and project manager. The domain expert is the person with a huge knowledge about the specific area gained by long-standing experiences. The knowledge of the human expert will be transferred to the expert system. The task of the knowledge engineer is to design and test the expert system based on the expertise of the human expert. His task involves also selecting the best programming language for the given problem. After this is done, a programmer with symbolic programming skills translates the knowledge in form of rules in a programming code. And the last member, the project manager guides the whole team and is the interface to the users. It is possible to reduce the number of the development team with using expert system shells. Expert system shells are software for developing rule-based expert systems with less programming skills than required. The knowledge can then be directly defined as rules. With such softwares a small rule based expert system can be developed also only by one person [1]. As mentioned before the developed DSS in this work is a rule-based system or also called production system. A production system is based on "IF-THEN" clauses, also referred to condition and action clauses [1]. The condition is made up of at least one object and one value. An example therefor is IF traffic light is red in which traffic light is the object and red the value. If the given object has the specified value then there is a consequence, called action. As well the action can be divided in two parts similar like in the condition part but does not require. It should be noticed, that the condition part requires at least one object and one value. The continuation of the above mentioned example for the action part is then THEN stop.

23 3.2 Logical Programming Language - Prolog Logical Programming Language - Prolog To develop a rule-based DSS, a logical and symbolical programming language is required. Prolog is the mostly used programming language for logic programming (Programming in logic). In this section a short introduction into Prolog is presented, where the essential Prolog terms will be introduced. Prolog is a declarative language, that is made up of three components - facts, rules and queries. Declarative programming languages are outlined with their abstract mode of expression of logical computations. Such languages enable domain experts to handle easier with the semantics of the program, since declarative languages do not focus on how a given problem has to be solved like imperative programming languages. They deal with the question what is the problem to be solve [23]. The user is able to ask the Prolog program question to solve the given problem of a specific domain. The posed questions to Prolog are called queries. With them it is possible to search through the facts and rules to deliver all correct and possible solutions. Prolog is a common used language in expert systems. According to BRATKO (2001) [24], a Prolog program consists of clauses, where each of them ends with a full stop. Types of clauses can be distinguished by facts, rules and queries. Facts have the head form and consist of a functor with a defined arity. Arity is the number of arguments related to a functor. The arguments can be either atoms (constants) or variables (general objects). Examples of facts are female(ann). parent(ann, bob)., in which the first fact has the arity 1, with the argument ann and the second fact has the arity 2 with the arguments tom and bob. The combination of a functor and arity is called predicate [25]. Predicates are either predefined by the Prolog system and called built-in predicates or are defined by the user as facts and rules, called user-defined predicates. The facts can be state as functor/arity, which are in the given examples female/1 and parent/2 [26]. The first fact is reading as "ann is female" and the second one "ann is parent of bob". These are user-defined predicates. One example of built-in predicate is the write/1 predicate,in which the argument of the functor write is given as an output on the console. Rules are made up of the form head :- g_1, g_2,..., g_n, in which head is the same head defined in facts, :- is the neck operator indicating the if clauses and g_1, g_2,..., g_n is the body of the clauses consisting of n-goals [27], [25]. An example of a rule is

24 3.3 Analytic Hierarchy Process - AHP 13 mother(x, Y):- parent( X, Y), female(x)., in which the arguments in the functor are in this case variables. A variable in Prolog begins either with a capital letter or with an underscore character [27]. The then clauses of an if-then are written in Prolog after the head of the rule. An and clause in Prolog is defined by a comma. The given exemplary rule is reading as, IF X is parent of Y and X is female, THEN X is mother of Y. Rules are stated as true if the goals predefined by facts are fulfilled, otherwise they are stated as false. A Prolog program can be extended by adding rules and facts without any problems. After facts and rules are set, the user can ask the implemented Prolog program questions. The question must be typed after system prompt, which is a question mark followed by a hyphen?-. The user does not need to type it manually, since Prolog generates it automatically on the console. A query is made up at least one goal, which has the same form as the facts. For the above introduced example of facts and rules, the question "is ann mother of bob?" can be asked with?- mother(ann, bob)., where the query ends with a full stop, since as mentioned before, it is also a clause. The rule defined above is applied and the answer of the Prolog system is true since the facts parent(ann, bob). and female(ann). are fulfilled. The variables X and Y are substituted by the atoms ann and bob respectively. Up until now, a Prolog implemented decision support system is not used in space related missions. In NOGUEIRA (2001) [28] an A-Prolog decision support system is designed for the Reaction Control System (RCS) of Space Shuttle. RCS is relevant for maneuvering the spacecraft, while it is in space. It is computer controlled during take of and landing, whereas during the flight it is controlled by the astronauts. Since in critical situations the astronauts have to communicate with the ground station, an intelligent system implemented in RCS would be helpful. Such a system was designed successfully and conformed the use of the declarative programming language, but it was not being used in a real mission ([28]). 3.3 Analytic Hierarchy Process - AHP There exist several types of decision theory techniques. The designed decision support systems are based on the Analytic Hierarchy Process (AHP). It is a concept for multi-criteria decision making and is developed by the mathematician Thomas L. Saaty [29]. With AHP it is possible to convert subjective evaluations into numerical values. Commonly this method is used in

25 3.3 Analytic Hierarchy Process - AHP 14 multi-criteria decisions, where applying AHP delivers the choice of the best alternative. Besides, AHP can be applied in wide range of decision making methods and one of them is the evaluation of the alternatives [29]. The AHP will be applied in the designed Èxypnos System to rate all possible failures and all possible events with a value. SAATY (2012) describes in [30], that the easiest way to structure a decision problem is a three level hierarchy that consists of the goal of the decision, criteria and alternatives. Figure 3.1 depicts such a simple three level Hierarchy. The aim of a hierarchy is to consider by the decision also the elements in the level linked above. The most challenging and creative part according to SAATY (2012), [30], is to define criteria in order to build the problem in a hierarchy. The criteria should consider the environment within the problem and the features influencing the problem. As illustrated in 3.1 the hierarchy does not have to be completed, it is possible that one element is not linked with all elements beneath, but at least with one. This not complete hierarchy exists, if the criteria are divided in sub-criteria and then linked to the alternatives. The decision making process AHP is based on relative measurements [31], in which one criterion, for example A, is compared pairwise with an other criterion, B [30]. Here the pairwise comparison is only done for homogeneous elements. For the comparison the so called fundamental scale is used, which is also defined by Saaty, [30]. With these pairwise comparisons a square matrix for the criteria or sub-criteria is set up. Out of the square matrix the eigenvectors of the principal eigenvalue is calculated. The calculated eigenvector represents the weighting of each criterion or sub-criterion. This was only a rough overview of the AHP, a detailed description follows in the next subsection. Figure 3.1: Three Level Hierarchy of the Analytic Hierarchy Process.

26 3.3.1 Detailed Approach of the Analytical Hierarchy Process 15 Table 3.1: The Fundamental Scale according to [30]. Intensity of Importance Definition Explanation 1 Equal importance 2 Weak Moderate 3 importance 4 Moderate plus 5 Strong importance 6 Strong plus 7 Very strong 8 Very, very strong 9 Extreme importance Two activities contribute equally to the objective Experience and judgment slightly favor one activity over Experience and judgment strongly favor one activity over An activity is favored very strongly over another; its dominance demonstrated in practice The evidence favoring one activity over another is of the highest possible order of affirmation Detailed Approach of the Analytical Hierarchy Process In this section the AHP will be explained step by step. An application of the method can be found in 5.2.2, in which AHP is applied to evaluate the power subsystem failures by numerical values. Step 1. The first step is to divide the given decision problem into levels consisting of a goal, criteria, if appropriate sub-criteria and alternatives. As mentioned before this part is the most creative part to solve. The relationship between the levels is given with the connections to the above element, which is illustrated in 3.1. In case of classifying the criteria further into sub-criteria, there would be an additional level between criteria and level for sub-criteria. In this case the criteria will be linked to the sub-criteria and these in turn will be linked to the alternatives. Step 2. The next step is to compare each criterion and if defined sub-criterion pairwise. This comparison has to be done for homogeneous elements. This means all criteria are compared with each other, whereas all sub-criteria related to one criterion are compared pairwise. Comparing sub-criteria across criterion is not given and does not make sense. The comparison is scored with the fundamental scale (3.1). In the most cases the pairwise comparison is done by experts or decision makers. It should be noticed that the pairwise comparison of the alternatives should

27 3.3.2 Super Decision Software 16 also be done with respect of the connected criteria or sub-criteria. Step 3. Out of the pairwise comparison a square matrix, named comparison matrix, is set up, which diagonal entries are one. The other elements are based on the pairwise comparison. Lets say i is the row of the matrix A and j the column. If the i th element is stronger than the j th, then the entry in the matrix A at the position (i, j) is larger than 1. The element at the position (j, i) is given by its reciprocal. But if the j th element is stronger than the i th element j, then entry at the position (i, j) is the reciprocal of the value, which states the importance of the element j based on the fundamental scale. And as well here the element at the position (j, i) is given by its inverse. Step 4. The comparison matrix is build to derive the priority vector, w. This is done with the aid of eigenvector and eigenvalue method. The eigenvector of the principal eigenvalue is the priority vector w. How the eigenvalues ad eigenvector are derived will be not explained in this work but can be found in [31]. However by applying the AHP method a software (like Expert Choice or Super Decision) is usually used, in which eigenvalues and -vectors are derived. Step 5. In order to check the consistency of the pairwise comparison done in step 2, the consistency ratio CR has to be calculated. It is the ratio of the consistency index CI and the random index RI. CI is given by CI = (λ max n), (3.1) (n 1) in which λ max is the maximum eigenvalue and n the order of the comparison matrix. RI is the average estimation of CI of randomly generated matrices and can be found in [31]. If the calculated CR is larger than 0.1 it exhibits the inconsistency of the pairwise comparison. Step 6. In the last step all values of connected criteria, sub-criteria and alternative are multiplied, which provides the evaluation of each alternative respectively to the rating of the criteria and alternatives Super Decision Software Due to the complexity of the Analytical Hierarchy Process, a software is necessary, which delivers the priority vectors described in previous subsection. In this work the Super Decision software is used. The hierarchic structure of the problem and their connections are done by the user himself, as well the pairwise comparison of homogeneous elements. The Super Decision software generates during the pairwise comparison the comparison matrices and calculates the related priority vectors with their inconsistencies. There is no requirement to derive the

28 3.3.2 Super Decision Software 17 eigenvector of the principal eigenvalues manually, which represents the priority vector. Since there are many matrix multiplication, it is useful to involve a software, which is either self implemented or already existing. There are several softwares for the AHP, but Super Decision is a free educational one. In this subsection a short introduction to the Super Decision software will be provided. A detailed tutorial of the Super Decision software can be found in [32]. The levels goal, criteria and alternatives are named in Super Decision software clusters. A cluster consists of elements, also called nodes. If a cluster is linked with a line to an other cluster, than the elements within the clusters are connected. It is possible to check which elements are connected by the Show Connections icon. The goal and criterion clusters can be named arbitrarily, whereas the alternatives cluster must involve the word "Alternatives". Figure 3.2 illustrates a sample model of a car hierarchy, which can be loaded by the data name Ca_hierarchy.sdmod. E.g. the cluster 2Criteria consists of the four elements 1Prestige, 2Price, 3MPG and 4Comfort. All these elements are connected to the elements of the 3Alternatives cluster. As well the Goal Node element in the cluster 1Goal is linked to the elements of the 2Criteria cluster. After all clusters and elements are build and linked, the pairwise comparison of elements within one cluster with respect to the connected element can be done. The pairwise comparison will be made for explained sample model Car_hierarchy. The pairwise comparison can either be done directly in the comparison matrix illustrated in 3.3 or in the so called questionnaire, which is depicted in 3.4. Both alternatives deliver the same result as it can be see in the figures on the right hand side in the part 3.Result. This is the priority vector for the done comparison, in which on the top the inconsistency is given. The same part is as well involved in the questionnaire comparison. In Figure 3.3 the blue colored values indicates the dominance of the elements on the left hand side, whereas the values written in red indicates the dominance of the elements listed on the top. During the pairwise comparison the priority vector is generated step by step. The inconsistency is increasing with increasing number of already done comparison. This can help the user of the software to control the inconsistency and not exceed the value of 0,1. For the pairwise comparison the fundamental scale (3.1) is used. In the questionnaire if the element on the left hand side (blue) is more important than on the right hand side (red), than the scoring is done on the left scale. Inversely if the element on the right is more important, than the scoring have to be done on the right hand sided scale. Anyway which comparison method is chosen (matrix or questionnaire), as mentioned before both will supply the same priority vector and the same inconsistency. If all pairwise comparisons of each element within a cluster are accomplished, the weighting of the alternative elements can be obtained. Therefore the Synthesize icon have to be selected in the software. A window will appear in the screen, which is depicted in 3.5. In this window the ratings off the defined alternatives are presented. For the design of an DSS only the columns

29 3.3.2 Super Decision Software 18 Figure 3.2: Shortcut of a Sample Model, Car Hierarchy, from Super Decision software. Figure 3.3: Shortcut of Pairwise Comparison Window with Comparison Matrix.

30 3.3.3 Advantages of AHP over the Simple Scoring Model 19 Figure 3.4: Shortcut of a Pairwise Comparison Window with Questionnaire. Normals and Ideals are of interest. The first one represents the priority vector mentioned in 3.3. The second one involves the normals values divided by the maximum Normals value. In this example the maximum Normals value is given by the alternative 3Honda Civic, thus the Ideals value leads to 1,0. It should be noticed, that entire scores are given in percentages, both the priority vector resulting after the pairwise comparison and the priority vector of the alternatives (Normals). As a result the Ideals are as well given in percentage. The purpose of Ideals is to rate the best alternative with 100,0%, but the proportions remain the same as in Normals. The analysis delivers in this case that the alternative 1Acura TL is 75,58% as good as the alternative 3Honda Civic and 2Toyota Camry is 43,95% as good as 3Honda Civic Advantages of AHP over the Simple Scoring Model In this section a brief explanation will be given, why the AHP is preferred over the simple scoring model. With the simple scoring model, the intuitive scoring of criteria by experts and summing them up for the ranking of the alternatives, is meant. The AHP approach for multi criteria decision making does not only involve the intuitive weighting of the given criteria, there are mathematically calculations behind it. Whereas the simple scoring model is based only on subjective judgments and basic mathematics (multiplying and summing). In both methods the ranking will be in the same order. For the purposes of the designed expert system not the ranking is of importance, but rather the rating of each alternatives. With AHP the evaluation of each alternative are preciser and more significant than in the simple scoring model. However due to pairwise comparisons the AHP approach is

31 3.3.3 Advantages of AHP over the Simple Scoring Model 20 Figure 3.5: The Scoring of the Alternatives of the Car_hierarchy Sample Model. more time consuming than the simple scoring model. Furthermore the inconsistency factor, provided by AHP, method leads to overcome mismatches of the criteria ratings. Discrepancies of criteria ratings are given if e.g. the criterion A is more important than B and B is more important than C and C is more important than A. Based on this advantages instead of applying the simple scoring model, the AHP is selected as the multi criteria decision making approach for the intended intelligent decision support system.

32 4 Spacecraft Mission Design Before the rule based decision support system can be designed, a satellite mission has to be created. In this work the hypothetical space mission is invented and will be presented. The satellite of this mission has the name ÈxypnosSat, which is composed of Èxypnos (derives from the Greek and means intelligent) and satellite. The fictional ÈxypnosSat is based on SONATE, which is currently in development by the University of Würzburg and will be launch in 2019 [4]. It should be noticed that the design of the mission is simplified and not detailed. It serves the purpose to develop a decision support system for a nano satellite. The invented ÈxypnosSat is a nano satellite for earth observation and has the aim to test and develop high-level on-board autonomy for future interplanetary or interstellar missions. ÈxypnosSat must demonstrate the ability to detect and investigate not predictable events on and around Earth. If an anomaly of the spacecraft monitored and an event is detected at the same time, than the satellites have to decide between fixing the failure or investigating the event. Thereby the decision is influenced by the impact of the failure and the importance of the event. Since it is a first step towards high-level autonomy, it is an earth observation mission. Greater benefits can be obtained in interplanetary and interstellar missions. Because in common missions the decision is taken by the operators on Earth and with increasing distance between spacecraft and ground station, the communication delay is also increasing. As a result unpredictable and short lived events will be missed, that maybe will never occur. A short overview of the SONATE mission will be given in Section 4.1 and afterwards the design of ÈxypnosSat will be presented by firstly defining its orbit in 4.2 and then specifying the subsystems together with their related components in SONATE Typically spacecrafts are controlled by the ground station. The spacecraft transmits to the ground station telemetry data and based on these the operators informs the spacecraft about the next steps via telecommand. Within the Earth orbit this leads to no complications. But in

33 4.2 Orbital Design 22 interplanetary missions, e.g. Mars mission, the communication between ground station and spacecraft will have a large delay due to the distance. This can lead to miss the not predictable event, with a short-time occurrence. This problem can be solved with an autonomy on-board the spacecraft. The key mission of SONATE is to increase the on-board autonomy. This will be done by autonomously detecting not predictable events and rescheduling the command sequence to not miss the event. Furthermore it will be able to detect, analyze and forecast on-board anomalous that will occur in the future [4]. The nano satellite, SONATE, is been currently developing by the University of Würzburg. The operational of SONATE is set to one year and its aim is the in-orbit verification of the Autonomous Diagnosis System (ADIA) and the Autonomous Sensor and Planning (ASAP) system [4]. Both systems are described in Section Further components for in-orbit verification are reaction wheels, AROS (4.3.3) and SSTV camera (4.3.6). 4.2 Orbital Design The design of a spacecraft orbit does not offer any strict specifications, but for earth observation it is obvious to select as an orbit type the Earth-referenced orbit for Earth coverage [33]. Due to the fact that a polar orbit can cover the Earth nearly global [34], a polar orbit is chosen for ÉxypnosSat mission. The orbit of a spacecraft and its position is uniquely defined with the six Keplerian elements (also known as orbital elements). The meaning of each orbital element will be not declared in this section, but can be found in [33]. A typical polar orbit has an altitude of approximately 700km and an inclination of approximately 95. Since for the first approach of the decision support system the elements are not required and therefore they will be not defined in this work. 4.3 Spacecraft Subsystems More important than the orbit design for the decision support system are the subsystems of the spacecraft. Due to this fact, the subsystems will be explained in more detail. A spacecraft is divided in several subsystems and they are interdependent [35]. To have a fully functional satellite, each subsystem have to fulfill at least its purposes. The subsystems are differentiated between payload and satellite bus. The payload is individually specified for each spacecraft according the defined mission to fulfill it and therefore are the sole reason to get a satellite into space. The payload is not functional without the satellite bus, therefore its task is to enable

34 4.3.1 On-Board Computer - OBC 23 the payload to accomplish the mission and keep it healthy. In general a spacecraft s satellite bus consists of six different parts: 1. On-Board Computer - OBC 2. Power System 3. Attitude Determination and Control System - ADCS 4. Thermal Control System 5. Telemetry Tracking and Command System - TT&C 6. Structure and Mechanism. The structure and mechanism subsystem is not considered in this work for simplification purposes. In the following sections all other subsystems ( ) and the payload of ÉxypnosSat will be described in more detail with their related components (presented in Figure 6.1).The most critical and error-prone components of subsystems are redundant, in order to enable the spacecraft reaching the intended. In Figure 6.1 the number of redundant elements of the components is given in the brackets. In case of no brackets, non redundant element is available. According to WERTZ (1999) [33], spacecraft redundancy can be categorized in either same design redundancy or functional redundancy. Same design redundancy is given if minimum two identical components exists and at least one of them is active. FORTESCUE (2011) [34] divides the same design redundancy in standby redundancy and active redundancy. In standby redundancy, the redundant element is turned off until the active element fails. In case of active redundancy all components are active and are sharing the load. If there occurs disagreements between active redundant elements, a voting process is applied. If there are no identical redundant elements but elements pursing the same aim, then a functional. One simple example for functional redundancy is the high gain and low gain antenna, since both are transmitting telemetry and receiving telecommand (but with different gains). It should be noticed that functional redundancies are not outlined in the figure 6.1. In the following subsections each subsystem will be presented On-Board Computer - OBC The key subsystem, that controls the spacecraft is the on-board computer. It has a processing capability and is linked to all other subsystems through their components. The OBC runs the on-board software to enable the remote operations, to control functionalities and to monitor of the health status of the spacecraft. Moreover the OBC involves the components processors, memories and the software. The processors are the cores of OBC and are responsible for all calculations and algorithm implementations and as known from the usual memories on Earth,

35 4.3.2 Power System 24 Figure 4.1: Subsystems of ÉxypnosSat the function of the memories in satellites is also to store data. It is an important component, since during the time in which no contact to the ground station can be established, all collected data are saved on the memories. Typically a spacecraft consists of more than one memory type [3]. The boot loader for the OBSW is stored in the boot memory, which is non-volatile ROM. The on-board software is stored in the work memory and the storage of the spacecraft s health status takes place in the safeguard memory. Since the satellite has not permanently contact with the ground station to transmit telemetry and scientific measurement data, until a broadcast takes place these are stored in the science and housekeeping data memory [3] Power System The power system gives inanimate subsystem "life", since the main function of it is to provide the subsystems with energy. A common power system is composed of three main components - primary energy source, secondary energy source and Power Control and Distribution Unit (PCDU) [34]. The primary energy source in ÈxypnosSat mission is solar arrays. They are converting the gained solar energy into electrical power. During the sun light duration, the

36 4.3.3 Attitude Determination and Control System - ADCS 25 satellite uses the energy directly from the solar panels and charges the secondary energy source - the batteries. If the satellite is in eclipse duration, then the batteries will provide power to the subsystems. The PCDU decides about the switching between solar arrays and batteries, energy distribution to other subsystems and charging the batteries [34] Attitude Determination and Control System - ADCS It is important to know the position and orientation of the spacecraft, to orient, e.g. the payloads to the desired position to fulfill the mission or the solar arrays towards sun to gain energy. These requirements are met with the attitude determination and control system (ADCS). Sensors enable the orbit determination and actuators the orbit control, whereby a distinction between reference sensors and inertial sensors are made. References sensors measure the direction of the spacecraft relative to earth with reference points, like sun, stars or earth s magnetic field lines, whereas inertial sensors measure only the change of spacecrafts attitude [34]. Therefore an inertial sensor have to collaborate at least with one reference sensor [34]. In ÈxypnosSat sun sensors, star sensors and magnetometers are used as reference sensors. Sun sensors are implemented to determine the direction of the sun in order to orient the solar arrays towards sun. Only sun sensors are not enough to determine the pose of the spacecraft. Therefore additionally star sensors, magnetometers and gyroscopes are used. Star sensor can determine the pose of the spacecraft with high accuracy by using suitable star images and a star catalog. Usually star sensors have a high mass, big size and a high-level of energy consumption [34]. Therefor a star sensor, that suitable for nano satellites is required. Within the AROS project such star sensors are been currently developing by the University of Würzburg. The star tracker AROS is intended for ÉxypnosSat for precise attitude determination. Another type of reference sensors for attitude determination are the magnetometers. It provides both the magnitude and the direction of the magnetic filed relative to Earth. Indeed magnetometers are light and have a low power consumption but they are inaccurate. For the invented mission only one inertial sensor type, the gyroscope, is intended. A gyroscope enables the measurement of spacecraft rotation starting from an initial start position. As described previously a gyroscope alone is not able to gain information about the position relative to Earth, hence it has to be combined with a reference sensor, e.g. magnetometer Thermal Control System The components within the spacecraft can survive during the whole mission, if the required temperature intervals are not exceeded. The thermal control subsystem ensures, that the

37 4.3.5 Telemetry, Tracking and Command System - TT&C 26 temperature in the satellite is kept between these intervals. With respect to different subsystems, there is a distinction to be made between survival limits, which are always valid and operational limits, which are valid during operational mode [33]. The temperature in the spacecraft is measured with thermal control sensors. The temperature is maintained passive and active. Passive thermal control is done by the design of the spacecraft, mechanical structure and materials (e.g. insulation) and does not need any kind of energy, whereas active thermal control requires energy. The active thermal control is simplified for the ÈxypnosSat mission and only an electrical heater is intended Telemetry, Tracking and Command System - TT&C The communication between the spacecraft and the ground station is realized through the telemetry, tracking and command system (TT&C ). The payload data and health status of the spacecraft are transmitted to ground station (also known as telemetry) and commandos from the ground station are received by the spacecraft through the transceiver component. The signal can either be transmitted/received by a high gain (HG) antenna or low gain antenna (LG). A high gain antenna transmits a signal with a higher amplification, but with smaller beam width. As a consequence the antenna has to be directed with high accuracy towards the ground station. Vice-versa a low gain antenna transmits a signal with a broader beam width, but a lower amplification. Usually a spacecraft owns both antennas, since a high gain antenna is required to transmit large amounts of data and a low gain antenna is necessary, in case of emergency (e.g. high gain antenna failed or can not point to ground station due to ADCS failures). Therefore low gain antennas can be seen as backup antennas and should be distributed equally around the satellite in order to be always able to communicate with the ground station during the contact duration. The ÈxypnosSat consists of transceiver, high gain and low gain antenna, whereby transceiver and low gain antenna are double-redundant (same design) and the high gain antenna is not redundant Payload Payloads are required to accomplish the specified mission and are uniquely developed for each mission. It exists several payload types for different mission purposes. Since ÈxypnosSat is an Earth observation satellite, remote sensing payloads are appropriate. The intended remote sensing payload in the invented mission is a slow scan television (SSTV) - camera for imagining earth s surface and near-earth space. SSTV is a way to transmit static images, in this case, to the ground station. Thereby the images are transfered through the transceiver as audio signal. The modern SSTV features allow to transmit monochrome images as well color images with

38 4.3.6 Payload 27 high quality. Another payload on-board of ÈxypnosSat is an autonomous on-board decision-making system - ASAP, which is currently been developing at the University of Würzburg. It detects unexpected events and reschedules the plan in order to investigate it. By means of ASAP even short-lived phenomenas will be not missed by the spacecraft, since in common spacecraft missions the operation schedule is changed delayed only by the ground station and only during contact duration [36]. ASAP consists of an imager and planning system. The task of the imager is to detect not predictable events by detecting the changes of captured images. If an event is detected, the ASAP planning system assists by rescheduling the operational plan of the spacecraft [4]. However in the ÈxypnosSat mission there is only one camera implemented for ASAP and observations. ASAP is one of the essential components of the designed decision support system for the ÈxypnosSat. Its task is to detect unexpected events, as described and forward them to the DSS as an input, which will be described in more detail in Section 7.1. The last payload set in the ÈxypnosSat mission is the Autonomous Diagnosis System for Satellites - ADIA++. Its task is to recognize failures and anomalies of the spacecraft autonomously on-board and to determine their causes. At the moment ADIA++ is been as well developing at the University of Würzburg [37]. It is another essential payload for the design of the decision support system and delivers additional input to it. Details about the input delivered by ADIA++ will follow in chapter 7.

39 5 Definition, Analysis and Evaluation of Spacecraft Failures For the decision making, the degree of impact of spacecraft failures have to be expressed in numerical values, which will be done in this chapter. The process to convert the failures in numerical values is divided in three main parts: defining, analyzing and evaluation. The definition of on-board failures will be provided in Section 5.1. Based on this, failures are analyzed in Section 5.2 with respect to their effects on the payload, satellite bus and the whole spacecraft and mission. Furthermore the effect on investigation of the event will be included in the analysis. In the last section the AHP method will be applied to rate the failures with numerical values according to their degree of impact. It should be noticed, that the definition, analysis and rating of failures are provided for all subsystems specified in 4.3. But a detailed description of the power system is presented in this chapter. The remaining subsystems analysis and rating can be found in the appendix. 5.1 Definition of Failures In order to be able to determine the degree of impact of each failure, anomalies which can occur in a spacecraft have to be defined and analyzed. To define and analyze all kind of possible spacecraft failures, it would go beyond the scope of this work. Therefore a few failures for each subsystem s component will be exemplary presented. Moreover in this work launch failures will not be taken into account, only failures that can occur during the operation in orbit. After failures are specified together with their consequences, the Analytic Hierarchy Process will be applied to assign a value for each failure, named degree of impact, which indicates the total impact of each failure. It includes effect on the spacecraft, as well the effects of investigation on the detected event. As a first step failures will be generally described a then assigned to each component of a subsystem. According to TAFAZOLI (2009) [38] failure types are generally divided in mechanical, electrical and software failures. Mechanical failures are caused by mechanical loads like heat, stress, external forces, friction or pressure variation. Power overload, short circuit

40 5.1 Definition of Failures 29 and anomalous battery depletion can cause electrical failures. The last failure type, software failures are triggered by programming errors or by incorrect commands sent from the ground station. A wide literature research of [39], [38], [40], [41], enabled to gather spacecraft failures from past and ongoing missions. Tables , separated by subsystems and components, contain the failures which are taken into account for the developed decision support system. Errors which occur in several subsystems and are not self-descriptive will be described first generally. Additionally the possible corrective measures of these failures will be addressed for further analysis. Specific failures, which can occur only in the given subsystem, will be defined in the Subsections A common spacecraft failure that can affect all subsystems is the Single Event Effects (SEE). The trigger of SEE are single charged particles of ionizing radiation, that can cause failures on the affected component. According to the impact, SEE can be distinguished between soft and hard errors. Temporary failures are soft SEE, whereas permanent and destructive errors are hard SEE [33]. With respect to their effects, SEE is divided in three different types. Single Event Upset (SEU), also known as bit-flip, causes change state of the device and thus is an soft error. If critical parts of the spacecraft are affected, e.g. control system and decision making logic, the soft error can grow to a hard error. SEU is correctable with EDAC 1 [33], [3]. Another type of SEE is Single Event Latch-up (SEL), where its impact leads to an excess current flow in the affected component. Due to its effect, SEL is categorized as hard SEE. If no correction measures are carried out, it can cause permanent failures or even lead to Single Event Burnout (SEB). SEB appears if the over current is also too high for the power supply. This effect leads to destruction of the device. The corrective measure of SEL and SEB is to turn immediately the power OFF of the affected devices. Multiple Bit Upset (MBU) causes also change of state, similar like SEU, but with more than one bit-flips. In this case, the multiple bit-flips can only be corrected with algorithms. Another failure which can occur in several subsystem components is the Electrostatic Discharge (ESD). It is caused either by spacecraft charging or by the charge accumulated over the years [41]. ESD can occur unexpectedly and lead to anomalies in the spacecraft operations [41]. The only possibility to handle the error is to reset the power, in order to prevent a total destruction of the device. In the following subsections, the the spacecrafts failures of the six explained subsystems in 4.3 will be presented. A summary of subsystem failures will be given in separated tables. 1 EDAC - Error Detection and Correction: Algorithms to detect and correct a single bit-flip.

41 5.1.1 OBC Failures OBC Failures Processor. A failure which is known from usual computers, used in daily life, is the overheating of the processors. This can also happen to the processor implemented in OBC. Generally it has not an immediate effect on the system, but it leads to a degradation of the spacecraft life time. It is possible to overcome this failure with cooling. Another failure in the processor is the electrical power surge, which is a high spike in the voltage. This can lead to a damage of electronic devices and thus lead to degradation of spacecraft life time or even loss. Since it happens in a extremely short time, it is not possible to patch. Hardware (HW) traps are, e.g. not correctable (by EDAC) SEUs in the register file [3] and must be corrected from the ground station with software patch. HW traps can provide wrong calculations or in case of trying to access the register having errors, a software crash can occur. A malfunction of the processor will lead either to an extremely high degradation of the spacecraft life time, if the processor is redundant or to total loss of the spacecraft, if the processor is not redundant. Memory. It is possible, e.g. due to high radiations, that instead of total memory outage, only a few memory chips fail. If the software tries to access these addresses, it will crash. To overcome this problem the operators have to change the hardware configurations. A total loss of the memory (malfunction) means also the loss of the spacecraft. Software. Even if the software is tested many times before launch, it still can have bugs. Past missions demonstrated, that common bugs are mostly sign error.harland (2005) [40] describes such occurred events in the TIMED and TERRIERS spacecrafts. The problem was compass confusion, which had an impact on the magnetometers and consequently on attitude determination. This resulted in a loss of orbit control. The error was later fixed by software updates. A software error can be generally overcome with a software update and should be done before the mission ends catastrophic Power System Failures Solar Array. The efficiency of solar arrays will degrade over a long period time, which is caused by the Total Ionizing Dose (TID) in the radiation environment. TID is the charge build up in the spacecraft, caused by the bombardment of charged particles[41]. The effects of efficiency degradation are not immediately noticeable, but with increasing time the solar arrays will provide less energy to the spacecraft. There is no chance to overcome this failure after the spacecraft is launched, therefore it has to be considered during the design. If all solar arrays will fail (malfunction), the loss of the spacecraft will enter. Since without solar arrays it is not possible to supply the spacecraft with power.

42 5.1.3 Thermal Control System Failures 31 Table 5.1: OBC failures Subsystem Component Failure on-board computer processor memory software overheating electrical power surge hardware traps soft SEU,MEU hard SEU, MEU malfunction soft SEU,MEU hard SEU, MEU fail of memory chip malfunction software errors Battery. An extremely hard power system failure is the exlosion of the batteries, which leads to the total loss of the satellite [40]. This can be caused e.g. by high temperatures, since the batteries of spacecrafts are composed of temperature dependent chemical systems, like usual batteries. It is obvious that no possibility is given to overcome the explosion. Another possible failure of the batteries is the fail of a few battery cells. The outcome of this is a less power availability, if the spacecraft passes through the eclipse duration. Thus the operations of the satellite can be limited during this time period. PCDU. The failure overcharging or deep discharging in PCDU can lead to a damage of the batteries. This error can be handled by software patches. A malfunction of the PCDU will also lead to the loss of the spacecraft, since no power can be obtained by the solar arrays and therefore no power can be supplied to all other subsystems Thermal Control System Failures Thermal Sensor. If it happens that all thermal sensors malfunctioned, the spacecraft will end in a catastrophic condition leading up to the loss of it. It would not be possible anymore to indicate the temperature of the spacecraft, which would deliver no or extremely wrong temperature control. Electrical heater. The temperature in the operating spacecraft is regulated by controllers, that is realized with software. Also in this component it is possible to have software failures. This would guide the spacecraft and all it subsystems into a critical state. Like all software bugs,

43 5.1.3 Thermal Control System Failures 32 Table 5.2: Power System failures Subsystem Component Failure power system solar array battery PCDU ESD efficiency degradation/ outgassing SEL SEB malfunction SEE explosion due high temperature fail of a few battery cells malfunction overheating SEE malfunction this error can be overcome with software updates. Mechanical failures of the electrical heater can also lead to incorrect thermal control with the consequence damaging the devices. The result will be the degradation of the spacecraft mission life time. In this case it is not possible to repair the defect. If no active thermal control is possible anymore due to malfunction, the effect on the system would be the loss of the spacecraft, since only the passive thermal control is not enough. Mechanical Design. Failures occurring in the mechanical design of a satellite are not repairable. Such failure can be caused by orbital debris, out gassing and relays of cable or structurer part due to poor design. Table 5.3: Thermal Control System failures. Subsystem Component Failure thermal control system thermal sensor electrical heater mechanical design SEE, ESD malfunction software failure SEE, ESD mechanical failure malfunction mechanical failure

44 5.1.4 ADCS Failures ADCS Failures Sun Sensor. It is possible that the sun sensors deliver anomalous output, which will lead to point the solar arrays not correctly towards sun. HARALD (2005) [40] mentions the TOMS-EP 2 spacecraft, in which the output of its sun sensors was incorrect. The release of this problem was the cross wiring of two sun sensors. This problem was cope with a software update by switching the sun sensors by the software. In case of anomalous outputs of sun sensor, the failures can be tried to patch with software updates. The total loss of all sun sensors (malfunction) does not mean the total loss of the spacecraft, because the satellite will able to detect the position of the Sun with other attitude determination sensor, e.g. star tracker. Star Tracker. Attitude determination with star tracker is done with a camera, suitable star catalogs and algorithms. As well in star sensors the possibility is given to have bugs in the software (software failures). Like all software failures, star tracker failures can be handled with a software patch. If all other functional redundant components of attitude determination have also failures or failed already, then the error in the star tracker must be corrected immediately, before the attitude control is lost. Since the loss of attitude control would lead to loss of the mission. The star trackers can be affected by the solar storm resulting in loss of sight (blinding during solar storm). One example therefore is the Genesis 3 spacecraft. It was exposed to a strong solar storm [39]. Genesis survived this time period, but tracking of spacecraft attitude was not possible with the star tracker during the solar storm. No possibilities of intervention is given for this kind of anomaly. The malfunction of all star trackers would lead to inaccurate attitude determination resulting also in inaccurate attitude control. If the case arises that all attitude sensors failed included the start tracker, total loss of the mission will occur. Gyroscope. Since the gyroscope is also based on software, bugs in this component may occur. If no same design redundancy is given, the failure will be result in a weak pointing of the camera. And here as well the problem can be tried to solve with software updates. Malfunction of all gyroscope means not necessarily the total loss of the spacecraft. In [40] an example is given for a gyroless spacecraft, the BeppoSAX 4. Magnetometer. A disturbing factor in magnetometers is external magnetic filed. Similar like the solar storm effects the star tracker, magnetometers are effected by this phenomena and delivers incorrect attitude determination, which will lead to incorrect control. Also in this case the problem can not be solved, but it is a non permanent error. If all magnetometers and its functional redundant elements will fail (malfunction), then attitude determination will be not possible anymore. This will lead to the loss of spacecraft attitude control and consequently to 2 TOMS-EP: Total Ozone Mapping Spectrometer in NASA s Earth Probe series. 3 Genesis: NASA s sample return mission to collect probes of solar wind. 4 BeppoSAX, X-Ray astronomy of ASI (Italian Space Agency) and NIVR (Netherlands Agency for Aerospace Programmes)

45 5.1.5 TT&C Failures 34 the loss of the mission. Thruster. The Thrusters are controlled as well with software, therefore bugs are as well in this component possible (software failures). If the thrusters act incorrect due to software failures, the spacecraft will tumble and attitude control will be lost. Also if only one thruster of two fails during the operation, the satellite will be in an imbalance and it will tumble. Due to the chemical compositions in the thrusters, explosion of the thrusters can occur. Obviously the total loss of the spacecraft is not preventable in this case. Magnetic Coils. A software failure, e.g. compass confusion in the magnetic coils, can end catastrophically for the mission. The control of the spacecraft would be either totally incorrect or even lost. In this case a software update has to be done immediately to overcome a disaster. Malfunction of the magnetic coils, when all its redundant elements (both same design and functional) already failed, would end with the loss of the spacecraft. Reaction Wheels. A significant failure of reaction wheels is the problem of drifting. This error would lead to the slightly loss the control of spacecrafts attitude. Before this point is reached, power reset has to be done. A total loss of all reaction wheels will lead to the loss the mission, if already all functional redundant elements failed before TT&C Failures Transceiver. The transceiver is one of the most important components of the spacecraft to stay in contact with the ground station. Its permanent outage (malfunction) implies no communication possibilities between the spacecraft and the ground station. This leads obviously to the total loss of the spacecraft, since commanding the spacecraft would be not possible and in case of a totally autonomous spacecraft, receiving scientific payload data would be omitted. High Gain Antenna. The high gain antenna has to be point with a high precision to the ground station in order to be able to transmit or receive data. If there exists an antenna pointing problem, e.g. due to software failures, the transmission and receiving of large amounts of data will be difficult and time-consuming or even not possible. This problem can be solved with software updates, as soon the communication is possible (e.g. with low gain antennas). Equivalent to the transceiver, the malfunction of the high gain antenna would lead to loss the satellite and consequently the mission, if its functional redundant components already failed. Low Gain Antenna. In emergencies the spacecraft will be not able to communicate with the ground station without a low gain antenna. For example in case of incorrect attitude determination and control, pointing of the high gain antenna would be not possible even if its

46 5.1.6 Payload Failures 35 Table 5.4: ADCS failures. Subsystem Component Failure attitude determination and control system sun sensor star tracker gyroscope magnetometer thruster magnetic coils reaction wheels anomalous outputs malfunction software failure linding during solar storm SEE malfunction anomalies, software failure malfunction external magnetic field SEE software failure malfunction software failure explosion malfunction SEE, ESD software failure malfunction software failure drift SEE, ESD malfunction still working. This means in worst case the malfunction of the low gain antenna will lead to the loss of the spacecraft Payload Failures ADIA++. If bugs (software failure) are detected in ADIA++ systems, they have to be patched immediately. It will effect the whole mission and may end in a disaster, if the failures are incorrect or not diagnosed. For example if a repairable error is not detected, the spacecraft will operate incorrect and the failure can arise up to a not repairable failure or release other failures. Since one input of the designed decision support system is delivered by ADIA++ (7), the failure will have a major impact on the decision system as well.

47 5.2 Analysis of the Defined Failures 36 Table 5.5: TT&C failures. Subsystem Component Failure tracking, telemetry & command transceiver high gain antenna low gain antenna malfunction antenna pointing problem malfunction SEE malfunction ASAP. Another input of the decision support system is the information about the detected events, provided by the ASAP system. An erroneously detect event due to software failures will risk the spacecraft for absolutely nothing. The reason is, that in case of an extremely high important event the decision support system will decide to investigate it, without considering the failure. Similar like the failures in ADIA++ system, it has to be corrected instantaneously with a software update. SSTV Camera. Failures in the SSTV camera can effect the loss the purpose of the whole mission. Besides that the spacecraft can not observe the Earth, ASAP would be not able to detect events. In case of small bugs (software failures in the camera would be not affect its operation heavily, but nevertheless it has to be patched. Also overheating is initially not dramatic for the camera, but a permanent overheating would lead to damage the optical device, which is very sensitive. Immediately cooling is the best way to prevent damages of the camera. Table 5.6: Paylod failures. Subsystem Component Failure payload ADIA++ ASAP camera software failure software failure software failure overheating anomalies malfunction 5.2 Analysis of the Defined Failures In order to be able to evaluate overall spacecraft failures applying the AHP method, criteria have to be defined, which describe the failures in the best possible way. These criteria have

48 5.2.1 Definition of the Characteristics of Power System Failures 37 to be also defined, such that the best decision can be taken. The first question to answer for the decision making is which effects will have the failure on the spacecraft. In this analysis the effects on the spacecraft is divided into effect on payload, effect on satellite bus and effect on system. Effect on payload expresses the failures and anomalies which can occur on the payload, if a corrective measure is applied. The effect on satellite bus describes the impact on all the other subsystems except the payload. And the last criterion effect on the system contains the information what would be the impact on the whole spacecraft and the mission. In order to take the best possible decision, the next important question to be answered is, if the occurring failure is repairable. Since if no possibilities are given to repair the failure, the event can be discovered instead of spending the time with trying to repair it. Another factor which influences the decision making is the number of redundant elements. If a component containing errors is one or more times redundant, the given opportunity to discover the event is higher than in case of non redundant elements. The last and most important criterion is the effect on discovery of the event. This feature indicates the opportunity to discover the detected event with the occurred failure in the spacecraft. For example if there is an anomaly in the ADCS and the camera can not be pointed towards the phenomena to investigate, then it is not possible to discover the event and it makes more sense to repair the failure and not risk the spacecraft. All six features explained above are factors that influences the decision making in critical situations. In order to set all the features of each failure described above, it is required to define more properties than mentioned above. For example to be able to set the feature repairable to yes, it is necessary to investigate the corrective measure of the failure, if one exists. If no corrective measure exists for the given failure, then the feature repairable can be labeled with no. Another example, where further analysis have to be done, is the feature number of redundancy. Before this value can be set, the type of redundancy and its redundant elements has to be defined. This failure analysis is made for all six subsystems described in The complete failure analysis can be found in appendix. However only the power subsystem will be presented in the following sections, but the approach remains the same for all subsystems Definition of the Characteristics of Power System Failures For demonstration and explanation purposes only the power systems will be presented. The options that can be taken by the features and are influencing the decision making (explained in 5.2) are specific for each subsystem. In this subsection at first the options of the features will be defined for the entire power subsystem and afterwards assigned to the component battery for demonstration purposes. Effect on the Payload. The failure can have a range of an impact from no effects up to the

49 5.2.1 Definition of the Characteristics of Power System Failures 38 loss of the payload. The most harmless effect on the payload is power limitation of the payload. In case of a failure in the battery, the power is limited during the eclipse duration, whereas a failure in the solar arrays can lead to a general power limitation, during sun and eclipse duration. Depending on the impact degree of the failure the power limitation can range from low up to very limited. In case of a failure induced by an external energy source, e.g. by building an electromagnetic interference in the power system, the functions of adjacent components of the payload can be affected. It is also possible that a failure can lead to incorrectly powering of the payload, e.g. with an extremely high current. This may result in a damage the payload. The most critical failures on the power system can cause either to no possibilities to supply power, that may lead to the loss of payload or directly to the total loss the payload. The described effects on the payload due to power system failures are summarized in Figure 5.1. Figure 5.1: Effects on Payloads caused by Power System Failures. Effect on the Satellite Bus. Also the satellite bus can be effected by failures that appear in the power system. It is possible that the satellite bus is not affected by the failure, but this happens only in few cases. Similar in the payload one effect is the power limitation and is also terraced here in levels depending on the degree of impact of the power system failure. Other effects within the satellite bus are the destruction of solar arrays and batteries. These effects are also scaled depending on the severity of the failures. The satellite bus operations can also be affected by the electromagnetic interference, similar like the payloads are affected. In the worst case the failure causes either that the satellite bus can not be powered or even totally lost. The power failure can also release a redundancy drop in the satellite bus. The effects on the satellite bus are illustrated in the Figure 5.2. Effect on the System. As described before, with system the entire spacecraft is meant. It includes the of the intended mission which is coupled with the of the spacecraft and additionally the overall operations of it. Failures in the power system can have an effect on the system in terms of degradation of the spacecraft. The degradation is strongly depending on the degree of the error, the effects on payload and satellite bus. It can extend

50 5.2.1 Definition of the Characteristics of Power System Failures 39 Figure 5.2: Effects on the Satellite Bus caused by Power System Failures. from slight degradation up to extremely strong degradation. As a consequence of the effect loss of satellite bus, the loss of the spacecraft will arise. In case of the effect loss of payload, the loss of the spacecraft will not happen necessarily. But without the payload the mission can be not fulfilled, since the payload is the main reason to launch a spacecraft and start a mission. As well here the effects on the system are depicted in Figure 5.3. Repairable. This feature indicates whether the failure can be fixed or not. Before a decision is taken, the repair ability of an error have to be indicated by possible corrective measures. If a corrective measure can be found, then repairable is set to yes, otherwise if a corrective measure can be not found, the feature repairable will take the option no. These are the only two possible options, that the feature repairable can have not only in the power system, but also in all other subsystems. Number of Redundancy. As mentioned in Section 4.3 most critical and error-prone components within the spacecraft are redundant. The power system is one of these components. The ÈxypnosSat is intended to be designed with four solar arrays, meaning three active redundant elements of same design. It is planned to integrate two batteries in ÈxypnosSat. The redundancy of the battery is than given with one, in which the redundant element is a passive same design element. Equivalent to the battery, the pcdu has the same design standby redundancy of one. In all failures the drop of redundancy is included, which means that one failure is

51 5.2.1 Definition of the Characteristics of Power System Failures 40 Figure 5.3: Effects on the System caused by Power System Failures. analyzed and rated with each possible number of redundancy. Based on the redundancy in the power system, it can be concluded that feature number of redundancy can have the following values: three, two, one and zero. Effect on Discovery of the Event. The last and very important feature is the effect on discovery of the event. This feature indicates if a detected event can be investigated despite the error. If it is not possible, than it does not make sense to try to investigate the phenomena. Following possibilities are given for the feature effect on discovery of the event: either it is not possible to discover the event or the investigation will be affected by the failure. Depending on the impact degree of the failure, the discovery can be effected slightly or strongly. The last possibility is, that the discovery is that much affected, that the investigation of the event is not possible. The possible option of the feature effect on discovery of the event is delineated in Figure 5.4. As mentioned before only the power system failure effects will be explained and demonstrated Figure 5.4: Effects on the Discovery of the Event caused by Power System Failures.

52 5.2.1 Definition of the Characteristics of Power System Failures 41 by the battery component. In Table 5.7 the battery failures are characterized by the features and their options as described above. The number of components delivers the total number of the component, in this case the total number of integrated batteries in the spacecraft. The column id involves identification numbers of each individual component, which are separated by a comma. In the special case of the battery component one has the id 11 and the other one 12. Also the failures have identification numbers beginning with f followed by a number. This is required, since one failure can have different impacts depending on the number of redundancy. The kind of a failure is specified in the column failure mode. A failure is uniquely defined with the name of the component, failure mode and number of redundancy. This enumerated attributes, that define a failure uniquely, have to be supplied by the ADIA++ payload in order to be able to categorize the failure and gain its evaluated value (which will be done in Section 5.2.2). The features described in are as well present in Table 5.7. Their entries are specifications which are also described in Since only the battery component considered all feature specifications are not present in the table, but can be found in appendix. Table 5.7: Battery Component Failure Analysis. component number of components id failure id failure mode effect on payload effect on satellite bus effect on the system repairable number of redundancy f42 SEE less power available for payload during eclipse moderate destruction of battery, less power available slight degradation of spacecraft life time yes 1 battery 2 11, 12 f43 f44 f45 f46 SEE explosion due to high temperature explosion due to high temperature fail of few baterry cell very limited power available for payload during eclipse loss of payload loss of payload less power available for payload during eclipse strong destruction of battery, very limited power available loss of satellite bus loss of satellite bus less power available for satellite bus in eclipse extremely strong degradation of spacecraft life time loss of spacecraft loss of spacecraft slightt degradation of spacecraft life time yes 0 no 1 no 0 yes 1 f47 fail of few baterry cell very limited power available for payload during eclipse very limited power available for satellite bus in eclipse strong degradation of spacecraft life time yes 0 f48 malfunction no effects on payload drop of redundancy extremely strong degradation of spacecraft life time no 1 f49 malfunction payload can not powered satellite bus can not powered loss of spacecraft no 0

53 5.2.2 Determining the Degree of Impact of Power System Failures Determining the Degree of Impact of Power System Failures Once failures are characterized with objective evaluation, they have to be converted into numerical values in order to be able to provide scales for the decision making. This is possible by applying the Analytic Hierarchy Process described in Subsection 3.3. This will be explained step by step based on the power system. At this point explaining only the rating of the battery component is not possible, since the pairwise comparison technique which is required for the AHP is done for the subsystem and not for each component. The AHP analysis is done with the aid of the Super Decision software introduced in Step 1: Representation of the Problem in a Hierarchy The first step in AHP is to set up the given problem in a hierarchy, which includes the goal of the analysis, the criteria, if given the sub-criteria and the alternatives. The goal in the given problem is to get a value for the degree of impact of each failure. The criteria are the following features stated in 5.2.1: - effect on payload - effect on satellite bus - effect on system - repairable - number of redundancy and - effect on discovery of the event. The sub-criteria of each criterion are defined as well in Subsection The alternatives are the failures, which are given by their failure ids. Figure 5.5 depicts the rating problem of power systems failures in a hierarchy. Each criterion is linked to its related sub-criteria and each sub-criterion is linked to the according alternative. An example is illustrated in figure 5.5 for the failure f42. The red bordered boxes are linked to the alternative f42 (which is as well red bordered) according to the analysis done in Table 5.7. Step 2: Pairwise Comparison After the most creative step is the next step to compare pairwise each criterion, sub-criterion and alternatives with respect to the node connected above. For the scoring of the pairwise comparison the fundamental scale described in 3.3 is used.this comparison is done only for homogeneous elements, meaning only elements in one box in Figure 5.5 are compared with each other. The pairwise comparison will be explained by the pairwise comparison of the criteria. Each criterion is compared with each other by contrasting them. The results of the

54 5.2.2 Determining the Degree of Impact of Power System Failures 43 Figure 5.5: Hierarchy of Power System Failures.

55 5.2.2 Determining the Degree of Impact of Power System Failures 44 pairwise comparison are collected in the comparison matrix A. In order to explain the pairwise comparison the results are firstly collected in the Table 5.8. The criterion written in the row (c i ) is compared with the criterion written in the column (c j ). If c i is more important than c j then the entry in the given row and column is scored according to their importance by the fundamental scale table. But if c j is more important than c i, than the entry is the reciprocal of the value reached as well by the fundamental scale (3.1). The comparison will be explained by some entries of the Table 5.8, which is defined as T i,j, where i is the row and j the column of the table. The first comparison of the table for the entry T 1,1 is effect on payload and effect on payload. Since these are the same criteria, the fundamental scale table delivers the value 1. The diagonal of the table (T 1,1... T 6,6 ) and later of the matrix is always one, because the criteria listed in the row are in the same order like the criteria listed in the column. Thus the diagonal entry of the table with one is filled in the Table 5.9a. After the diagonal entires are defined, the table can be filled either starting with the lower triangular or with upper. Here the upper triangular is chosen. Therefore the next comparison is effect on payload and effect on satellite bus for the cell T 1,2. As mentioned before the satellite bus makes it possible to use the payload. But on the other hand without the payload the mission can be not fulfilled. Therefore effect on satellite bus is weakly more important than effect on payload and has the scaling value 2. Since the element in the column, c j is more important than the row element c i, the entry for the cell T 1,2 is the reciprocal of 2, thus 1. The next comparison between effect on payload and effect on satellite bus delivers the 2 value 1, because effect on system has a moderate plus importance than the criterion effect on 4 payload, which is indicated with the value 4. And since the column element is more important than the row element, it is the reciprocal of 4. The rest of the upper triangular is filled with the same principal. Once the upper triangular of the table is set, the lower triangular can be derived by T j,i = 1 T i,j. (5.1) For example the element T 2,1 is the reciprocal of the value in the cell T 1,2 which is 1 1/2 = 2. Doing this for all cells for the lower triangular will provide the complete table (5.9b). Step 3: Comparison Matrix In the third step the comparison table has to be stated as a comparison matrix, in order to later calculate its eigenvector of the principal eigenvalues, which is at the same time the priority vector. Out of the comparison Table 5.9b a 6x6 matrix is set up as follows:

56 5.2.2 Determining the Degree of Impact of Power System Failures 45 Table 5.8: Pairwise Comparison of Criteria. (a) Pairwise comparison of upper triangular. (b) Complete pairwise comparison. Criteria effect on payload effect on satellite bus effect on system repairable number of redundancy effect on discover of the event Criteria effect on payload effect on satellite bus effect on system repairable number of redundancy effect on discover of the event effect on payload 1 1/2 1/4 1/2 1/2 1/6 effect on payload 1 1/2 1/4 1/2 1/2 1/6 effect on satellite bus 2 1 1/4 1/3 1/2 1/5 effect on satellite bus 2 1 1/4 1/3 1/2 1/5 effect on system /4 effect on system /4 repairable 2 3 1/ /6 repairable 2 3 1/ /6 number of redundancy 2 2 1/4 1/3 1 1/5 number of redundancy 2 2 1/4 1/3 1 1/5 effect on discover of the event effect on discover of the event A = Step 4: Priority Vector Based on the comparison matrix the priority vector w can be derived. Therefore the eigenvalues and eigenvector are required. The priority vector corresponds to the normalized eigenvector of the maximum eigenvalue, also referred to as the normalized principal eigenvector. It delivers the importance of each criterion with as a numerical value. Since a software is used for determining the priority vector, how the eigenvalue and eigenvector is calculated will be not explained here. The used Super Decision software delivers priority vector simply. The result of the software for w for the matrix A is given by w = With the priority vector the weighting of each criterion is provided. The values of the vector are given in percentage, in which the total sum of all values is 100,0%. The criterion effect on

57 5.2.2 Determining the Degree of Impact of Power System Failures 46 payload has a weighting of 4,83%. This means that the criterion effect on payload influences the rating of the failures by the value 4,83%. All other criteria are weighted according to the priority vector and the results are: Table 5.10: Weighting of the Criteria according to the Priority Vector. Criteria Weighting effect on payload 4,83% effect on satellite bus 5,97% effect on system 22,28% repairable 12,03% number of redundancy 7,48% effect on discover of the event 47,40% Step 2 and step 3 are applied as well to the sub-criteria. The pairwise comparison of homogeneous elements are done with respect to the linked criteria. The steps 2 and 3 have to be applied as well to the alternatives. The pairwise comparison of the alternatives are done with respect to the above linked sub-criteria. It should be noticed, that the alternatives in this work are weighted equally with respect to the linked sub-criteria for simplification purposes. But the possibility to compare the alternatives with each other with respect to the linked criteria is also possible. These steps are jumped over and only the weighting of all sub-criteria are presented in Table The weights are reached as described in step 4 with deriving the priority vector. The elements are sorted ascending by their weighting. As well here the sum of each sub-criterion weighting is 100,0%. Since the pairwise comparison of the alternatives with respect to the connected sub-criteria is not carried out, only their weighting are presented in Table The weighting is done equally for each alternatives regarding to the linked sub-criteria. The equally weighting of the alternatives will be demonstrated by loss of spacecraft, which is an element of the sub-criterion effect on system. Besides the battery component failures f44, f45 and f49 presented in 5.7, there are other power system failures f41 and f55, which may lead to the loss of the spacecraft. Since the weighting is done for the overall subsystem and not only for one component, these

58 5.2.2 Determining the Degree of Impact of Power System Failures 47 failures have to be taken as well into account. Thus the element loss of spacecraft is linked to the five alternatives f41, f44, f45, f49 and f55. With a total weighting sum of 100,0% and five alternatives that have to be weighted equally, the weighting of each alternative is 20,0%. The equally weighting of alternatives with respect to the linked sub-criteria is a default setting in the Super Decision software and has not to be made manually. Step 5: Determination of the Consistency Ratio CR In order to check the inconsistency of the pairwise comparison, the consistency ratio has to be derived as described in step 5. The Super Decision software determines CR automatically during the pairwise comparison. There is no need to calculate the CR manually. It is necessary that the value CR is smaller than 0,1 otherwise the pairwise comparison will be inconsistent. In this case the pairwise comparison has to be repeated, until CR is smaller than 0,1. Since the CR values are indicating the inconsistency of a pairwise comparison and are not required afterwards.. Step 6: Rating of each Alternative In the last step the alternative, in this case the failures are evaluated by values. The rating of each failure can be reached by multiplying the weighting of criteria, sub-criteria and alternative and summing them up. This approach will be illustrated by the failure f44. The Figure 5.6 depicts the link of criteria with sub-criteria and the link of sub-criteria and the alternative f44. The figure is only for explanation purposes and does not contain the complete hierarchy. The number in the ellipses are the weighting of each element. The weighting of the criteria are from Table 5.10 and of the sub-criteria are from Table The weightings of the alternative f44 with respect to the linked sub-criteria are determined as described in step 5. The criterion effect on payload is linked to the sub-criterion loss of payload, which in turn is linked to the alternative f44. The weighting of the alternative varies with respect to the linked the sub-criteria.

59 5.2.2 Determining the Degree of Impact of Power System Failures 48 Table 5.11: Weighting of all Sub-criteria according to the Priority Vector. Sub-criteria: Sub-criteria: Effect on Effect on Payload Weighting Satellite Bus no effects on payload low power available for payload less power available for payload during eclipse less power available for payload 1,38% 2,46% 3,21% 3,82% Weight no effects on satellite bus 0,69% low power available for satellite bus less power available for satellite bus in eclipse less power available for satellite bus slight destruction od SA, low power available very limited power available for satellite bus in eclipse very limited power available for satellite bus EMI on adjacent components, affecting their functions 1,18% 1,33% 1,45% 1,71% 1,88% 2,51% 2,71% Sub-criteria: Effect on System slight degradation of spacecraft life time moderate degradation of spacecraft life time undesired operations of the spacecraft Weighting 2,80% 5,23% 7,29% Sub-criteria: Sub-criteria: Repairable Weighting Number of Redundancy 3 2 5,53% 11,75% no Weighting 90,00% EMI on adjacent components affecting their functions very limited power available for payload during eclipse very limited power available for payload incorrect power supply to paylaod leading to damage them payload can not powered loss of payload 5,35% 7,66% 9,58% 11,75% 22,29% 32,51% moderate destruction of SA, less power available moderate destruction of battery, less power available damage of battery leading to less power capacity strong destruction of SA, less power available strong destruction of battery, very limited power available damage of battery leading to very limited power capacity extremely strong destruction of SA, very limited power available incorrect power distribution to satellite bus can damage it 2,81% 3,06% 3,49% 3,75% 4,95% 5,14% 5,27% 6,87% drop of redundancy 12,71% satellite bus can not powered 16,20% loss of satellite bus 22,29% strong degradation of spacecraft life time extremely strong degradation of spacecraft life time loss of spacecraft Sum: 100,0% Sum: 100,0% Sum: 100,0% Sum: 100,0% Sum: 100,0% 12,73% 22,90% 49,05% ,22% 56,50% yes 10,00% Sub-criteria: Effect on Dicovery of the Event Weighting no effects on discovery 4,21% can effect the discovery strongly 28,36% can effect the discovery slightly 8,12% not possible to discover 59,31% Sum: 100,0%

60 5.2.2 Determining the Degree of Impact of Power System Failures 49 Figure 5.6: Rating of the Alternative f44. Criteria effect on payload Weighting (Cw) 4,83% Table 5.12: Rating of the Alternative f44. Sub-Criteria loss of payload Weighting (Sw) Alternative Weighting (Aw), w.r.t. linked Sub- Criteria Multiplication of Cw, Sw and Aw 32,51% 50,00% 0,79% effect on satellite bus 5,97% loss of satellite bus 22,29% 50,00% 0,67% effect on loss of 22,28% 49,05% 20,00% 2,19% system spacecraft repairable 7,48% no 26,22% f44 8,33% 0,16% number of redundancy 12,03% 1 10,00% 7,14% 0,09% effect on discovery of the event 47,40% not possible to discover 59,31% 20,00% 5,62% Rating of f44: 9,51% The weighting of the alternative f44 with respect to the sub-criteria element loss of payload is 50,0%, whereas the weighting of the same alternative with respect to the sub-criteria element loss of spacecraft is 20,0%. The total rating of the alternative f44 is reached by multiplying the

61 5.2.2 Determining the Degree of Impact of Power System Failures 50 weighting of each connected element and summing them up. In Figure 5.6 the weighting of the linked elements are marked in the same color. These values are also presented in the Table The elements criteria, sub-criteria and alternative, which are in the same line are connected. The multiplication of each weighting in the same line can be found in the last column. The rating of the failure f44 is than given by the sum of the overall multiplications. As a result the rating of the alternative f44 is 9,51%. Table 5.13: Rating of all Alternatives of the Power System Failures. component failure mode failure id normals degree of impact (ideals) solar array efficiency degradation/ outgassing f26 0,52% 5,34% solar array malfunction f38 0,70% 7,21% solar array SEL f30 0,98% 10,15% solar array efficiency degradation/ outgassing f28 1,08% 11,13% solar array malfunction f39 1,09% 11,26% solar array efficiency degradation/ outgassing f27 1,12% 11,55% battery fail of few baterry cell f46 1,12% 11,56% solar array SEB f34 1,17% 12,05% pcdu overcharging, deep discharge f50 1,25% 12,89% solar array SEB f35 1,26% 13,01% battery SEE f42 1,52% 15,72% solar array SEL f31 1,56% 16,04% battery malfunction f48 1,56% 16,11% pcdu malfunction f54 1,56% 16,11% solar array electrostatic discharge f22 1,62% 16,66% solar array SEL f32 1,67% 17,26% solar array electrostatic discharge f23 1,71% 17,62% pcdu SEE f52 1,78% 18,34% pcdu overcharging, deep discharge f51 2,09% 21,54% solar array SEB f36 2,43% 25,01% solar array malfunction f40 2,51% 25,92% solar array electrostatic discharge f24 2,56% 26,40% solar array efficiency degradation/ outgassing f29 2,70% 27,86% solar array electrostatic discharge f25 2,75% 28,35% battery fail of few baterry cell f47 2,76% 28,43% pcdu SEE f53 3,01% 31,04% solar array SEL f33 3,14% 32,36% battery SEE f43 3,39% 34,91% solar array SEB f37 3,40% 35,03% solar array malfunction f41 8,93% 92,07% battery malfunction f49 8,93% 92,07% pcdu malfunction f55 8,93% 92,07% battery explosion due to high temperature f44 9,51% 98,05% battery explosion due to high temperature f45 9,70% 100,00% Sum: 100,0% The rating of each alternative is derived by the Super Decision software automatically and

62 5.2.3 Results of the Failure Rating 51 there is no need to calculate the rating of each alternative manually. The evaluation of each alternative of the power system failures can be found in 5.13, in which the normals, are the ratings derived as above described, which represents the ratings in the normalized form. Therefor the sum of overall rating-normals will provide 100,0%. The table is sorted in the ascending order by the normals. The ideals are the normals divided by the maximum value of the normals column. In power system failure rating the maximum normal is given with the alternative f45, that corresponds to the failure mode explosion due high temperature. Dividing all normals by 9,70% delivers the entry in the column ideals. With ideals the value for the degree of impact of each failure is provided. The highest degree of impact will be 100,0%, which is the worst failure, that can occur in the power subsystem. With decreasing degree of impact the severity of the failures also decreases. The degree of impact moves towards 0% but will never reach it, since each failure will have a degree of impact, even if it is minimal. Figure 5.7: Assignment of Failure Impact Values to a Severity Level Results of the Failure Rating As mentioned before only the degree of impact of power system failures are presented here. The evaluation of the remaining subsystem failures can be found in appendix. Based on a reasonability analysis, the failures will be classified in levels ranging from 1 to 4. The analysis of power system failures and all other remaining subsystems show that a failure with an impact of equal and grater than 90,0% indicates the total loss of the spacecraft. This is mostly the

63 5.2.3 Results of the Failure Rating 52 case if a element with non redundancy fails. Extremely strong failures, e.g. explosion of the battery, can as well lead to the loss of the spacecraft. This failures are classified as level 4 failures. Failures with an impact between 40,0% and 90,0% are strong failures, which should be repaired instantaneously, otherwise it can damage the spacecraft strongly or even lead to loss. These failures are assigned to level 3 failures. Whereas failures between 30,0% and 40,0% are moderate failures which will influence the spacecraft operation slightly. These failures have a severity level of 2. All failures below 30,0% are less critical for the spacecraft, but still they can create hazards. These failures are mostly not repairable failures, failures occurring in a still redundant component or failures with minor effects. They are classed as level 1 failures. The Figure 5.7 depicts the assignment of failure impact values to their severity levels. As it can be seen in the figure, the severity of a failure is decreasing with decreasing impact value. The assignment is required to establish later the rules of the designed DSS 7.

64 6 Event Analysis A difficult part of designing a decision support system for high-level planning in critical situations is to specify the events that may interesting to investigate. The high-level planning in critical situations consists of unpredictable events. This in turn extends from known up to totally unknown phenomenas. In this section a detailed analysis of the events will be made and illustrated by examples. Since the Èxypnos System will operate for testing purposes as an earth observation satellite, the most examples will be based on events occurring on and around Earth. First of all the features which will influence the importance of an event will be determined in Section 6.1. Explicit specifying each event is not possible, since the spacecraft can detect also completely unknown phenomenas. Therefore in Section 6.2 all features will be combined to cover all events that can be detected. Similar like in the failure rating part, the events are also evaluated by applying the AHP method. In the last section the value importance of a will be derived by the AHP based on the analysis before. 6.1 Defining the Features of the Events As a first step the events have to be characterized by features in order to rate them by their importances. The features predictability, repetition in one cycle and strangeness are considered and will be defined in the following subsection Predictability The events can be divided according to their predictability in three types. The first one are predictable events, in which its occurrence can be calculated. There exist several books and catalogs, which include the calculated astronomical phenomenas of each year. One of them is the world wide known Astronomical Almanac published one year in advanced by United States Naval Observatory (USNO) and Her Majesty s Nautical Almanac Office (HMNAO) [42]. It contains several informations of astronomical events for example phenomenas like solar and moon eclipses, position and constellation of celestial bodies and many other calculate able events [42]. Another type of phenomena foresee ability is conditionally predictable events. These

65 6.1.2 Repetition in one Cycle 54 events involves e.g. the impact of near-earth object on Earth and polar lights. The occurrence of these phenomena are mostly depending on the occurrence of other phenomena. For example polar lights are depending on solar wind. The last and for this work essential phenomenas are not predictable. This are for example Gamma Ray Bursts (GRB) 1, Novae 2, extraterrestrial signals or even totally unknown phenomena. As mentioned before the interesting events are not predictable events for high-level planning challenge and the analysis will be continued only with not predictable events Repetition in one Cycle Based on the detection of the event, the repetition in one cycle has to be supported. One cycle can be defined by the system designer and can be one orbit, one hour, ten minutes, ten seconds and so on. In this work, one cycle is set on one minute. The feature repetition in one cycle can take the following values for the designed system: - 0, 1, 2, 3-4, 5, 6-7, 8, 9 - >9. If e.g. the repetition of the event is 2 times per cycle then the input parameter has to be the total line, which means 0, 1, 2, 3. The reason to do it in this way was to outline the concept of the Èypnos System as simple as possible. The value of repetition is necessary for the decision support system, because its importance is increasing with decreasing repetition. The reason therefor is, if an event is repeating e.g. for one hour (meaning a repetition of >9) then the failure occurring at the same time in the spacecraft can be corrected, if it is possible and the correction will take less than one hour. After the correction the spacecraft can discover the event without risking itself Level of Intensity Another essential feature is the level of intensity of the observed and measured phenomenon. To measure the level of intensity the standard deviation will be used. If a measurement is within the 3σ standard deviation from its mean value, it is not significant. Since in case of 1 GRBs are short electromagnetic explosions. 2 Noave are bright shining of stars due to explosions

66 6.1.4 Strangeness 55 a normal distribution of the measurement, 99,7% of the values will lie within the 3σ. It will be significant if the standard deviation is above 3σ. Therefore with an increasing standard deviation the importance of the event also increases. The values for the level of intensity are as follow: - 0, 1, 2, 3 σ - 4, 5, 6 σ - 7, 8, 9 σ - >9 σ. An example therefor is the so called Wow! signal 3, measured with the Big Ear radio telescope of the Ohio Stat University. Dr. Jerry R. Ehman recorded this signal in 1977 and analyzed it. It was recorded for 72 seconds. His results delivered with a signal intensity, which was 30 times stronger than the background noise. Even now there is no clearly explanation for this phenomenon and it is was never recorded again [43] Strangeness The last important feature to characterize the importance of a phenomenon is its strangeness. An event is strange if either the phenomena is totally unknown or the phenomena occurs at a not expected region. The strangeness is divided in extremely high, high and low. A phenomenon with an extremely high strangeness is an event that was never observed before by humans. As a result the occurring reason is unexpected and will be investigated. An example of extremely high strange event is the Wow! signal mentioned in Another example is Gamma Ray Bursts, as they observed the first time in 1967 [44]. A high strangeness is defined as a known phenomenon occurring in a region in which it is not expected. An exaggerated example is a volcanic eruption in Berlin or another is liquid water on Lunar s surface. The strangeness of an event is low, if the phenomenon is already observed before, therefore known and if it occurs in an area, where it is expected. 6.2 Combination of Event Features In summary it can be stated that an event is characterized by its repetition in one cycle, the level of intensity and its strangeness. This work is concentrated only of not predictable 3 Dr. Jerry R. Ehman circled the unusual measurement and wrote "Wow!", therefore this signal is called the Wow! signal.

67 6.3 Determining the Importances of Events 56 events, therefore the predictability consists of one value, not predictable. The properties repetition in one cycle and level of intensity can have four different values described in (for repetition in once cycle) and (for level of intensity). And the last mentioned feature in 6.1.4, strangeness can take three different attributes. The combination of all these properties delivers 48 (= 4 (repetition) 4 (level of intensity) 3 (strangeness)) possible events which have to be rated according to their importances. Figure 6.1 depicts a cutout of the event tree which illustrates all possible events. The complete event tree can be found in appendix. Figure 6.1: Cutout of the Event Tree. The name of the events is a composition of its features: strangeness, repetition in one cycle, level of intensity and that right in this order. For example if ASAP detected an event, in which its strangeness is high, the repetition is 3 times in one cycle and the level of intensity is 8σ, then the phenomenon is named e(high, {0, 1, 2, 3}, {7σ, 8σ, 9σ}). This is also illustrated in Figure 6.1 on the right hand side in the blue boxes. This was required to identify each event uniquely depending on its properties. 6.3 Determining the Importances of Events The importance of an event is required for the decision making. Equivalent to the failures, the importance of events have to be expressed as numerical values. As well here the AHP method is used to gain a value for the importances of the events. This is done in the same way as described in Subsection 5.2.2, but with changed criteria, sub-criteria and alternatives. The criteria are the features defined in Section 6.1 and the sub-criteria are the related values of the criteria. The alternatives are the resulting 48 combinations defined in 6.2. The described steps

68 6.3 Determining the Importances of Events 57 in are also applied to the events. The weighting of each criteria is presented in Table 6.1 and the weighting of each sub-criteria is presented in Table 6.2. The elements are sorted ascending by the weights. As well here the alternatives with respect to the linked sub-criteria are weighted equally, which is done by the Super Decision software. The resulting weighting of one alternative is The most important criterion is strangeness and influences the decision making with more than 70,0%. The criteria level of intensity and repetition have an influence of about 22,0% and 8,0% respectively. The weightings of the sub-criteria strangeness and level of intensity decrease with a decreasing strangeness and intensity, whereas the weighting of the sub-criteria repetition decreases with increasing repetition of the event. This is comprehensible, since an infrequent event gains in importance. In Table 6.3 all possible events, derived from the combination of event features are presented. The events are not sorted in an ascending order by their importance like the power system failures for clarity purposes. Instead, the events are grouped first by their strangenesses than by their repetition. As desired the importances deliver a higher value for the events with extremely high strangenesses. The most important event, in which the importance is 100,0%, is the event with an extremely high strangeness, a repetition of {0, 1, 2, 3} and a level of intensity larger than 9σ. It can be stated, that the most important events are given in extremely high strangenesses, in which their importances range from 69,42% to 100,00%.

69 6.3 Determining the Importances of Events 58 Table 6.1: Weighting of Event Criteria according to the Priority Vector. Criteria Weighting repition 8,41% level of intensity 21,09% strangeness 70,49% Sum: 100,0% Sub-criteria: Strangeness Table 6.2: Weighting of Event Sub-Criteria according to the Priority Vector. Weighting Sub-criteria: Repetition Weighting Sub-Criteria: Level of Intensity Weighting low 6,60% ( >9) 7,53% (0, 1, 2, 3)sigma 4,21% high 31,87% (7, 8, 9) 12,01% (4, 5, 6)sigma 11,90% extremely high 61,53% (4, 5, 6) 26,97% (7, 8, 9)sigma 26,92% (0, 1, 2, 3) 53,49% ( >9)sigma 56,98% Sum: 100,0% Sum: 100,0% Sum: 100,0%

70 6.3 Determining the Importances of Events 59 Table 6.3: Importance of each Event derived by AHP. level of importance id event strangeness repetition normals intensity (ideals) 1 e(low, {0, 1, 2, 3}, {0, 1σ, 2σ, 3σ}) {0, 1σ, 2σ, 3σ} 0,74% 18,10% 2 e(low, {0, 1, 2, 3}, {4σ, 5σ, 6σ}) {4σ, 5σ, 6σ} 0,88% 21,41% {0, 1, 2, 3} 3 e(low, {0, 1, 2, 3}, {7σ, 8σ, 9σ}) {7σ, 8σ, 9σ} 1,14% 27,87% 4 e(low, {0, 1, 2, 3}, > 9σ) > 9σ 1,67% 40,79% 5 e(low, {4, 5, 6}, {0, 1σ, 2σ, 3σ}) {0, 1σ, 2σ, 3σ} 0,55% 13,55% 6 e(low, {4, 5, 6}, {4σ, 5σ, 6σ}) {4, 5, 6} {4σ, 5σ, 6σ} 0,69% 16,86% 7 e(low, {4, 5, 6}, {7σ, 8σ, 9σ}) {7σ, 8σ, 9σ} 0,95% 23,31% 8 e(low, {4, 5, 6}, > 9σ) > 9σ 1,48% 36,24% low 9 e(low, {7, 8, 9}, {0, 1σ, 2σ, 3σ}) {0, 1σ, 2σ, 3σ} 0,45% 10,98% 10 e(low, {7, 8, 9}, {4σ, 5σ, 6σ}) {7, 8, 9} {4σ, 5σ, 6σ} 0,58% 14,29% 11 e(low, {7, 8, 9}, {7σ, 8σ, 9σ}) {7σ, 8σ, 9σ} 0,85% 20,75% 12 e(low, {7, 8, 9}, > 9σ) > 9σ 1,38% 33,68% 13 e(low, > 9, {0, 1σ, 2σ, 3σ}) {0, 1σ, 2σ, 3σ} 0,42% 10,22% 14 e(low, > 9, {4σ, 5σ, 6σ}) {4σ, 5σ, 6σ} 0,55% 13,52% > 9 15 e(low, > 9, {7σ, 8σ, 9σ}) {7σ, 8σ, 9σ} 0,82% 19,98% 16 e(low, > 9, > 9σ) > 9σ 1,35% 32,91% 17 e(high, {0, 1, 2, 3}, {0, 1σ, 2σ, 3σ}) {0, 1σ, 2σ, 3σ} 1,85% 45,33% 18 e(high, {0, 1, 2, 3}, {4σ, 5σ, 6σ}) {4σ, 5σ, 6σ} 1,99% 48,64% {0, 1, 2, 3} 19 e(high, {0, 1, 2, 3}, {4σ, 5σ, 6σ}) {7σ, 8σ, 9σ} 2,25% 55,10% 20 e(high, {0, 1, 2, 3}, > 9σ) > 9σ 2,78% 68,02% 21 e(high, {4, 5, 6}, {0, 1σ, 2σ, 3σ}) {0, 1σ, 2σ, 3σ} 1,67% 40,78% 22 e(high, {4, 5, 6}, {4σ, 5σ, 6σ}) {4σ, 5σ, 6σ} 1,80% 44,09% {4, 5, 6} 23 e(high, {4, 5, 6}, {7σ, 8σ, 9σ}) {7σ, 8σ, 9σ} 2,07% 50,55% 24 e(high, {4, 5, 6}, > 9σ) high > 9σ 2,59% 63,47% 25 e(high, {7, 8, 9}, {0, 1σ, 2σ, 3σ}) {0, 1σ, 2σ, 3σ} 1,56% 38,22% 26 e(high, {7, 8, 9}, {4σ, 5σ, 6σ}) {4σ, 5σ, 6σ} 1,70% 41,52% {7, 8, 9} 27 e(high, {7, 8, 9}, {7σ, 8σ, 9σ}) {7σ, 8σ, 9σ} 1,96% 47,98% 28 e(high, {7, 8, 9}, > 9σ) > 9σ 2,49% 60,91% 29 e(high, > 9, {0, 1σ, 2σ, 3σ}) {0, 1σ, 2σ, 3σ} 1,53% 37,45% 30 e(high, > 9, {4σ, 5σ, 6σ}) {4σ, 5σ, 6σ} 1,67% 40,76% > 9 31 e(high, > 9, {7σ, 8σ, 9σ}) {7σ, 8σ, 9σ} 1,93% 47,21% 32 e(high, > 9, > 9σ) > 9σ 2,46% 60,14% 33 e(extremely high, {0, 1, 2, 3}, {0, 1σ, 2σ, 3σ}) {0, 1σ, 2σ, 3σ} 3,16% 77,31% 34 e(extremely high, {0, 1, 2, 3}, {4σ, 5σ, 6σ}) {0, 1, 2, 3} {4σ, 5σ, 6σ} 3,30% 80,62% 35 e(extremely high, {0, 1, 2, 3}, {7σ, 8σ, 9σ}) {7σ, 8σ, 9σ} 3,56% 87,07% 36 e(extremely high, {0, 1, 2, 3}, > 9σ) > 9σ 4,09% 100,00% 37 e(extremely high, {4, 5, 6}, {0, 1σ, 2σ, 3σ}) {0, 1σ, 2σ, 3σ} 2,97% 72,76% 38 e(extremely high, {4, 5, 6}, {4σ, 5σ, 6σ}) {4, 5, 6} {4σ, 5σ, 6σ} 3,11% 76,07% 39 e(extremely high, {4, 5, 6}, {7σ, 8σ, 9σ}) {7σ, 8σ, 9σ} 3,37% 82,52% 40 e(extremely high, {4, 5, 6}, > 9σ) > 9σ 3,90% 95,45% extremely high 41 e(extremely high, {7, 8, 9}, {0, 1σ, 2σ, 3σ}) {0, 1σ, 2σ, 3σ} 2,87% 70,19% 42 e(extremely high, {7, 8, 9}, {4σ, 5σ, 6σ}) {4σ, 5σ, 6σ} 3,00% 73,50% {7, 8, 9} 43 e(extremely high, {7, 8, 9}, {7σ, 8σ, 9σ}) {7σ, 8σ, 9σ} 3,27% 79,96% 44 e(extremely high, {7, 8, 9}, > 9σ) > 9σ 3,80% 92,88% 45 e(extremely high, > 9, {0, 1σ, 2σ, 3σ}) {0, 1σ, 2σ, 3σ} 2,84% 69,42% 46 e(extremely high, > 9, {4σ, 5σ, 6σ}) > 9 {4σ, 5σ, 6σ} 2,97% 72,73% 47 e(extremely high, > 9, {7σ, 8σ, 9σ}) {7σ, 8σ, 9σ} 3,24% 79,19% 48 e(extremely high, > 9, > 9σ) > 9σ 3,77% 92,12% Sum: 100,0%

71 7 Decision Support System After the degree of impact of failures and the importance of events are analyzed and expressed in numerical values, the decision support system can be built. This will be done in this chapter. Since a rule based decision support system will be developed, facts and rules will be set in Section 7.1. Finally in Section 7.2 the implementation of the defined facts and rules in Prolog will be presented. It should be noticed that only the power system is implemented in Prolog for illustration purposes. 7.1 Defining the Facts and Rules The designed decision support system Èxypnos System is a rule-based system as described in 3.1. The Èxypnos System has to decide between repairing a failure or investigating an event;in case, that both enter at the same time. The basis of a rule based system are the rules and facts. In this chapter the rules and facts will be defined for the Èxypnos System Facts The database of a decision support system involves facts, that are required for the condition part of a rule (3.1). In Èxypnos System, the the database is build up of subsystem failures and events, which may attractive to investigate. In Prolog, databases can be expressed without any problems as facts [26]. The failure database of the DSS includes the following attributes which are derived by the failure analysis in Chapter 5: - failure id - component - failure mode - number of redundant elements - impact. For illustrative purposes, facts for the power system failures are presented in a tabular form in The entries are sorted in the ascending order by the degree of impact of the according

72 7.1.2 Rules 61 power system failure. An important attribute is the number of redundancy, since a failure can occur more than one time in a component, e.g. SEL in solar array with different degree of impact. This is based on the number of redundancy, since the impact of a failure in a redundant component is lower than the impact of a failure in a non redundant element. The facts are predefined and uploaded to the spacecraft and therefore it is not required to apply the AHP method on-board. The importances of events, expressed in numerical values as defined in 6 are as well implemented in the Èxypnos System database and uploaded to the spacecraft. The attributes of the events - for each data set - are specified with - event id - strangeness - repetition - level of intensity - importance. These attributes are extracted from the Table Rules The rules of the Èxypnos System are determined, based on the delivered result of the failure (5.2.3) and event analysis (6). The rules are the basis of the DSS, since the decision making of the system is depending on the rules. They are defined based on the objective evaluations, e.g. of the expert, and can be changed according to the expert knowledge, spacecraft sensitivity, defined mission and so on. The rules are defined based on their severity levels. The will provide the decisions, either to repair the failure or to investigate the event. In case of an on-board failure occurrence in one of the subsystems and the detection of an unpredictable event at the same time, the following rules will be applied by the Èxypnos System for the decision making. The condition of the rules requires as an input the value impact of the occurring failure and the value importance of the detected event. The rules will be first described textual and afterwards stated with IF-THEN clauses. If a failure of level 1 occurs, in which its impact is smaller than 30,0%, and if the difference between importance and impact is greater than or equal 10,0%, then the failure can be discovered. But if the difference of importance and impact is smaller than 10,0%, then the failure has to be repaired. This description results in two IF-THEN clauses: Rule 1:

73 7.1.2 Rules 62 IF impact < 30,0% AND importance - impact 10,0% THEN Discover the event. Rule 2: IF impact < 30,0% AND importance - impact 10,0% THEN Repair the failure. If the failure is categorized as level 2 failure, meaning the impact is greater than or equal 30,0% and less than 40,0%, and the difference between importance and impact is greater than or equal 20,0%, then the event have to be discovered. However, if the difference is smaller than 20,0%, then the failure has to be repaired. As well in this case two IF-THEN clauses follows with: Rule 3: IF impact 30,0% AND impact < 40,0% AND importance - impact 20,0% THEN Discover the event. Rule 4: IF impact 30,0% AND impact < 40,0% AND importance - impact < 20,0% THEN Repair the failure. If the failure is assigned to the severity level 3, in which the impact of the failure is greater than or equal 40,0% and less than 90,0%, and the difference between importance and impact is greater than or equal 35,0%, then the event should be discovered. But if the difference of importance and impact is smaller than 35,0%, then the failure has to be repaired. Out of this statement two IF-THEN clauses can be derived: Rule 5: IF impact 40,0% AND impact < 90,0% AND importance - impact 35,0% THEN Discover the event. Rule 6:

74 7.1.2 Rules 63 IF impact 40,0% AND impact < 90% AND importance - impact < 35,0% THEN Repair the failure. If the impact of the failure is greater than or equal 90,0%, then it is classified as a failure of severity level 4. In this case the spacecraft should discover the event and transmit the scientific data to Earth until the total loss enters. This leads to a non convoluted IF-THEN clauses as follows: Rule 7: IF impact 90,0% THEN Discover until spacecraft is completely loss and can not transmit anymore. The last defined rule is justified with the statement, that failures with a severity level of 4 will lead anyway to the loss of the spacecraft. For that reason the detected event should be investigated until the total loss of the spacecraft enters and the mission will be lost. The possibility to transmit the scientific data of the discovered event to Earth must be as well given before the total loss occurs. In total, seven rules are defined for the Èxypnos System. The rules implemented in Prolog can be found in Subsection Equivalent to the facts, the rules are as well predefined and uploaded to the spacecraft. By updating the decision support data base, the rules and facts can be extended arbitrarily.

75 7.2 Implementation in Prolog Implementation in Prolog For verification purposes, the facts and rules defined in previous section are implemented in Prolog and will be presented in this section. It should be noticed, that only the power system is realized in Prolog. Figure 7.1: Input and Output of the Èxypnos System. Failures analyzed in chapter 5 are uniquely defined with the attributes failure mode, component and number of redundancy. With these attributes and a query, it is possible to get the failure id and the impact value of each failure. The outputs of ADIA++ have to involve these attributes, in oder to use them as an input for the Èxypnos System. Other inputs delivered by the ASAP system are the detected event features strangeness, repetition and level of intensity. Again with a query, which involves these attributes, the event id and the value of its importance can be gained by predefined facts. Figure 7.1 illustrates the inputs and the possible outputs of the system. Based on the applied rules either the failure has to be patched or the event has to be discovered. If the importance of the detected event is more significant than the impact of the failure, than the event should be investigated. But in case of a failure which will lead to the loss of the spacecraft and no corrective measures are possible, then the event should be investigated anyway. Obviously the scientific data have to be transmitted to the ground station before the total loss of the spacecraft enters. In this section the implementation of the facts and rules will be explained step by step. After the definition of the facts and rules, exemplary queries will be demonstrated in order to show how the system works.

76 7.2.1 Facts in Prolog Facts in Prolog The database of the rule-based DSS is made up of the clauses type facts as mentioned before. Each line corresponds exactly to one dataset. For the failure database, the functor failure is defined with the arity 5. The predicate with the corresponding atoms of each failure dataset is defined according to as follows /* failure( failure_id, component, failure_mode, number_of_redundancy, degree_of_impact) <- */. Equivalently each event dataset has the functor event with the arity 5. In this regard the predicate of each event fact is defined as described in with the following atoms: /* event( event_id, strangeness, repetition, level_of_intensity, importance) <- */ Rules in Prolog As mention in 3.2 a rule is composed of a head and a body, in which the body consists of n goals, in which n is greater than or equal 1. The set rules for the Èxypnos System have the functor decision and the arity 2. The required variables for the rules are degree_of_impact which is an atom derived by the facts of the failures and importance gained by the facts of the events. The head and the body of the set rules are /* decision( Degree_of_Impact, Importance) :- goal 1,... goal n-1, write(...). <- */. The predicate write, which is in each rule the n th goal, is a built-in predicate with the arity 1. Its argument will be streamed as an output on the console [24]. A built-in predicate is a standard predicate, which is defined by Prolog itself as mentioned in Chapter 3. The seven defined rules in Subsection are implemented in Prolog and only Rule 1 will be presented here. The remaining six rules can be found in the appendix.

77 7.2.3 Queries in Prolog 66 /* decision( Degree_of_Impact, Importance) :- Degree_of_Impact < 30.00, Importance - Degree_of_Impact >= 10.00, write( Discover the event. ). <- */ Queries in Prolog After the facts and rules are defined the problem can be solved by queries. As mentioned before, the ADIA++ system delivers the attributes component, failure_mode and number_of_redundancy. Since with these parameters a failure is uniquely defined, the degree_of_impact of the according failure can be figured out easily with only one query. This will be illustrated with one example of power system failures. The following missions scenario should be assumed and the informations are supplied by ADIA++: A Single Event Effect (SEE) occurs in the Power Control and Distribution Unit (PCDU) component. Since the only one redundant element failed already, the actual number of redundant elements are zero. The question is: What is the degree of impact of exactly this failure? Additionally the failure id can be figured out, but it is not necessarily for the further steps. The known parameters, which are delivered by the ADIA++ system are called in Prolog atoms. The variables Failure_id and Degree_of_impact of the described failure can be gained with the query?- failure(failure_id, pcdu, see, 0, Degree_of_impact)., in which the variables have to begin with a capital letter or an underscore and the atoms, pcdu, see and 0, with small letter. It should be noticed, that the queries are clauses as well and have to end with a full stop like all clauses. The Prolog system delivers the following result of the asked query Failure_id = f53, Degree_of_impact = , whereby the Degree_of_impact is in percentage. Comparing the results of the Èxypnos System, with Table 5.13, in which the rating of all power system are presented, delivers the correctness. Another query is required to figure out the importance of the event, which is detected by the ASAP system. The input parameters of the Èxypnos System, delivered by ASAP are the features of the detected event. These are the strangeness, the repetition and the level of

78 7.2.3 Queries in Prolog 67 intensity of the event. The listed attributes specify an event and make it possible to figure its importance and if required the event id. As well in this case only one query is enough to gain these informations. For example an event with a high strangeness is detected, its repetition in one cycle is one and its level of intensity is given with the standard deviation of 8σ, then the query to find out the importance and the id of the event is?- event(event_id, high, 0, 1, 2, 3, (7, 8, 9)sigma, Importance). The following result is delivered by this query, whereby the Importance is given similar like Degree_of_importance in percentage: Event_id = e20, Importance = Checking the value of importance for the event e20 with Table 6.3 delivers the same value. If a failure and event detection occur at the same time, a decision has to be taken between repairing the failure and investigating the event. The decision is made by the predefined rules in First the Degree_of_impact of the failure and Importance of the event have to be figured out. Afterwards these values are delivered as the input to the query, which provides the decision. There are two options possible how the decision can be obtained. The first one is to get the Degree_of_impact and the Importance by separate queries and afterwards to use these results in the decision query. In total there exists three queries. For the example described above the queries and result would be in this case?- failure(failure_id, pcdu, see, 0, Degree_of_impact). Failure_id = f53, Impact = ?- event(event_id, high, 0, 1, 2, 3, (7, 8, 9)sigma, Importance). Event_id = e20, Importance = 55.1.?- decision(31.04, 55.10). Discover the event. true. The values Degree_of_impact and Importance are set manually in the decision query. The second possibility and the more elegant solution is to solve the decision problem of the given failure and event only by one query with three goals, in which two goals will deliver the required values for the decision and the last goal takes the decision. This would be for the same example

79 7.2.3 Queries in Prolog 68?- failure(failure_id, pcdu, see, 0, Degree_of_impact), event(event_id, high, 0, 1, 2, 3, (7, 8, 9)sigma, Importance), decision(degree_of_impact, Importance). Discover the event. Failure_id = f53, Degree_of_impact = 31.04, Event_id = e20, Importance = Rule 3, which is defined in applies, since the degree of impact of the failure is larger than 30,0% and smaller 40,0%. The difference of importance of the event, with 55,10%, and degree of impact of the failure, with 31,04%, is equal to 24,09% and is larger than 20,0%. This leads to the decision to discover the event. In case of a failure with the id f53 and an event with the id e20, the provided decision is to discover the event. If another event is detected by ASAP, let s say an event with a low strangeness, a repetition of 3 in one cycle and a level of intensity of 1σ, then the decision is taken as follows?- failure(failure_id, pcdu, see, 0, Degree_of_impact), event(event_id, low, 0, 1, 2, 3, (0, 1, 2, 3)sigma, Importance), decision(degree_of_impact, Importance). Repair the failure immediately. Failure_id = f53, Degree_of_impact = 31.04, Event_id = e21, Importance = In this example the Rule 4 applies. The failure has still the degree of impact between 30,0% and 40,0% but since the detect event is another one, its importance changed to 18,20%. This results in a difference, which is smaller than 20,0%. The decision to repair the failure immediately is taken. In case of a failure, which degree of impact is larger than 90,0%, the importances of the events are not taken into account. For example if the malfunction of a battery occurs, in which non redundant element is available and an arbitrary event is detected, let s say the event e1 described above, with the importance 18,10%, then the decision of the Èxypnos System would be

80 7.2.3 Queries in Prolog 69?- failure(failure_id, battery, malfunction, 0, Degree_of_impact), event(event_id, low, 0, 1, 2, 3, (0, 1, 2, 3) sigma, Importance), decision(degree_of_impact, Importance). Discover until spacecraft is completely loss and can not transmit anymore. Failure_id = f49, Degree_of_impact = 92.07, Event_id = e1, Importance = The justification, why the DSS decides to discover the event until the loss of the spacecraft enters, can be found in As mentioned before only the power system failures of its corresponding components are implemented in Prolog, to verify its use in space related expert systems. The complete program code of Èxypnos System for power system can be found in appendix. The implemented program delivers the desired result for the decision. It is not an executable system on spacecrafts, since it would go beyond the scope of this work. The implementation, done in this work, is for illustration purposes to underly the idea beyond the design. It is a first step towards a runnable DSS in space applications.

81 8 Results and Future Work In this chapter at first the results of the designed decision support system will be presented in 8.1, which is followed by the statements of future works that have to be done in order to develop an executable Prolog program. Besides the improvements of the concept will be mentioned in Section Results of the Work The judgment of the designed system based on specific values is impossible, since the resulted values can vary, depending on the sensitivity of the mission and the decision of the expert, that rates the failures, events and set the rules. Therefore the results can only be discussed based on reasonability analysis, which will be done in this section. With AHP it was possible to convert objective evaluations of failures and events into numerical values. The values degree of impact of failures and importance of events are local and not global ratings. With local rating the major failure in each subsystem with a rating of 100,0% and all other values for degree of impact are derived based on it, is meant. The same is given also in the events, the most important event that can be detected is evaluated with 100,0%. Local ratings of each subsystem failures are desired and required, since all subsystems together will contribute to a functional spacecraft. Besides this issue, AHP delivers reasonable values for the degree of impact and for the importance. For example the failure with the less impact, which can occur in the power system is the efficiency degradation/outgassing of a solar array, in which the number of redundant elements are three (see Table 5.13). Due to the fact that efficiency degradation/outgassing of solar arrays can not be overcome in the space environment and its impact of the spacecraft is noticeable after a period, its degree of impact with 5,34% of 100,0% is reasonable. With this value, the failure is categorized as level 1 failure, representing minor critical failures as defined in Subsection Whereas failures which will lead to the total loss of the spacecraft are characterized with their degree of impact above 90,0%. Such failures are classified as level 4 failures. If the malfunction of a solar array with none redundant elements is considered, the degree of impact will be 92,07% (see 5.13). This failure will lead to the total loss of the spacecraft, since no power can be supplied anymore to the subsystems.

82 8.1 Results of the Work 71 However the failure leads to the total loss of the spacecraft even its degree of impact is not rated with 100,0%. This can be stated by the fact that the failure is not the worst one that can occur and the loss of the mission will enter slightly. Whereas the explosion of the battery due to high temperature (with no redundant elements) will lead to an immediately loss of the spacecraft and is therefore rated with 100,0%. The difference between the explosion of battery with non redundant element (100,0%) and one redundant element (98,05%) is based upon the given number of redundant elements. Although both will have the same consequence, their evaluations are different. As the number of redundancy is an important factor for the decision, this side effect of the AHP can be overcome by changing the degree of impact for the explosion with one redundant element to 100,0% manually. Nonetheless both are categorized as level 4 failures and indicates with its classifications of the total loss of the spacecraft. As well the event analysis delivers convincing values for the importance. The least important event presented in Table 6.3, with a value of 10,22%, is the event e(low, >9, {0, 1σ, 2σ, 3σ}), in which low indicates its strangeness, >9 its repetition and {0, 1σ, 2σ, 3σ} its level of intensity. In the same table the most important event with an importance of 100,0% is given by e(extremely high, {0, 1, 2, 3}, >9σ). Based on the event analysis it is indicated, that with an increasing strangeness, increasing level of intensity and decreasing repetition the importance values of an event increases, which delivers desirable outcomes for the purposes of this work. The definition, analysis and application of AHP is done for all subsystems, but only the power subsystem is presented in this work, the remaining subsystems can be found in appendix. Also only the failures of power system are implemented in Prolog. It is not an executable program, it is rather a demonstration of how the given problem can be expressed in facts and rules and how the result of the decision is gained by queries. The implemented Prolog program includes the failures and events. It implies, that Prolog is a suitable programming language for a space mission expert system. Since defining and analyzing all failures and events and rating them with reasonable values was an elaborate process, there were no facilities to deliver an executable Prolog program within the master thesis. Summarized it can be stated, that the designed system is a first iteration of an expert system for nano satellites, which will support the spacecraft in case of critical decision making situations. Further developments and improvements are required for an executable and precise system, which will be described in the next section. This work outlined that the AHP can be used to convert objective evaluation into numerical values for the degree of impact of failures and importance of events. Furthermore the failures and events can be implemented as facts in Prolog and based on their evaluations, as well rules can be defined in Prolog easily.

83 8.2 Future Work Future Work As outlined in the previous section only the power subsystem is implemented in Prolog and an executable program is not developed yet. The first approach is to refine the failure and event analysis, as well the decision criteria. This requires a completely designed spacecraft mission, in which all details and specifications are defined. For example the decision making can involve the remaining of the spacecraft, the resources, the probability of a failure occurrence and many other factors desired by the expert. Furthermore the stated rules in Section 8.1 can be specialized by defining individual rules for each subsystem or even component, depending on the susceptibility to errors. The refinement of the events can be done by dividing the repetition and level of intensity in only one value instead of grouped values. E.g. instead of using the range of values {4, 5, 6}, the values 4, 5 and 6 can be used separately. In this work for each subsystem failure analysis a hierarchy is established in order to apply the AHP. Building a hierarchy for each component separately and applying the AHP, will lead to refined evaluations of the failures. In this case the worst failure in each component would have the degree of impact of 100,0%. An important feature, which is not considered in this work are multiple failure occurrences and multiple event detection. Obviously in case of multiple failures the degree of impact increases, which can effect the decision making strongly, whereas in case of multiple events, the most important event will be investigated. After the refinement and the consideration of multiple failures and events, the designed system can be implemented in Prolog by setting new facts and rules. For an executable Prolog program, either the payloads of SONATE, ASAP and ADIA++, have to be integrated directly or randomly generated failures and events have to be used as inputs to the Èxypnos System. However in the second case the systems ASAP and ADIA++ have to be integrated afterwards. A conceivable method for the rating of the failures and events is the Analytical Network Process, also developed by Saaty. ANP is as well a multi-criteria decision making approach, in which the criteria have dependencies, whereas in AHP the criteria are independent of each other. For example the failure criterion effect on the system is depending on the effect on payload, satellite bus and the number of redundant elements. The applied approach AHP does not consider these dependencies.

84 9 Conclusion A first approach of an intelligent decision support system, also known as expert systems, for high-level planning in nano satellites is designed in this work. High level planning is specified here as the decision making between repairing an on-board failure or investigating an unexpected event, if both occur concurrently. Although an executable program was not realizable within this work, main features required for an intelligent decision support system are outlined. These main features involve the defining, analyzing and evaluating of the failures that can occur and events that can be detected. The rating with the AHP technique delivered from objective evaluations numerical values for the degree of impact of failures and for the importance of events. The implementation of the power system showed, that Prolog is a suitable language for knowledge representation of failures and events and implementation of rules for the given decision making purposes. Based on this work, it can be stated that an expert system for high level planning in nano satellites can be developed using the described approaches above. But still refinements and improvements of failure and event analyses are required. It was noticeable, that a domain expert is an essential part of the development of an expert system. Because of this for future expansion of this work it is recommendable to involve a domain expert with many years of experience in spacecraft missions. If it is not given that the domain expert has the knowledge in a logical programming language, e.g. Prolog, then also a programmer or computer scientist is necessary with the required knowledge. These are minimum demands for the expert system development team. The presented work makes first steps towards high autonomy of satellites. With increasing distances between spacecraft and ground station and with improving space technology over years, the necessity of autonomous systems in critical situations is underlined. This work serves as preliminary study of developing an intelligent decision support system for nano satellites in Prolog by evaluating the decision criteria with AHP.

85 Appendix All detailed analysis and the results of the AHP approach can be found in Appendixes A - F. Firstly a detailed analysis of the according subsystem will be presented, followed by its resulting degree of impact. The pairwise comparison will be not illustrated here, since depending on the judgments they can vary and therefore only the results of the failure analysis is of importance. The event tree including all not predictable events for the decision making is depicted in Appendix G. The complete Prolog program is added in Appendix H. A On-Board Computer Failure Analysis Table A1: OBC Failures Sorted in Ascending Order According to Degree of Impact. component failure id failure mode priority vector (normals) degree of impact (ideals) processor f1 overheating 7,63% 1,16% memory f13 soft SEU, MEU 8,18% 1,25% processor f7 soft SEE,MEU 9,26% 1,41% processor f2 overheating 11,61% 1,77% memory f14 soft SEU, MEU 12,15% 1,85% processor f8 soft SEE,MEU 13,23% 2,02% processor f11 malfunction 13,58% 2,07% memory f19 malfunction 13,58% 2,07% memory f17 fail of memory chip 13,63% 2,08% processor f5 hardware traps 14,12% 2,15% processor f3 electrical power surge 15,13% 2,31% memory f15 hard SEU, MEU 16,75% 2,55% memory f18 fail of memory chip 17,61% 2,68% processor f6 hardware traps 31,57% 4,81% processor f9 hard SEE, MEU 33,40% 5,09% processor f4 electrical power surge 42,41% 6,46% memory f16 hard SEU, MEU 43,42% 6,62% processor f10 hard SEE, MEU 56,48% 8,61% software f21 software failure, e.g. sign errors 82,60% 12,59% processor f12 malfunction 100,00% 15,24% memory f20 malfunction 100,00% 15,24%

86 A On-Board Computer Failure Analysis 75 Table A2: Detailed Analysis of OBC Failures Analysis. component number of components processor 2 1, 2 id failure id failure mode effect on payload effect on satellite bus effect on system corrective measures repairable f1 overheating no effects slight ageing f2 overheating no effects slight ageing f3 f4 electrical power surge electrical power surge f5 hardware traps f6 hardware traps f7 soft SEE,MEU f8 soft SEE,MEU damage of electronic devices damage of electronic devices providing wrong calculation to decision making logic providing wrong calculation to decision making logic providing wrong calculation to decision making logic providing wrong calculation to decision making logic f9 hard SEE, MEU no effects f10 hard SEE, MEU payload can not operate any more strong damage of electronic devices strong damage of electronic devices providing wrong calculation to control system providing wrong calculation to control system providing wrong calculation to control system providing wrong calculation to control system can cause to write over critical data base or even to halt the processor can cause to write over critical data base or even to halt the processor f11 malfunction no effects drop of redundancy f12 malfunction payload can not operate any more satelitte bus can not operate any more slight degradation of s/c life time slight degradation of s/c life time strong degradation of s/c life time type of redundancy redundant elements number of redundancy effect on discovery of the event cooling yes same design, active 1 of {1, 2} 1 no effects cooling yes same design, active none 0 no effects not repairable no same design, active 1 of {1, 2} 1 can lead to loss of s/c not repairable no same design, active none 0 can lead to undesired operations of the s/c undesired operations of the s/c can lead to undesired operations of the s/c can lead to undesired operations of the s/c temporary outage of s/c temporary outage of spacecraft which can lead to loss the s/c extremly strong degradation of s/c life time f13 soft SEU, MEU no effects state change of memory no effects f14 soft SEU, MEU no effects state change of memory no effects f15 hard SEU, MEU no effects permanently damage of memory software patch yes same design, active 1 of {1, 2} 1 software patch yes same design, active none 0 EDAC or possible to correct with algorithms EDAC or possible to correct with algorithms EDAC or possible to correct with algorithms EDAC or possible to correct with algorithms can effect the discovery slightly can effect the discovery strong can effect the discovery slightly can effect the discovery strong yes same design, active 1 of {1, 2} 1 no effects yes same design, active none 0 no effects yes same design, active 1 of {1, 2} 1 yes same design, active none 0 can effect the discovery strong can effect the discovery strong not repairable no same design, active 1 of {1, 2} 1 no effects loss of s/c not repairable no same design, active none 0 strong degradation of s/c life time f16 hard SEU, MEU no effects damage of stored data can lead to loss of s/c EDAC or possible to correct with algorithms EDAC or possible to correct with algorithms EDAC or possible to correct with algorithms EDAC or possible to correct with algorithms not possible to discover yes same design, active 1 of {3, 4} 1 no effects yes same design, active none 0 no effects yes same design, active 1 of {3, 4} 1 no effects yes same design, active none 0 can effect the discovery strong memory 2 3, 4 f17 fail of memory chip no effects OBSW is prone to crash if trying to access this address slight degradation of s/c life time On board HW reconfiguartion yes same design, active 1 of {3, 4} 1 can effect the discovery slightly f18 fail of memory chip no effects OBSW is prone to crash if trying to access this address slight degradation of s/c life time On board HW reconfiguartion yes same design, active none 0 can effect the discovery slightly software 2 5, 6 f21 f19 malfunction no effects drop of redundancy f20 malfunction software failure, e.g. sign errors payload can not operate any more payload can not operate any more satelitte bus can not operate any more problem to boot the operating system and other software extremly strong degradation of s/c life time not repairable no same design, active 1 of {3, 4} 1 no effects loss of spacecraft not repairable no same design, active none 0 undesired operations of the s/c software update yes same design, standby 1 of {5, 6} 1 not possible to discover not possible to discover

87 B Power System Failure Analysis 76 B Power System Failure Analysis Table B1: Power System Failures Sorted in Ascending Order According to Degree of Impact. component failure id failure mode priority vector (normals) degree of impact (ideals) solar array f26 efficiency degradation/ outgassing 0,52% 5,34% solar array f38 malfunction 0,70% 7,21% solar array f30 SEL 0,98% 10,15% solar array f28 efficiency degradation/ outgassing 1,08% 11,13% solar array f39 malfunction 1,09% 11,26% solar array f27 efficiency degradation/ outgassing 1,12% 11,55% battery f46 fail of few baterry cell 1,12% 11,56% solar array f34 SEB 1,17% 12,05% pcdu f50 overcharging, deep discharge 1,25% 12,89% solar array f35 SEB 1,26% 13,01% battery f42 SEE 1,52% 15,72% solar array f31 SEL 1,56% 16,04% battery f48 malfunction 1,56% 16,11% pcdu f54 malfunction 1,56% 16,11% solar array f22 electrostatic discharge 1,62% 16,66% solar array f32 SEL 1,67% 17,26% solar array f23 electrostatic discharge 1,71% 17,62% pcdu f52 SEE 1,78% 18,34% pcdu f51 overcharging, deep discharge 2,09% 21,54% solar array f36 SEB 2,43% 25,01% solar array f40 malfunction 2,51% 25,92% solar array f24 electrostatic discharge 2,56% 26,40% solar array f29 efficiency degradation/ outgassing 2,70% 27,86% solar array f25 electrostatic discharge 2,75% 28,35% battery f47 fail of few baterry cell 2,76% 28,43% pcdu f53 SEE 3,01% 31,04% solar array f33 SEL 3,14% 32,36% battery f43 SEE 3,39% 34,91% solar array f37 SEB 3,40% 35,03% solar array f41 malfunction 8,93% 92,07% battery f49 malfunction 8,93% 92,07% pcdu f55 malfunction 8,93% 92,07% battery f44 explosion due to high temperature 9,51% 98,05% battery f45 explosion due to high temperature 9,70% 100,00%

88 B Power System Failure Analysis 77 component number of components solar array 4 7, 8, 9, 10 Table B2: Detailed Analysis of Power System Failures Analysis. id battery 2 11, 12 pcdu 2 13, 14 failure id failure mode f22 f23 f24 f25 f26 f27 f28 f29 f30 f31 f32 f33 f34 f35 f36 f37 f38 f39 f40 f41 f42 f43 f44 f45 f46 f47 f48 f49 f50 f51 f52 f53 f54 f55 electrostatic discharge electrostatic discharge electrostatic discharge electrostatic discharge efficiency degradation/ outgassing efficiency degradation/ outgassing efficiency degradation/ outgassing efficiency degradation/ outgassing SEL SEL SEL SEL SEB SEB SEB SEB malfunction malfunction malfunction effect on payload EMI on adjacent payload affecting their functions (e.g SSTV Camera) EMI on adjacent payload affecting their functions (e.g SSTV Camera) EMI on adjacent payload affecting their functions (e.g SSTV Camera) EMI on adjacent payload affecting their functions (e.g SSTV Camera) no effects on payload low power available for payload less power available for payload very limited power available for payload low power available for payload low power available for payload less power available for payload very limited power available for payload low power available for payload low power available for payload less power available for payload very limited power available for payload less power available for payload less power available for payload very limited power available for payload effect on satellite bus EMI on adjacent components affecting their functions (e.g reaction wheels) EMI on adjacent components affecting their functions (e.g reaction wheels) EMI on adjacent components affecting their functions (e.g reaction wheels) EMI on adjacent components affecting their functions (e.g reaction wheels) no effects on satellite bus low power available for satellite bus less power available for satellite bus very limited power available for satellite bus slight destruction of SA, low power available slight destruction of SA, low power available moderate destruction of SA, less power available strong destruction of SA, very limited power available strong destruction of SA, less power available strong destruction of SA, less power available strong destruction of SA, less power available extremely strong destruction of SA, very limited power available less power available for satellite bus less power available for satellite bus very limited power available for satellite bus payload can not satellite bus can malfunction powered not powered less power moderate available for destruction of SEE payload during battery, less eclipse power available strong very limited destruction of power available SEE battery, very for payload limited power during eclipse available explosion due to high temperature explosion due to high temperature fail of few baterry cell fail of few baterry cell malfunction malfunction overcharging, deep discharge overcharging, deep discharge SEE SEE malfunction malfunction loss of payload loss of payload less power available for payload during eclipse very limited power available for payload during eclipse no effects on payload payload can not powered less power for payload available very limited power available for payload loss of satellite bus loss of satellite bus less power available for satellite bus in eclipse very limited power available for satellite bus in eclipse drop of redundancy satellite bus can not powered damage of battery leading to less power capacity damage of battery leading to very limited power capacity incorrect power incorrect power supply to payload distribution to leading to satellite bus can damage it lead to damage it incorrect power supply to payload leading to damage it no effects on payload payload can not powered incorrect power distribution to satellite bus can lead to damage it drop of redundancy satellite bus can not powered effect on the system undesired operations of s/c undesired operations of s/c undesired operations of s/c undesired operations of s/c slight degradation of s/c corrective measures turn power OFF turn power OFF turn power OFF turn power OFF not repairable moderate degradation of s/c not repairable strong degradation not repairable of s/c extremely strong degradation of s/c not repairable slight degradation of s/c moderate degradation of s/c strong degradation of s/c extremely strong degradation of s/c strong degradation of s/c strong degradation of s/c strong degradation of s/c extremely strong degradation of s/c turn power OFF turn power OFF turn power OFF turn power OFF turn power OFF turn power OFF turn power OFF turn power OFF strong degradation not repairable of s/c strong degradation not repairable of s/c extremely strong degradation of s/c not repairable repairable yes yes yes yes no no no no yes yes yes yes yes yes yes yes no no no loss of s/c not repairable no slight degradation of s/c extremely strong degradation of s/c turn power OFF turn power OFF yes yes loss of s/c not repairable no loss of s/c not repairable no sligh degradation of s/c strong degradation of s/c software update in PDU software update in PDU extremely strong degradation of s/c not repairable life time yes yes no loss of s/c not repairable no slight degradation of s/c strong degradation of s/c slight degradation of s/c strong stdegradation of s/c software update software update turn power OFF turn power OFF extremely strong degradation of s/c not repairable yes yes yes yes no loss of s/c not repairable no type of redundancy same design, active same design, active same design, active same design, active same design, active same design, active same design, active same design, active same design, active same design, active same design, active same design, active same design, active same design, active same design, active same design, active same design, active same design, active same design, active same design, active same design, standby same design, standby same design, active same design, standby same design, standby same design, standby same design, standby same design, standby same design, standby same design, standby same design, standby same design, standby same design, standby same design, standby redundant elements 3 of {7, 8, 9, 10} 2 of {7, 8, 9, 10} 1 of {7, 8, 9, 10} number of redundancy none 0 3 of {7, 8, 9, 10} 2 of {7, 8, 9, 10} 1 of {7, 8, 9, 10} effect on discovery of the event can effect the discovery slightly can effect the discovery slightly can effect the discovery strong can effect the discovery strong 3 no effects 2 no effects 1 none 0 3 of {7, 8, 9, 10} 2 of {7, 8, 9, 10} 1 of {7, 8, 9, 10} can effect the discovery slightly can effect the discovery strong 3 no effects 2 no effects 1 none 0 3 of {7, 8, 9, 10} 2 of {7, 8, 9, 10} 1 of {7, 8, 9, 10} can effect the discovery slightly can effect the discovery strong 3 no effects 2 no effects 1 none 0 3 of {7, 8, 9, 10} 2 of {7, 8, 9, 10} 1 of {7, 8, 9, 10} can effect the discovery strong can effect the discovery strong 3 no effects 2 1 none 0 1 of {11, 12} 1 none 0 1 of {11, 12} 1 none 0 can effect the discovery slightly can effect the discovery strong not possible to discover can effect the discovery slightly can effect the discovery strong not possible to discover not possible to discover 1 of {11, 12} 1 no effects none 0 can effect the discovery strong 1 of {11, 12} 1 no effects none 0 not possible to discover 1 of {13, 14} 1 no effects none 0 1 of {13, 14} 1 none 0 can effect the discovery slightly can effect the discovery slightly can effect the discovery strong 1 of {13, 14} 1 no effects none 0 not possible to discover

89 C Thermal Control System Failure Analysis 78 C Thermal Control System Failure Analysis Table C1: Thermal Control System Failures Sorted in Ascending Order According to Degree of Impact. component failure id failure mode priority vector (normals) degree of impact (ideals) thermal control sensor f60 malfunction 1,76% 7,74% thermal control sensor f56 SEE, ESD 2,94% 12,93% thermal control sensor f57 SEE, ESD 3,18% 13,95% thermal control sensor f61 malfunction 3,30% 14,51% thermal control sensor f62 malfunction 4,28% 18,80% electrical heater f65 SEE, ESD 5,17% 22,72% thermal control sensor f58 SEE, ESD 5,41% 23,76% electrical heater f66 mechanical failures 6,37% 28,00% mechanical design f69 mechanical failures 6,95% 30,53% electrical heater f64 software failure 7,50% 32,96% thermal control sensor f59 SEE, ESD 7,61% 33,44% thermal control sensor f63 malfunction 22,76% 100,00% electrical heater f67 malfunction 22,76% 100,00%

90 C Thermal Control System Failure Analysis 79 Table C2: Detailed Analysis of Thermal Control System Failures Analysis. component number of components id failure id failure mode effect on payload effect on satellite bus f56 SEE, ESD no effects no effects f57 SEE, ESD no effects no effects thermal control sensor 4 15, 16, 17, 18 f58 SEE, ESD f59 SEE, ESD critical themral control of payload, can damage it slightly critical themral control of payload, can damage it slightly f60 malfunction no effects critical themral control of satellite bus, can damage it slightly critical themral control of satellite bus, can damage it slightly drop of redundancy f61 malfunction no effects drop of redundancy f62 malfunction critical themral control of payload, can damage it slightly critical themral control of satellite bus, can damage it slightly f63 malfunction incorrect thermal control of payload, can damage it strongly incorrect thermal control of satellite bus, can damage it strongly f64 software failure incorrect thermal control of payload, can damage it strongly incorrect thermal control of satellite bus, can damage it strongly electrical heater 1 19 f65 SEE, ESD f66 mechanical failures critical themral control of payload, can damage it slightly incorrect thermal control of payload, can damage it strongly critical themral control of satellite bus, can damage it slightly incorrect thermal control of satellite bus, can damage it strongly f67 malfunction no thermal control possible loss of payload no thermal control possible loss of satellite bus mechanical design 1 20 f69 mechanical failures incorrect thermal control of payload, can damage it strongly damage of satellite bus structure effect on the system slight degradation of s/c slight degradation of s/c critical state of s/c extremely critical state of s/c slight degradation of s/c strong degradation of s/c extremely strong degradation of s/c loss of s/c critical state of s/c critical state of s/c extremely critical state of s/c loss of s/c extremely critical state of s/c corrective type of measures repairable redundancy redundant elements number of redundancy effect on discovery of the event turn power OFF yes same design, active 3 of {15, 16, 17, 18} 3 no effects turn power OFF yes same design, active 2 of {15, 16, 17, 18} 2 no effects turn power OFF yes same design, active 1 of {15, 16, 17, 18} 1 can effect the discovery slightly turn power OFF yes same design, active none 0 can effect the discovery strongly not repairable no same design, active 3 of {15, 16, 17, 18} 3 no effects not repairable no same design, active 2 of {15, 16, 17, 18} 2 no effects not repairable no same design, active 1 of {15, 16, 17, 18} 1 can effect the discovery slightly not repairable no same design, active none 0 not possible to discover software update yes not redundant none 0 can effect the discovery strongly turn power OFF yes not redundant none 0 can effect the discovery slightly not repairable no not redundant none 0 can effect the discovery strongly not repairable no not redundant none 0 not possible to discover not repairable no functional none 0 can effect the discovery strongly

91 D Attitude Determination and Control System Failure Analysis 80 D Attitude Determination and Control System Failure Analysis Table D1: ADCS Failures Sorted in Ascending Order According to Degree of Impact (1/2). component failure iid failure mode priority vector degree of impact (ideals) (normals) magnetometer f121 malfunction 0,09% 1,97% magnetic coils f153 malfunction 0,09% 1,97% reaction wheel f189 malfunction 0,09% 1,97% magnetic coils f152 malfunction 0,10% 1,99% reaction wheel f188 malfunction 0,10% 1,99% magnetometer f122 malfunction 0,10% 2,13% sun sensor f76 malfunction 0,11% 2,24% star tracker aros f86 blinding during solar strom 0,11% 2,30% magnetic coils f154 malfunction 0,11% 2,36% reaction wheel f190 malfunction 0,11% 2,36% magnetometer f123 malfunction 0,12% 2,47% magnetic coils f155 malfunction 0,12% 2,47% reaction wheel f191 malfunction 0,12% 2,47% sun sensor f77 malfunction 0,12% 2,54% star tracker aros f94 malfunction 0,13% 2,63% star tracker aros f87 blinding during solar strom 0,13% 2,68% magnetometer f102 external magnetic field 0,13% 2,68% magnetometer f124 malfunction 0,13% 2,77% magnetometer f119 software failure 0,17% 3,58% magnetometer f113 software failure 0,19% 3,97% magnetic coils f144 software failure 0,19% 3,97% reaction wheel f162 software failure 0,19% 3,97% magnetic coils f143 software failure 0,19% 3,99% reaction wheel f161 software failure 0,19% 3,99% magnetometer f114 software failure 0,20% 4,13% magnetic coils f145 software failure 0,20% 4,13% reaction wheel f163 software failure 0,20% 4,13% magnetic coils f158 malfunction 0,20% 4,17% reaction wheel f194 malfunction 0,20% 4,17% sun sensor f70 anomalous outputs 0,20% 4,24% magnetometer f115 software failure 0,20% 4,24% magnetic coils f146 software failure 0,20% 4,24% reaction wheel f164 software failure 0,20% 4,24% magnetic coils f156 malfunction 0,21% 4,34% reaction wheel f192 malfunction 0,21% 4,34% gyroscope f100 malfunction 0,21% 4,39% magnetometer f105 SEE 0,21% 4,40% magnetic coils f135 SEE,ESD 0,21% 4,40% reaction wheel f180 SEE,ESD 0,21% 4,40% magnetic coils f134 SEE,ESD 0,21% 4,42% reaction wheel f179 SEE,ESD 0,21% 4,42% magnetometer f125 malfunction 0,21% 4,43% magnetic coils f157 malfunction 0,21% 4,43% reaction wheel f193 malfunction 0,21% 4,43% sun sensor f71 anomalous outputs 0,22% 4,54% magnetometer f116 software failure 0,22% 4,54% magnetic coils f147 software failure 0,22% 4,54% reaction wheel f165 software failure 0,22% 4,54% magnetometer f106 SEE 0,22% 4,56% magnetic coils f136 SEE,ESD 0,22% 4,56% star tracker aros f82 software failure 0,22% 4,63% magnetometer f117 software failure 0,22% 4,63% magnetic coils f148 software failure 0,22% 4,63% reaction wheel f166 software failure 0,22% 4,63% magnetic coils f137 SEE,ESD 0,24% 4,90% reaction wheel f182 SEE,ESD 0,24% 4,90% star tracker aros f83 software failure 0,24% 5,01% magnetometer f118 software failure 0,24% 5,01% magnetic coils f149 software failure 0,24% 5,01% reaction wheel f167 software failure 0,24% 5,01% star tracker aros f90 SEE 0,24% 5,06% gyroscope f98 anomalies, software failure 0,25% 5,12% magnetic coils f138 SEE,ESD 0,25% 5,20%

92 D Attitude Determination and Control System Failure Analysis 81 Table D2: ADCS Failures Sorted in Ascending Order According to Degree of Impact (2/2). component failure iid failure mode priority vector degree of impact (ideals) (normals) reaction wheel f183 SEE,ESD 0,25% 5,20% magnetic coils f150 software failure 0,25% 5,23% reaction wheel f168 software failure 0,25% 5,23% magnetic coils f139 SEE,ESD 0,25% 5,29% reaction wheel f184 SEE,ESD 0,25% 5,29% star tracker aros f91 SEE 0,26% 5,44% magnetic coils f141 SEE,ESD 0,31% 6,54% magnetic coils f140 SEE,ESD 0,32% 6,60% reaction wheel f185 SEE,ESD 0,32% 6,60% reaction wheel f186 SEE,ESD 0,33% 6,82% reaction wheel f181 SEE,ESD 0,33% 6,87% star tracker aros f95 malfunction 0,48% 9,96% sun sensor f72 anomalous outputs 0,50% 10,30% magnetometer f126 malfunction 0,52% 10,71% sun sensor f78 malfunction 0,53% 11,10% magnetometer f107 SEE 0,55% 11,39% sun sensor f79 malfunction 0,55% 11,48% magnetometer f108 SEE 0,57% 11,92% magnetometer f109 SEE 0,58% 12,01% magnetometer f103 external magnetic field 0,63% 13,06% magnetic coils f159 malfunction 0,63% 13,08% magnetometer f127 malfunction 0,66% 13,65% reaction wheel f195 malfunction 0,67% 13,83% star tracker aros f96 malfunction 0,67% 13,90% star tracker aros f88 blinding during solar strom 0,71% 14,81% star tracker aros f92 SEE 0,74% 15,32% magnetometer f110 SEE 0,76% 15,70% magnetometer f111 SEE 0,77% 15,93% star tracker aros f84 software failure 0,82% 17,14% thruster f132 malfunction 0,84% 17,55% sun sensor f73 anomalous outputs 0,85% 17,58% star tracker aros f93 SEE 0,85% 17,73% star tracker aros f85 software failure 0,86% 17,80% reaction wheel f171 drift 0,86% 17,97% reaction wheel f170 drift 0,87% 17,99% reaction wheel f172 drift 0,87% 18,13% reaction wheel f173 drift 0,88% 18,24% reaction wheel f174 drift 0,89% 18,54% reaction wheel f175 drift 0,90% 18,63% magnetometer f112 SEE 0,90% 18,66% reaction wheel f176 drift 0,91% 19,01% reaction wheel f177 drift 0,93% 19,23% thruster f133 malfunction 1,02% 21,25% sun sensor f74 anomalous outputs 1,14% 23,76% gyroscope f99 anomalies, software failure 1,15% 23,99% magnetometer f104 external magnetic field 1,16% 24,17% sun sensor f75 anomalous outputs 1,59% 33,07% reaction wheel f187 SEE,ESD 1,80% 37,50% thruster f129 software failure 1,99% 41,36% thruster f130 software failure 2,02% 42,03% sun sensor f80 malfunction 2,08% 43,34% gyroscope f101 malfunction 2,15% 44,65% magnetic coils f142 SEE,ESD 2,24% 46,51% reaction wheel f178 drift 2,53% 52,53% sun sensor f81 malfunction 2,99% 62,20% magnetometer f120 software failure 3,46% 71,93% magnetic coils f151 software failure 3,49% 72,59% reaction wheel f169 software failure 3,49% 72,59% star tracker aros f89 blinding during solar strom 4,13% 85,91% star tracker aros f97 malfunction 4,81% 100,00% magnetometer f128 malfunction 4,81% 100,00% thruster f131 explosion 4,81% 100,00% magnetic coils f160 malfunction 4,81% 100,00% reaction wheel f196 malfunction 4,81% 100,00%

93 D Attitude Determination and Control System Failure Analysis 82 Table D3: Detailed Analysis of ADCS Failures (1/4). number of component id failure iid failure mode effect on payload effect on satellite bus effect on the system corrective redundant number of effect on discovery repairable type of redundancy components measures elements redundancy of the event 5 of {21, 22, 23, 24, f70 anomalous outputs no effects on payload no effects on satellite bus no effects on system software update yes same design, active 5 no effects 25, 26} 4 of {21, 22, 23, 24, f71 anomalous outputs no effects on payload no effects on satellite bus no effects on system software update yes same design, active 4 no effects 25, 26} temporary difficult to point delayed power supply to 3 of {21, 22, 23, 24, f72 anomalous outputs no effects on payload solar panels toward sun, can software update yes same design, active 3 no effects s/c 25, 26} lead to less power temporary difficult to point slightly isolated s/c 2 of {21, 22, 23, 24, can effect the discovery f73 anomalous outputs no effects on payload solar panels toward sun, can software update yes same design, active 2 operation 25, 26} slightly lead to less power temporary difficult to point temporary less power moderately isolated s/c 1 of {21, 22, 23, 24, can effect the discovery f74 anomalous outputs solar panels toward sun, can software update yes same design, active 1 available for payload operation 25, 26} slightly lead to less power temporary difficult to point temporary less power strong isolated s/c can effect the discovery f75 anomalous outputs solar panels toward sun, can software update yes same design, active none 0 available for payload operation strongly lead to less power slight degradation of s/ct 5 of {21, 22, 23, 24, f76 malfunction no effects on payload drop of redundancy not repairable no same design, active 5 no effects 21, 22, 23, 25, 26} sun sensor 6 24, 25, 26 slight degradation of s/c 4 of {21, 22, 23, 24, f77 malfunction no effects on payload drop of redundancy not repairable no same design, active 4 no effects 25, 26} difficult to point solar panels toward sun, can lead moderate degradation of 3 of {21, 22, 23, 24, can effect the discovery f78 malfunction no effects on payload not repairable no same design, active 3 to less power, drop of s/c 25, 26} slightly redundancy difficult to point solar panels toward sun, can lead moderate degradation of 2 of {21, 22, 23, 24, can effect the discovery f79 malfunction no effects on payload not repairable no same design, active 2 to less power, drop of s/ct 25, 26} slightly redundancy not possible to point the strong isloation of s/c less power available for solar panles accurate 1 of {21, 22, 23, 24, can effect the discovery f80 malfunction operation and strong s/c not repairable no same design, active 1 payload towards sun, less power, 25, 26} strongly degradation drop of redundancy extremely strong limitation of mission less power available for detecting sun is not possible can effect the discovery f81 malfunction operation and extremely not repairable no same design, active none 0 payload any more with sun sensors strongly strong s/c degradation 3 of{27, 28, (1 of {29, f82 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, active & functional 30} and 1 of {31, 32, 3 no effects 33, 34, 35, 36}) 2 of{27, 28, (1 of {29, f83 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, active & functional 30} and 1 of {31, 32, 2 no effects 33, 34, 35, 36}) weak attitude 1 of{27, 28, (1 of {29, weak pointing of the can effect the discovery f84 software failure ADC incorrect determiantion and software update yes same design, active & functional 30} and 1 of {31, 32, 1 SSTV camera strongly control of s/c 33, 34, 35, 36}) weak attitude weak pointing of the can effect the discovery f85 software failure ADC incorrect determiantion and software update yes same design, active & functional none 0 SSTV camera strongly control of s/c not solveable, 3 of{27, 28, (1 of {29, blinding during solar f86 no effects on payload no effects on satellite bus no effects on system non permanent no same design, active & functional 30} and 1 of {31, 32, 3 no effects strom failure 33, 34, 35, 36}) not solveable, 2 of{27, 28, (1 of {29, blinding during solar f87 no effects on payload no effects on satellite bus no effects on system non permanent no same design, active & functional 30} and 1 of {31, 32, 2 no effects strom failure 33, 34, 35, 36}) weak attitude not solveable, 1 of{27, 28, (1 of {29, blinding during solar weak pointing of the can effect the discovery f88 ADC incorrect determiantion and non permanent no same design, active & functional 30} and 1 of {31, 32, 1 strom SSTV camera strongly control of s/c failure 33, 34, 35, 36}) not solveable, blinding during solar pointing of SSTV camera f89 ADC not possible loss of adc non permanent no same design, active & functional none 0 not possible to discover star tracker aros 2 27, 28 strom not possible failure 3 of{27, 28, (1 of {29, can lead to damage the slight degradation of s/c turn power OFF, f90 SEE no effects on payload yes same design, active & functional 30} and 1 of {31, 32, 3 no effects devices permanently EDAC 33, 34, 35, 36}) 2 of{27, 28, (1 of {29, can lead to damage the slight degradation of s/c turn power OFF, f91 SEE no effects on payload yes same design, active & functional 30} and 1 of {31, 32, 2 no effects devices permanently EDAC 33, 34, 35, 36}) can lead to damage the 1 of{27, 28, (1 of {29, weak pointing of the moderate degradation of turn power OFF, can effect the discovery f92 SEE devices permanently, yes same design, active & functional 30} and 1 of {31, 32, 1 SSTV camera s/c EDAC slightly incorrect ADC 33, 34, 35, 36}) can lead to damage the weak pointing of the moderate degradation of turn power OFF, can effect the discovery f93 SEE devices permanently, yes same design, active & functional none 0 SSTV camera s/c EDAC strongly incorrect ADC 3 of{27, 28, (1 of {29, slight degradation of s/c f94 malfunction no effects on payload drop of redundancy not repairable no same design, active & functional 30} and 1 of {31, 32, 3 no effects 33, 34, 35, 36}) 2 of{27, 28, (1 of {29, moderate degradation of can effect the discovery f95 malfunction no effects on payload drop of redundancy not repairable no same design, active & functional 30} and 1 of {31, 32, 2 s/c slightly 33, 34, 35, 36}) 1 of{27, 28, (1 of {29, weak pointing of the strong degradation of s/c can effect the discovery f96 malfunction drop of redundancy not repairable no same design, active & functional 30} and 1 of {31, 32, 1 SSTV camera strongly 33, 34, 35, 36}) f97 malfunction loss of payload loss of satellite bus loss of s/c not repairable no same design, active & functional none 0 not possible to discover anomalies, software f98 no effects on payload no effects on satellite bus no effects on system software update yes same design, standby 1 out of {29, 30} 1 no effects failure anomalies, software weak pointing of the temporary weak can effect the discovery f99 ADC incorrect software update yes same design, standby none 0 failure SSTV camera orientation of s/c strongly gyroscope 2 29, 30 extremely strong f100 malfunction no effects on payload drop of redundancy degradation of s/c not repairable no same design, standby 1 out of {29, 30} 1 no effects weak pointing of the gyroless s/c, weak can effect the discovery f101 malfunction ADC incorrect not repairable no same design, standby none 0 SSTV camera orientation strongly

94 D Attitude Determination and Control System Failure Analysis 83 Table D4: Detailed Analysis of ADCS Failures (2/4). component number of components id failure iid failure mode effect on payload effect on satellite bus effect on the system corrective measures repairable type of redundancy redundant elements number of redundancy effect on discovery of the event f102 external magnetic field no effects on payload no effects on satellite bus no effects on system not solveable, non permanent failure no functional (all magenotometer are affected) 2 of {27,28} 2 no effcects magnetometer 6 31, 32, 33, 34, 35, 36 thruster 2 37, 38 f103 f104 external magnetic field external magnetic field weak pointing of the SSTV camera pointing of SSTV camera not possible f105 SEE no effects on payload f106 SEE no effects on payload f107 SEE no effects on payload f108 SEE no effects on payload f109 SEE no effects on payload f110 SEE no effects on payload f111 SEE no effects on payload f112 SEE weak pointing of the SSTV camera ADC incorrect ADC incorrect can lead to damage the devices permanently can lead to damage the devices permanently can lead to damage the devices permanently can lead to damage the devices permanently can lead to damage the devices permanently can lead to damage the devices permanently can lead to damage the devices permanently can lead to damage the devices permanently, incorrect ADC weak attitude determiantion and control of s/c weak attitude determiantion and control of s/c slight degradation of s/c slight degradation of s/c slight degradation of s/c moderate degradation of /c moderate degradation of s/c strong degradation of s/c strong degradation of s/c extremely strong degradation of s/c not solveable, non permanent failure not solveable, non permanent failure no no functional (all magenotometer are affected) functional (all magenotometer are affected) turn power OFF yes same design, standby & functional turn power OFF yes same design, standby & functional turn power OFF yes same design, standby & functional turn power OFF yes same design, standby & functional turn power OFF yes same design, standby & functional turn power OFF yes same design, standby & functional turn power OFF yes same design, standby & functional 1 of {27,28} 1 none 0 7 of { 27,28, 31, 32, 33, 34, 35, 36} 6 of { 27,28, 31, 32, 33, 34, 35, 36} 5 of { 27,28, 31, 32, 33, 34, 35, 36} 4 of { 27,28, 31, 32, 33, 34, 35, 36} 3 of { 27,28, 31, 32, 33, 34, 35, 36} 2 of { 27,28, 31, 32, 33, 34, 35, 36} 1 of { 27,28, 31, 32, 33, 34, 35, 36} can effect the discovery slightly can effect the discovery strongly 7 no effects can effect the discovery slightly can effect the discovery slightly can effect the discovery slightly can effect the discovery strongly can effect the discovery strongly can effect the discovery strongly turn power OFF yes same design, standby & functional none 0 not possible to discover f113 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional f114 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional f115 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional f116 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional f117 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional f118 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional f119 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional f120 software failure weak pointing of the SSTV camera ADC incorrect f121 malfunction no effects on payload drop of redundancy f122 malfunction no effects on payload drop of redundancy f123 malfunction no effects on payload drop of redundancy f124 malfunction no effects on payload drop of redundancy f125 malfunction no effects on payload drop of redundancy f126 malfunction no effects on payload drop of redundancy weak pointing of the SSTV camera extremely strong degradation of s/c slight degradation of spacecraft life time slight degradation of s/c moderate degradation of s/c moderate degradation of s/c strong degradation of s/c extremely strong degradation of s/c extremely strong degradation of s/c 7 of { 27,28, 31, 32, 33, 34, 35, 36} 6 of { 27,28, 31, 32, 33, 34, 35, 36} 5 of { 27,28, 31, 32, 33, 34, 35, 36} 4 of { 27,28, 31, 32, 33, 34, 35, 36} 3 of { 27,28, 31, 32, 33, 34, 35, 36} 2 of { 27,28, 31, 32, 33, 34, 35, 36} 1 of { 27,28, 31, 32, 33, 34, 35, 36} 7 no effects 6 no effects 5 no effects 4 no effects 3 no effects 2 no effects 1 no effects software update yes same design, standby & functional none 0 not possible to discover not repairable no same design, standby & functional not repairable no same design, standby & functional not repairable no same design, standby & functional not repairable no same design, standby & functional not repairable no same design, standby & functional not repairable no same design, standby & functional 7 of { 27,28, 31, 32, 33, 34, 35, 36} 6 of { 27,28, 31, 32, 33, 34, 35, 36} 5 of { 27,28, 31, 32, 33, 34, 35, 36} 4 of { 27,28, 31, 32, 33, 34, 35, 36} 3 of { 27,28, 31, 32, 33, 34, 35, 36} 2 of { 27,28, 31, 32, 33, 34, 35, 36} 1 of { 27,28, 31, 32, 33, 34, 35, 36} 7 no effects 6 no effects 5 no effects 4 no effects 3 no effects 2 can effect the discovery slightly can effect the discovery strongly f127 malfunction ADC incorrect not repairable no same design, standby & functional 1 f128 malfunction loss of payload loss of satellite bus loss of s/c not repairable no same design, standby & functional none 0 not possible to discover f129 software failure weak pointing of the SSTV camera tumble and incorrect manoeuver can lead to loss of s/c software update yes same design, active 1 of {37, 38} 1 can effect the discovery strongly weak pointing of the tumble and incorrect can effect the discovery f130 software failure can lead to loss of s/c software update yes same design, active none 0 SSTV camera manoeuver strongly f131 explosion loss of payload loss of satellite bus loss of s/c not repairable no same design, active none 0 not possible to discover f132 malfunction no effects on payload f133 malfunction no effects on payload tumble and incorrect manoeuver no orbit manoeuvre possible extremely strong degradation of s/c extremely strong degradation of s/c not repairable no same design, active 1 of {37, 38} 1 not repairable no same design, active none 0 can effect the discovery strongly can effect the discovery strongly

95 D Attitude Determination and Control System Failure Analysis 84 Table D5: Detailed Analysis of ADCS Failures (3/4). component number of components magnetic coils 6 id failure iid failure mode effect on payload effect on satellite bus effect on the system corrective measures repairable type of redundancy redundant elements number of redundancy effect on discovery of the event f134 SEE,ESD no efffects on payload can lead to damage the devices permanently slight degradation of s/c turn power OFF yes same design, standby & functional 8 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 8 no effects 39, 40, 41, 42, 43, 44 f135 SEE,ESD no efffects on payload f136 SEE,ESD no efffects on payload f137 SEE,ESD no efffects on payload f138 SEE,ESD no efffects on payload f139 SEE,ESD no efffects on payload f140 SEE,ESD no efffects on payload f141 SEE,ESD no efffects on payload f142 SEE,ESD weak pointing of the SSTV camera can lead to damage the devices permanently can lead to damage the devices permanently can lead to damage the devices permanently can lead to damage the devices permanently can lead to damage the devices permanently can lead to damage the devices permanently can lead to damage the devices permanently can lead to damage the devices permanently slight degradation of s/c slight degradation of s/c moderate degradation of s/c moderate degradation of s/c moderate degradation of s/c extremely strong degradation of s/c extremely strong degradation of s/c turn power OFF yes same design, standby & functional turn power OFF yes same design, standby & functional turn power OFF yes same design, standby & functional turn power OFF yes same design, standby & functional turn power OFF yes same design, standby & functional turn power OFF yes same design, standby & functional turn power OFF yes same design, standby & functional 7 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 6 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 5 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 4 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 3 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 2 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 1 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } loss of adc turn power OFF yes same design, standby & functional none 0 f143 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional f144 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional f145 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional f146 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional f147 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional f148 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional f149 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional f150 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional f151 software failure weak pointing of the SSTV camera ADC incorrect f152 malfunction no effects on payload drop of redundancy f153 malfunction no effects on payload drop of redundancy f154 malfunction no effects on payload drop of redundancy f155 malfunction no effects on payload drop of redundancy f156 malfunction no effects on payload drop of redundancy f157 malfunction no effects on payload drop of redundancy f158 malfunction no effects on payload drop of redundancy weak pointing of the SSTV camera extremely strong degradation of s/c slight degradation of s/c slight degradation of s/c moderate degradation of s/c moderate degradation of s/c strong degradation of s/c strong degradation of s/c extremely strong degradation of s/c extremely strong degradation of s/c 8 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 7 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 6 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 5 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 4 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 3 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 2 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 1 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 7 no effects 6 no effects 5 no effects 4 no effects 3 no effects 2 no effects 1 no effects can effect the discovery strongly 8 no effects 7 no effects 6 no effects 5 no effects 4 no effects 3 no effects 2 no effects 1 no effects software update yes same design, standby & functional none 0 not possible to discover not repairable no same design, standby & functional not repairable no same design, standby & functional not repairable no same design, standby & functional not repairable no same design, standby & functional not repairable no same design, standby & functional not repairable no same design, standby & functional not repairable no same design, standby & functional 8 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 7 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 6 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 5 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 4 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 3 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 2 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 1 of {39, 40, 41, 42, 43, 44, 45, 46, 47 } 8 no effects 7 no effects 6 no effects 5 no effects 4 no effects 3 no effects 2 no effects can effect the discovery strongly f159 malfunction ADC incorrect not repairable no same design, standby & functional 1 f160 malfunction loss of payload loss of satellite bus loss of s/c not repairable no same design, standby & functional none 0 not possible to discover

96 D Attitude Determination and Control System Failure Analysis 85 Table D6: Detailed Analysis of ADCS Failures (4/4). component number of components id failure iid failure mode effect on payload effect on satellite bus effect on the system corrective measures repairable type of redundancy redundant elements number of redundancy effect on discovery of the event 8 of {39, 40, 41, 42, f161 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional 8 no effects 43, 44, 45, 46, 47 } 7 of {39, 40, 41, 42, f162 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional 7 no effects 43, 44, 45, 46, 47 } 6 of {39, 40, 41, 42, f163 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional 6 no effects 43, 44, 45, 46, 47 } 5 of {39, 40, 41, 42, f164 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional 5 no effects 43, 44, 45, 46, 47 } 4 of {39, 40, 41, 42, f165 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional 4 no effects 43, 44, 45, 46, 47 } 3 of {39, 40, 41, 42, f166 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional 3 no effects 43, 44, 45, 46, 47 } 2 of {39, 40, 41, 42, f167 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional 2 no effects 43, 44, 45, 46, 47 } 1 of {39, 40, 41, 42, f168 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design, standby & functional 1 no effects 43, 44, 45, 46, 47 } extremely strong weak pointing of the f169 software failure ADC incorrect degradation of s/c software update yes same design, standby & functional none 0 not possible to discover SSTV camera weak attitude weak pointing of the determiantion and turn magnetic 8 of {39, 40, 41, 42, can effect the discovery f170 drift ADC incorrect yes same design, standby & functional 8 SSTV camera control of s/c or even coils OFF 43, 44, 45, 46, 47 } strongly loss weak attitude weak pointing of the determiantion and turn magnetic 7 of {39, 40, 41, 42, can effect the discovery f171 drift ADC incorrect yes same design, standby & functional 7 SSTV camera control of s/c or even coils OFF 43, 44, 45, 46, 47 } strongly loss weak attitude weak pointing of the determiantion and turn magnetic 6 of {39, 40, 41, 42, can effect the discovery f172 drift ADC incorrect yes same design, standby & functional 6 SSTV camera control of s/c or even coils OFF 43, 44, 45, 46, 47 } strongly loss weak attitude weak pointing of the determiantion and turn magnetic 5 of {39, 40, 41, 42, can effect the discovery f173 drift ADC incorrect yes same design, standby & functional 5 SSTV camera control of s/c or even coils OFF 43, 44, 45, 46, 47 } strongly loss weak attitude weak pointing of the determiantion and turn magnetic 4 of {39, 40, 41, 42, can effect the discovery f174 drift ADC incorrect yes same design, standby & functional 4 SSTV camera control of s/c or even coils OFF 43, 44, 45, 46, 47 } strongly loss weak attitude weak pointing of the determiantion and turn magnetic 3 of {39, 40, 41, 42, can effect the discovery f175 drift ADC incorrect yes same design, standby & functional 3 SSTV camera control of s/c or even coils OFF 43, 44, 45, 46, 47 } strongly loss weak attitude weak pointing of the determiantion and turn magnetic 2 of {39, 40, 41, 42, can effect the discovery f176 drift ADC incorrect yes same design, standby & functional 2 SSTV camera control of s/c or even coils OFF 43, 44, 45, 46, 47 } strongly reaction wheel 3 45, 46, 47 loss weak attitude weak pointing of the determiantion and turn magnetic 1 of {39, 40, 41, 42, can effect the discovery f177 drift ADC incorrect yes same design, standby & functional 1 SSTV camera control of s/c or even coils OFF 43, 44, 45, 46, 47 } strongly loss pointing of SSTV camera turn magnetic can effect the discovery f178 drift ADC not possible can lead to loss of s/c yes same design, standby & functional none 0 not possible coils OFF strongly can lead to damage the slight degradation of s/c 8 of {39, 40, 41, 42, f179 SEE,ESD no efffects on payload turn power OFF yes same design, standby & functional 8 no effects devices permanently 43, 44, 45, 46, 47 } can lead to damage the slight degradation of s/c 7 of {39, 40, 41, 42, f180 SEE,ESD no efffects on payload turn power OFF yes same design, standby & functional 7 no effects devices permanently 43, 44, 45, 46, 47 } can lead to damage the slight degradation of s/c 6 of {39, 40, 41, 42, f181 SEE,ESD no efffects on payload turn power OFF yes same design, standby & functional 6 no effects devices permanently 43, 44, 45, 46, 47 } can lead to damage the moderate degradation of 5 of {39, 40, 41, 42, f182 SEE,ESD no efffects on payload turn power OFF yes same design, standby & functional 5 no effects devices permanently s/c 43, 44, 45, 46, 47 } can lead to damage the moderate degradation of 4 of {39, 40, 41, 42, f183 SEE,ESD no efffects on payload turn power OFF yes same design, standby & functional 4 no effects devices permanently s/c 43, 44, 45, 46, 47 } can lead to damage the moderate degradation of 3 of {39, 40, 41, 42, f184 SEE,ESD no efffects on payload turn power OFF yes same design, standby & functional 3 no effects devices permanently s/c 43, 44, 45, 46, 47 } extremely strong can lead to damage the 2 of {39, 40, 41, 42, f185 SEE,ESD no efffects on payload degradation of s/c turn power OFF yes same design, standby & functional 2 no effects devices permanently 43, 44, 45, 46, 47 } extremely strong can lead to damage the 1 of {39, 40, 41, 42, f186 SEE,ESD no efffects on payload degradation of s/c turn power OFF yes same design, standby & functional 1 no effects devices permanently 43, 44, 45, 46, 47 } can lead to damage the weak pointing of the can effect the discovery f187 SEE,ESD devices permanently, loss of adc turn power OFF yes same design, standby & functional none 0 SSTV camera strongly incorrect ADC slight degradation of s/c 8 of {39, 40, 41, 42, f188 malfunction no effects on payload drop of redundancy not repairable no same design, standby & functional 8 no effects 43, 44, 45, 46, 47 } slight degradation of s/c 7 of {39, 40, 41, 42, f189 malfunction no effects on payload drop of redundancy not repairable no same design, standby & functional 7 no effects 43, 44, 45, 46, 47 } moderate degradation of 6 of {39, 40, 41, 42, f190 malfunction no effects on payload drop of redundancy not repairable no same design, standby & functional 6 no effects s/c 43, 44, 45, 46, 47 } moderate degradation of 5 of {39, 40, 41, 42, f191 malfunction no effects on payload drop of redundancy not repairable no same design, standby & functional 5 no effects s/c 43, 44, 45, 46, 47 } strong degradation of s/c 4 of {39, 40, 41, 42, f192 malfunction no effects on payload drop of redundancy not repairable no same design, standby & functional 4 no effects 43, 44, 45, 46, 47 } strong degradation of s/c 3 of {39, 40, 41, 42, f193 malfunction no effects on payload drop of redundancy not repairable no same design, standby & functional 3 no effects 43, 44, 45, 46, 47 } extremely strong 2 of {39, 40, 41, 42, f194 malfunction no effects on payload drop of redundancy degradation of s/c not repairable no same design, standby & functional 2 no effects 43, 44, 45, 46, 47 } extremely strong weak pointing of the 1 of {39, 40, 41, 42, can effect the discovery f195 malfunction ADC incorrect degradation of s/c not repairable no same design, standby & functional 1 SSTV camera 43, 44, 45, 46, 47 } strongly f196 malfunction loss of payload loss of satellite bus loss of s/c not repairable no same design, standby & functional none 0 not possible to discover

97 E Telemetry, Tracking & Command Failure Analysis 86 E Telemetry, Tracking & Command Failure Analysis Table E1: TT&C Failures Sorted in Ascending Order According to Degree of Impact. component failure id failure mode degree of impact Normals (ideals) high gain antenna f205 malfunction 1,18% 8,46% high gain antenna f206 malfunction 1,51% 10,79% low gain anetnna f211 malfunction 1,79% 12,79% transceiver f200 malfunction 2,12% 15,12% high gain antenna f202 antenna pointing problem due to software 2,73% 19,47% high gain antenna f203 antenna pointing problem due to software 3,05% 21,81% low gain anetnna f209 SEE 8,31% 59,36% low gain anetnna f209 SEE 8,40% 60,02% low gain anetnna f212 malfunction 8,77% 62,65% low gain anetnna f210 SEE 8,78% 62,72% high gain antenna f204 antenna pointing problem due to software 11,37% 81,22% transceiver f201 malfunction 14,00% 100,00% high gain antenna f207 malfunction 14,00% 100,00% low gain anetnna f213 malfunction 14,00% 100,00%

98 E Telemetry, Tracking & Command Failure Analysis 87 Table E2: Detailed Analysis of TT&C Failures. component number of components id failure id failure mode f200 malfunction transceiver 2 48, 49 f201 malfunction f202 antenna pointing problem due to software f203 antenna pointing problem due to software high gain antenna 1 50 f204 antenna pointing problem due to software f205 malfunction f206 malfunction f207 malfunction f209 SEE f209 SEE f210 SEE low gain anetnna 2 51, 52 f211 malfunction f212 malfunction f213 malfunction effect on payload no effects on payload transmit of payload data not possible temporary delayed payload data transmit temporary delayed payload data transmit transmit of payload data temporary not possible delayed payload data transmit delayed payload data transmit transmit of payload data not possible no effects on payload can lead to damage payload, in case of incorrect TC/TM can lead to damage payload, in case of incorrect TC/TM no effects on payload no effects on payload transmit of payload data not possible effect on satellite bus drop of redundancy TC/TM transmit/receive not possible any more temporary delayed TC/TM transmit/receive temporary delayed TC/TM transmit/receive TC/TM transmit/receive temporary not possible delayed TC/TM transmit/receive delayed TC/TM transmit/receive TC/TM transmit/receive not possible any more can lead to receive/transmit incorrect TC/TM can lead to receive/transmit incorrect TC/TM can lead to receive/transmit incorrect TC/TM drop of redundancy if one LG antenna already failed,communic ation with ground station during emergencies not possible TC/TM transmit/receive not possible any more effect on the system corrective redundan cy measures repairable type of redundant elements number of Redundan cy effect on discovery of the event strong degradation of s/c not repairable no same design, active 1 of {48, 49} 1 no effects not possible any more to communicate with ground station, loss of s/c not repairable no same design, active none 0 not possible to transmit the discovery data difficult to transmit/receive large amounts of data software update yes functional 2 of {51, 52} 2 no effects difficult to transmit/receive large amounts of data software update yes functional 1 of{51, 52} 1 no effects temporary loss of communication with ground station software update yes functional none 0 not possible to transmit the discovery data difficult to transmit/receive large amounts of data difficult to transfer large amounts of data not possible any more to communicate with ground station, loss of s/c undesired operation of s/c, can lead to loss s/c in case of critical operations undesired operation of spacecraft, can lead to loss s/c in case of critical operations undesired operation of s/c, can lead to loss s/c in case of critical operations strong degradation of s/c not repairable not repairable not repairable turn power OFF turn power OFF turn power OFF not repairable no functional 2 of {51, 52} 2 no effects no functional 1 of{51, 52} 1 no effects no functional none 0 yes yes yes no same design, active & functional same design, active & functional same design, active & functional same design, active & functional 2 of {50, 51, 52} 1 of {50, 51, 52} 2 1 none 0 2 of {50, 51, 52} not possible to transmit the discovery data can effect the discovery slightly can effect the discovery strongly can effect the discovery strongly 2 no effects extremely strong degradation of s/c not repairable no same design, active & functional 1 of {50, 51, 52} 1 can effec the dicovery strongly not possible any more to communicate with ground station, loss of s/c not repairable no same design, active & functional none 0 not possible to transmit the discovery data

99 F Payload Failure Analysis 88 F Payload Failure Analysis Table F1: Payload Failures Sorted in Ascending Order According to Degree of Impact. component failure id failure mode priority vector (normals) degree of impact (ideals) ADIA++ f214 software failure 4,48% 14,43% SSTV camera f218 overheating 7,85% 25,26% SSTV camera f217 software failure 9,74% 31,37% ASAP f216 software failure 13,54% 43,60% ADIA++ f215 software failure 13,95% 44,91% SSTV camera f219 anomalies 19,38% 62,40% SSTV camera f220 malfunction 31,06% 100,00%

100 F Payload Failure Analysis 89 component number of components id failure id failure mode effect on payload effect on satellite bus effect on the system corrective type of measures repairable redundancy redundant elements number of redundancy effect on discovery of the event f214 software failure no effects on payload no effects on satellite bus no effects on system software update yes same design active 1 of {53, 54} 1 no effects ADIA , 54 f215 software failure wrong failure detection/prediction, trying to repair a fully functional payload can lead to break it wrong failure detection/prediction, trying to repair a fully functional component lead to damage it extremely strong degradation of s/c software update yes same design active none 0 can effect the discovery extremely strong ASAP 1 55 f216 SSTV camera 1 56 f217 software failure software failure f218 overheating f219 anomalies affecting the Decision Support System in case of wrong detected event can provide wrong data to ASAP can slightly damage camera can provide wrong data to ASAP trying to dicover an incorrect event can lead to damage the satellite bus completely for nothing no effects on satellite bus satellite bus can damaged slightly no effects on satellite bus f220 malfunction loss of main payload no effects on satellite bus extremely strong degradation of s/c temporary not possible to fulfill the mission slightly degradation of s/c temporary not possible to fulfill the mission extremely strong degradation of s/c software update software update yes not redundant none 0 yes not redundant none 0 can effect the discovery extremely strong can effect the discovery slightly cooling yes not redundant none 0 no effects turn camera OFF not repairable yes not redundant none 0 no not redundant none 0 temporar not possible to discover the event optical not possible to discover the event optical Table F2: Detailed Analysis of Payload Failures.

101 G Event Tree 90 G Event Tree Figure G1: Event Tree Complete.

102 H Èxypnos System Code for Power System Failures 91 H Èxypnos System Code for Power System Failures /******************************************************************/ /*** ***/ /*** Èxypnos System: Saliha Serdar ***/ /*** Failures in the Power System ***/ /*** ***/ /******************************************************************/ /*** facts ********************************************************/ /* failure( failure_id, component, failure_mode, number_of_redundancy, degree_of_impact) <- */ % solar_array failure(f22, solar_array, electrostatic_discharge, 3, 16.66). failure(f23, solar_array, electrostatic_discharge, 2, 17.62). failure(f24, solar_array, electrostatic_discharge, 1, 26.40). failure(f25, solar_array, electrostatic_discharge, 0, 28.35). failure(f26, solar_array, eff_degradation_outgassing, 3, 5.34). failure(f27, solar_array, eff_degradation_outgassing, 2, 11.55). failure(f28, solar_array, eff_degradation_outgassing, 1, 11.13). failure(f29, solar_array, eff_degradation_outgassing, 0, 27.86). failure(f30, solar_array, sel, 3, 10.15). failure(f31, solar_array, sel, 2, 16.04). failure(f32, solar_array, sel, 1, 17.26). failure(f33, solar_array, sel, 0, 32.36). failure(f34, solar_array, seb, 3, 12.05). failure(f35, solar_array, seb, 2, 13.01). failure(f36, solar_array, seb, 1, 25.01). failure(f37, solar_array, seb, 0, 35.03). failure(f38, solar_array, malfunction, 3, 7.21). failure(f39, solar_array, malfunction, 2, 11.26). failure(f40, solar_array, malfunction, 1, 25.92). failure(f41, solar_array, malfunction, 0, 92.07).

103 H Èxypnos System Code for Power System Failures 92 /******************************************************************/ /*** ***/ /*** Èxypnos System: Saliha Serdar ***/ /*** Failures in the Power System ***/ /*** ***/ /******************************************************************/ /*** facts ********************************************************/ /* failure( failure_id, component, failure_mode, number_of_redundancy, degree_of_impact) <- */ % solar_array failure(f22, solar_array, electrostatic_discharge, 3, 16.66). failure(f23, solar_array, electrostatic_discharge, 2, 17.62). failure(f24, solar_array, electrostatic_discharge, 1, 26.40). failure(f25, solar_array, electrostatic_discharge, 0, 28.35). failure(f26, solar_array, eff_degradation_outgassing, 3, 5.34). failure(f27, solar_array, eff_degradation_outgassing, 2, 11.55). failure(f28, solar_array, eff_degradation_outgassing, 1, 11.13). failure(f29, solar_array, eff_degradation_outgassing, 0, 27.86). failure(f30, solar_array, sel, 3, 10.15). failure(f31, solar_array, sel, 2, 16.04). failure(f32, solar_array, sel, 1, 17.26). failure(f33, solar_array, sel, 0, 32.36). failure(f34, solar_array, seb, 3, 12.05). failure(f35, solar_array, seb, 2, 13.01). failure(f36, solar_array, seb, 1, 25.01). failure(f37, solar_array, seb, 0, 35.03). failure(f38, solar_array, malfunction, 3, 7.21). failure(f39, solar_array, malfunction, 2, 11.26). failure(f40, solar_array, malfunction, 1, 25.92). failure(f41, solar_array, malfunction, 0, 92.07).

104 H Èxypnos System Code for Power System Failures 93 % battery failure(f42, battery, see, 1, 15.72). failure(f43, battery, see, 0, 34.91). failure(f44, battery, explosion, 1, 98.05). failure(f45, battery, explosion, 0, ). failure(f46, battery, fail_of_a_few_battery_cells, 1, 11.56). failure(f47, battery, fail_of_a_few_battery_cells, 0, 28.43). failure(f48, battery, malfunction, 1, 16.11). failure(f49, battery, malfunction, 0, 92.07). % power control and distribution unit - pcdu failure(f50, pcdu, overcharging_deep_discharging, 1, 12.89). failure(f51, pcdu, overcharging_deep_discharging, 0, 21.54). failure(f52, pcdu, see, 1, 18.34). failure(f53, pcdu, see, 0, 31.04). failure(f54, malfunction, 1, 16.11). failure(f55, malfunction, 0, 92.07). /* event( event_id, strangeness, repetition, level_of_intensity, importance) <- */ event(e1, low, '0, 1, 2, 3', '(0, 1, 2, 3)sigma', 18.10). event(e2, low, '0, 1, 2, 3', '(4, 5, 6)sigma', 21.41). event(e3, low, '0, 1, 2, 3', '(7, 8, 9)sigma', 27.87). event(e4, low, '0, 1, 2, 3', '>9sigma', 40.79). event(e5, low, '4, 5, 6', '(0, 1, 2, 3)sigma', 13.55). event(e6, low, '4, 5, 6', '(4, 5, 6)sigma', 16.86). event(e7, low, '4, 5, 6', '(7, 8, 9)sigma', 23.31). event(e8, low, '4, 5, 6', '>9 sigma', 36.24). event(e9, low, '7, 8, 9', '(0, 1, 2, 3)sigma', 10.98). event(e10, low, '7, 8, 9', '(4, 5, 6)sigma', 14.29). event(e11, low, '7, 8, 9', '(7, 8, 9)sigma', 20.75). event(e12, low, '7, 8, 9', '>9 sigma', 33.68). event(e13, low, '>9', '(0, 1, 2, 3)sigma', 10.22). event(e14, low, '>9', '(4, 5, 6)sigma', 13.52). event(e15, low, '>9', '(7, 8, 9)sigma', 19.98). event(e16, low, '>9', '>9 sigma', 32.91). event(e18, high, '0, 1, 2, 3', '(0, 1, 2, 3)sigma', 45.33). event(e19, high, '0, 1, 2, 3', '(4, 5, 6) sigma', 48.64). event(e20, high, '0, 1, 2, 3', '(7, 8, 9) sigma', 55.10). event(e21, high, '0, 1, 2, 3', '>9sigma', 68.02).