Anomaly investigation of HORYU-II and lessons learned

Paper number

IAC-13,B4,6B,2,x18563

Author

Mr. Yuta Okumura, Kyushu Institute of Technology, Japan

Coauthor

Mr. kyutech satellite Project, Japan

Coauthor

Dr. Hirokazu Masui, Kyushu Institute of Technology, Japan

Coauthor

Prof. Mengu Cho, Kyushu Institute of Technology, Japan

Year

2013

Abstract

The Horyu-II, a nanosatellite with 7kg weight and 30cm cubic shape was launched as an auxiliary payload on-board a H-IIA rocket on May 18, 2012 (UTC). The satellite was developed and tested at Kyushu Institute of Technology started from 2010 to 2012.
Since its launch, the satellite was running normally. But, on June 5 2012 an anomaly occurred. The satellite could not renew the real-time housekeeping data that was supposed to be sent continuously. The satellite did not respond to any command from the ground except sending back the acknowledgement of the signal receipt. On June 30th 2012, the situation got worse. The satellite could not send even the frozen housekeeping data leaving only the call sign sent continuously. Fortunately, on July 3rd 2012 the satellite recovered to the normal state. It was found that the battery state of charge had dropped to around 10\%.
This paper presents the result of the anomaly investigations and the lessons learned. We carried out Fault Tree Analysis to determine the root cause of the failure. From the observed phenomena, the point of anomaly was identified to be the onboard computer (OBC) subsystem. The suspect was narrowed down to four; opening of the circuit by thermal cycling, short-circuit due to a contaminant particle, discharge due to internal charging, single-event-latch-up (SEL). Using the flight spare board, we carried out thermal cycle test, charging test and radiation test. We found that SEL could occur very easily on the micro-processor unit (MPU). The current due to SEL was less than the threshold current of the over-current protection circuit. The root cause was our negligence of the radiation effects. We employed a spot shielding due to Tungsten sheet and the over-current protection circuit. But their effectiveness was not verified by test nor analysis before the launch. 
The communication subsystem was designed so that the beacon can be sent independent of the failed MPU. Thanks to that design, the satellite could kept sending the call sign and we did not lose the satellite. The power subsytem was designed so that the satellite system can reboot itself even from the condition where the battery is completely depleted. Its design was verified thoroughly via the battery charging and discharge test on the ground. The battery recover profile was very similar to the one we had on the ground. The robust design saved the satellite at the end.

Abstract document

IAC-13,B4,6B,2,x18563.brief.pdf

Manuscript document

IAC-13,B4,6B,2,x18563.pdf (🔒 authorized access only).

To get the manuscript, please contact IAF Secretariat.