Skip to main content

A probabilistic analysis of the implicationsof instrument failures on ESA’s Swarm mission for its individual satellite orbit deployments


On launch, one of Swarm’s absolute scalar magnetometers (ASMs) failed to function, leaving an asymmetrical arrangement of redundant spares on different spacecrafts. A decision was required concerning the deployment of individual satellites into the low-orbit pair or the higher “lonely” orbit. I analyse the probabilities for successful operation of two of the science components of the Swarm mission in terms of a classical probabilistic failure analysis, with a view to concluding a favourable assignment for the satellite with the single working ASM. I concentrate on the following two science aspects: the east-west gradiometer aspect of the lower pair of satellites and the constellation aspect, which requires a working ASM in each of the two orbital planes. I use the so-called “expert solicitation” probabilities for instrument failure solicited from Mission Advisory Group (MAG) members. My conclusion from the analysis is that it is better to have redundancy of ASMs in the lonely satellite orbit. Although the opposite scenario, having redundancy (and thus four ASMs) in the lower orbit, increases the chance of a working gradiometer late in the mission; it does so at the expense of a likely constellation. Although the results are presented based on actual MAG members’ probabilities, the results are rather generic, excepting the case when the probability of individual ASM failure is very small; in this case, any arrangement will ensure a successful mission since there is essentially no failure expected at all. Since the very design of the lower pair is to enable common mode rejection of external signals, it is likely that its work can be successfully achieved during the first 5 years of the mission.



After 12 years of planning, ESA’s Swarm mission finally launched at 13.02 on 22 November 2013. This is the first low Earth-orbit satellite mission comprised of three identical satellites that are able to fly simultaneously, allowing a “constellation” approach to satellite magnetometry. Separation of the three constituent satellites was successful about 90 min after launch, and all three (Alpha, Bravo and Charlie) entered orbit. Within the following hours health checks from the satellites indicated that all was well, with the only exception being that the absolute scalar magnetometer (ASM) on Charlie did not wake. This left an asymmetry in the instrument configurations of the three otherwise identical spacecrafts. Each satellite is equipped with a 3-component vector field magnetometer (VFM) and a star-camera, the so-called advanced stellar compass (ASC), that enables oriented vector field measurements to be made. Calibration of the VFM is performed using data from the ASM. We shall not discuss the other instruments on each satellite that are concerned with electric field measurements and GPS acquisition (see, for example, ESA 2004).

The constellation plan of the mission proposed two satellites at low altitude flying closely side-by-side with a small east-west separation; this configuration comprises essentially a gradiometer that should allow the determination of east-west gradients in the crustal field that are otherwise so difficult to determine. An additional advantage of the gradiometer concept is the “common rejection mode” for external signals, whereby a difference of the two signals on the satellites can effectively reject large-scale time-varying external sources that are normally so difficult to handle, leaving only the internal signal. This then presents the opportunity for determination of a high-resolution model of the crustal field of the Earth. The third satellite would fly at a higher altitude with an orbit that gradually drifts relative to the orbit of the lower pair. After a few years, the two orbits become perpendicular (separation in time of 6 h or 90° in longitude), leading to an ideal configuration for other science aspects of the mission, namely the determination of the internal field and also the ability to perform electromagnetic sounding of the mantle. Both these science goals require an excellent separation of the internal and external fields, and this is most easily achieved when the local time coverage of the Earth is maximal.

In the original mission plan, Charlie was the satellite that was planned to be placed in the higher “lonely” orbit. With the failure of its spare ASM, one should consider the risk associated with the assignment of spacecrafts to different orbits, considering the fact that a subsequent loss of the only operating ASM on Charlie would leave that particular spacecraft with no absolute control on its vector measurements made by the VFM. In the following analysis, I consider failure scenarios probabilistically that allows a determination of the risk to the two scientific goals of the mission. The probabilities of failure are presented in terms of the probability of the failure of a single instrument per year, and the conclusions are rather generic. Nevertheless, I use the so-called expert elicitation (e.g. Aspinall 2010; Cooke 1991) to assign specific probabilities and thus give estimates of failure rates. The overall conclusion is that the safest assignment is to place Charlie, with only one operable ASM, into the lower orbit, and to place one of the satellites with a redundant spare ASM into the higher orbit. This determination is in agreement with the decision taken by ESA in early 2014, which was to place Bravo into the higher orbit and to place Charlie as one of the lower pair.


Consider a single ASM chosen at random from the spacecrafts. Since all instruments are identical we believe a priori that they all have identical probabilities of failure, typically from space radiation. Failure of the ASM is the event F, and the probability that it will fail during one year is

$$ p_{1}(F)=f $$

and consequently the complementary probability of continued perfect operation, termed operability O for short, is

$$ p_{1}(O)=o=1-f. $$

In what follows, we use notation p(a b) for the events a and b both occurring, where each event refers to an individual magnetometer. The notation \(\overline {ab}\) stands for the event ab not occurring. Clearly \(O=\overline {F}\) and vice versa.

We assume a memoryless process; the probability of failure is independent of the time already passed, during which the instrument functioned. Rice (1995) analyses this process and argues that the mathematical form is uniquely determined by its memoryless property. I make the simplifying assumption that the probability for an instrument to fail does not depend on it being switched “on” or “off”. I do not consider any type of instrument aging; my primary concern is that of damage to the instrument through radiation dose. Thus, this is not the same as the problem faced with a car (G. Hulot, personal communication 2014). A garaged car tends to live longer than one that is used. Since I consider radiation dose, it is likely that the effect is the same whether the instrument is “on” or “off”. In the car analogy, in this case, leaving the vehicle in the garage does not help to prolong its life. Since there remain open questions concerning the real reasons concerning instrument failure, I simply state my assumptions clearly here.

The memoryless process is described by the exponential distribution, so that the probability of a lifetime T (continued operability) being at least t is

$$ p_{1}(O)=e^{-\lambda t} $$

The probability of failure in interval tt+d t is λ exp(−λ t)d t, consistent with the fact that the probability of failure in 0→T is

$$ p_{1}(F)={\int_{0}^{T}} \lambda \exp(-\lambda t) dt = 1-\exp(-\lambda T) $$

Clearly, λ is the instantaneous rate of failure, but this is not a quantity we are used to dealing with. We see below in the examples that we are more used to reporting failure rates over finite time periods, such as a year or a decade.

We now consider two ASMs together on one satellite. For the two magnetometers both to have failed we have

$$ p_{2}(FF)=(1-e^{-\lambda t})^{2} $$

and thus the probability of at least one ASM still working is

$$ p_{2}(\overline{FF})=1-(1-e^{-\lambda t})^{2} $$


Let us take as an example, a 10 % probability per year that an ASM will fail. Using our model, this means when t is measured in years, the probability of failure when t[0,1] is 1− exp(−λ)=0.1. We use this to discover an appropriate value of λ: −λ= ln(0.9) or λ=0.105. Note that this is not quite the same as one would have deduced for λ if one had considered the statement of the failure rate to have been an instantaneous one; the instantaneous rate assigns λ=0.1, but we consider that it is better to interpret the statement of failure under the given finite time and hence set λ accordingly. As a result, we introduce a notation we shall use henceforth when we work in integer numbers of years N; We take o= exp(−λ) (o = 0.9 in the present example), and thus operability after N years is just o N.

We find from the preceding formulae that the chance of a working ASM after 6 years is 0.53 and after 10 years 0.35. We can see that when two ASMs are together, the chances of one of them still working is 0.78 after 6 years and 0.575 after 10 years. One sees that for a gradiometer configuration with three ASMs (i.e. one satellite has one ASM and the other has two), the probability of operability after 10 years is 0.35×0.575=0.2. Conversely, with both being dual ASMs, the probability of operability is (0.575)2 = 0.33.

With three ASMs, the probability of at least one continuing to work after 10 years is 0.73.


Let us now find the probabilities of a working gradiometer in the following two cases: when a) both satellites have two ASMs and b) when only one satellite has two and the other has one. I use the symbol j to denote a gradiometer in the low orbit being considered where one of the satellites has j ASMs. It should be noted that the second satellite in the low orbit will always be equipped with two ASMs. I also use the notation C j to discuss what I call “constellation” measurements, which rely on having a working ASM in both a high and a low orbit; j is now, in this case, the index stating the number of ASMs on the high-orbit satellite.

Both double ASMs in low orbit

I call this scenario 2 since there are two ASMs on both low satellites. Operability occurs with probability

$$ p_{2}(\overline{FF})p_{2}(\overline{FF})=\left[1-\left(1-o^{N}\right)^{2}\right]^{2} $$

Single ASM in low orbit

I call this scenario 1 since there is one ASM on one of the low satellites. Operability occurs with probability

$$ p_{1}(O)p_{2}(\overline{FF})=o^{N}\left[1-\left(1-o^{N}\right)^{2}\right] $$


Let us now find the probabilities of a working constellation, by which I mean that there is one working ASM in a high orbit and a minimum of one working ASM in a low orbit. We treat the following two cases: when a) the lonely orbit satellite has one ASM and b) when the lonely orbit satellite has two ASMs.

Both double ASMs in low orbit (i.e. lonely ASM)

I call this scenario constellation 1, or C 1, since there is one ASM on the lonely satellite.

$$ \begin{aligned} p_{\text{fail}}({C_{1}})&=p_{1}(F)p_{4}(\overline{FFFF})+p_{1}(O)p_{4}(FFFF)\\ &\quad+p_{1}(F)p_{4}(FFFF) \end{aligned} $$
$$ \begin{aligned} p_{\text{fail}}({C_{1}})&=\left(1-o^{N}\right)\left[1-\left(1-o^{N}\right)^{4}\right]+o^{N}\left(1-o^{N}\right)^{4}\\ &\quad+\left(1-o^{N}\right)\left(1-o^{N}\right)^{4} \end{aligned} $$

We report the complement of these probabilities (i.e. the probability of operability) in Tables 1, 2, 3, 4 and 5.

Table 1 Probabilities for operability for various scenarios. Each of the six rows are for the probability supplied by one of the MAG respondents. Values in columns one and two are of f and its complement o supplied by respondents. The four following probabilities are for the probability of operability of the gradiometer with one ASM or two ASMs, and then for the constellation with one upper ASM and two upper ASMs. Values are for N=10 years
Table 2 Probabilities as in Table 1. Values are for N=8 years
Table 3 Probabilities as in Table 1. Values are for N=6 years
Table 4 Probabilities as in Table 1. Values are for N=5 years
Table 5 Probabilities as in Table 1. Values are for N=3 years

Three ASMs in low orbit and double ASM in lonely orbit

I call this scenario constellation 2, or C 2, since there are two ASMs on the lonely satellite.

$$ \begin{aligned} p_{\text{fail}}({C_{2}})&=p_{2}(FF)p_{3}(\overline{FFF})+p_{2}(\overline{FF})p_{3}(FFF)\\ &\quad+p_{2}(FF)p_{3}(FFF) \end{aligned} $$
$$ \begin{aligned} {}p_{\text{fail}}({C_{2}})&=\left(1-o^{N}\right)^{2}\left[1-\left(1-o^{N}\right)^{3}\right]\\ &\quad+\!\left[\!1\,-\,\left(1\,-\,o^{N}\right)^{2}\right]\left(1\,-\,o^{N}\right)^{3}\,+\,\left(1\,-\,o^{N}\right)^{2}\!\left(1\,-\,o^{N}\right)^{3} \end{aligned} $$

We report the complement of these probabilities (i.e. the probability of operability) in Tables 1, 2, 3, 4 and 5.

The scenarios as a function of time

In Fig. 1, I plot these results for the different constellation scenarios for the purely notional value of f=0.1, as discussed in previous examples. Note that it follows that scenario C 2 implies 1 and C 1 implies 2.

Fig. 1
figure 1

Probabilities for p(1) (solid), p(2) (dotted), p(C 1) (long dashes) and p(C 2) (short dashes) when f=0.1 as a function of mission duration

Expert solicitation exercise

I asked ESA’s Swarm Mission Advisory Group (MAG) members to supply me with their personal probability that a single individual ASM chosen at random would fail over a year. In all, there were six respondents who supplied a value for f.

The responses are given in Tables 1, 2, 3, 4 and 5 along with probabilities pertinent to the constellation and the gradiometer for N=10,8,6,5,3 years based on the formulae above.


My conclusions are based on the probabilities in Tables 1, 2, 3, 4 and 5.

  • The majority of respondents hold that with a single ASM in the lower orbit, the gradiometer will operate for 3 years with a probability more than 66 % (Table 5, column 3) and will work for 5 years with a probability of more than a half (Table 4, column 3).

  • The same respondents hold that with two ASMs in the upper orbit, the constellation will operate successfully for more than 8 years with a probability of more than a half (Table 2, column 6).

  • The respondents hold that with a single ASM in the upper orbit, the constellation will operate with a probability of half for more than 6 years (Table 3, column 5) but not more than 8 years (Table 2, column 5).

Although the results are presented based on actual MAG members’ probabilities, the results are rather generic, excepting the case when the probability of individual ASM failure is very small; in this case, any arrangement will ensure a successful mission since there is essentially no failure expected at all!

The common mode rejection of large-scale external signals from the lower pair is ideally suited for this gradiometer to successfully perform its work in the first part of the mission in a worst-case scenario. Most respondents consider that it will reach the upcoming solar minimum nevertheless.

Obviously, a decision needs to be taken by ESA on the actual assignment of orbits for the spacecrafts. An independent analysis by ESA concluded, in line with the analysis of this letter, that the safest option was to place redundant ASMs in the lonely orbit. Therefore, in early 2014, spacecraft Charlie became part of the low orbiting pair, and Bravo was assigned to the lonely orbit.

As a postscript, it should be noted that the second ASM onboard Charlie stopped functioning the 5th of November 2014. This unfortunate event leaves Charlie with no ASM. One must really scrutinize the model that assumes that failure is a random process, since two failures on one satellite argues against this model. The failure has prompted the development of efforts to calibrate Charlie against its neighbour Alpha.

If one were to take the random model seriously, despite these misgivings, one can use the performance of the ASMs to date to discover a value of λ from them. We will not take this exercise very far, as the evidence points against randomness, but we can indicate how it would proceed. We have to date (May 2015) the following evidence: failure at times (in years) t 1=ε and t 2≈0.96 and operability of four ASMs for at least t 3t 6=1.5; ε is a small but unknown number associated with the first failure. One can use the rules of probability to discover a pdf for λ given the evidence so far, namely

$$ {\small{\begin{aligned} {} p(\lambda|\{t_{i}\})&=p(\{t_{i}\}|\lambda)p(\lambda)\\ &=(1\! -\! \exp[-\lambda t_{1}])(1 - \exp[-\lambda t_{2}])\exp[-\lambda t_{3}]^{4} p(\lambda). \end{aligned}}} $$

Since ε is small the following pdf is accurate when one takes a flat prior for λ:

$$ p(\lambda|\{t_{i}\})\approx \lambda \epsilon (1 - \exp[-\lambda t_{2}])\exp[-\lambda t_{3}]^{4}. $$

The small value ε now just scales the whole probability, not affecting its shape, and so in Fig. 2, I plot this probability density for an arbitrary value of ε=0.01, and we find that the most likely value for λ would be about 0.3, of course many times higher than any of the values supplied in column 1 of Table 1.

Fig. 2
figure 2

Probability p(λ) deduced from the memoryless model given the survival and failure evidence for the six ASMs in the mission until May 2015


  • Aspinall, W (2010) A route to more tractable expert advice. Nature 463: 294–295.

    Article  Google Scholar 

  • Cooke, RM (1991) Experts in uncertainty: opinion and subjective probability in science. Oxford Univ. Press, Oxford, UK.

    Google Scholar 

  • ESA (2004) Reports for mission selection, The six candidate earth explorer missions, SP-1279 (6). Available at

  • Rice, JA (1995) Mathematical statistics and data analysis. 2nd Edition. Duxbury Press, Belmont, Califoria.

    Google Scholar 

Download references


It is a pleasure to thank Prof. Cathy Constable for her careful review of the first version of the paper.

Author information

Authors and Affiliations


Corresponding author

Correspondence to Andrew Jackson.

Additional information

Competing interests

The authors declare that they have no competing interests.

Rights and permissions

Open Access This article is distributed under the terms of the Creative Commons Attribution 4.0 International License (, which permits use, duplication, adaptation, distribution, and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made.

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Jackson, A. A probabilistic analysis of the implicationsof instrument failures on ESA’s Swarm mission for its individual satellite orbit deployments. Earth Planet Sp 67, 113 (2015).

Download citation

  • Received:

  • Accepted:

  • Published:

  • DOI: