 LETTER
 Open Access
 Published:
A probabilistic analysis of the implicationsof instrument failures on ESA’s Swarm mission for its individual satellite orbit deployments
Earth, Planets and Space volume 67, Article number: 113 (2015)
Abstract
On launch, one of Swarm’s absolute scalar magnetometers (ASMs) failed to function, leaving an asymmetrical arrangement of redundant spares on different spacecrafts. A decision was required concerning the deployment of individual satellites into the loworbit pair or the higher “lonely” orbit. I analyse the probabilities for successful operation of two of the science components of the Swarm mission in terms of a classical probabilistic failure analysis, with a view to concluding a favourable assignment for the satellite with the single working ASM. I concentrate on the following two science aspects: the eastwest gradiometer aspect of the lower pair of satellites and the constellation aspect, which requires a working ASM in each of the two orbital planes. I use the socalled “expert solicitation” probabilities for instrument failure solicited from Mission Advisory Group (MAG) members. My conclusion from the analysis is that it is better to have redundancy of ASMs in the lonely satellite orbit. Although the opposite scenario, having redundancy (and thus four ASMs) in the lower orbit, increases the chance of a working gradiometer late in the mission; it does so at the expense of a likely constellation. Although the results are presented based on actual MAG members’ probabilities, the results are rather generic, excepting the case when the probability of individual ASM failure is very small; in this case, any arrangement will ensure a successful mission since there is essentially no failure expected at all. Since the very design of the lower pair is to enable common mode rejection of external signals, it is likely that its work can be successfully achieved during the first 5 years of the mission.
Findings
Introduction
After 12 years of planning, ESA’s Swarm mission finally launched at 13.02 on 22 November 2013. This is the first low Earthorbit satellite mission comprised of three identical satellites that are able to fly simultaneously, allowing a “constellation” approach to satellite magnetometry. Separation of the three constituent satellites was successful about 90 min after launch, and all three (Alpha, Bravo and Charlie) entered orbit. Within the following hours health checks from the satellites indicated that all was well, with the only exception being that the absolute scalar magnetometer (ASM) on Charlie did not wake. This left an asymmetry in the instrument configurations of the three otherwise identical spacecrafts. Each satellite is equipped with a 3component vector field magnetometer (VFM) and a starcamera, the socalled advanced stellar compass (ASC), that enables oriented vector field measurements to be made. Calibration of the VFM is performed using data from the ASM. We shall not discuss the other instruments on each satellite that are concerned with electric field measurements and GPS acquisition (see, for example, ESA 2004).
The constellation plan of the mission proposed two satellites at low altitude flying closely sidebyside with a small eastwest separation; this configuration comprises essentially a gradiometer that should allow the determination of eastwest gradients in the crustal field that are otherwise so difficult to determine. An additional advantage of the gradiometer concept is the “common rejection mode” for external signals, whereby a difference of the two signals on the satellites can effectively reject largescale timevarying external sources that are normally so difficult to handle, leaving only the internal signal. This then presents the opportunity for determination of a highresolution model of the crustal field of the Earth. The third satellite would fly at a higher altitude with an orbit that gradually drifts relative to the orbit of the lower pair. After a few years, the two orbits become perpendicular (separation in time of 6 h or 90° in longitude), leading to an ideal configuration for other science aspects of the mission, namely the determination of the internal field and also the ability to perform electromagnetic sounding of the mantle. Both these science goals require an excellent separation of the internal and external fields, and this is most easily achieved when the local time coverage of the Earth is maximal.
In the original mission plan, Charlie was the satellite that was planned to be placed in the higher “lonely” orbit. With the failure of its spare ASM, one should consider the risk associated with the assignment of spacecrafts to different orbits, considering the fact that a subsequent loss of the only operating ASM on Charlie would leave that particular spacecraft with no absolute control on its vector measurements made by the VFM. In the following analysis, I consider failure scenarios probabilistically that allows a determination of the risk to the two scientific goals of the mission. The probabilities of failure are presented in terms of the probability of the failure of a single instrument per year, and the conclusions are rather generic. Nevertheless, I use the socalled expert elicitation (e.g. Aspinall 2010; Cooke 1991) to assign specific probabilities and thus give estimates of failure rates. The overall conclusion is that the safest assignment is to place Charlie, with only one operable ASM, into the lower orbit, and to place one of the satellites with a redundant spare ASM into the higher orbit. This determination is in agreement with the decision taken by ESA in early 2014, which was to place Bravo into the higher orbit and to place Charlie as one of the lower pair.
Definitions
Consider a single ASM chosen at random from the spacecrafts. Since all instruments are identical we believe a priori that they all have identical probabilities of failure, typically from space radiation. Failure of the ASM is the event F, and the probability that it will fail during one year is
and consequently the complementary probability of continued perfect operation, termed operability O for short, is
In what follows, we use notation p(a b) for the events a and b both occurring, where each event refers to an individual magnetometer. The notation $\overline {ab}$ stands for the event ab not occurring. Clearly $O=\overline {F}$ and vice versa.
We assume a memoryless process; the probability of failure is independent of the time already passed, during which the instrument functioned. Rice (1995) analyses this process and argues that the mathematical form is uniquely determined by its memoryless property. I make the simplifying assumption that the probability for an instrument to fail does not depend on it being switched “on” or “off”. I do not consider any type of instrument aging; my primary concern is that of damage to the instrument through radiation dose. Thus, this is not the same as the problem faced with a car (G. Hulot, personal communication 2014). A garaged car tends to live longer than one that is used. Since I consider radiation dose, it is likely that the effect is the same whether the instrument is “on” or “off”. In the car analogy, in this case, leaving the vehicle in the garage does not help to prolong its life. Since there remain open questions concerning the real reasons concerning instrument failure, I simply state my assumptions clearly here.
The memoryless process is described by the exponential distribution, so that the probability of a lifetime T (continued operability) being at least t is
The probability of failure in interval t→t+d t is λ exp(−λ t)d t, consistent with the fact that the probability of failure in 0→T is
Clearly, λ is the instantaneous rate of failure, but this is not a quantity we are used to dealing with. We see below in the examples that we are more used to reporting failure rates over finite time periods, such as a year or a decade.
We now consider two ASMs together on one satellite. For the two magnetometers both to have failed we have
and thus the probability of at least one ASM still working is
Examples
Let us take as an example, a 10 % probability per year that an ASM will fail. Using our model, this means when t is measured in years, the probability of failure when t∈[0,1] is 1− exp(−λ)=0.1. We use this to discover an appropriate value of λ: −λ= ln(0.9) or λ=0.105. Note that this is not quite the same as one would have deduced for λ if one had considered the statement of the failure rate to have been an instantaneous one; the instantaneous rate assigns λ=0.1, but we consider that it is better to interpret the statement of failure under the given finite time and hence set λ accordingly. As a result, we introduce a notation we shall use henceforth when we work in integer numbers of years N; We take o= exp(−λ) (o = 0.9 in the present example), and thus operability after N years is just o ^{N}.
We find from the preceding formulae that the chance of a working ASM after 6 years is 0.53 and after 10 years 0.35. We can see that when two ASMs are together, the chances of one of them still working is 0.78 after 6 years and 0.575 after 10 years. One sees that for a gradiometer configuration with three ASMs (i.e. one satellite has one ASM and the other has two), the probability of operability after 10 years is 0.35×0.575=0.2. Conversely, with both being dual ASMs, the probability of operability is (0.575)^{2} = 0.33.
With three ASMs, the probability of at least one continuing to work after 10 years is 0.73.
Gradiometer
Let us now find the probabilities of a working gradiometer in the following two cases: when a) both satellites have two ASMs and b) when only one satellite has two and the other has one. I use the symbol ∇_{ j } to denote a gradiometer in the low orbit being considered where one of the satellites has j ASMs. It should be noted that the second satellite in the low orbit will always be equipped with two ASMs. I also use the notation C _{ j } to discuss what I call “constellation” measurements, which rely on having a working ASM in both a high and a low orbit; j is now, in this case, the index stating the number of ASMs on the highorbit satellite.
Both double ASMs in low orbit
I call this scenario ∇_{2} since there are two ASMs on both low satellites. Operability occurs with probability
Single ASM in low orbit
I call this scenario ∇_{1} since there is one ASM on one of the low satellites. Operability occurs with probability
Constellation
Let us now find the probabilities of a working constellation, by which I mean that there is one working ASM in a high orbit and a minimum of one working ASM in a low orbit. We treat the following two cases: when a) the lonely orbit satellite has one ASM and b) when the lonely orbit satellite has two ASMs.
Both double ASMs in low orbit (i.e. lonely ASM)
I call this scenario constellation 1, or C _{1}, since there is one ASM on the lonely satellite.
We report the complement of these probabilities (i.e. the probability of operability) in Tables 1, 2, 3, 4 and 5.
Three ASMs in low orbit and double ASM in lonely orbit
I call this scenario constellation 2, or C _{2}, since there are two ASMs on the lonely satellite.
We report the complement of these probabilities (i.e. the probability of operability) in Tables 1, 2, 3, 4 and 5.
The scenarios as a function of time
In Fig. 1, I plot these results for the different constellation scenarios for the purely notional value of f=0.1, as discussed in previous examples. Note that it follows that scenario C _{2} implies ∇_{1} and C _{1} implies ∇_{2}.
Expert solicitation exercise
I asked ESA’s Swarm Mission Advisory Group (MAG) members to supply me with their personal probability that a single individual ASM chosen at random would fail over a year. In all, there were six respondents who supplied a value for f.
The responses are given in Tables 1, 2, 3, 4 and 5 along with probabilities pertinent to the constellation and the gradiometer for N=10,8,6,5,3 years based on the formulae above.
Conclusions
My conclusions are based on the probabilities in Tables 1, 2, 3, 4 and 5.

The majority of respondents hold that with a single ASM in the lower orbit, the gradiometer will operate for 3 years with a probability more than 66 % (Table 5, column 3) and will work for 5 years with a probability of more than a half (Table 4, column 3).

The same respondents hold that with two ASMs in the upper orbit, the constellation will operate successfully for more than 8 years with a probability of more than a half (Table 2, column 6).

The respondents hold that with a single ASM in the upper orbit, the constellation will operate with a probability of half for more than 6 years (Table 3, column 5) but not more than 8 years (Table 2, column 5).
Although the results are presented based on actual MAG members’ probabilities, the results are rather generic, excepting the case when the probability of individual ASM failure is very small; in this case, any arrangement will ensure a successful mission since there is essentially no failure expected at all!
The common mode rejection of largescale external signals from the lower pair is ideally suited for this gradiometer to successfully perform its work in the first part of the mission in a worstcase scenario. Most respondents consider that it will reach the upcoming solar minimum nevertheless.
Obviously, a decision needs to be taken by ESA on the actual assignment of orbits for the spacecrafts. An independent analysis by ESA concluded, in line with the analysis of this letter, that the safest option was to place redundant ASMs in the lonely orbit. Therefore, in early 2014, spacecraft Charlie became part of the low orbiting pair, and Bravo was assigned to the lonely orbit.
As a postscript, it should be noted that the second ASM onboard Charlie stopped functioning the 5th of November 2014. This unfortunate event leaves Charlie with no ASM. One must really scrutinize the model that assumes that failure is a random process, since two failures on one satellite argues against this model. The failure has prompted the development of efforts to calibrate Charlie against its neighbour Alpha.
If one were to take the random model seriously, despite these misgivings, one can use the performance of the ASMs to date to discover a value of λ from them. We will not take this exercise very far, as the evidence points against randomness, but we can indicate how it would proceed. We have to date (May 2015) the following evidence: failure at times (in years) t _{1}=ε and t _{2}≈0.96 and operability of four ASMs for at least t _{3}…t _{6}=1.5; ε is a small but unknown number associated with the first failure. One can use the rules of probability to discover a pdf for λ given the evidence so far, namely
Since ε is small the following pdf is accurate when one takes a flat prior for λ:
The small value ε now just scales the whole probability, not affecting its shape, and so in Fig. 2, I plot this probability density for an arbitrary value of ε=0.01, and we find that the most likely value for λ would be about 0.3, of course many times higher than any of the values supplied in column 1 of Table 1.
References
Aspinall, W (2010) A route to more tractable expert advice. Nature 463: 294–295.
Cooke, RM (1991) Experts in uncertainty: opinion and subjective probability in science. Oxford Univ. Press, Oxford, UK.
ESA (2004) Reports for mission selection, The six candidate earth explorer missions, SP1279 (6). Available at http://esamultimedia.esa.int/docs/SP_1279_6_Swarm.pdf.
Rice, JA (1995) Mathematical statistics and data analysis. 2nd Edition. Duxbury Press, Belmont, Califoria.
Acknowledgments
It is a pleasure to thank Prof. Cathy Constable for her careful review of the first version of the paper.
Author information
Additional information
Competing interests
The authors declare that they have no competing interests.
Rights and permissions
Open Access This article is distributed under the terms of the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0), which permits use, duplication, adaptation, distribution, and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made.
About this article
Received
Accepted
Published
DOI
Keywords
 Lower Pair
 High Orbit
 Individual Satellite
 Successful Mission
 Instrument Failure