Skip to content
GUIDE · SATELLITE OPERATIONS · ADVISORY

How to Investigate a Satellite Anomaly

A channel drifts out of family. Is it the hardware, a command someone sent, or the environment? An investigation has to answer that with evidence, and say where the evidence stops. This is the method, step by step, and what Jantar does at each step.

Try an investigation
THE FAILURE

Why investigations go wrong

The alarm is the easy part. The hours after it are not. An on-call engineer pulls telemetry from one tool, the manual from another and the command log from a third, and correlates them by hand.

Under pressure, two mistakes are common. A commanded response is taken for a fault. And a confident cause is written down before the evidence for it is checked. The second is worse: a wrong cause sends the recovery down the wrong path, and a report that does not say what it rests on cannot be checked afterwards.

THE METHOD

Six steps, in order

  1. Check the data before the spacecraft

    A gap is not a zero. Readings delivered out of time order cannot say which way a value moved. Before any hypothesis, establish what was actually measured.

    In Jantar: Gaps are recorded as gaps and never filled in. A window delivered out of time order yields no evidence at all, rather than a guess about its order.

  2. Check command history first

    Most deviations follow a telecommand: a heater switched on, a mode changed, a table loaded. A commanded response looks exactly like a fault until someone checks.

    In Jantar: A deviation that follows a related command within a set window is suppressed before an investigation starts. Command history is read, never written.

  3. Map the channels to components

    Which parts could move these channels, and what else would those parts move? The answer narrows the search and names the channels to check next.

    In Jantar: The spacecraft’s knowledge graph links each channel to its components, subsystems and the failure modes that affect them, including what feeds what.

  4. Take candidates from the FMECA, not from a guess

    The operator’s failure modes, effects and criticality analysis is the record of what can go wrong with this spacecraft. Candidates come from it.

    In Jantar: Candidate causes come only from the operator’s FMECA. A cause that is not in it cannot be named, however plausible it sounds.

  5. Test each candidate against the telemetry

    Does each channel move the way the failure mode says, in direction, persistence and onset? Did the channels it says should stay nominal stay nominal?

    In Jantar: Each leading candidate is tested on its own against the telemetry windows. Candidates the evidence does not support are ruled out, with the reason recorded.

  6. Draft the recovery, and hold it for a person

    The procedure comes from the operator’s own procedures. A person decides whether to run it, with the evidence in front of them.

    In Jantar: Every step carries a citation or is marked ungrounded, and an ungrounded step blocks release. The draft is held for a human, and a held draft expires rather than waiting indefinitely.

Space weather is context, not proof

A memory error during a proton event is suggestive, not conclusive. When a space-weather source is configured, Jantar reads published indices as context: they can support a claim about the spacecraft, and can never prove one on their own. A feed that cannot be read later is read but never cited.

THE LIMIT

Where Jantar stops

Jantar needs the operator’s FMECA, documents and telemetry. Without them it does not guess. ESA’s OPS-SAT-1 has no public FMECA, so the right answer on every one of its anomalies is to decline. Anomalies investigated: 434/434. Declined, never a cause: 1.000. Fabricated causes: 0. Commands staged: 0.

Read those figures for what they are. The run supplied no failure modes at all, made no model calls, and took its anomalies from the operators’ own labels rather than from Jantar’s detection. It measures whether Jantar refuses when the evidence is absent, not whether it can diagnose.

Every root-cause figure we publish is measured on JANTAR-REF-1, a synthetic reference spacecraft we built. A real operator’s data is what turns that into evidence about a real mission, and we say so wherever the figures appear. The detection results on OPS-SAT-1 are on the benchmark page, with their protocol.

Where to go next