Know what's wrong with your satellite, and what to do about it.
Health monitoring and fault diagnosis for small-satellite operators — with a false-alarm budget you set, and an attributable reason attached to every alarm.
Notes
- Validated on real ESA mission telemetry.
- Every number published with its source.
- Your operators make every call.
View A — the plan not to scale
- From the groundNow
- OnboardNext
- Our own satellite phantom — not yet builtThen
- More than software phantom — unspecifiedBeyond
Sheet 01The problem
Thresholds miss the failures that matter, and cry wolf about the ones that don't.
Most small-satellite teams monitor bus health with hand-written threshold rules and whoever is on console.
Thresholds miss slow drifts, stuck-at faults and cross-channel interactions. When they do fire, they fire constantly — and operators learn to ignore them.
Diagnosis — working out which subsystem is actually failing from a wall of correlated alarms — still happens in someone's head, usually hours after the pass.
Illustrative — not mission data. A sun-synchronous orbit computed for this page, seen from a notional station in Glasgow: flown to closest approach, then predicted (phantom line).
Illustrative signal, not mission data. Single channel · synthetic · fixed seed, identical on every load.
A drawing of one synthetic telemetry channel: a quiet noisy trace that develops a slow drift and then a sharp excursion, with the excursion marked. It is an illustration of the shape of the problem and carries no measured result.
Sheet 02Detection, at a budget you set
Same budget. 18% of events caught, or 81%.
Both bars: see notes — the budget is matched
- ESA OPSSAT-AD — 529 expert-labelled segments, 113 events.
- False-alarm budget matched at 10 / hour / channel, both bars.
- Event-wise metrics, ESA-ADB methodology.
Detail A — roughly an eighth of the raw false-alarm rate
3.76 false alarms per hour observed, against 28.84 per hour uncalibrated — the same detector, a 7.7× reduction.
What travels with thisCalibration is what buys it, and it is the same dial an operator uses to trade sensitivity against console noise. It is a dial, not a package.
Detail B — both ends of that dial
Run uncalibrated and our most sensitive detector flags 112 of 113 labelled events at 0.5-second median latency.
The cost of that sensitivityThat operating point runs at 15.14 false alarms per hour, where three of every four alarms is false. Calibrated to a 10/hour budget, that same detector reaches 8% recall. Two ends of a dial, not a package — which is why we never quote them in one breath.
Sheet 03A budget that holds
Set “no more than N false alarms per week.” Pick one and see what it did.
Three budgets were tested against 447 days per channel of real ESA mission telemetry, on four channels. Twelve configurations. These are the committed results — the only three that exist.
What travels with these numbers 447 days per channel across four channels (4.9 channel-years) of real ESA Mission-1 telemetry, on the shipped default configuration. Each panel's observed figure is the range across the four channels at that budget; the ratio band below it spans all twelve configurations. All twelve sat inside a 95% Wilson interval and held to within 1.5% of target. This is coverage held over the long run, not a finite-sample proof — and only these three budgets were tested, so the panel offers only these three.
Sheet 04An explanation, not just an alarm
An alarm tells you something moved. This tells you what broke.
Fault diagnosis ranks hypotheses across subsystems and states its evidence in plain English. The shape of the answer:
Battery-cell fault, confidence 0.82 — power and pack temperature are both away from where they should be; comms symptoms are downstream of the EPS.
What travels with this That is a format illustration, not a measured case. The power and thermal evidence behind it is validated on our simulator only — OPSSAT's magnetometer and photodiode channels carry no power or thermal observables to test it against. We state it as design intent, and will not claim otherwise until it is demonstrated on real telemetry.
Sheet 05Safe by construction
Your operators stay in command.
Detail C — your operators decide
Every suggestion goes to your operators first. They decide what reaches the spacecraft.
Detail D — the checks on the onboard safety component
66 of 66 generated mutants killed. Property suite at 2048 cases per property. Exhaustive state-space enumeration. Model-checked with Kani on scheduled CI.
What travels with thisModel-checked on scheduled CI, not per-commit. We say which, because the difference matters.
Sheet 06The onboard path
It already fits on the flight computer.
The same code path is built for embedded flight computers. The ground tool is step one of an onboard autonomy roadmap, not a port of it.
What travels with these numbers Flash, RAM and instruction counts are measured exactly under emulation. Cycles-per-instruction is now measured on silicon — 1.65 to 1.95 on a Cortex-M7 devboard, in both cache configurations, with the emulation anchor reproduced bit for bit. CPU load remains strongly target-dependent. The 1.97–2.32% figure applies this board's measured CPI to a different part's clock — an extrapolation, and we label it as one. The 13–19% figure is still projected at an assumed CPI, because the on-silicon run covered the M7 class only. We state the FPU class with the number, and we do not call a projected figure measured.
Sheet 07Where we're going
Ground first. Then the spacecraft itself.
The drawing at the top of this page is the whole plan. Here it is as a revision block, one revision at a time.
- ANow
From the ground
Health monitoring and fault diagnosis on your ground segment, against your own telemetry. Every engagement starts here today.
DrawingGround station and downlink shown.
- BNext
Onboard
The same code path on the flight computer, so a spacecraft can recognise its own faults between passes. It already fits — see sheet 06.
DrawingGround station and downlink removed. Core redlined: it runs onboard.
- CThen
Our own satellite
A small spacecraft of our own, to prove the onboard layer in orbit rather than on a bench.
DrawingSatellite redrawn as our own, hexagonal. Panels added.
- DBeyond
More than software
The software is where Orbital-AI starts, not where it stops.
DrawingCompanion and outer orbit added, in phantom.
What travels with this Direction, not a schedule. We put a date on something when we can measure it.
Sheet 08Why believe any of it
The discipline is the product.
Anyone can put a number on a website. Here is the machinery that stops us putting the wrong one there.
Every number has a row
Each public figure has an entry in our claims-provenance file naming its source report, the command that produced it, whether it is measured, derived or projected, and the caveat that must travel with it. CI fails if any of them drifts from its source artifact.
A mission we have never looked at
A second ESA mission is held out of development entirely, behind a code-level guard that raises unless explicitly overridden at release time. It is not a promise; it is a function that throws.
We reproduce the published baseline
0.296vs 0.295Our isolation-forest segment F1 is 0.296 against the benchmark paper's 0.295. Segment F1, not event F1 — a benchmark audience will check, and they should.
ESA's data, ESA's methodology
The harness pins ESA's expert-labelled OPSSAT-AD dataset by checksum and follows the ESA-ADB event-wise evaluation methodology, not point-wise F1.
What travels with this page Every figure on this page is measured on public data and traces to a committed report naming the command that produced it. Where a number is derived or projected rather than measured, this page says which, next to the number.
Sheet 09Start here
Start with an Alarm Review.
| Item | Description | Price |
|---|---|---|
Alarm ReviewBefore any pilot, make the limits you already fly with earn their keep. You send — a stretch of housekeeping telemetry and the limit table your mission-control software runs today — to us, under a mutual NDA. You get — a tuned limit table for that same software. |
£950Fixed price | |
Then, if it earns it: a fixed-scope pilotWe're taking on a small number of fixed-scope pilot deployments.
|
— |
Title blockContact
Worth 20 minutes?
If you operate a small satellite and your bus-health monitoring is a threshold file and a console, I'd like to show you what the same telemetry looks like through this.
ankit@orbital-ai.uk