UNISEC外第22-22号

Mission Assurance Handbook
for the University-built Lean Satellite
Ver 2.0

March 2023
University Space Engineering Consortium (UNISEC)

1Mission Assurance Handbook for the University-built Lean Satellite
Contents
1. Introduction
2. Project Management
2.1 Schedule Management
2.2 Team Organization
2.3 Improving Project Efficiency
2.4 Frequency Coordination and RF License
2.5 Compliance with Safety Requirements
2.6 Documentation Control
2.7 Defect Management
2.8 Relationship with External Stakeholders
2.9 Funding Plan
3. Defining the Mission
3.1 Feasibility
3.2 Success Criteria
3.3 Mission Scenario
3.4 Risk Management
4. Conceptual Design
4.1 Requirements Management (Consistency between Mission Requirements,
Design Requirements, and Verification Requirements）
4.2 Incorporation of the Lessons Learned from Past Projects
4.3 Safety Requirements Compliance Check
4.4 Verification Plan
5. Detail Design
5.1 Selection of Parts and Components
5.2 Risk Management, FTA and FMEA
5.3 Aiming for a Satellite that can Survive
5.4 Avoid Excessive Protective Functions
5.5 Points to Note in Design Changes
5.6 Satellite Design allowing Easy Operation
5.7 Satellite Design that is Easy to Test and Easy to Assemble, Integrate and Test
5.8 Understanding of Design Basis
5.9 Before advancing to FM Phase
5.10 Safety Requirements Compliance Check
6. Satellite Assembly and Integration
6.1 Quality Control
6.2 Contracting the Work or Building Inhouse
6.3 Safety Requirements Compliance Check
7. Testing
7.1 Electromagnetic Compatibility Test
7.2 End-to-End Mission Test
7.3 Electrical Interface (Integration) Test
7.4 System Functional Test
7.5 End-to-End Long Term Operation Test
7.6 Deployment Test
7.7 Fit Check
7.8 Thermal Test

1

7.9 Vibration Test
7.10 Test Configuration (Test-as-you-Fly)
7.11 Use of Outside Testing Organization
7.12 Evaluation of Test Results
7.13 Defect Management
7.14 Storage of Satellite
7.15 Confirmation of Compliance with Safety Requirements
8. Satellite Operation
8.1 Preparation and Maintenance of Ground Systems
8.2 Satellite Operation Plan
8.3 Handling Anomaly and Failures in Orbit
9. After Satellite Operation
9.1 Lessons Learned
9.2 Recording, Reporting and Publication of Results
9.3 Sharing of Knowhow
10. Sustainability of University satellite Program10.1 Viewpoint as a Program
10.2 Strengthening the Research Base in University
10.3 Funding of Project10.4 Cooperation with Outside Organizations2

Abbreviation
AIT
AT
BBM
CDR
C&DH
EM
FM
FET
FMEA
FTA
ISS
MA
MDR
MCU
MOSFET
OBC
PDR
QT
Rx
Tx

Assembly, Integration and Testing
Acceptance Test
Bread Board Model
Critical Design Review
Command and Data HandlingEngineering Model
Flight Model
Field Effect Transistor
Fault Mode Effect Analysis
Fault Tree Analysis
International Space Station
Mission Assurance
Mission Definition Review
Micro-Controller Unit
Metal-Oxide-Semiconductor Field Effect Transistor
OnBoard Computer
Preliminary Design Review
Qualification Test
ReceiverTransmitter3

1. Introduction
This document summarizes the matters that all the members of lean satellite
projects at universities and/or technical colleges (collectively referred as the
Universities), including professors, staffs and students, must remember in order toimprove the mission success rate. The phrase “Mission Assurance” means a series ofactivities to identify the factors in design, construction, operation of the satellite, etc.
that will hinder mission success and to eliminate or decrease the effects of suchfactors.
Lean satellite is a satellite that utilizes non-traditional, risk-taking development
and management approaches – with the aim to provide the satellite value to thecustomer and/or the stakeholder at low-cost and without taking much time to realize
the satellite mission[1]. Most of so-called nanosatellites and micro-satellite,
including CubeSats, fall into this category, especially the ones built by universities.
Throughout the rest of this handbook, the word of “lean satellite” is used to refer tothe nano-satellites and micro-satellites.
More than 20 years have passed since the universities started making satellites,
and a lean satellite is now not just an educational tool for students but is used for
cutting-edge scientific observation and business. Many start-up companies, the socalled “New Space,” have been launched by former students who experienced
university satellite projects. They have become the driving force behind the growing
space industry sector.
In Japan, more than 20 universities have launched lean satellites into orbit, but
the mission success rate remains low. This trend applies worldwide, and according
to Reference [2], 25% of satellites launched by the universities were DOA (Dead-onArrival; Contact is lost immediately after the satellite reached orbit), and less than
50% of satellites are said to be successful, even including those classed as partiallysuccessful.
The primary purposes of university satellites are education, technology
demonstration, and scientific observation. Even when the main purpose is education,
the educational effect by operation of the satellite is comparable to the effectobtained in development of the satellite. Accordingly, certain operations of thesatellite, such as the acquisition and downlinking of data on the orbit, should be
intended even in projects for educational purposes.
Improvement of the mission success rate of the university satellite does not only
contribute to education of students who will enter the space business sectors after
graduation, but also leads to improved results in challenging technology
demonstration and scientific observation using such satellites. Such results will
become a pathfinder of the larger scale missions and will contribute to growth of thespace sector overall.
This document is prepared based on the analysis results of both the successful andfailed missions presented at the Lessons Learned Sharing Meetings of the
University Space Engineering Consortium (UNISEC) in 2020. The summary of the
Lessons Learned Sharing Meetings is already published as Reference [3]. In Section
5.2 of Reference [3], the requirements to ensure the lean satellite mission successare listed as “Selection of Mission Assurance Requirements of Lean satellites.” The
present document is intended to be a constant reference by professors and students
participating in the satellite projects by revising the requirements in Ref.[3] basedon the further root cause analysis of the failed projects. In particular, the following
four items are considered.

4

●
●
●
●

The appropriate management method in the university according to the project
execution form
The key points to achieve the project efficiently.
The things to be done to improve the mission success rate at each phase of the
project lifecycle from mission definition to post-operation, andThe key points to make the university satellite program sustainable to improvethe mission success rate steadily as a program not as individual projects.

Mission success rate of the university satellite is extremely low for the first project.
It significantly improves, however, for the second satellite and subsequent satellites
because the lessons learned in the first satellite can be used. However, failure cannot
be completely avoided for the second and subsequent satellites. The mission successrate can be further improved by sharing lessons learned in the satellite projects byothers. Therefore, the target readers of this document are not only the professors,
staffs and students who are first engaged in the development of the satellite but also
include those engaged in the projects of the subsequent satellites.
This document was made as a part of contract, “Investigation of supporting
methods utilizing JAXA knowledge to improve the mission success rate of leansatellites, fiscal year 2021” (JX-PSPS-536920A) given to University SpaceEngineering Consortium by Japan Aerospace Exploration Agency.

52. Project Management
2.1 Schedule Management
It is quite rare for the university satellite to be successful in the mission from thefirst satellite. In many cases, the mission fails due to the lack of time for the systemtest caused by poor schedule management coming from lack of experience. Because
the university satellite is usually launched by ride share or piggy-back, it is almost
impossible for the satellite builder to determine the deadline of satellite delivery to
the launch provider. Table 1 shows the milestone chart that should be used forschedule management with the satellite delivery date designated as “D”. It isdifficult to reduce the time required for (A) through (E). Time required for orderingand procurement of the material, parts, and components cannot be reduced by
student effort alone. To what extent and for how long the entire system can be
combined and tested to find the defects of hardware and software and correct themin (A) and (B) determines the mission success rate. Therefore, maintaining theschedule by reducing the time required for (A) and (B) should never be considered.
Table 1 Schedule Management Milestones
Milestones
Delivery of the satellite to the launch vehicle assembly site
Software debugging (1 month)
The hardware and software of the FM is completed and testing of
the hardware (vibration, thermal, vacuum tests, etc.) is finished.
The basic software of the ground station is completed.
(B)
Assembly, integration, and test of the FM (2 months)
MonthD-3
Variety of hardware used for the FM is received and awaiting
assembly(C)
Order placement and procurement for the FM (3 months)
MonthD-6
Testing of the EM is complete and functioning as the satellite
system is confirmed(D)
Assembly, integration, and test of the EM (4 months)
MonthD-10 Variety of hardware used for the EM is received and awaiting
assembly(E)
Order placement and procurement for the EM (3 months)
MonthD-13 Feasibility of the conceived mission is confirmed
Design of the EM is complete and order placement starts(F)
Proof of Concept*Month D-A Mission profile of the satellite is decided* The timing differs dependent on the satellite project.
Timing
D(A)
MonthD-1

During period (A) (1 month), the hardware should not be changed/modified,instead the focus will be on debugging the software by the end-to-end long-term
operation test (see 7.5). Even if a software bug is found, whether or not to modify thesoftware before the satellite delivery should be carefully decided by comparing therisk of modification (the functioning part before modification may become
nonfunctional) with the risk of non-modification (the bug may occur in orbit).
During period (B) (2 months) the FM is assembled, integrated, andenvironmentally tested (AIT). AIT requires at least 2 months because modificationof the FM will be required when problems are found during the AIT. When the test6

is conducted by an outside testing organization, close communication should bemaintained with the organization as the test schedule may have to be changed
frequently.
During period (C) (3 months) order placement and procurement of the FM are
performed, but a certain minor modification to the FM is unavoidable according to
the test results of the EM. There are cases where an unexpectedly long time isrequired to revise the EM designs. During such time period, the schedule of the FM
test should be established and the test facility should be secured. Considering thepossibility that the time required for assembly and integration of the FM will requireconsiderable time, two schedule plans of the FM, Plan A (the processes progress asplanned) and Plan B (the processes do not progress as planned) should be prepared.
During period (D) (4 months) the EM is assembled, integrated, and tested.
Assembly and integration should be conducted step by step using the material, partsand components received confirming compatibility of the interface, rather thanconducting assembly and integration all at once after all the components are received.
Incompatibility of the mechanical interface will require modification of thestructures and/or circuit boards. Incompatibility of the electrical interface will
require tremendous time for troubleshooting. As the members involved will not be
accustomed to environmental tests, e.g. vibration and thermal vacuum tests, ample
margin in the test schedule should be considered. Especially in the case of the firstsatellite, the vibration test of the EM will not be completed in a single test. The teamshould be prepared to do such tests multiple times. CDR is usually conducted at theend of the period (D).
Period (E) (3 months) is the period waiting for delivery of the EM, but there aremany things to be done during this period, such as the structural analysis andvibration test of the STM for the safety review, software development using the BBM,
etc. The test schedule of the EM should be prepared and availability of the test
facility should be confirmed during this period.
During Period (F) (the duration depends on each project), the mission feasibility
should be confirmed using hardware like BBM. The proof of concept (PoC) should beobtained. When multiple missions are planned, some missions may need to beabandoned if the PoC is not obtained. Postponing the decision may lead to designchanges at the EM or FM stages, which results in the cost increase and the schedule
delay. If PoC of the main mission is not obtained, the mission requirements should
be reviewed in detail. MDR is usually conducted at the beginning of Period (F) andPDR at the end of Period (F).
2.2 Team Organization
It is impossible for a university satellite project to find all the necessary talents inthe students alone. The shortage should be filled by using staff members, expecting
the growth of the student, cooperating with outside organizations, and by purchasing
items. The solution should be selected considering mission difficulty, project budget,
geographical conditions, etc. In any project, identification of the required talents inthe team is extremely important to formulate the satellite missions. Table 2 provides
the checklist to be used for identification of the talents for reference. Although thischecklist does not determine whether the team organization is good or bad, it can beused to overlook the various aspects such as the team experience, the skill level ofstudents, the diversity of the specialty, etc.
Once the talents within the team are identified, it is important to effectively

7acquire the required expertise and knowhow that are not available in the team byoutsourcing. The important thing to note is the team members must fully
understand the requirements of such components and the specifications must be
consistent with the mission requirements and system requirement, even when thedevelopment and manufacture of the components are outsourced. After thecomponent is delivered to the university, it is the responsibility of the university
team to incorporate the component into the system for verification of the entire
satellite, and all the team members must remember such responsibility.
The university satellite project is not possible without devoted efforts by students
even when dedicated staff are hired. Participation in the project by the students is
supported by motivation. The level of motivation is different among the students.
Some students are highly motivated. Some are not. The professors must keep inmind that the responsibility to maintain and enhance such motivation entirely
belongs to the professors. It is natural that the motivation level is different. There isa possibility that the project schedule is delayed because a student whose motivation
is not high is assigned an important task. The role of project manager is extremely
important to catch the sign of schedule delay due to the student motivation anddiscuss the issue with the principal investigator, i.e. the professor. The project
manager and the professor should continuously communicate each other, find the
problem and the solution.
When the project is run as the laboratory project, the project activities can belinked to the bachelor thesis, master thesis, or doctoral dissertation. When this is
not the case, it is necessary to make the students find a certain meaning inparticipating in the project. If the project is run by a small team yet as a timeintensive project, there will be intensive mental pressure on the students. It isnecessary to make every student have a clear view of what he/she can get once theproject goal is achieved.
When the project is run as an extra-curricular activity where participation isdecided at the discretion of each student, the participants are mostly young
undergraduate students. The relationship between such student and the professor
is not so close compared with a project run by a lab. Such project does not involve a
competition with others like ordinary extra-curricular athletic activities and does
not have a clear goal at several months ahead like a robot competition. Unless theprofessors demonstrate an attitude of actively participating in the project and to deal
with student concerns early, it will be difficult to maintain student motivation onlyby the relationship among students.
It is absolutely important that the target launch date is secured to keep student
motivation high. A project without a definite satellite launch date may not be run
consistently. However, it does not mean that the students can build a reliable
satellite once the target launch date is fixed. The professors must always say thatthe project success is not the moment when the satellite is made by the target launchdate, but that the real success is to achieve the mission success in orbit. The students
will not really participate in the project unless professors say the mission success isthe most important.
If the development of the satellite takes too long time, a student can experience
only a part of the process, which keeps maintaining student motivation difficult. The
motivation comes when the student can experience the entire process of the satellite
development up to operation of the satellite. Therefore, it is desirable to keep the
project lifecycle from start to operation within 3 years.

8The establishment of the 3-year project lifecycle is very important. If a problem
that is overlooked during development is found in orbit, such problem must be
rectified by operation. Although what the team can do is limited, recovery from ahopeless situation may become possible if the members are familiar with the designof the satellite. They know a wide range of steps available for recovery. The majorityof the university satellite projects are run as a lab-type project by a laboratory in anengineering department, where the students can generally participate in the project
during the fourth grade (senior) and 2 years in the master’s course. When the project
period exceeds 3 years from start to launch, students familiar with the design of thesatellite are no longer available at the time of satellite operation. In the case of theresearch-oriented project supported by a large amount of funding obtained byoutside organizations in which many dedicated staff and graduate school students(master’s course and doctoral students) participate, the dedicated staff should be
hired for the duration including operation of the satellite, without limiting the term
to the completion of satellite development. In the case of a club-type activity projectin which students other than those in the professor’s lab participate, a lifecycle
exceeding 3 years will be possible. However, when the project period is too long, it isdifficult to maintain student motivation. The students will not be able to spend muchtime on the project after the 4th grade, because they have to spend more time intheir final year projects (i.e. bachelor thesis). It is difficult to spend time in thesatellite project without understanding of the research supervisor. Therefore, it ispreferred to limit the lifecycle by approximately 3 years.
In the case of university satellites, while priority is given to the decisions made by
the dedicated professor who is a P/I (Principal Investigator), critical decisions should
be made not by this professor alone, but should be made after careful discussion
between team members. The professors must be open-minded and willing to hear
opinions from others.
When the project manager is a student, postdoctoral fellow, or junior professor,
the senior professor (usually the P/I) should constantly oversee the status and should
ask assistance from outside when required. As a student or postdoctoral fellow will
not have appropriate contact with the outside, it will be difficult to obtain theassistance. Accordingly, it is the responsibility of the senior professor to establish
the appropriate contact with the outside. The professor should not leave it to thestudent or postdoctoral fellow. Once the channel is made, however, it is better forthe student or postdoctoral fellow who knows the issues the most to contact theoutside directly to avoid a message game.
In the case of project organization where the project manager alone can oversee
the entire system, a significant risk is posed as there may be an accident/incident
involving such project manager. As such, multiple team members must be familiar
with the entire system. Sharing of information between team members should beconsidered. Project management highly dependent on a single person is too risky andshould be avoided. So, the organization of the development should be preferably
established where all team members work together in a single room. To the contrary,
it is not a lean satellite project where entire the system cannot be overseen by the
project manager alone. As the system becomes complicated, the person withexperience in lean satellite development (a person who has experienced the entire
system lifecycle) should be appointed as the project manager.

9

Table 2 Checklist for Identification of the Talents in the Satellite Project
Item
Time available for the project 100
50-99(%) by the responsible
professor (P/I) besides timeused for lecturing
Experience of the responsible 3 or more
2
professor in satellite projects
Faculty members involved in 3 or more2
the satellite project (full-timein the department)
Dedicated staffs involved in 3
2
satellite project
Professors’ area of expertise Astronautics Science(multiple fields)
Project manager
Responsible Full-time
professor
professor(P/I)
other than
P/I
Number of satellite projects 3 or more2experienced by project
manager
Subjects of study of
Astronautics Science
participating students(multiple subjects allowed)
Grade of students (multiple Doctor
Mastergrades allowed)
Participation of students
Recommend Limited

20-49

Selections of Response
5-19
0-4

1

0

1

0

1

0

Mechanicalengineering
Dedicated
staffElectricalengineering
Doctoralstudent

10Communication Mechatronics
engineering
Master’s course Undergraduate
student(in theprofessor’s lab)

Mechanical ElectricalCommunication Mechatronics
engineering engineering engineering
4th year

3rd year

ComputerOtherscience
Undergraduate(not in theprofessor’s lab)

ComputerscienceOther

1st/2nd year

0

other than those in theprofessor’s lab of the
responsible professor
Percentage of students withexperience of the satellite
project (%)
Number of outsideorganizations independently
involved in satellite project

ed

100

50~99

20~49

0~19

3 or more

2

1

0

0

1

2.3 Improving Project Efficiency
Activities in the satellite project are classified into three categories according toReference [4]. The first category is activities to enhance the value of the satellite.
This includes MA. The second category is activities that will not enhance the value
but are necessary. The second category includes activities related with the safety
review, the Space Activity Act, RF license, etc. The third category is activities thatwill create no value (useless activities, “Muda”). In a lean satellite project, thedevelopment and operation of the satellite becomes possible by a lean workforce andbudget, reducing such useless activities to the minimum.
In the satellite project, useless activities frequently arise in moving and waiting.
Such useless activities should be reduced and the time created by reducing theuseless activities should be used for MA. Even when the satellite is developed in one
campus, if individual teams are located in different buildings, the time required tomove to and meet at a certain place for meetings and AIT is useless. The timerequired to move to the ground station for operation of the satellite is also useless.
The environment for remote work and communication have significantly advanced
during the Covid-19 pandemic. But their efficiency is still not high enough comparedwith face-to-face activities and communication. When the test facility is not available
on campus, the time required to move the satellite and the team to and from thetesting place is useless. Time lost in waiting for a response by e-mail communication
will not create any value. Face-to-face communication among the team members
located in the same room will save a significant amount of time. Things should be
categorized as a matter to be recorded in text or not. The former items should becommunicated by a text message. Otherwise, a quick oral communication is goodenough. To improve the efficiency of movement and communication, it isrecommended to have the office, work room, test facility, and ground station in thesame building.
2.4 Frequency Coordination and RF License
Even when development of the satellite goes smoothly, changes in the basic design,changes of the mission, delay in delivery of the satellite, cancellation of the satellite
mission, or restriction in operation of the satellite may become necessary as a resultof frequency coordination and RF license application. Special attention is necessary
when amateur radio bands and non-amateur bands are used by one satellite and afrequency not assigned in the primary allocation band is used.
The time required for frequency coordination in amateur radio bands and for
obtaining the preliminary license is increasing due to the increase of the leansatellites. Especially the satellites whose mission is difficult to judge whether it
conforms to the spirit of amateur radio communication or not are experiencing a longtime in amateur radio frequency allocation. The project team should understand thata delay in the government procedures for radio license may lead to a delay in deliveryof the satellite or loss of the launching opportunity in the worst case, because asatellite for which frequency coordination or preliminary license has not been
completed cannot be launched.
As international frequency coordination and application for an RF license require
expertise in the regulatory and technical aspects of radio communication, specificmember(s) may be put under a heavy workload. More than one team member,including the project manager, should constantly monitor progress in frequency

2

coordination. It is also desirable that more than one member should read Reference[5] if the radio license is obtained in Japan. In each country, the team should consult
with an appropriate radio authority well in advance. It is good practice to outsource
the work necessary for frequency assignment to an outside consultant in certain
cases. Of course, certain project team members should constantly monitor progresseven when the work is outsourced to an outside consultant.
2.5 Compliance with Safety Requirements
Noncompliance with safety requirements will result in design modification and/or
rebuilding of the satellite, which will reduce the time used for MA. If the satellite
does not pass the safety review, in the worst case a dummy mass will be launchedinstead of your satellite. There have been such instances in the past (see Figure 1).
In order to avoid such a case, problems associated with compliance with safety
requirements should be identified at the respective phases when the conceptual
design and detail design are completed, and should be consulted with the launchprovider for confirmation.
The verification method of compliance with safety requirements is an issue in thesafety review. A verification that requires the minimum effort for verification
method should be agreed with the launch provider. When the commitment to an
excessive method is made (university professors tend to make an excessivecommitment wishing to show their ability), such a commitment may become aburden to the project at a later stage. The resource should be allocated to theactivities of MA, etc., limiting the efforts for safety verification to the minimum.
The person in charge of the system safety often needs to say a strong word to theperson in charge of design and AIT. It is recommended to assign a person who canunderstand the technical rationale behind the safety requirement and explain it
clearly to the system safety.

Figure 1 Small Piggyback Satellites installed in H-IIA Launch Vehicle 30 (Thesilver object located at 6 o’clock position is a dummy mass) (Source: JAXA Digital
Archives)
https://s3-ap-northeast-1.amazonaws.com/jaxajda/http_root/photo/P100010489/5590ac570abed216cfe9acfe71681338.jpg

3

2.6 Documentation Control
Documentation is required because of the following reasons in the satellite project.
a) Regulatory affairs work (Safety review, frequency assignment, radio license, andSpace Activity Act)b) Communication among the project team (Necessary during development,
testing, and operation)c) Securing traceability to investigate in-orbit anomalyd) Knowledge transfere) Sharing of knowledge and knowhow with other projectsf) Source data in writing research papers
For (a) and (b), documentation is necessary because satellite launch will become
impossible without such documentation. With respect to (a), the students must
engage in documentation work when the professor or the staff does not have enoughtime or the aptitude for documentation. Therefore, the documentation work forsafety review should be assigned to students as an important task at the start of the
project. The students must be motivated by the notion that the completion of thetask determines whether the satellite launch can be made successfully. Nevertheless,the documentation for the safety review prepared by the students must be checkedby the professors and staff.
With respect to (b), the documentation will be inevitably prepared by the persons
in charge of each subsystem or the project manager as they feel the needs. No student,
however, will be excited by such documentation work. The documentation work isalso in in parallel with the development of the satellite. The documents made tend
to become very minimum one unless the professor directs the student to prepare thedocuments for their own study. For (f), the documentation will be prepared by theprofessors and students (mostly the doctoral students) to write their own papers.
The documentation of (b), (c), and (d) is related to MA activities. Suchdocumentation is required to prepare for the situation where no one is familiar withthe detail design of the satellite in the operation phase due to generation change
within the university or for the purpose of smooth transition to the next satellite
project. However, such documentation will not be made by the students even if they
are repeatedly directed that knowledge inheritance is important and that theknowledge should be documented. One idea to solve such problem is to make thesatellite project in combination with the bachelor thesis or master’s thesis of thestudents. The bachelor thesis and master’s thesis are essential requirements forstudents in science and engineering courses. When development and/or testing ofcertain systems or components is selected as the theme of their thesis, details of thedevelopment and/or testing must be described in the thesis. While such thesis may
not cover the entire satellite, very detailed documents will be prepared in specificareas. When the deployment mechanism of the antenna is selected as the theme of
the bachelor thesis, for example, the student will make the very detailed record ofwhat he/she did describing basics of the antenna, how the threads were connected,
to what extent the tests were conducted and in what conditions, to what extent the
tests were successful, and the possible factors of the failure of the test.
2.7 Defect Management
A defect will occur when we develop a satellite. It cannot be avoided. After all, thesatellite development is a series of repeating the processes to find a defect and fix it

4

before the flight. It is important to have a management system to collect the defectinformation and make the project manager or the person in charge aware of thedefect. Based on the system, a proper action is done to each defect. The defectmanagement system, which can be as simple as an Excel sheet, becomes increasing
important as the satellite system becomes more complicated. The defectmanagement system has been proven to be effective in several university satellite
projects. It is, however, important not to divert the limited resources to solve all thedefects. It is important to prioritize the defects based on the effect on the mission
success and work according to the priority list. Also, during the early stage ofdevelopment, such as BBM phase, the person in charge may not regard the defect as
defect and think that simply the development is not complete yet. If the person in
charge changes in the middle, the defect may be left as it is. Communication between
the project manager and the person in charge is important.
2.8 Relationship with External Stakeholders
University satellites are often requested by companies to do in-orbit demonstrationof the product. It is good for the companies because they can save much labor andcost compared to the case where they build the satellites by themselves. It is also
good for the university team because they can obtain funding from the companies.
Also, if the product itself has research and development elements, the work may leadto the publication of papers as a part of joint research. When the university teamreceives such a request, however, they should clearly determine the interface andscope of work. For the system side (university), it would be much easier if they simply
provide the power supply line and data line only and have the company make all themeasurement circuits to obtain the in-orbit data. Efforts should be made to at least
minimize the impact on the satellite bus design. If the area of responsibility remains
vague, it may end up spending a large amount of human resources in the company
payload, or an unexpected design change may become necessary at the project final
stage. The principal investigator must be careful about accepting the offer from thecompanies. The principal investigator should think whether the team can handle theadditional complication to the satellite system and coordination with the external
stakeholders. The money will come with a price.
2.9 Funding plan
Satellite projects are expensive. It is very difficult to predict how much it will cost,especially for the first satellite project. Funds are also needed for minimum
infrastructure such as a ground station and a clean booth. If the satellite is a 1U
CubeSat that does not have active attitude control and is equipped with only a UHF
band communication device, it is better to assume that the total cost of EM and FM
hardware will be about 10 million yen. Purchasing a foreign-made CubeSat platform
will increase the price even further. It will be difficult to get the EM and FM together
under 10 million yen. Adding infrastructure such as the ground station and the cleanbooth, as well as test instruments such as power supplies, oscilloscope, spectrum
analyzer, etc., adds up to about 15 million yen. In addition, costs associated withtesting and travel must be accounted. In total, as a ball park figure, the team should
prepare about 20 million yen, excluding the launch costs, for the first satellite. Fromthe second satellite, there will be no cost for the infrastructure. Also, the team canutilize the surplus parts from the previous projects, and the know-how cumulated
will save the money for testing. It is not recommended to rely on student handwork5to save the money for procurement as the quality decreases. If the external
stakeholders are invited to fill the funding gap, the satellite complexity increases
lowering the satellite reliability and increasing the project management workload.
It is necessary to have a margin in the funding plan at the project start. It isdangerous to start the project without solid funding base.
3. Defining the Mission
3. 1 Feasibility
It is very unlikely that the knowledge and skills required for development of thesatellite are fully covered by the team members. The idea to bring in talent fromoutside that cannot be filled internally by newly hiring staff does not always
guarantee fulfillment of all the required talents. It is risky to expect the growth ofstudent talents. The budget is also limited. In formulating the mission, such
restrictions should be deeply taken into consideration. A feasible mission fitting theavailable budget and staff should be formulated. For the case of an educational
satellite project, the project may fail if too many new development elements areincorporated.
Success of the university satellite depends on the professors. Even if the professors
try something beyond their capability, the students may not be able to follow. The
professor is not a god and does not know everything in judging the mission feasibility.
It is important to accept what is lacking in his/her ability, to ask assistance fromoutside, and not to try too hard in a weak area. When assistance is requested to theoutside, an attitude of faithfully accepting comments from an experienced person isimportant. The ability to decide whether the comment is valuable or not is required
as a prerequisite, and an effort must be done to acquire such ability.
3.2 Success Criteria
The success criteria are the guidance to make progress in the project. The successcriteria are usually composed of three elements; minimum success (the minimum
target to be achieved no matter what happens), full success (the target of results tobe achieved when the system fully functions as required), and extra success (thetarget of results that is more than expected in addition to the achievement of fullsuccess) (Reference [6]). It is required to use quantitative indicators as much as
possible (especially for the minimum success and the full success).
The success criteria should be defined at the start of the project. Whether or not
the target, especially the target of full success, can be achieved should be checked ateach project milestone such as the review meeting. If achieving the target isconsidered impossible, the criteria need to be changed. But, it should be thoroughly
examined whether the meaning of the entire project can be achieved (whether or not
the results can satisfy the project stakeholders). If the feasibility of design change isreviewed, whether or not the minimum success criteria can be achieved by designchange should be seriously examined. The minimum success criteria should not bechanged easily. On the other hand, revision of the respective success criteria in the
upward direction at a late stage of the project should be avoided because it may add
something to the system requirements. Any addition to the system requirements at
a later stage tends to cause a failure of the project.
The achievement status of respective success criteria will become the indicator to
be used in formulating the satellite operation plan in the operation phase. As
explained later in 8.2 Operation Plan, once the satellite is released into orbit,

6

operation to achieve the minimum success criteria should be implemented as soon
as possible.
3.3 Mission Scenario
The operation scenario of respective missions, i.e. concept of operation, should beformulated after what missions will be done. It should be considered how to operate
the satellite by command link from the ground station, and how the data will be
downlinked to the ground. Based on these, the functions and general performancethat the satellite should be equipped with can be estimated, which is called
functional analysis. Based on the functional analysis results, the satellite design
requirements will be derived. Also, at this stage, budget tables for thecommunication, power, and attitude control (pointing) functions should be prepared.
The budget tables should be revised constantly during the project. The accuracy
should be improved with the progress of the design, manufacture, and verification of
the satellite. If there is no or very little margin in the communication, power, andattitude control at the mission definition stage, such mission should be considered“unfeasible”.
At this stage, the power budget should have a margin of achieving the full mission
success even if the satellite loses one solar panel. The communication link budgets
should have 10dB margin for the minimum success and 6dB margin for the fullsuccess for the downlink. For the command uplink, the margin should beapproximately 20dB at the mission definition stage.
3.4 Risk Management
The satellite project is a series of processes in which the unknowns (success or
failure is unclear) are converted to knowns (confidence in success). There are always
technical unknowns to achieve the mission success. The project without unknowns
is not exciting. Even when the technology is already used by other organizations or
teams, such technology is unknown as long as it is not used by the project team. All
the unknowns are risk items against the mission success. In a satellite project, oncethe mission scenario is defined, the functional analysis is carried out. After thefunctional analysis, it becomes clear what technical unknowns exist in the project.
The risk management is a process to assess the possibility of the unknowns
causing the failure and the effect of each failure on the mission success. The risk
level is determined by the product of the possibility and the seriousness. If thepossibility is high and the effect is serious, the risk level is high and the project
resource should be allocated with priority to reduce the risk level.
The risk management is not an activity done only once during the satellite project
life cycle. As the system development and verification progresses, the unknowns
become knowns. The possibility of failure caused by the unknowns will become clear
and the risk level should be revised.

7

4. Conceptual Design
4.1 Requirements Management (Consistency between the mission requirements,
design requirements, and verification requirements)
The design of the satellite should be consistent with the mission requirements.
The mission requirements should be decided during the conceptual design of thesatellite based on careful discussion among the team members. Participation byexperts and persons from outside with experience of satellite projects is preferable.
When the satellite’s mission is primarily education of the students, for example, it isdesirable to build a satellite that will function with certainty so that the students
can experience operation of the satellite. To use a component primarily made for
R&D purposes (e.g., an antenna with a completely new design) is not consistent withthe mission requirements. The design requirements should comply with the mission
requirements. But the basics of system development is sometimes neglected becauseof the ambition of a university researcher. Such ambition should be removed throughcomments from another member of the project or from the outside. The professor
must be open to the opinions of others.
On the other hand, there are cases where the design does not reach the level of themission requirements. It is frequently the case where the communication link isdesigned assuming the maximum capacity to allow downlinking of the data requiredby the mission. But it is quite rare that the maximum channel capacity is achievedin actual operation. In reality, the amount of data that can be downlinked is typicallymuch lower than 10% of the maximum communication capacity. A comment in theconcept design phase is also effective in such a case.
4.2 Incorporation of the Lessons Learned from Past Projects
When the team has experience with some satellite projects, the lessons learned inpast projects should be incorporated in the conceptual design. The items thatsuccessfully functioned in orbit and those that did not should be distinguished. Thosethat functioned should not be changed unless such change is very reasonably
required. Correction or improvement should be applied to those that did not function
after identifying the cause. When components are procured from the outside, theteam should have experience as to whether the procurement was easier and whether
a good aftercare was provided. Based on the experience, whether to use the same
component should be carefully considered.
4.3 Safety Requirements Compliance Check
After conceptual design is complete, the issues of safety compliance should be
identified before commencing the detail design. This may be performed in Phases 0
and 1 of the Safety Review. As an experienced expert can easily identify the potential
issues just by reading the conceptual design document, it is good to ask the review
by such an expert.
For the second or later projects, it is recommended to get lectures from the systemsafety person of the previous projects about the safety related issues, such as whatsafety requirements were applied, what kind of verification was necessary, etc..
4.4 Verification Plan
Verification is an activity to confirm that the satellite is built according to therequirements. It can be done not only by testing, but also by analysis, drawing check,and others. The verification plan should be prepared during the conceptual design,8which defines when and how compliance with the various design requirements
should be verified. Such plan needs to be revised with the progress of design anddevelopment. It is important to keep in mind that a design that is not verifiable
should not be used. Optimism such as that the design will probably work should be
avoided. A verification plan that is doable should be made. It is easy to include astatement “to be verified by radiation test” in the plan. But it should be considered
whether the test facility is available, team members have the required knowhow for
performing the radiation test, etc. When the radiation test is not conducted, thedesign for radiation resistance should be made based on the condition that noradiation test has been conducted, such as by using parts with flight heritage.
Because most of the universities do not have all the test facilities, an outside
testing center that offer testing services to outside users is usually used. Preliminary
contact should be made with the testing center during the conceptual design phaseto check whether the testing center is available and suitable or not. If the team has
little experience in testing, a testing center that can provide advices on the satellite
design and testing should be selected.
As explained in 2.5 Compliance with Safety Requirements, verification for safety
requirements is required but it does not enhance the value of the satellite. Therefore,
the efforts used for safety verification should be kept at the minimum level. Efforts
should be concentrated on the verification of requirements that will enhance thevalue of the satellite (to increase the survival rate of the satellite, to increase thesuccess rate of the mission, to improve the quality of data obtained in orbit, etc.). For
an example, safety verification of the battery is the highlight in the safety review.
Students often spend a tremendous amount of time in the battery screening. The
students tend to have a feeling of being engaged in meaningful work because thework is real. While the battery screening is a necessary activity, the team members
must understand that much effort should be concentrated on other matters toenhance the value of the satellite. However, when such fact is emphasized too much,the motivation of the student assigned to an inconspicuous task such as the battery
screening may be lost. Therefore, careful consideration is needed.
For CubeSats released from the International Space Station (ISS), the minimum
set of required tests is listed in Table 3. Where “R” means “required” and indicates
the test to be conducted in respective phases. The mark “O” represents optional andthe mark “N” represents not required. Details of the respective tests are explainedin Section 7. As analysis used for verification, structural analysis (identification ofresonance frequency, derivation of maximum allowable load, and safety margin)
must be performed.
When the satellite is deployed directly from a launch vehicle such as piggy-backlaunch on H2A or Epsilon rocket, quasistatic load test (sine burst test), sine wave
vibration test, shock test, etc. may be required in addition to those tests listed inTable 3.

9

Table 3 Tests to be conducted on CubeSat released from the International Space
StationTest Item
EM(QT)FM (AT)
Electromagnetic
R
N*1
Compatibility Test
End-to-End Mission TestR
N*1
Electrical Interface Test
R
R
System Functional Test
R
R
End-to-End Long-term
NR
Operation Test
Deployment TestRR
Fit Check
R
R
Thermal TestR
O*3
*2
Random Vibration Test
OR
*1: Included in the End-to-End Long-term Operation Test for the FM*2: To be conducted when specifically required for the satellite. No need to be
conducted when not required.
*3: It is required to demonstrate that the satellite is functional after exposure to 15C and +60C for verification of compliance with the safety requirements. (Seereference [7]). When verification is impossible by design (allowable temperature
range of the parts used that is obtained from the datasheet, etc.), testing is required.
The thermal vacuum test and thermal cycle test in a thermal chamber are conductedwhen the project team (not the launch provider) judges them as necessary.
Otherwise, they may be skipped.

10

5. Detail Design
5.1 Selection of Parts and Components
Attention should be paid to delivery time, aftermarket service, and interface
conformity when a foreign vendor (seller, manufacturer, etc.) is selected as the
supplier of components. The members must understand that tremendous time isnecessary for coordination with the vendor if any nonconformity of the interface isdiscovered. Even in the case of a domestic vendor, attention is also necessary whenthe experience of the vendor is not adequate. Even if a vendor is excellent intechnology, it may have a problem with delivery time. More attention should be paid
to availability of the product, easiness of handling (simplicity of the interface),
response to repair requests, etc., in vendor selection. Such factors are sometimes
more valuable to the project than the size, price, and function.
It is important to have a margin in the number of parts/components to be procured.
Failures or damage due to careless handling or overload during testing cannot be
avoided. If the schedule is very tight and there is not back-up, there is no time to
procure a replacement. Then, there is a risk that the launch will be postponed. If you
have procured EM equivalent to flight products, you can use EM products in case of
emergency. Even if it is not used in the actual flight, it can be used during operation
as an FM backup (TableSat) that is used to check the uplink commands in advanceand investigate the in-orbit anomaly. In addition, since the Covid-19 pandemic, it
has become extremely difficult to procure various electronic components, including
semiconductors, and early procurement is required as a part of risk mitigation. We
must avoid a situation in which parts and components arrive at the last minute forthe satellite delivery, leaving no time for system testing.
For components involving certain elements of new development, the interface of
the work between the vendor and the system (project team) should be clearly defined,
to clearly show to what point the vendor is responsible and to what point the project
team is responsible. The satellite project should be regarded as the program, andspecifications of the bus components should not be changed as much as possible, toeliminate development work by the vendor for the second, third and later projects toallow delivery of the identical component. This is preferrable from the aspect of shortdelivery time. Excessive discount or an academic discount from the vendor should
not be expected because the vendor product is produced procuring raw materials andby labor of the employees. A good relationship with the vendor to allow for long-term
relationship should be established without causing a financial loss to the vendor.
When the component is developed jointly with the vendor, the design andknowhow should be transferred to the vendor so that a sustainable supply chain
system can be established where the vendor is fully responsible for the supply of thecomponent. To maintain stable product quality, a vendor with whom a good longterm relationship can be maintained should be selected.
5.2 Risk Management, FTA and FMEA
It is impossible for the university to build a satellite for which failure is nottolerated. A risk of failure of the mission should be tolerated. Nevertheless, nottaking any action against such risks is not allowed. The risks must be evaluatedfrom the viewpoint of the possibility that such risk might actually occur (event
probability) and the impact when such risk is realized (severity). As the resource(manpower, budget, schedule, etc.) is limited, priority should be given to actions
against the risk in the order of a product of the event probability and the severity.

11Normally, actions are taken from the risk in which a product of the event probability
and severity is largest. It should be noted that in such a case, experience and/or
Wisdom of Crowds is usually used in case of the lean satellite because quantitativeevaluation of the event probability and seriousness requires a budget and time.
Therefore, it is a common practice to obtain opinions from the person with experiencein development of a lean satellite, or from an expert in risk assessment. By asking
for the review of the completed concept design to an outside expert, valuable opinions
will be obtained for the issues of compliance with safety requirements and for therisks to which priority should be given.
FMEA (Fault Mode Effect Analysis) and FTA (Fault Tree Analysis) should be usedin activities to sort out the technical risks. But few students learn FMEA or FTA in
the university course and do not know the method. The same thing applies to theprofessors. It is important to start analysis at the level that the team members canunderstand without fully following the method available in literature.
For FTA, a flow chart of the mission scenario should be prepared, and it should beconsidered which component is responsible for a possible failure of the respective
step. For FMEA, it should be started from categorization of the cases; (1) The mission
can be executed without problem, (2) The mission can be executed with someproblems, (3) Execution of the mission is impossible, and (4) Complete failure of thesatellite (communication blackout) when the respective component should fail. With
respect to whether or not the component fails, use of the following indicators will be
used for convenience; (1) The component has a record of successful operation, (2) A
similar component has a record of successful operation, (3) The component isdesigned and built by a manufacturer with a record of successful operation, (4) The
component functions with certainty in the ground environment, (5) Design of thecomponent is completely new, and (6) The component is built by students. In any
case, a failure of the part or component that may result in complete failure of thesatellite (single point of failure) should be first sorted out to determine the priority
in activities to reduce the risks. When there are many single points of failures andit is difficult to deal with all of them due to the resource limitation, the items thathas the large numbers of the product of the effect on the mission (the numbers listedfrom 1 to 4) and the possibility of occurrence (the numbers listed from 1 to 6).
FTA and FMEA should be also applied to the activities in addition to physicalitems such as parts and components. As a human makes mistakes, the results of a
mistake, such as what happens when there is an error in sending a command orwhen the sensor is connected with polarity reversed, etc., should be carefully
examined to incorporate a mechanism to make it more difficult for a mistake to occur
or to make recovery action possible in the design even in the case of a mistake.
5.3 Aiming for a Satellite that can survive
The design of the satellite should incorporate a means so that the satellite can
avoid the risk of complete failure (loss of communication with the ground) under any
circumstances. Examples are as follows.
● Installation of the so-called “God PIC”, Micro Controller PIC16F877 whose
excellent radiation resistance is demonstrated in orbit, to allow power of theentire satellite system to be reset.
● Means to allow battery recharging even when the battery becomes completely
empty or to ensure it enters safe mode when the voltage drops.
● A design that allows the satellite to function using power generated by solar

12panels even when the battery is dead.
Redundant communication link when the satellite has some room in the interior
volume.
● To make the power budget feasible in the following cases for the minimum
functions of the satellite (certain missions can be executed so long as thecommunication link with the ground (up and down) can be established andsubstantial discharge of the battery is accepted)
 Loss of attitude control
 Solar paddle deployment failure Loss of functioning of one solar panel in the case of 1U CubeSat. Without
this feature loss of function of any one of solar panel, (usually 1U CubeSat
is made of 4 to 6 solar panels), will make the satellite entirely unfunctional,
which means that 4 to 6 single points of failure exist.
It is still necessary to verify that the system can avoid the risk of total failure as
designed when these designs are incorporated. When the satellite restart after power
reset, the system may become unfunctional at a half awake state. A test simulating
the failure conditions in orbit should be conducted, and it should be confirmed thatthe satellite can successfully restart from power reset. Recovery of the battery froma completely dry condition should be confirmed simulating the power generation
conditions in orbit using the solar array simulator, etc. Transition to safe mode
should be tested using the actual satellite. For the power budget, system
functionality should be confirmed in the worst case scenario of power conditions. A
certain margin should be kept in the power budget, because certain errors inmeasurement of the power produced and power consumed cannot be avoided.
Redundancy test of the communication system should be also conducted.
●

5.4 Avoid Excessive Protective Functions
In the design of satellite systems, a variety of protective functions tend to beinstalled. Examples are a safe mode to prevent the battery from drying up and abattery heater to protect the battery at low temperatures. But before incorporatingsuch functions, the risks and benefits of such protective functions should be carefully
examined as to whether they are really required. Automatic activation of theprotective function is based on the condition that the voltage and temperature
sensors function normally, but how much such sensors can be trusted should beconsidered. The safe mode may cause a risk of the system failing to restart because
the safe mode may cause the system to go into a suspended condition, and somesatellites have experienced such situation. The battery heater requires power, andsuch power consumption may make the battery dry up because of a negative power
balance.
Instead of using the safe mode, a design may be used where power supplied to thesatellite is automatically interrupted when battery voltage decreases to below the
input limit to the DC-DC converter and the power reset function which shuts off thepower of the satellite completely is activated. Then, when the satellite emerges fromthe eclipse, the satellite system will start up from the initial mode. A battery heater
design whereby it can be restarted by a command from the ground monitoring thebattery temperature in orbit is preferable to automatic activation. The battery
temperature will not decrease all of a sudden in orbit. When the satellite orbit
altitude is low, the temperature of the overall satellite will become higher. In such acase, appropriate insulation applied to the battery without a battery heater may be

13adequate for satellite operation.
5.5 Points to Note in Design Changes
Whether or not the design change is adopted should be always decided after
evaluating the benefits obtained and the new risks brought about by the designchange. Minimum success and full success are used as the criteria for such
evaluation. Careful decision is needed when there is a risk that will jeopardize theminimum success. When the design change increases the possibility of full success,the risks associated with such design changes should be carefully examined. For an
example, suppose there is an idea of crossed connections of two antennas and two
communication equipment using the RF switch for multiplexing the communication
link as shown in Figure 2. Such configuration is frequently considered if thecommunication equipment and antennas do not have a heritage of successful
operation. Such configuration will improve the reliability of the communication link,
giving more chances of having at least one combination of the antenna and thetransceiver survives. There will be, however, a loss of RF output, a risk thatswitching of the RF switch will become impossible or it sticks in an intermediate
position where the transceivers and antennas are disconnected, and in the worst
case, there is a risk of no communication at all. Even without such crossed connection,communication can be established when at least one pair of communicationequipment and antenna is functional and the minimum criteria can be achieved. The
benefit obtained by a crossed connection is not considered to surpass the associatedrisks.

Figure 2 Study on Crossed Connection between Transceivers and Antennas using
the RF Switch
5.6 Satellite Design allowing Easy Operation
Easy satellite operation should be intended considering how to execute the mission.
For second and subsequent projects the lessons learned from past operations in thepast should be incorporated to the maximum. When the project is for the firstsatellite, hearing from a university who has experience with satellite operation is
helpful. For example, the stored command (reserved command) system will makestarting the satellite’s missions possible at any point above the ground other than

14

Japan. When a series of operations are reserved, it will not be required to uplinkindividual operations one by one. It will increase the data volume because data canbe downlinked at different ground stations (however, frequency coordination should
be carefully made).
To improve the uplink success rate, a simple uplink command should be used sothat the command can be uplinked with a small number of bytes. As command
encryption will only decrease the success rate of the uplink, the benefit obtained fromencryption is low in the case of a university satellite in which confidentiality is notreally required.
The software of the ground station is preferably designed to be compatible withremote operation and automatic operation to allow operation possible even when thenumber of operation staff decreases.
If the power reset is done, it is recommended to keep the history of attitude control
parameters and housekeeping data before the reset. The attitude control parameters
often require the uplink over multiple satellite passes. If the parameters go back to
the initial setting after each reset, every time it takes a lot of time to restart theattitude control. Also, the housekeeping data history is useful for the anomaly
investigation.
5.7 Satellite Design that is Easy to Test and Easy to Assemble, Integrate and Test
Satellite should be designed considering the easiness of assembly, integration andtesting. Fasteners (screws and bolts), cable harnesses, and connectors are essential
parts in assembly of the satellite. Assembly of the satellite will become easy when
the type and quantity of such parts are small. Particularly, as workmanship errors
can frequently occur related to the harnesses and connectors. A design thatminimizes the use of such parts should be considered. If the harness use cannot be
avoided, it is desirable to outsource the harness making to a professional rather thanin-house making by students. A mechanism to prevent mistakes in fitting the parts
is also required. Mounting the parts on the PCB may be asked with the front andback faces mistaken. A mechanism that prevents such mistake is required. It is nota solution to prevent a mistake just by the worker being careful. A mechanism toprevent human mistakes should be incorporated in the design.
It is frequently required to remove a component with a problem during the systemtest, especially the first system functional test. The satellite should be designed sothat disassembling the entire satellite is not necessary when the components and asmall number of the associated parts are removed from the satellite. The connector
should be durable for frequent connection and disconnection because
connection/disconnection is required in component removal and installation. Whenthe connector is forcibly disconnected, the connector may be damaged. A device todisconnect it smoothly should be prepared. It is recommended to prepare test beds
for the electrical interface test and software development, because such tests can bemade without installing the entire satellite system in the satellite.
Access ports should be provided in the outer panel of the satellite to allow accessto the processors (microcontrollers) after assembly of the satellite is complete. A
design that does not allow access to the processor from outside should not be used
unless you are fully confident in your software capability. When more than one
satellite with identical designs are built, identification should be applied to theexterior of the satellite to identify each satellite. For example, in Figure 3 theidentification sticker is applied on the GPS antenna of each satellite.

15

It is recommended to fabricate jigs used for assembly, storage, tests, etc. of thesatellite (Figures 4 and 5) to prevent an accident during tests and assembly. The
satellite should not be placed directly on the desktop because damage may be caused.
The design of the jig should consider how to hold the satellite. In the case of CubeSat,a Pelican Case, etc. is used to carry the satellite, but at the last moment it must be
held by hands when it is set for the vibration test and thermal vacuum test (neverhold the satellite using just one hand). For satellites other than the CubeSat, thedesign should allow for installation of the I-bolt used to hoist the satellite in theupper structure of the satellite. Holding the satellite by hand should not be
considered.

Figure 3 Jig for Satellite Storage

Figure 4 Testbed for Component Test

16

Figure 5 State of the System Functional Test (The satellite is placed on the testjig)
5.8 Understanding of Design Basis
Normalcy bias is a common behavior by which a human being considers whathe/she cannot completely understand as probably OK, and justify such decision
groundlessly. In the satellite development, the words “probably” or “will be” should
be avoided when making a decision. The design should be based on firm grounds.
Especially for critical design items that will decide the fate of the satellite and themission, all effort to understand the grounds of the design should be made until you
are convinced. When you do not understand, opinions should be obtained fromdifferent people, and you should accept comments from people with experience indeciding the principles of the design and verification method. It is important thatyou admit that you cannot understand if you cannot understand an item. It is acommon practice to use the same design as in the past in the development of secondand subsequent projects, but a problem may sometimes occur when a design change
is applied to a certain item when considering that such change will be effective but
without understanding the design grounds. For an example, the threshold value toactivate the over current protection circuit to exit from the single-event-latch-up
should be determined in principle by measuring the latch-up current by a radiation
test. If the value is already decided, the team should understand the rationale behindthe number.
5.9 Before advancing to FM Phase
In the EM phase, efforts should be concentrated on completion of the satellite
functions and improving the team skills. For that purpose, an EM that isfunctionally equal to the FM (all components other than the solar panel are installed)
and can even serve as a flight spare should be made and thoroughly tested. Assembly
and testing of the actual satellite system by the team improves skills. (This is very
important for a university satellite for which a majority of the team members lackexperience.) By confirming that the satellite system will be able to achieve theminimum required mission by the end-to-end test in the EM phase, a fundamental
change of the system should be avoided when the project is moved to the FM phase.
If there is a function that could not be verified in the EM, the decision not to install
the function in the FM is necessary, unless the function is essentially required for17the mission success. A new problem will naturally be found after the project moves
to the FM phase, but handling of such defect requires higher costs, a longer time,and more mental pressure. A system defect found after moving to the FM may need
to be discarded unless such system is critical to the mission success, and works
should be concentrated on the items with higher importance.
To allow such decision, all team members as well as the project manager shouldshare understanding of which mission should be given priority, and prioritize which
items should be achieved as a minimum (success criteria).
In addition, works at the FM stage is often carried out in a clean room or a cleanbooth. When a person participate in a satellite project for the first time, mostly likely
the person has no experience working in the clean room environment. Before moving
to the FM stage, the rules regarding the works in the clean room environment should
be confirmed by all the team members.
5.10 Safety Requirements Compliance Check
Phase 0, 1, and 2 safety review is normally conducted after the detail design andtesting of the EM is complete. Documentation for safety review requires a very longtime. Such documentation work should be performed not only by the members incharge of safety review but by all the project team members maintaining highmotivation. In Phase 0, 1, and 2 safety review, the method to verify compliance of
the FM with the safety requirements is discussed. Attention should be paid to themethod of verification so that verification can be made without a problem by close
communication between the members in charge of safety review, members in chargeof satellite construction, and members in charge of verification of the FM. There aresome risks that the satellite does not pass the Phase 3 safety review if verification is
not made correctly because of a lack of communication. In such a case excessive timeloss may occur to repeat the work for verification, and in the worst case the team has
to start the design from the beginning.

18

6. Satellite Assembly and Integration
6.1 Quality Control
Most of the parts used in the lean satellite are parts mass-produced for terrestrial
consumer products, not for space applications. Quality assurance of such parts isprovided by the manufacturer as mass-produced products. The possibility of defects
in those parts are quite low and there is no need to inspect individual parts in the
project. A failure of parts, if it occurs, is mostly due to inappropriate handling of theparts after delivery such as electrostatic discharge, humidity, and contamination.
Practices such as the use of antistatic wrist straps during work, confirmation ofadequate grounding of equipment and worktables before starting work, using globes
during the work, etc., should be enforced within the team as a common practice.
The quality of individual electronics parts is assured because their manufacturing
process is established and matured already as mass-produced items. But, the qualityof components made from those parts is not assured. The components refer to atransceiver, a computer board, a power control unit, etc. The components are notmass-produced items. They are one of a kind product. Their manufacturing process
is not established. Even when the same components are ordered in multiple
quantities, it is not guaranteed that all the components have the same quality. Whensuch component is delivered, a basic functional test should be conducted before it isincorporated in the system to check for possible defects.
6.2 Contracting the Work or Building Inhouse
The decision to contract a portion of the work required to build the satellite insteadof making everything inhouse is required in the case of the university satellite. The
decision to build inhouse because of insufficient budget may result in schedule delay
or mission failure. The decision to make the students work on items that require
handyman skills (harness, solar panel, soldering, etc.) for a university satellite
should be made carefully. As some students may have excellent handyman skills, it
may be possible to have such work done by them, but when it is difficult to find such
students, the work should be contracted outside. The purpose of the educational
satellite is not acquisition of handyman skills by the students but to make thestudents learn systems engineering and project management by practice in the
project.
Students may not be motivated if the components has no new developments, suchas buying outsourced components or using the components already flight-proven inprevious projects. However, what is important is that students think what kind oftests are necessary for the satellite to work as a system when these components areassembled, and how to integrate the components with other ones, while
synchronizing with the overall system development schedule. The educational effectof systems engineering and project management obtained in those processes isgreater than simply making a new component.
In addition, there are many cases where components purchased from the outside
do not work when their functionality is checked upon delivery. There are often cases
where there is a problem in handling the component correctly rather than the defects
in the components. To select a vendor, it is necessary to consider factors such as theeasiness of handling, the prompt response to the customer inquiry, and the wellwriting operation manual, and others. At the same time, it is important to make aserious effort to think about the causes of malfunctions in your own way.

19

6.3 Safety Requirements Compliance Check
The records during the FM AIT (Assembly, Integration and Testing) are the basisof the critical verification documents in the Phase 3 safety review. The records
should be prepared during the FM AIT as much as possible. Note that making therecord is not simply taking photographs. The records should be prepared while
precisely understanding what items need to be verified and what data andphotographs are required. The material certificate of the structural parts andcomponents and the proof that the satellite has been assembled according to theassembly procedure, etc. are particularly important. Assembly of the satellite should
be basically done by two persons or more, and one person must concentrate on
confirming the procedure and recording the work.

207. Testing
7.1 Electromagnetic Compatibility Test
In the case of the lean satellite, electromagnetic interference with other satellites
and the launch vehicle need not be considered because the power is off during thelaunch. However, restricting the RF radiation level below the allowable limit isrequired by the safety requirements because of a possible safety risk when the poweris turned on by mistake (see Note below). The effect of the RF noise produced by thesatellite on the functions of the satellite is important with respect to electromagnetic
interference, and the effect on the uplink communication should be especiallyconsidered. It is too late if it is found that the uplink communication does not workin the satellite during the end-to-end long term operation test using the FM. An
adequate margin in the uplink line should be confirmed in the EM test.
First, the receiver sensitivity of the transceiver should be measured under ideal
conditions when the transceiver EM is delivered. The minimum RF signal strength
the receiver can decode the uplink signal should be measured with the transceiverplaced in a shielded box and the RF signal from the signal generator injected via RF
cable. Such signal strength means the minimum (ideal) signal strength that thereceiver can decode in the noise floor generated by the receiver. When the transceiveris installed in the satellite and connected to the antenna, the noise floor will increase
but will never decrease. In addition, the RF signal is received through the antenna,
which will produce various losses (line loss, polarization loss, pointing loss, reflective
loss, etc.). Considering these circumstances, communication during actual operation
will not be established unless there is an adequate margin in the ideal conditions
where measurement is done with the RF cable directly connected to the receiver unit
under external noise-free environment.
For a CubeSat, the effect of noise from other components can be evaluated by atest whereby a complete satellite is placed in a shielded box as shown in Figure 6.
Even when the satellite is larger than the CubeSat, the test including some factorsof antenna loss is possible when the electromagnetic anechoic chamber is used.
These tests should be conducted in the EM phase to verify if the communication
system design satisfies the requirements.

Figure 6 Receiver Sensitivity Test in the Shielded Box
Note: When the MOSFET is used as the inhibit switch against satellite power-on,
the FET may be activated by excitation of the line connected to the gate of the FETby the radiated electric field of the ISS. That will require the design install a pull-up
or pull-down resistor to the FET gate. When the resistor is not installed, analysis
and verification will be required.

21

7.2 End-to-End Mission Test
It should be confirmed that the minimum mission can be achieved by the end-toend test with the ground station during the EM phase. In the end-to-end test, thefollowing process should be confirmed by transmitting the command from the groundstation, which is received by the satellite receiver, and then the command is sent to
the C&DH system, which in turn sends the command to the mission payload, andafter performing the mission the data are sent to the transmitter, which transmits
such data to the ground station, to be displayed on the computer screen at the groundstation. For an example, when the mission is imaging the Earth’s surface, theprocess starts by sending a shutter command from the ground station and iscompleted when the image taken can be confirmed at the ground station. As
explained above, the core element of the mission should be completed in advance.
The fact that such mission is practically possible should be demonstrated by the test.
Then the detail making should be started. This test is preferably conducted byactually transmitting the RF signal, but when the electromagnetic anechoic chambercannot be used, it may be conducted by connecting simulated communicationequipment in the ground station with the satellite transceiver via RF cable.
7.3 Electrical Interface (Integration) Test
The interface test with the other components of the satellite should be conductedwhen the components are delivered but before they are installed in the satellite
structure. This test is required for both EM and FM. Successful testing for the EM
does not always guarantee that the test for FM is successful. The components used
for the lean satellite are basically hand-crafted in small lots. The components for EM
and FM are not produced in the same lot. Accordingly, all the components of the EM
and FM are not always the same. In the test as to whether interfacing with the
C&DH system, power system, etc. is successful, whether equipment ON/OFF ispossible, whether data can be transmitted normally, and whether the system
functions correctly are also checked. It is desirable to prepare a test bed to allow foreasy installation and removal of components and not to cause any damage to theconnectors of the components.
7.4 System Functional Test
After the electrical interface test with the delivered components is successfullycompleted, the satellite should be assembled promptly and the system test with all
systems incorporated should be started. The functional test of all the systems should
be conducted before the environmental test to confirm that the satellite is assembled
correctly. The following items should be checked at that time.
a) The modes from release of the satellite into orbit to the time when the steady stateis reached. Such modes include receiving of the beacon data from the satellite,
deployment of the antenna and solar panel, tumbling control (de-tumbling),
transition to sun pointing, etc.
b) All operations to be executed in the initial operation. Such operations include
uplink to the satellite, housekeeping data acquisition, command transmission andmission data reception to be executed as a minimum (equal to the minimum successcriteria).
c) All the operations to be executed in steady state operation. This includes missioncommand transmission, mission data receiving, and different types of attitudecontrols equal to the full success criteria.

22d) Confirmation of the functions incorporated in the satellite as countermeasuresagainst failure, such as power reset, transition to safe mode, resetting, etc.
It is important to examine the details of data transmitted from the satellite in thistest, and whether housekeeping data, mission data, etc. are consistent should bechecked. For example, in the case of housekeeping data, it should be checked
whether the battery voltage and current change consistently with the operating
conditions of the onboard payload and with the power input from the solar panel,and that they are consistent with the power budget prepared in advance, whether
the images are taken as planned, whether the sensors of the attitude control systemsend the correct data and actuators like the reaction wheel and magnetic torquer
function correctly according to the input from sensors, and whether RF signal istransmitted according to the power and frequency as contemplated, etc. When aproblem is discovered in such system functional test, the problems should be solved
before starting the environmental test. As the trial and error process at this stage
will require a tremendous amount of time, adequate margin should be allocated in
the schedule. A schedule where conducting the thermal vacuum test takes place one
week after the satellite is first assembled should not be planned.
7.5 End-to-End Long-term Operation Test
A majority of the university satellites fails because the FM end-to-end long-term
tests could not be conducted before satellite delivery due to a delay in the schedule.
The end-to-end long-term operation test of the FM has the following aspects.
a) Flight software debugging
Although the system test is considered to be complete using the EM before the FM,verification of minor updates to software made after the FM is necessary. The
functioning of built-in software directly linked with hardware in the actual system
is not guaranteed even when it functions on the simulator PC used for programming.
Functioning of the software in any situation (in normal and also in emergency
conditions) that the satellite may encounter from the time the satellite is released inorbit to the time when the satellite operation is terminated should be confirmed.
This test includes transmission of the mission command and receiving of the mission
data, to confirm whether the mission can be achieved.
Although this test is almost the same as the system functional test, in the long-term
operation test simulating operation during the first week in orbit using the actual
time scale is desired. This is because a problem is most likely to occur in this one
week period. Software bugs are inevitable, and as the time passes, and while thenumber of bugs found decreases, the long-term operation test will improve reliabilityof the satellite. However, even if a new bug is found, there is a risk when we replace
the sfotware. Beyond a certain time prior to the satellite delivery, a decision not torewrite software may be made even if a bug is found, depending on its criticality.
b) Operation rehearsal
The end-to-end long-term operation test should be conducted using the control
software of the ground station. Any communication with the satellite should
basically be made only by the uplink and downlink signals. By such processes, themethod to understand the satellite’s condition from housekeeping data and theprocessing method of the mission data should be learned. In addition, the satellite’s
response to the uplink command can be understood. Using the control software of
the ground station will improve the operation team’s proficiency. By experiencing
the operation with the satellite at hand, the anxiety of having communication with23

the satellite in orbit by RF signals alone will be reduced.
c) Confirmation of communication between the ground station and the satellite
In the end-to-end long-term operation test, communication between the groundstation and the satellite should be made by RF signals as much as is flight
representative. The problem of the radio station license should be resolved, or thetest should be conducted in an electromagnetic anechoic chamber. The
communication with the satellite by RF signal will confirm the communication linkbudget. In the communication link budget of the lean satellite, the items that are
difficult to know precisely are the loss between the satellite antenna and thetransceiver and the noise floor around the transceiver. The loss between the satellite
antenna and the transceiver is determined by fabrication of the antenna and its
peripheral circuit and the skill in installation. In the case of CubeSat, thecomponents are closely packed and the RF noise environment around the transceiveris extremely complicated. As shown in Figure 7, the uplink signal intensity isextremely reduced due to the free space path loss when it arrives at the satellite.
The two elements above determine the success rate of the uplink. In order to check
whether the communication link works, an uplink signal with a known intensity issent via free-space radio wave and whether or not the uplink is successful or fails
should be measured. Under actual flight conditions, it should be taken into
consideration that the success rate of the uplink will be further reduced due to the
Doppler shift.

Figure 7 Communication Link Budget (Uplink)
7.6 Deployment Test
The missions of many lean satellites with deployable systems have failed. Many
CubeSats have deployable UHF/VHF antennas retained by threads. Consideringthat the missions of about a quarter of the university CubeSats ended up as DoA(Dead on Arrival) (Reference [2]), it can be reasonably considered that the
deployment of such antenna failed in many cases. There are many satellites in which
deployment of the solar panel also failed and the success rate of satellites with the24deployment of film or with separation between the master satellite and subsatellite
is not high.
When such facts are considered, we can say that in many cases the deployment
test on the ground was not sufficient. Because actuation of the mechanism withmovable parts in microgravity and the vacuum environment in space is certainly
difficult and computer simulation is also difficult, verification using the actual
mechanism such as the EM and FM cannot be skipped. For the EM, tests assuming
all adverse conditions should be repeated. The testd should be done in the same
conditions that will be encountered in orbit as much as possible. When the antenna
is deployed by cutting the thread with a heated cutter, successful deployment should
be confirmed by the low battery condition immediately after the satellite is separated
and released, and in the condition where the heat cutter is exposed to lowtemperatures. Figure 8 shows the example of the deployment test in a lowtemperature condition. Because the number of deployment tests increases as the
deployment system becomes more complicated, the design should consider the easeof conducting the test and the allowance in the limit to the number of tests. Effort tomake the test environment as close to microgravity and vacuum condition as possible
should be also made.

Figure 8 Antenna Deployment Test in Low Temperature Environment in the
Thermostatic Chamber
7.7 Fit Check
The purpose of this test is to confirm that the mechanical interface between thesatellite and the launch vehicle is consistent. In the case of CubeSat, it should bechecked that the CubeSat can be inserted into and ejected from the POD smoothly,
and that the satellite envelop fits in the POD (no contact between the items attachedto the satellite surface with the inside of the POD). Recently it is quite rare that auniversity team develops the satellite separation mechanism. Development of theseparation mechanism by the university should be avoided unless there is a very25

good reason. The safety verification of the separation mechanism may sometimes bemore burdensome than the safety verification of the satellite itself. Therefore, it will
be necessary only to confirm that the separation mechanism provided by the launchprovider (PAF-239M etc.) or POD mechanically fits the satellite.
In the case of CubeSat, it does not mean that the satellite is assembled according
to the CAD drawings, even when respective structural parts are fabricated according
to the drawings. Distortion, etc. cannot be avoided. A case where the satellite cannot
be inserted into the POD when the satellite is delivered to the launch provider has
actually happened even for 1U satellite. As distortion increases with the size of thesatellite, more care needs to be taken. The simplest method of the fit check is toinsert the satellite into the official POD supplied by the launch provider. Thismethod is preferably applied both for the EM and FM phases.
As jigs used for fit checks such as the official POD are lent for a limited time, thelending period should be discussed and determined with the launch provider inadvance. Such jigs are specially manufactured for space vehicle use and are very
expensive, so very careful handling is required. When even one part of such jig may
be damaged, compensation will be very high (more than ten thousand dollars). There
have been actually such instances before.
7.8 Thermal Test
Items in the thermal test of lean satellites and large satellites are the same.
Accordingly, there is no difference in the test method.
However, the temperature difference in vacuum and in atmosphere is not thatlarge for a satellite like the 1U CubeSat. Therefore, a high temperature test and low
temperature test in a thermostatic chamber may replace the thermal vacuum test.
(See Annex-F to Reference [8]) Even in such a case, a functional test with the entire
satellite placed in the vacuum chamber should be conducted at least once.
The thermal equilibrium test of the lean satellite is conducted to obtain data forthermal analysis and for verification of the thermal analysis results because active
temperature control is hardly performed for parts other than the battery heater.
Many lean satellites are operating in orbit already and sufficient temperature dataon their orbits are available. In particular, most of the surface area of CubeSat iscovered by solar cells and there is no significant difference in the thermal radiation.
The time required for thermal analysis can be saved by obtaining the high and low
temperature conditions of a thermal test using the highest and lowest temperaturesin operation, as far as the temperature data of CubeSats in the same orbit areavailable. As a lot of data from CubeSats released from the ISS are available, it isrecommended to use such data. See Ref.[9] for an example. Attention should be paid
to use the data under full solar illumination, i.e. no eclipse in orbit, in calculation of
the high temperature conditions, because those cases may be present due to the highbeta angle.

26

7.9 Vibration Test
Items in the vibration test of the lean satellite and large satellite are the same.
Therefore, the test methods are the same. Because the vibration test records
constitute the critical documents in safety review, the records should be written
clearly.
7.10 Test Configuration (Test-as-you-Fly)
The tests should be conducted in conditions similar to the actual operating
conditions. The condition of the satellite and mission accomplishment or failure
should be determined by transmitting the actual operating command and analyzing
the data received from the satellite responding to such command by the software in
the ground station. As no external cables are connected to the satellite in operation,
the external cables should not be connected as much as possible in the system test.
Unintended noise may be introduced via external cables. For the mission equipment,
its functioning when incorporated in a satellite system in a vacuum environment(not simply a transmission of the simulated data with the switch engaged but by
actual measurement and relaying the data) should be confirmed.
7.11 Use of the Outside Testing Organization
Universities having all the necessary test facilities inhouse are limited, and inmany projects testing using an outside testing center is required. It is desirable toselect a testing center with sufficient experience to provide advice for the design andtesting of the satellite when the experience of the project team is not sufficient. In atest conducted by the external testing center, it is required to complete the required
tests in the prescribed time frame. Meetings with the testing center in advance using
the test specifications and/or test plan are essential to meet such requirements.
What materials and equipment need to be brought to the testing center and what
support can be obtained by the testing center should be defined clearly, indicating
the purpose of the tests and testing conditions by video conference, etc.
7.12 Evaluation of Test Results
All effort should be made to correctly evaluate the consistency of the test results.
If test results that are not good or are worrisome are left unattended, unexpectedbugs may be hidden. The pass/fail criteria of the test should be established before
the test, but indefinite results within the allowable limit that are difficult to decide
may sometimes be obtained. In such a case, you should try to explain why the result
deviated from the nominal value. In addition, when incomprehensible events occur
randomly (relatively frequent in the thermal vacuum test), what you have noticed
should be recorded and the events should be resolved. Optimistic attitudes, such as
thinking that the event is just imagination or that the event will not occur in orbit,
based on normalcy bias should be avoided. As very specialized equipment/apparatus
are used in the RF test, etc., erroneous RF signal strength may be obtained by
mistake in operation of the equipment/apparatus. When test setup work is asked ofa single person only, a mistake may be unnoticed. A system where more than one
member examines the test plan and the test report is desirable.
7.13 Defect Management
As a result of testing, there will always be defects. In another word, testing is to findand fix problems on the ground before they occur on orbit. As described in "2.7 Defect27

Management", defects found during testing should be collected, prioritized, andhandled based on the priority. When setting the priorities, it is necessary to conduct
risk management properly and evaluate the impact on mission success if amalfunction occurs in orbit. In failure analysis, the team should make full use of
FTA, which will also serve as a rehearsal for FTA to be carried out when a problem
occurs after launch. FTAs require logical thinking, and it is important to think witha cool head.
When the team disassembles the satellite to investigate a malfunction or to retest
after repair, the stress impact on the satellite should be considered. There is a limit
to the number of times the connector can be inserted and removed, and the numberof times the fastener can be used. Vibration tests, etc. give cumulative fatigue toeach part of the satellite. It should be carefully decided whether or not to perform all
AT tests again as a retest.
7.14 Storage of Satellite
It may take an unexpectedly long time from the date all the tests are successfullycompleted to the date the satellite is delivered. The possible causes of such delay arevarious, such as delay of launch vehicle, extension of safety review, delay of the RF
license. When the satellite needs to be stored for a long time, care should be taken
because the separation switch is under stress for a long time and deformation ofparts may occur. The battery of the satellite needs to be supplementally charged asneeded, and charging should be made by more than one member according to theprocedure. Human error cannot be avoided, even if members are familiar with thework. A device that prevents hands from using wrong pins during the battery
charging should be included in the design. It is also recommended to consider
including a flight pin in the design to prevent satellite startup, antenna deployment,
etc. by mistake while the satellite is stored.
7.15 Confirmation of Compliance with Safety Requirements
The Phase 3 safety review is conducted after completion of the FM tests. It is theevent to examine whether the satellite is constructed according to the safety
requirements based on a variety of the evidence (verification results). The
verification documents should include the results of the verification methods thatare agreed with the launch provider in Phase 2 safety review. The verification
documents should not be provided to the launch provider all at once after all the
tests are completed. The documents should be provided once they are done without
waiting for other documents become complete. The details of the documents shouldbe agreed with the launch provider upon from the FM AIT phases.

28

8. Satellite Operation
8.1 Preparation and Maintenance of Ground Systems
Preparation of the ground systems should be completed before delivery of thesatellite, and whether communication can be established with the FM should be
confirmed. The following matters should be considered to determine the place where
the ground systems are located.
a) No high buildings around the site and a satellite at a low angle of elevation is kept
in line of sightb) No electromagnetic noise source (RF emission source) around the sitec) Space to set up the communication equipment, etc. is available near the antennad) A comfortable environment is maintained in the room where the communicationequipment is placed, which is closely located to the ordinary office and 24-hour accessis allowed.
e) Easy access to a place where the antenna is located is ensured for inspection andmaintenanceItems a), b), and c) are required to enhance the performance of the communication
link. As a high frequency electrical signal is easily attenuated by the coaxial cable(attenuation can be easily calculated when the frequency and the coaxial cable typeare known), item c) is very important. When the antenna is located far from thecommunication equipment, conversion to a low frequency signal near the antennashould be considered.
Items a), b), and c) tend to be focused when determining the antenna location, but
items d) and e) are also necessary when considering a long-term operation, and abalanced approach considering both requirements is necessary. For example, wheninspection and maintenance of the antenna becomes necessary, timely operation of
the satellite will become impossible in case of an emergency as it may take several
days to obtain access permission, arrange for a contractor (access to the antenna by
students is not permitted), etc.. If the radio station is located in a room to whichaccess at night is not allowed, operation of the satellite at night becomes impossible,
resulting in a 50% loss of visible time of the satellite from the beginning. While
operation via the network is possible, in critical situations such as immediately after
the satellite is released into orbit it should be operated using all the visible time.
Operation is better performed by members sitting in front of the communicationequipment unless members have adequate experience in network operation. It is
required that the operation room is located close to the office room when operation
at night is considered, and where the members should spend hours between thevisible time and the visible time during the night should also be considered. When
operation in midsummer and midwinter is considered, working in a utility space on
the rooftop where the communication equipment is located will not be comfortable.
Periodic maintenance of the antenna is essential as the antenna is exposed toweather. If you feel there is difficulty in uplink or the Morse code tone is weak, thedirection of the antenna should be checked. Figure 9 shows the typical antenna
pattern of a Yagi antenna, which shows that the gain decreases by 10 dB when theantenna direction changes by 10 degrees from the centerline, and the communication
margin will be sacrificed. Attention should be paid in adjusting the antenna direction
because the magnetic north indicated by a compass is not the geographical north asshown on a map. The cable connects the antenna and the communication equipmentusing more than one connector. Contact failure, corrosion, etc. of the connector are29

frequent causes of a failure of the ground station.
Whether the ground system is functioning properly can be confirmed measuring
the RF field strength of the signal received from the satellite. For your own satellite,
it is impossible to know whether a problem exists in your satellite or in the groundsystem. So, it is recommended to determine the satellite that should be used as thecalibrator (the satellite transmitting the beacon signal for years) and to track suchsatellite and to measure the RF field strength.

Figure 9 Antenna Pattern Example of Yagi Antenna for Ground Station
8.2 Operation Plan
The lean satellite is made using non-space-qualified commercial-off-the-shelf(COTS) products that are not guaranteed to function in space, and testing conductedprior to launch is limited. Accordingly, unexpected problems in orbit cannot be
avoided, which may frequently result in complete failure shortly after the start ofoperation. Accordingly, the following should be implemented.
a) Check the functions that are essentially required for the survival of the satellite,
such as the battery and solar panels.
b) The uplink and downlink should be established and an Integrated Test (In Japan,
the examination by the radio authority to check the communication is established or
not after the satellite launch is called “Integration Test”. In different countries,
different term may be used for the final exam before issuance of the full radio
license.) should be conducted to obtain an official radio station license.
c) The mission to realize the minimum success criteria should be performed as earlyas possible. This should be preferably done within one week from release of the30

satellite in orbit. In the case of the first satellite, members will be occupied in
decoding the CW Morse code and analyzing the basic housekeeping data sent fromthe satellite with excitement. You should, however, proceed to execute the mission
as soon as possible. There have been many satellites where communication was lostwhile the team was busy analyzing the received CW Morse code. The reason theacquisition of a regular radio station license needs to be hurried is because the public
release of the satellite mission’s results is restricted if you have only a preliminary
license, as operation of the satellite immediately after release in orbit is made withthe preliminary license.
8.3 Handling Anomaly and Failures in orbit
As explained in 8.2, communication with the satellite may be interrupted at any
moment. But the team should never give up even in such a case. There is a satellitethat recovered after two years without communication. It is important to maintainmotivation within the team. What is the most important is the positive attitude of
the professor (principal investigator). All the team members should bear in mind theimportance of identifying the cause, even if the satellite fails completely, to reflect
the lessons learned from such investigation on the second and subsequent satellite
projects. In the case of a satellite where the second satellite succeeded after the
failure of the first satellite, this was achieved through a thorough investigation of
the failure causes in the first one, and the results were reflected in the design of thesecond one. You cannot be successful only by chance. When the main mission
becomes impossible to accomplish while communication is still maintained, it isimportant to continue acquiring operation data in orbit from the surviving satellite,
because lessons learned in operation from such data can be reflected in the design ofthe subsequent satellites.
It is recommended to perform the FTA along the flow of communication when afailure (including communication interruption) occurs. It is recommended toinvestigate whether a problem occurs within each block or at each interface of blocks
along the information flow from the ground station  satellite  ground station
shown in Figure 10. Whether the problem is in the ground station or not can be easily
checked using the flight spare and the ground station equipment. The problem inthe satellite is investigated by checking the possible causes of the failure. The
observed events should be listed first along with how frequently the events occur,when they occur, the particular location in orbit and other relevant information. The
telemetry data should be analyzed. The uplink command history and the actions of
the satellite to each command should be checked. Sound data and unsound data areseparated. The data trends are investigated. Using the flight spare, experiments toreplicating the observed event should be done.
To do FTA, the final flight software source code, the design documents of thesatellite and flight spare, etc. are important. But the most helpful is the members
who actually developed the satellite. A failure that occurred in orbit is not always
unrecoverable. Recovery from the defect may be possible by working out analternative plan in operation. To make such recovery possible, the operation teamshould understand the satellite design. It is strongly desired that a project schedule
is established so that members engaged in the development remain in the teamduring satellite operation. It is strongly recommended to make the flight sparebecause it plays an important role when a problem occurs in operation. The flightspare is also very useful when a replacement part becomes urgently necessary due

31to a mistake during the FM AIT. The EM may be used as the flight spare.
Ground station side

Groundstation
PC

Radio
Tx

Satellite side

Antenna

Antenna

Radio
Rx

COM MCU

OBC

MissionpayloadGroundstation
PC

Radio
Rx

Antenna

Antenna

Radio
Tx

COM MCU

OBC

Figure 10 Information Flow Ground Station  Satellite  Ground Station

32

9. After Satellite Operation
9.1 Lessons Learned
Lessons learned are the essential factor in the practical application of theexperience and knowledge obtained in the satellite project in subsequent satellite
projects or activities in the real world. There are two opportunities to summarize thelessons learned. When the satellite is delivered and when the satellite operation isfinished. The lessons learned should be summarized before graduation of the core
members when the operation expands for a long time like two or three years. It is
recommended that the responsible professor (principal investigator) should record
what has been noticed in a notebook while the project is ongoing. No definite method
is prescribed in summarizing the lessons learned, but the most important thing is tocreate an atmosphere where the members participated the project can discuss freely
and openly. The importance of the lessons learned exists when they are effectively
utilized, the responsible professor (principal investigator) should refer to the lessons
learned of the past project when the situation requires.
9.2 Recording, Reporting and Publication of Results
The progress and records of the entire project including operation of the satellite
and the management should be summarized and documented in addition to thedesign and test results of the satellite. Such documentation will provide valuableguidance and will be used as a reference by students participating in subsequent
projects. Documentation should be prepared by the project manager or responsible
professor overseeing the entire project, but motivation is necessary to promote thewriting of such document. Giving a presentation in the space technology conferencesuch as Nanosatellite Symposium and other conferences such as UNISEC Space
Takumi Conference will be good opportunities.
The variety of cooperation and assistance was obtained from outside organizations
or persons during the progress of the satellite project. For such organizations andpersons, reporting of what is obtained by the project is the best reward. Accordingly,
when the summary of the project becomes available to some extent, it isrecommended to hold a reporting session to such organizations and persons. The
materials used for presentation in such sessions can be conveniently used later as arecord of the project. The results of the satellite’s mission should be published to avariety of audiences by papers, etc., and not limited to sharing among a limited
numbers of persons related to the project. The purpose of the university satellite isdeveloping human resource and making progress in science and technology. In thecase of a satellite intended for technology demonstration or scientific observation, its
results should be ultimately returned to society by publishing the results. Even in
the case of a satellite intended for the education of students, what educational
results can be obtained by the satellite project should be made public so that otheruniversities can use it as a reference, considering the nature of the lean satellite as
the method of education. Publication of such scientific or educational results should
not be restricted to publication as a peer reviewed papers in journals. Needless to
say though, publication as a peer reviewed article in a journal is desirable for the
responsible professor or student (doctoral student in particular) when their academic
career is considered.
9.3 Sharing of Knowhow
For the success of the lean satellite mission, the correct functioning of the satellite33bus supporting the mission is essential. There were so many failures of the mission
caused by failure of the satellite bus. To achieve an advanced mission, advanced bus
technology is required but it does not mean that all the bus equipment needs to be
newly developed. For the satellite bus that has a sufficient record of operation inorbit, it is desired to use reliable and proven technology, sharing the data, knowhow,and software in the community. For sharing of knowhow, the knowhow needs to be
remade to a form that can be shared. It is this work that takes time. Because it isdifficult to construct a platform for information sharing all at once, it is desirable tobegin with the extent possible. The in-orbit data (temperature etc.), the record ofdefects that occurred in orbit, the list of the parts installed, etc. are considered ashigh demand, so the willingness to share such data with other projects is desired.

34

10. Sustainability of University satellite Program10.1 Viewpoint as a Program
The approach to improve the satellite bus and mission payload as a series ofprograms rather than as an individual satellite project is important. To achieve
excellent results as the satellite program consistently, how to cumulate the lessons,knowledge, and knowhow obtained should be considered carefully. There is no
definite answer in the case of the university satellite, depending on the conditions ofindividual university, professors, etc. but it is desirable that persons with actual
experience of the project life cycle continue to serve in subsequent projects, inaddition to recording the lessons in documentation. This does not apply to thestudents because they graduate. The lessons should be inherited by the professors
and staff. Even in the case of staff, there are issues to be considered such as thefunding to continue employment, tenure according to the university rules, or careeradvancement as a researcher in the case of a postdoctoral fellow. When the lessons
are inherited by the professor, it is necessary that such professor continues to engage
in satellite projects as a program director.
As an alternative method by which the lessons are inherited by a group of students,
it is possible that senior students convey lessons to junior students based on the
results of operation in preceding projects by overlapping multiple satellite projects
simultaneously for respective grades. This is a method to retain experience ascollective intelligence. However, this method will require the professors to makeevery effort to acquire the necessary funds.
To construct a sustainable system to inherit lessons will be difficult in an
organization where only the students are directly assigned to a responsible professor,
because such organization will impose excessive burden to the professor. The
organization where the postdoctoral fellow and assistant professors support the
project as middle level members is desired. For that case, a system where juniorresearchers can build up their academic career is required.
When the technology becomes fully mature after experiencing a number of orbital
operations, an approach whereby the results of the projects are returned to society
is desired. One way is to transfer the design and knowhow to a company. Anotherway is to make them available as opensource. Information such as electronic circuits
and structures can be left in the form of drawings. Then, it is possible to prevent thetechnology from belonging to a particular person by transferring it to a company or
making it open source. But information such as software whose development work
is mostly done by single person is difficult to make the information transferrable.
Most students are not trained to write software in a way that others can understand.
For professors whose is not specialized in software the software is a black box. What
the professor can do is to suggest putting as many comments as possible only. At
present, there is no method other than making the software open source to increase
the chance of reviewed by many people. How to transfer the software know-how is
still an issue for university satellites.
10.2 Strengthening the Research Base in University
The university is “a group of small private shops” in nature. The university
satellite projects are run as a laboratory project of the responsible professor in manycases. To make the satellite project continue as a research program and steadily
obtain outcome, support from the university management is required. But support
from the university will require a return to the university. For that reason, the35

professors may be asked by the university to do work what they do not want to do or
they are not good at. If the professor does not want to do such work, the idea to makethe university a project sponsor should be abandoned and enterprise(s) outside theuniversity as a sponsor should be sought.
When support from the university is sought, the university satellite is often used asa tool of student recruitment. When the value of the project is limited to such effect,
however, the support from the university will be limited. The effects on education,
research activities of the university, or both must be demonstrated. This is relatively
easy for educational activities. In recent education provided by faculty of engineering,the design capability and incorporation of Project Based Learning (PBL) are required
as prompted by JABEE. (Note: This is the case of Japan. JABEE stands for Japan
Accreditation Board for Engineering Education.) In a bachelor course of education,
learning from a wide perspective is required in addition to learning by specializingin specific fields. Particularly, in the department related to space engineering,systems engineering is one of the most important subjects, and practical training in
addition to learning by lecture is required. The satellite project is the subject best fit
for such purpose, and it will not be difficult to award credits to a student who
participates in the satellite project. When the satellite project is included in the
curriculum, support from the university will be obtained continuously. But it should
be noted that the amount of funding granted by the university will not be large
enough. Support from the university should be considered as a chance from which asatellite project can grow out from the personal project of the professors.
When you consider expanding the satellite project in the university, coordination
with other professors cannot be avoided. It is one step forward from the project ofProfessor XX to the project of Professors XX, YY, and so on. Coordination amongprofessors is expected to have positive effects such as diversification of teammembers, increase in expertise within the team owing to the increased number ofprofessors, diversification of the satellite mission (this is remarkable whencoordination is established between professors in science and engineering), theincrease of chances to obtain funding from outside, etc. There is also the associatedrisk that may arise of possible inconsistency between the students when the students
become aware of the walls existing between different laboratories. To solve suchproblem, daily cooperation between professors is necessary. With respect tocooperation between laboratories, this is true not only with professors in spacesciences (installation of scientific observation equipment, etc.), but should also be
considered professors in satellite data application. In particular, as a pilot projectusing the team’s own satellite in the fields of IoT and AI may draw the attention of
professors who are interested in data analysis but may not be interested in building
a satellite, active cooperation may become possible.
10.3 Funding of Project
Even if the research base in the university is established, it is very rare thatfunding sufficient to continue the making and launch of the satellites is provided by
the university. The team needs to acquire the funds necessary to continue suchprogram, but such funding should be achieved by the efforts of individual professors.
It is recommended that a funding plan have adequate allowance because expenses
will easily increase due to factors that cannot be estimated at the start of the project(repair of purchased parts, purchase of additional parts, etc.). As continuity of the
program cannot be guaranteed when the program relies only on KAKENHI (Grant-36

in-Aid for Scientific Research, a competitive government research funding aimed atmostly university professors) or other competitive research funding from theGovernment, it is important to acquire multiple funding sources. While adequate
funding should be acquired, the design of the satellite bus should be a type that canbe purchased at low cost.
10.4 Cooperation with Outside Organizations
Cooperation with outside organizations or persons is essential for continuing theconstruction of satellites as a program. It is important to maintain good relationships
with companies who supply key components. Needless to say, the project teamshould also have a good relationship with the community of amateur radio operatorsand the space agency.
Cooperation with other universities and outside research institutes, as well as
cooperation with other laboratories in your university, brings many benefits when
you want to expand the program. Cooperation with organizations abroad isespecially beneficial because students can experience international projects. The
students can learn matters such as finding out the needs of satellite use in othercountries in planning the satellite mission. Physical distance and difference in time
may become a problem in cooperation with foreign organizations. Simultaneousdevelopment of the satellite bus in your country and development of the mission
payload outside your country, with such payload being assembled in the satellite bus
in your country for delivery of the satellite will be possible when the interface
between the satellite bus and the mission payload is clearly defined, and such project
has actually been made. In a cooperative project with a foreign organization, therequirement for paperwork under the Security Export Control (different terms may
be used in different countries) must be confirmed, and when publicly known
technology (information available in open source) is not used, very careful checking
is required. Nowadays, many universities have a department that specially handles
the security export control matters, and contact with such department in advance isstrongly recommended.

37

References[1] “Definition and Requirements of Small Satellites Seeking Low-Cost and FastDelivery”, Edited by Mengu Cho and Filippo Graziani, International Academy of
Astronautics, 2017, Code ISBN/EAN IAA: 978-2-917761-59-5[2]Michael Swartwout, Clay Jayne, University-Class Spacecraft by the Numbers:
Success, Failure, Debris. (But Mostly Success.), 30th Annual AIAA/USU Conference
on Small Satellites, 2016
[3] “Lessons Learned Case Analysis for Micro/Nano satellite Mission Success”,
University Space Engineering Consortium, JAXA-CR-21-002, JAXA, 2021 (inJapanese)[4] Toyota Production System, Taichi Ohno, Productivity Press, 1988, ISBN9780915299140[5] Manual for International Frequency Coordination Procedures for Small Satellites,(In Japanese)
https://www.tele.soumu.go.jp/resource/j/freq/process/freqint/001.pdf[6] JBDB-08012D “Success Criteria Making Guideline”, JAXA Chief Engineer Office,January, 2018 (in Japanese)[7] JX-ESPC-101133-D , “JEM Payload Accommodation Handbook, Vol.8, Small
Satellite Deployment Interface Control Document”, Revision D, July 2020.
https://humans-in-space.jaxa.jp/kibouser/library/item/jx-espc_8d-d1_en.pdf[8]]ISO-19683 “Space Systems – Design qualification and acceptance tests for small
spacecraft and units”, 2017.07[9] Adolfo Jara, Pooja Lepcha, “On-orbit Electrical Power System Dataset of 1U CubeSat
constellation for Machine Learning Models”, Mendeley Data, May 2022,
DOI:10.17632/8kp25ycf63.

38