Reliability Case Study of COTS Storage on the Jilin-1 KF Satellite: On-Board Operations, Failure Analysis, and Closed-Loop Management

Abstract

In recent years, the rapid development of commercial satellite projects, such as low-Earth orbit (LEO) communication and remote sensing constellations, has driven the satellite industry toward low-cost, rapid development, and large-scale deployment. Commercial off-the-shelf (COTS) components have been widely adopted across various commercial satellite platforms due to their advantages of low cost, high performance, and plug-and-play availability. However, the space environment is complex and hostile. COTS components were not originally designed for such conditions, and they often lack systematically flight-verified protective frameworks, making their reliability issues a core bottleneck limiting their extensive application in critical missions. This paper focuses on COTS solid-state drives (SSDs) onboard the Jilin-1 KF satellite and presents a full-lifecycle reliability practice covering component selection, system design, on-orbit operation, and failure feedback. The core contribution lies in proposing a full-lifecycle methodology that integrates proactive design—including multi-module redundancy architecture and targeted environmental stress screening—with on-orbit data monitoring and failure cause analysis. Through fault tree analysis, on-orbit data mining, and statistical analysis, it was found that SSD failures show a significant correlation with high-energy particle radiation in the South Atlantic Anomaly region. Building on this key spatial correlation, the on-orbit failure mode was successfully reproduced via proton irradiation experiments, confirming the mechanism of radiation-induced SSD damage and providing a basis for subsequent model development and management decisions. The study demonstrates that although individual COTS SSDs exhibit a certain failure rate, reasonable design, protection, and testing can enhance the on-orbit survivability of storage systems using COTS components. More broadly, by providing a validated closed-loop paradigm—encompassing design, flight verification and feedback, and iterative improvement—we enable the reliable use of COTS components in future cost-sensitive, high-performance satellite missions, adopting system-level solutions to balance cost and reliability without being confined to expensive radiation-hardened products.

1. Introduction

In recent years, the proposal of mega-constellations has driven a paradigm shift in the global satellite industry, particularly within the commercial space sector, characterized by low cost, rapid development, and large-scale deployment [1]. Commercial satellite projects, represented by low Earth orbit (LEO) communication and remote sensing constellations, have imposed unprecedented stringent demands on the cost-effectiveness and development cycles of satellite platforms [2,3]. Against this backdrop, commercial off-the-shelf (COTS) components have been widely adopted across various commercial satellite platforms—from onboard computers and communication payloads to rechargeable batteries and even critical mission management units—due to their significant cost advantages, high performance levels, and plug-and-play availability [4,5,6,7]. Among these, high-capacity onboard storage products based on COTS components are particularly critical for supporting data-intensive missions such as high-resolution Earth observation and on-board intelligent processing.

However, the space environment is extremely complex and hostile, encompassing multiple adverse factors such as high-energy particle radiation, extreme temperature fluctuations, and vacuum conditions. Unlike traditional space-grade components, which undergo stringent process control and protective design, COTS components are not originally designed for such harsh environments. Their inherent reliability issues have become a core bottleneck limiting their widespread application in critical missions. Common radiation effects include single-event effects (SEE), total ionizing dose (TID), and displacement damage (DD) [8,9,10], which can severely impact system performance, leading to anomalies or even catastrophic failures [11,12]. SEE induced by high-energy particle radiation, particularly single-event upsets (SEU) that may corrupt data and single-event latch-ups (SEL) that can cause functional interruptions, pose significant threats to the stable on-orbit operation of COTS products [13]. Although COTS components can substantially reduce initial costs, their potential for anomalies and failures may jeopardize the success of the entire mission, thereby incurring higher lifecycle costs. For instance, the COTS SRAM chip from CYPRESS incorporates a novel latch-up suppression circuit. However, during high-energy particle irradiation testing, SEE still induced burst multiple-bit upsets in the chip, with the number of flipped bits exceeding 100. Analyses confirmed that this phenomenon is attributed to local latch-up effects, which significantly diminish the effectiveness of error detection and correction hardening in the space environment [14]. Furthermore, during the on-orbit operation of the PROBA-V satellite, the COTS SRAM memory in its redundant modules exhibited unexpectedly high error rates. By comparing experimental simulation data with the flight data, researchers analyzed and concluded that temperature and shielding variations may be responsible for the discrepancy in error rates between the primary and redundant lines [15]. Therefore, COTS components still require additional radiation hardening measures—such as enhanced shielding and redundancy design—for deployment in space environments like those of LEO satellites. Shielding designs utilizing high-atomic-number materials such as tantalum, tungsten, and lead offer effective protection against low-energy particle radiation and TID effects [16]. However, their effectiveness is limited against high-energy particles and heavy ions, and they are largely ineffective against SEE. Therefore, the most robust approach to ensuring reliability typically includes circuit-level radiation-hardened-by-design techniques or system-level triple modular redundancy (TMR). For instance, a highly stable and radiation-hardened latch named HITTSFL, which is tolerant to triple-node upsets (TNUs) and single-event transients (SET), has been proposed. It utilizes three inverters to converge the stored values from multi-parallel Dual-Interlocked-storage Cells to the input of a Schmitt trigger, thereby preventing the flipped values caused by a TNU from being maintained and filtering out SETs [17]. A highly reliable radiation-hardened-by-design memory cell, RHBD-14T, has also been introduced. By employing redundant nodes at the circuit level and implementing node isolation and source isolation techniques at the layout level, the RHBD-14T cell can recover to the correct state from multi-node upsets induced by SEE [18].

However, considering the potential power consumption burden and the current level of technological maturity associated with the hardware improvements mentioned above, these methods are generally not yet suitable for modern small satellite missions. Additionally, for aerospace systems utilizing COTS components, a series of fast recovery strategies for fault detection and isolation have been explored. These strategies can be broadly categorized into hardware-centric solutions and software-centric solutions. A parity-based dual-modular redundancy method has been proposed for the interconnect interface of COTS System-on-Chips in nanosatellites, aiming to enhance the reliability of data transmission between the core processing unit and the FPGA. This method was validated through simulation experiments and compared with TMR technology. The simulations demonstrated that the total error percentage for this configured method decreases and approaches that of TMR as the SEU rate decreases. Concurrently, this method reduces hardware resource utilization and power consumption compared to a TMR implementation [19]. The French National Centre for Space Studies (CNES) has specifically developed two fault-tolerant architectures for COTS components in spacecraft. One, known as the DMT architecture, is based on a temporal redundancy scheme. The other, called the DT2 architecture, is based on a structural duplex framework with minimal replication design. Both architectures not only reduce the susceptibility of COTS components to SEE but also offer advantages in terms of lower lifecycle cost, reduced mass, and lower power consumption compared to traditional TMR designs [20]. To address SEU faults in COTS software-defined radios, a pure software framework for fault detection, isolation, and recovery was designed specifically for AD936x radio frequency agile transceivers. This method relies on three core technologies: active register scrubbing, real-time health monitoring, and autonomous fault recovery. In test scenarios, this method achieved 100% fault coverage with negligible computational overhead [21].

To address the reliability challenges of complex space missions, current research primarily focuses on reconfigurable systems [22,23], agile engineering processes [24], and system-level verification techniques [25,26]. These three aspects are key methods for enhancing both the efficiency of the development process and the resilience of the systems themselves. These directions aim to ensure the reliability and effectiveness of COTS-based complex systems in the space environment. Although extensive research has been conducted on the reliability of COTS components for aerospace applications, it has yet to systematically address the usability issues of COTS. This gap stems from a significant divide between theoretical protective strategies for COTS device deployment and systematically verified practical frameworks. Existing efforts often concentrate on isolated stages, such as analyzing the mechanisms of radiation effects, designing hardened circuits, or developing system-level fault-tolerant algorithms. There is a lack of a closed-loop methodology that seamlessly integrates multiple phases: pre-flight design and screening, real-time on-orbit performance monitoring, data-driven root-cause analysis of failures, and the feedback of on-orbit experience. This fragmented research model struggles to meet the practical engineering needs of commercial satellites, which require a balanced trade-off among cost, performance, and reliability. Consequently, it fails to establish a continuous improvement cycle.

Given this research status, this paper proposes and constructs a reliability study framework covering the entire lifecycle of COTS components, integrating the previously fragmented aspects of COTS reliability into an organic, closed-loop, and engineering-applicable system. The goal is to systematically ensure the reliability of COTS components for space missions without significantly compromising their cost and performance advantages, thereby providing technical support and a practical foundation for developing future high-performance, low-cost commercial satellites. Our work makes three core contributions: First, considering the pronounced demand for capacity and reliability in storage systems for high-resolution remote sensing satellites, we focus on a typical COTS-based onboard storage product and detail a practical strategy incorporating redundancy and protection. Second, moving beyond conventional ground testing, we conducted an actual on-orbit mission deploying a specific COTS model, investigated potential failure scenarios, collected in-flight failure data, and performed comprehensive analysis of this data to evaluate the capability of COTS components to operate in the space environment. Through this process, employing statistical and geospatial techniques, we empirically pinpointed the South Atlantic Anomaly (SAA) region as the primary driver of SSD failures—an insight critical for mission planning and risk assessment. Third, and most significantly, we completed the closed-loop corroboration by correlating in-flight data with controlled ground experiments, thereby transforming observational data into a verified physical failure mechanism. This finding directly drives the optimized design of next-generation products. This entire process—from design for flight qualification, through fault reproduction, to design feedback—establishes a paradigm for a continuous reliability growth cycle.

2. Satellite Development, Testing, and On-Orbit Operations

The Jilin-1 KF Satellite is a remote sensing satellite within the Jilin-1 satellite constellation, where KF means wide remote sensing image swath. It carries a high-performance space camera designed to provide high-resolution and ultra-wide-swath remote sensing image products. Due to the extremely high optical bandwidth product of its imaging system, a large-capacity storage component is essential to support data compression and temporary storage requirements. To meet these storage demands, KF Satellites are often equipped with Solid State Drives (SSDs), the number of which can be several times greater than that on standard remote sensing satellites. To ensure the satellite operates normally in the space environment, the storage system typically employs space-grade components. However, this significantly increases the manufacturing cost of the KF Satellite. Consequently, a trial operation using COTS SSD has been proposed to reduce satellite manufacturing costs, particularly for satellites like the KF Satellite which have high storage capacity requirements.

2.1. Functional and Reliability Design of the System

The KF Satellite comprises several subsystems. Its imaging subsystem includes the optical lens assembly, the image detector, and the image processor. Among these, the SSDs are the component of the image processor. The overall architecture of the image processor is illustrated in Figure 1. Its functionalities include: (1) Storing image data from the CMOS sensor during imaging operations into non-volatile SSDs; (2) Sending the data stored on the SSDs to the data transmission subsystem to complete satellite-to-ground data transfer; (3) Receiving and executing command programs from the central processing subsystem and feeding back the status data of the imaging subsystem; (4) Other functions. The KF Satellite carries the image processor utilizing industrial-grade SSDs. In this design, the SSDs are dedicated solely to the storage function, while control functions such as read/write operations and bad block management are implemented by an FPGA. This system features three SSDs configured in a multi-parallel redundancy architecture.

Figure 1. Functional architecture of the image processor with other components and its partial physical photos.

To ensure that the image processor can fulfill its operational requirements throughout the satellite’s intended lifespan, several reliability protection measures have been designed and implemented, including: (1) Derating design of components, selecting parts with wider operational margins than standard specifications to reduce the probability of system failure due to abnormal conditions; (2) Mechanical protection design, rationally designing the weight, strength, and stiffness of printed circuit boards to mitigate the impact of rocket and satellite platform vibrations on the system; (3) Thermal protection design, forming efficient thermal pathways through rational layout to prevent abnormal temperature rises in components caused by heat accumulation; (4) Electrostatic discharge protection and electromagnetic compatibility design, ensuring that internal and external electrical or magnetic stresses do not interfere with normal system operation; (5) Other control measures such as process quality control and supply chain quality control. Furthermore, several environmental adaptation designs have been implemented, including: (1) Protection against TID from space radiation by installing tantalum foil shielding on the exterior of the image processor structure [27]; (2) Protection against SEL from space radiation by incorporating resettable fuses in the power management module to achieve partitioned overcurrent protection design; (3) Protection against SEU from space radiation by implementing a multi-parallel redundancy strategy for critical data and programs within the FPGA.

2.2. Reliability Testing of COTS SSDs

Based on relevant standards and historical experience, in addition to the necessary functional testing of the entire satellite, specific tests were conducted to screen for early failures and assess environmental adaptability. The reliability tests performed on the image processor included atmospheric thermal cycling and vacuum thermal cycling. For the COTS SSDs, these tests served multiple integrated purposes: (1) Reliability screening, using elevated temperatures to rapidly eliminate products with inherent process defects; (2) Reliability qualification, evaluating the reliability level of the SSDs under combined thermal and electrical stress under a right-censored scenario; (3) Reliability acceptance, ensuring the SSDs pass mandatory environmental adaptability tests to obtain flight approval for on-orbit deployment. Within the reliability test regimen, atmospheric thermal cycling was used to accelerate the detection of early failures, while vacuum thermal cycling was employed to accelerate the verification of their adaptability to the vacuum space environment. The profile for a single cycle of the environmental testing was established based on the satellite’s mission profile and the principles of high-temperature accelerated testing, as illustrated in Figure 2.

Figure 2. Profile of the environmental testing within a single cycle.

Constrained by development timelines and testing costs, the reliability testing was implemented following a right-censored life test plan. A total of 420 SSD samples participated in the test, which was conducted in two rounds. In each round, the thermal cycling test lasted for 10.5 cycles, and the thermal vacuum test lasted for 3.5 cycles. Throughout the entire testing process, samples exhibiting early failures—such as read/write speeds failing to meet technical specifications—were screened out. Beyond this, all components operated normally, with all performance metrics meeting requirements, and no samples exhibited random failures.

2.3. On-Orbit Operations of COTS SSDs

The SSDs that underwent testing were carried on the KF Satellite and launched into LEO to provide storage functionality for imaging missions. After the satellite completed its on-orbit testing phase and began routine operations, the COTS SSDs started to fail successively following a period of mission execution. The failure manifestation is as follows: the FPGA activates the controller to power on the SSD, and the SSD can provide a startup response signal, but the FPGA fails to initialize the SSD. When attempting initialization, the SSD cannot return File Allocation Table (FAT) information, and the available capacity is reported as 0. Upon failure of a single COTS SSD, a cold-backup SSD takes over its function. Part of the survival data, with individual SSDs as the unit, is shown in Table 1. In response to this on-orbit performance, we analyzed the failure mechanisms and attempted to identify the root causes.

Table 1. A partial display of survival data for individual SSDs. The study period spanned from 20 November 2024 (commencement of routine operations) to 30 October 2025 (end of data collection).

SSD ID	Starting Time	Failure Time	Lifespan/Day
KF-01-01	20 November 2024	30 October 2025	345
KF-01-02	20 November 2024	30 October 2025	345
KF-01-03	20 November 2024	30 October 2025	345
KF-01-04	20 November 2024	30 October 2025	345
KF-01-05	20 November 2024	1 October 2025	52
……	……	……	……

3. Failure Mode and Mechanisms Analysis in Space Storage

During ground testing, after screening out early failures, the reliability of the COTS SSDs reached the random failure period of the bathtub curve. However, no failures occurred in the ground environment, allowing failures caused by design issues to be ruled out. Analysis of satellite system problems over the past few decades indicates that a significant portion of issues are attributed to the space environment [28]. For the on-orbit failures, the impact of the external space environment on the SSDs warrants consideration. Since the KF Satellite operates in LEO, the failure mechanisms of the SSDs will be investigated by analyzing both external factors related to the LEO space environment and internal factors related to storage principles.

3.1. LEO Space Environment

3.1.1. Thermal Stress

Solar electromagnetic radiation refers to the energy transmitted by the Sun in the form of electromagnetic waves. While it provides energy input to the satellite, it can also cause unintended temperature increases. Furthermore, a portion of the solar radiation incident on Earth’s atmosphere is scattered by the atmosphere and reflected by the Earth’s surface back into space. The temperature of a satellite is primarily influenced by the combined effects of solar radiation and Earth-atmosphere radiation, which can be expressed as [29]

$${\displaystyle \frac{\mathrm{d}T}{\mathrm{d}t}}=({\displaystyle \frac{\mathrm{d}{Q}_{\mathrm{hd}}}{\mathrm{d}t}}+{\displaystyle \frac{\mathrm{d}{Q}_{\mathrm{sr}}}{\mathrm{d}t}}+{\displaystyle \frac{\mathrm{d}{Q}_{\mathrm{er}}}{\mathrm{d}t}}-ϵA\sigma T^4)/C,$$

(1)

where $Q_{\mathrm{hd}}$, $Q_{\mathrm{sr}}$, and $Q_{\mathrm{er}}$ represent the internal heat dissipation, solar radiation energy, and Earth-atmosphere radiation energy, respectively, while $C$ denotes the overall specific heat capacity of the satellite system. The cooling mechanism of the satellite is described by the fourth term in Equation (1), which represents the heat radiated into space from the satellite’s surface, adhering to the Stefan-Boltzmann law. The primary factors affecting satellite temperature are the solar constant and the surface areas responsible for receiving and emitting thermal radiation. The solar constant, defined as the solar radiation energy received per unit area per unit time at the mean Earth-Sun distance with the surface perpendicular to the solar rays, generally remains stable [30]. Therefore, during on-orbit operations, the rate of temperature change in a satellite is mainly influenced by variations in its operational attitude and orbital position and may experience significant temperature variations under certain extreme conditions [31].

3.1.2. Electrical Stress

Solar electromagnetic radiation interacts with the upper atmosphere, ionizing it to form low-energy plasma regions. The interaction between the satellite and the plasma layer can be described by the particle transport equations [32] as

$$[{\displaystyle \frac{\mathit{\partial }}{\mathit{\partial }t}}+{\mu }_e({\displaystyle \frac{{\mathit{\partial }}^2\varphi }{\mathit{\partial }{r}^2}}+{\displaystyle \frac{\mathit{\partial }\varphi }{\mathit{\partial }r}}{\displaystyle \frac{\mathit{\partial }}{\mathit{\partial }r}})-D_e{\displaystyle \frac{{\mathit{\partial }}^2}{\mathit{\partial }{r}^2}}-\alpha ]n_e(r,t)=0,$$

(2)

where $n_e(r,t)$ represents the electron density at a specific time $t$ and position $r$, ${\mu }_e$ denotes the electron mobility, $D_e$ is the electron diffusion coefficient, $\varphi$ is the electric potential, and $\alpha$ signifies the ionization frequency for the generation of new electrons. The terms in this equation include: the rate of change in electron density with time, the electron drift under the influence of an external electric field, the thermal diffusion of electrons, and the rate of ionization due to radiation in different orbits. This exerts electrical effects on satellites, leading to various phenomena, primarily including: (1) Charged plasma bombarding the satellite surface, generating significant voltage [33]; (2) Abnormal arc discharge pulses occurring in the satellite’s high-voltage solar arrays [34]; (3) Interaction between the satellite’s surface potential and charged plasma in space, forming ion drag [35]. These effects can cause unexpected changes in the satellite’s attitude and orbit, while also interfering with the normal operation of signal and power systems. Long-term variations in the electrical properties of the plasma layer are primarily related to solar activity, while also exhibiting seasonal cycles, diurnal cycles, and correlations with latitude and altitude [36].

3.1.3. High-Energy Particle Stress

Previous analyses of satellite system issues have shown that a significant proportion of problems are induced by high-energy particle radiation in space [37]. High-energy particles primarily consist of galactic cosmic rays and solar cosmic rays. The fluxes of both types peak alternately with the solar cycle and can significantly induce electronic component anomalies as well as biological effects. For example, high-energy charged particles can generate internal electric field pulses in local regions of a satellite [38], as

$${\displaystyle \frac{\mathit{\partial }E(r,t)}{\mathit{\partial }t}}\approx -{\displaystyle \frac{R^2}{\epsilon {\epsilon }_0{r}^2}}{{\displaystyle \int }}_{R-l(w_0)}^r\rho (s,w_0)ds,$$

(3)

where the satellite is approximated as a sphere of radius $R$ with uniform electrical properties. $E(r,t)$ represents the electric field distribution at a specific time $t$ and radial distance $r$; the parameters $\epsilon$ and ${\epsilon }_0$ denote the relative permittivity of the satellite material and the vacuum permittivity, respectively; $w_0$ is the average energy lost by an incident high-energy electron as it penetrates the satellite’s surface Debye shielding layer. This value determines the maximum depth $l(w_0)$ reachable by the high-energy particle and the resulting charge injection density $\rho (r,w_0)$. Consequently, different satellite designs can lead to concentrations of electric field stress in different locations, potentially causing damage to specific components.

Fortunately, the radiation belts formed by Earth’s magnetosphere trapping these high-energy particles provide relatively effective protection for the region inside them. Earth has two radiation belts, with the Van Allen inner radiation belt mainly distributed at orbital altitudes around 3000 km above the equatorial plane. Over the South Atlantic Anomaly (SAA) region, it dips to a minimum altitude of approximately 500 km [39]. The dominant particles in the Van Allen inner radiation belt are high-energy protons. Their flux is influenced not only by Earth’s magnetosphere but also by extreme events such as solar flares. For LEO satellites, traversing the SAA region entails significant risks of failures caused by high-energy particle radiation [40].

3.2. Typical Failure Mechanisms of NAND Flash Memory

NAND flash memory, due to its superior read speed and robustness, is widely used in computers, large-scale data storage systems, and enterprise servers. The advantages of commercial NAND flash memory are particularly attractive for satellite applications where space and weight are critical, and many space programs have begun adopting state-of-the-art NAND flash memory in on-orbit applications [41]. Related technologies are also rapidly evolving, including multi-level cell (MLC) technology [42] and 3D NAND [43], which enhance storage density. The basic unit of NAND flash memory consists of an N-type MOSFET and a polysilicon floating gate. The control circuit of the storage system applies specific electric fields by altering the electrical signals at the terminals of the MOSFET. These fields control the injection or emission of electrons into or from the floating gate, changing its electrical state to achieve data storage and programming.

Under normal operating conditions, the reliability of flash memory systems primarily refers to their ability to program and store data correctly throughout their lifecycle. This reliability is mainly influenced by the high electric field stress during Fowler-Nordheim tunneling (FN-t) [44]. Unfortunately, the normal functionality of flash memory cells is significantly affected by the space environment: (1) As a typical semiconductor device, flash memory is sensitive to temperature variations, which may accelerate aging due to FN-t, enhance trap-assisted tunneling, and cause charge detrapping [45]; (2) Since electrical signals are used for programming and storage, external electric fields can significantly interfere with normal flash memory behavior, such as inducing unintended charge migration [46]; (3) High-energy particle bombardment of semiconductor devices can cause bit flips [47] and DD [48]. These factors can lead to hardware and data failures, resulting in mission failure or even satellite system malfunctions.

In ground systems, the SSD typically functions as external storage for data retention. However, from the perspective of satellite operations, after the satellites complete imaging missions, data is temporarily stored on SSDs. Once the satellite communicates with ground stations and transfers data to ground-based data systems, the drives are formatted [49]. Thus, the satellite’s SSDs essentially function as high-capacity, relatively long data lifetime temporary memory within the entire remote sensing data service system of the satellite. Compared to terrestrial applications, their use in space storage operations leads to higher frequencies of programming and erasing, which often accelerates the degradation of the tunneling oxide layer and reduces data retention capabilities [50].

3.3. Failure Analysis of the Spaceborne Storage

The success state space and failure state space of a system can complementarily describe all its possible states. The failure space is often finite and composed of independent elements, making it more suitable for deductive analysis of the system’s state [51]. To systematically analyze the failures of the spaceborne storage system, a fault tree can be constructed to clarify the failure mechanisms, as illustrated in Figure 3. Based on the operational principles of the satellite’s storage system shown in Figure 1, its failures can be attributed to three sub-events: (1) SSD failure, where the drive itself malfunctions, affecting storage functionality. This includes hardware damage due to aging or external environmental factors (e.g., flash memory and peripheral circuits) or corruption of logical states (such as FAT) caused by high-energy particle radiation; (2) Control module failure, where the drive’s control module fails to operate according to commands. Examples include damage to the FPGA itself or interface failures between the FPGA and the drive due to inadequate process control; (3) Power supply module failure, where the drive does not receive the required operational voltage. This could result from hardware damage to power components, interface failures, or latch-up events in MOSFETs induced by high-energy particle radiation, leading to voltage drop.

Figure 3. The fault tree analysis for spaceborne storage failure. The event definitions in the tree are as follows: T, Top Event, spaceborne storage failure; M1, SSD failure; M2, control module failure; M3, power supply module failure; M4, critical hardware damage of SSD; M5, critical data corruption of SSD; M6, FPGA-SSD interface damage; M7, FPGA failure; M8, power device damage; M9, latch-up of power circuit MOS device; M10, power supply interface damage; M11, critical hardware damage of FPGA; M12, critical data corruption of FPGA; X1, quality grade does not meet environmental adaptation requirements; X2, random Space environmental stress effect; X3, SEE; X4, quality defects due to insufficient quality control.

The relationship between the system failure top event and the basic events is expressed as

$$T=(x_1+x_4)(x_2+x_3),$$

(4)

where $x_1$ denotes insufficient quality grade of the COTS components, including design or manufacturing processes that fail to meet the reliability requirements for the space environment, or batch-related issues; $x_2$ signifies random Space environmental stress, which may cause random failures in components; $x_3$ refers to high-energy particle radiation, which can trigger latch-up or bit flips in semiconductor devices, leading to power supply failures or logical errors in software; $x_4$ represents process defects due to inadequate quality management during system development and production. On one hand, based on historical flight experience and batch-related issues observed in on-orbit performance, the basic event of process defects $x_4$ can largely be ruled out. On the other hand, given that the SSD can provide an initialization response signal to the FPGA and based on the design logic of the storage system, the intermediate events $M_2$ (control module failure) and $M_3$ (power supply module failure) can also be excluded. Therefore, logically, the failure of the spaceborne storage system can be attributed to the intermediate event $M_1$ (SSD failure). To further pinpoint the exact cause, quality data from both ground testing and on-orbit operations will be analyzed in detail.

4. Analysis of Test and On-Orbit Data, and Failure Reproduction Experiments

To further clarify the failure mechanisms and provide a basis for subsequent reliability management decisions, a series of related data analyses were conducted. These included reliability analysis of ground test and on-orbit operational data, as well as statistical analysis of telemetry data under on-orbit conditions. The analysis pinpointed high-energy particle radiation as the primary cause of failure. Consequently, a high-energy particle radiation test was performed on the hard drives, successfully reproducing the on-orbit failure mode. This step effectively closed the quality issue feedback loop for the COTS SSDs.

4.1. Failure Rate Analysis

As described in Section 2.2, reliability qualification testing under thermal stress was conducted on the COTS SSDs on the ground. Due to constraints in the development timelines, this test was a right-censored accelerated life test. The acceleration factors consist of two parts. First, within the 250 h life test, there was a 120 h high-temperature operating phase. The elevated test environment caused thermal acceleration. During the high-temperature phase, the test temperature was 42.5 °C, while the standard operating temperature is 20 °C. Based on the Arrhenius Model, the acceleration factor is given by

$$\mathrm{AF}=\exp [{\displaystyle \frac{E_a}{k}}({\displaystyle \frac{1}{T_0}}-{\displaystyle \frac{1}{T_A}})]\approx 39.09,$$

(5)

where $E_a$ is the activation energy, taken as 1.3 eV [52,53]; $k$ = 8.623 × 10⁻⁵ eV/K is the Boltzmann constant; and $T_0$, $T_A$ are the standard and accelerated operating temperatures in Kelvin, respectively. Therefore, the 120 h high-temperature operation is equivalent to approximately 4700 h under standard conditions. Furthermore, the temperature cycling accelerated failures induced by thermal shock stress. Under normal operating conditions, the duration of a single imaging mission is approximately 10 min, with a temperature rise rate in the satellite’s image processor area of about 1 °C per minute. In contrast, during the test, the temperature change rate was 4.5 °C per minute, reaching a maximum of 42.5 °C and a minimum of −2.5 °C. Thus, according to the Coffin-Manson Model, the acceleration factor is given by

$$\mathrm{AF}={({\displaystyle \frac{\mathrm{\Delta }{T}_A}{\mathrm{\Delta }{T}_0}})}^2{({\displaystyle \frac{\mathrm{\Delta }{f}_A}{\mathrm{\Delta }{f}_0}})}^{1/3}\exp [{\displaystyle \frac{E_a}{k}}({\displaystyle \frac{1}{\max \left\{T_0\right\}}}-{\displaystyle \frac{1}{\max \left\{T_A\right\}}})]\approx 239.58,$$

(6)

where the constant exponents are referenced from [54], and $\mathrm{\Delta }T$ and $\mathrm{\Delta }f$ represent the temperature change range and rate, respectively. Consequently, the 9.3 h of temperature cycling is equivalent to approximately 2200 h under standard conditions. Finally, neglecting the potential acceleration effect on SSD failures from the 0 °C low-temperature exposure in this test setup, the operational duration under those conditions totals 104 h. Thus, under the combined thermal and thermal shock stresses, this test is equivalent to a lifespan of approximately 7000 h. Under the right-censored test condition, assuming a constant failure rate $\lambda$, the probability of observing zero failures in the samples follows the Poisson process

$$P(N_f(T)=0)={\displaystyle \frac{{(\lambda NT)}^k\exp (-\lambda NT)}{k!}}{|}_{k=0}=\exp (-\lambda NT),$$

(7)

where $N_f$ is the number of failures, $N=420$ is the total number of samples, and $T=7000$ h is the total equivalent test duration. At a 95% confidence level, we have

$$P(N_f(T)=0)\ge 5\%,$$

(8)

so $\lambda \le 1.02\times {10}^{-6}{h}^{-1}$ could be obtained. This result implies that, under random internal and external stresses and adopting a 5% failure risk criterion (i.e., a reliability of 0.95), the minimum expected lifetime of the SSDs is approximately 5.7 years.

On the other hand, the on-orbit operational conditions for the COTS hard drives spanned approximately one year—from the start of routine operations to the end of the statistical window for failure data. During this period, 10 failures occurred. The likelihood function for the failure rate $\lambda$ is given by

$$L(\lambda )={\lambda }^{N_f}\exp [-\lambda ({\displaystyle \sum _{i=1}^{N_f}{t}_i}+N_r{T}_r)],$$

(9)

where $N_r$ is the number of surviving samples, $t_i$ is the survival time of each sample, and $T_r$ is the censoring time. Based on the failure data provided in Section 2.3, the maximum likelihood estimate for the random failure rate of the SSDs is $\widehat{\lambda }=3.74\times {10}^{-6}{h}^{-1}$. This result is markedly different from the reliability conclusion derived from ground testing, as shown in Figure 4. Therefore, beyond failures attributable to the natural lifespan degradation of the SSDs, other factors must be contributing to the observed failures. To determine the root cause of these failures, investigation into other environmental stresses is essential.

Figure 4. The survival curve of KF SSD, the point estimate curve of its reliability under the assumption of a constant failure rate, and the lower bound curve of the reliability interval estimate based on ground testing. Evidently, the actual on-orbit survival performance of the SSD falls far short of that observed during ground tests.

4.2. Analysis of On-Orbit Operating Conditions

To analyze instantaneous failures caused by factors such as thermal shock, electrical shock, and high-energy particle impact, telemetry data from the period surrounding SSD failures was examined. The raw format of the telemetry data is shown in Table 2. Using specific decoding rules, this data was converted into corresponding actual physical values. The telemetry data has a frequency of one record every 4 s, covering a total of 5706 operational missions, amounting to approximately 1.1 million data records. Each record includes 23 sensor data items, including time, thermal status, electrical status, SSD status, and orbital status. The overall dataset can be represented as

$$D={\{d_i,d_i\in {ℝ}^{T_i\times C},T_i\in {\mathbb{N}}^{+}\}}_{i=1}^B,$$

(10)

where $T_i$ denotes the length of i-th telemetry data for each mission varying from tens to hundreds of records, $B$ = 5706 is the total number of missions, and $C$ = 23 is the number of sensor parameters.

Table 2. A partial display of telemetry raw data during periods of SSD failure, totaling approximately 1.1 million entries. Due to varying mission durations, the length of telemetry data corresponding to each mission ID differs.

Mission ID	SSD Failure Label	Satellite Time	Imaging Processor Temperature	SSD Temperature	……
0	0	8 January 2025 0:31:28	9.49	10.0	……
		8 January 2025 0:31:32	9.53	10.5	……
		……	……	……	……
1	0	8 January 2025 2:12:04	11.25	11.5	……
		8 January 2025 2:12:08	11.25	11.5	……
		……	……	……	……
……	……	……	……	……	……

We converted the 19 thermal and electrical status time-series data items from the telemetry data of each operational mission into feature data [55] to align the data dimensions across different missions. Specifically, for any finite-length time-series data, a feature extraction mapping

$$f:{\cup }_{n\in {\mathbb{N}}^{+}}{ℝ}^n\to {ℝ}^M.$$

(11)

is defined to transform the time-series dataset D into a feature dataset $X\in {ℝ}^{B\times MN}$, which is then normalized to standardize each feature. In the equation above, $M$ represents the feature dimension for a single sensor’s time-series data, including metrics such as global average energy, the sum of absolute first-order differences, local linear regression coefficients, and autocorrelation coefficients. $N$ = 19 denotes the number of sensor data items related to electrical and thermal status. Additionally, the feature dataset has a corresponding state dataset $Y\in {\{0,1\}}^B$, indicating whether the SSD was damaged during the mission. Subsequently, we proceeded to explore the relationships between the thermal/electrical feature data X and the SSD state data Y. We attempted to employ directed acyclic graphs [56] to explore causal relationships within the data by optimizing

$$\begin{array}{l}{\min }_{W_{xx},W_{xy}}{\lambda }_f{L}_f+{\lambda }_s{L}_s+{\lambda }_t{L}_t,\\ \hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}s.t.\hspace{0.33em}{L}_f={\lambda }_x\left|\right|X-X{W}_{xx}|{|}_F^2+{\lambda }_y\mathrm{BCE}(Y,\sigma (X{W}_{xy}+b)),\\ \hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}{L}_s=\left|\right|W_{xx}|{|}_1+|\left|W_{xy}\right|{|}_1,\\ \hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}{L}_t={(\mathrm{Tr}(\exp [W_{xx}{W}_{xx}])-MN)}^2,\\ \hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}\hspace{0.33em}{W}_{xx}\in {ℝ}^{MN\times MN},W_{xy}\in {ℝ}^{MN}.\end{array}.$$

(12)

In this formulation, BCE denotes the binary cross-entropy loss, $\sigma$ is the sigmoid activation function, $W$ represents the regression coefficient matrix, whose structure ensures no outgoing edges from Y to X in the causal graph, and $b$ is a bias constant. The optimization objective comprises three terms: (1) the fidelity term $L_f$, which aims to uncover the causal influence of X itself on Y; (2) the sparsity regularization term $L_s$, which enforces sparsity in the causal graph to mitigate noise interference; and (3) the acyclicity regularization term $L_t$, which ensures that the learned causal graph contains no cyclic dependencies. Under strict sparsity and acyclicity constraints, the objective was optimized using the Adam algorithm [57]. However, the resulting model exhibited poor generalization. On one hand, the discovered causal relationships appeared to be dominated by noise. On the other hand, the outcome suggested that the posterior distribution of Y given the observed features X remained close to its prior distribution, indicating potential independence between X and Y [58]. To strengthen confidence in the conclusion of no causal relationship, we applied the Hilbert-Schmidt Independence Criterion (HSIC) test [59]. Each feature and the SSD state data were separately mapped into Reproducing Kernel Hilbert Spaces (RKHS) using a Gaussian kernel and a Kronecker delta function, respectively, and the distance between their distributions was measured. The results of the independence test consistently indicated a high degree of independence between the operational condition features and the SSD state data. Finally, we attempted to cluster the feature data X using the unsupervised DBSCAN algorithm [60] to identify anomalous operating conditions. We then manually examined whether any correlation existed between these anomalies and SSD failure states. Several mission profiles deviating from the majority of standard operational conditions were identified—for instance, anomalies in telemetry data caused by bit errors during downlink transmission to ground stations. Despite the presence of such anomalous conditions, none coincided with missions in which SSD failures occurred. Based on this analysis, we can reasonably conclude with high confidence that the SSD failures are unlikely to have originated from thermal or electrical stress shocks.

On the other hand, since the satellite is not equipped with sensors to detect high-energy particle radiation, it is impossible to directly analyze the satellite’s high-energy radiation conditions during operation. Considering the inhomogeneity of Earth’s radiation field, the relationship between SSD failure occurrences and orbital position can be investigated. From each sample $d_i$ in the total dataset D, the SSD status and orbital position during a mission are extracted to form a new subset

$$P={\{(N_i,E_i,y_i)\}}_{i=1}^B,$$

(13)

where ($N_i,E_i$) represents the latitude and longitude where the i-th mission was executed, and $y_i$ indicates whether an SSD failure occurred during that mission. Plotting this data on a map reveals the failure distribution, as shown in Figure 5. Visually, SSD failures are significantly concentrated within the SAA radiation region. Using the Mercator projection, we employed the minimum path distance between any two spatial points as the distance metric and adopted the highest silhouette coefficient as the clustering objective when applying DBSCAN [60] for clustering. This approach allowed the failure points within the SAA region to be clustered into an SAA failure cluster, while the remaining failure points were labeled as noise without cluster affiliation. By treating the other failure points as a single cluster, we calculated an average silhouette coefficient of 0.64 for the SAA cluster. Given the small sample size, this value indicates satisfactory clustering performance, demonstrating the spatial concentration of failure points within the SAA region. Therefore, we conduct a hypothesis test analysis. First, due to the characteristics of the satellite’s orbit—each orbital pass traverses the polar regions while the longitude of the path between the poles changes uniformly—and given that the satellite moves at a nearly constant velocity for the vast majority of the time, its probability of being at any given coordinate in a Mercator projection is essentially uniform. If SSD failures are unaffected by radiation, the expected ratio of failures within the radiation region to failures elsewhere should equal the ratio of the area of the radiation region to the total area. Consequently, we formulate the null hypothesis H0: The spatial distribution of SSD failures is independent of the spatial distribution of the radiation region. The alternative hypothesis H1 is that there is a significant correlation between the two spatial distributions. Under H0, the number of failure locations falling within the radiation region $N_f$ follows the binomial distribution

$$N_f ~ \mathrm{Binom}(k,p),$$

(14)

where $k$ = 10 is the total number of failure samples, and p = 0.1 is the orbit proportion of the radiation region [40]. Based on this model and the observed data, the p-value for H0—the probability of observing at least 4 failure samples within the radiation region—is calculated to be

$$P(N_f\ge 4)=0.0128.$$

(15)

At the 95% significance level, there is sufficient evidence to reject the H0 hypothesis that the spatial distribution of SSD failures is independent of the spatial distribution of the radiation region. This indicates that the observed significant clustering of failure points strongly supports the alternative hypothesis H1 that SSD failures are associated with the radiation environment.

Figure 5. Locations of SSD failures during satellite mission execution. The SSD failures are notably concentrated within the SAA region, particularly over the area of Africa where the magnetic field is weakest.

Figure 5. Locations of SSD failures during satellite mission execution. The SSD failures are notably concentrated within the SAA region, particularly over the area of Africa where the magnetic field is weakest.

4.3. Failure Recurrence Experiments

Based on the analysis in Section 4.2 and the fact that proton flux constitutes the most significant component of high-energy particle radiation affecting satellites in LEO, this study conducted proton irradiation experiments on operational SSDs using a 50 MeV proton cyclotron to simulate the effects of high-energy protons in the LEO environment. The experimental setup is illustrated in Figure 6. The SSD was mounted on an FPGA controller, and both were connected to a computer. The computer simulated the central processing subsystem by sending operational commands to the FPGA. During proton irradiation, the SSD operated under conditions analogous to on-orbit operation: the central computer sequentially sent the FPGA commands for drive selection, power-on, imaging, and data storage. The FPGA executed these commands in order, writing data from the CMOS sensor into the SSD. Once the SSD storage capacity fell below a low-capacity threshold, the central computer commanded the FPGA to power down the drive, thereby completing one storage task. The SSD was then formatted to erase all data, after which the storage task cycle was repeated until the irradiation experiment finished.

Figure 6. High-energy proton irradiation experiment setup for the SSD.

During the experiment, the storage capacity of the SSD could be queried via telemetry commands sent through the communication interface. First, under non-irradiated conditions, three consecutive storage tasks were performed. The change in SSD capacity remained essentially consistent across all three tasks, as shown in Figure 7a. As real-time image data was stored, the SSD capacity decreased at a constant write speed of 145 MByte/s. Under high-energy proton irradiation, the SSD operated normally for 90 min. At the next storage task, a failure occurred, as shown in Figure 7b. In this task, the write speed remained normal for the first 395 s. Between 395 s and 400 s, the write speed dropped to 27 MByte/s. After 400 s, the SSD became unable to write data. Following the experiment, multiple attempts to re-execute the storage task resulted in a condition identical to the on-orbit failure: after power-up, the available capacity was reported as 0, and this condition could not be recovered through self-annealing. After thorough investigation, the root cause of the failure in this SSD sample was identified as physical damage to the disk sector containing the FAT. This damage prevented the SSD system information from being recognized. After the FPGA driver rewrote the FAT information to a physically undamaged sector manually and removed the bad blocks from the storage capacity mapping, the SSD resumed normal operation.

Figure 7. As the storage task proceeds, the remaining capacity curves of the hard drive under non-irradiated and irradiated conditions are shown in (a) and (b), respectively.

5. Conclusions and Management Decisions

With the shift toward low-cost and rapid-development satellite projects in the commercial field, exemplified by LEO communication and remote sensing constellations, the application of COTS components across various commercial satellite platforms has become increasingly widespread. However, as COTS devices are not inherently designed for harsh space environments, their inherent reliability issues have become a core bottleneck limiting their extensive use in critical missions. This paper conducted a practical mission deployment of spaceborne COTS storage devices, including (1) comprehensive consideration of the technical specifications and reliability of satellites carrying COTS storage devices, implementing protective measures and environmental adaptation designs; (2) conducting ground testing of COTS storage devices and, upon acceptance, launching them into orbit to execute Earth imaging missions, recording the on-orbit performance of the COTS storage devices. Over a nearly one-year operational period, approximately 3% of the hard drives failed, yet the spaceborne storage system itself experienced no failures due to the multi-parallel redundancy strategy; (3) analyzing ground test data and on-orbit data to identify the causes of COTS storage device failures and reproduce the failure modes. Thanks to the multi-parallel redundancy strategy, while the reliability of an individual hard drive at the one-year mark was 0.9678, the reliability of the overall spaceborne storage system remained close to 1. Building on this, and disregarding the natural wear-out of the hard drives, the spaceborne storage system can still maintain a high reliability of 0.9877 by the end of the satellite’s 8-year design life. Although this does not meet the traditional reliability requirements allocated to spaceborne storage systems, from the perspective of exploring the practical application of COTS, this conclusion remains sufficiently optimistic. Furthermore, ground-based repair commands can be attempted to recover failed hard drives at the cost of temporarily reducing the availability of the satellite constellation.

The aforementioned practical experience and analysis also yield several general conclusions: (1) The batch application of COTS components in commercial spacecraft is feasible; (2) COTS components remain significantly susceptible to radiation effects, making necessary reliability protection measures essential during spacecraft design; (3) Through rational redundancy design, the on-orbit survivability of storage systems employing COTS components can be significantly enhanced, effectively balancing cost and reliability. Furthermore, the risks associated with COTS failures remain severe. This practice informs subsequent quality management decisions for constellation development: (1) When employing spaceborne COTS components, it is crucial to thoroughly identify the failure risks posed by the space environment and implement essential reliability design and protection measures against high-risk high-energy particle radiation effects. Based on the reliability data obtained, the required number of backup storage units can be quantified in subsequent models to ensure the system reliability meets quality requirements. (2) Different COTS component models exhibit potentially significant variations in design and manufacturing processes. Therefore, we have incorporated COTS components into the aerospace unit maturity grading and management program. It stipulates that products that have undergone sufficient ground verification and reached a certain maturity level can be used in formal flight models, and only those that have undergone sufficient on-orbit flight verification and reached a higher maturity level are qualified for use in mass-produced satellite models. The principle of “prioritizing products with higher maturity levels” is enforced to ensure the selected COTS component models have undergone adequate screening and qualification. (3) Establishing a continuous on-orbit data—ground analysis—design optimization feedback mechanism, utilizing actual flight data as a basis for improving subsequent satellite system development, facilitates reliability growth. We have established an aerospace product maturity and heritage-level database to systematically accumulate lifespan and failure data. This provides data support for satellite lifetime estimation and design optimization, addressing the challenge of high failure rates inherent to COTS components while leveraging their cost advantages, thereby controlling satellite failure risks. Through the above work, this paper has completed a closed-loop management process encompassing satellite development and design, on-orbit practice and problem reporting, problem analysis and reproduction, and the improvement of management decisions.