PHOENIX: Fine-Tuned SLM-Powered Autonomous Satellite Lifetime Extension via Predictive Self-Healing and Multi-Agent AI Recovery

The paper addresses the chronic reliability shortfall of CubeSats—small, low-cost satellites roughly the size of a shoebox. Citing the CubeSat Failure Database compiled by Langer and Bouwmeester [1], the authors report that a study of 178 missions found that only 48–65% remain operational after two years, against a designed lifetime of 2–5 years. Their Kaplan-Meier curves show reliability falling to 75–87% right after deployment, then 59–73% at 100 days, and only 48–65% at two years, with a Weibull shape parameter of β = 0.4797 indicating infant mortality: failures cluster early rather than distribute uniformly.

The root obstacle is radio geometry: "a CubeSat in low Earth orbit is visible to a ground station for about 5–10 minutes per orbit, 3–5 passes a day, roughly 30–40 minutes of contact out of 1,440. For the remaining 85 minutes of every 96-minute orbit there is no radio link at all. Consequently, faults that start during that window go unnoticed until the next contact pass, by which point recovery may no longer be possible. The authors note that existing onboard protection is mostly threshold checking: if a voltage reading goes outside a preset range, an alarm fires. While prior neural approaches reached 89.1% CEF0.5 on a flying CubeSat with only 192KB of RAM (Horne et al. [6]) and 88.8% CEF0.5 at a 59KB footprint (Goetze et al. [5]), detection alone does not say what will break next week or what to do about it. Furthermore, ATSADBENCH [4] found that general-purpose LLMs perform poorly on multivariate aerospace telemetry, with RAG offering no meaningful improvement, so fine-tuning appears to be the only viable path to domain-specific reliability."

PHOENIX (Predictive Health On-orbit Edge Neural Intelligence eXtension) is designed to give the satellite its own fault reasoning capability. The core idea: deploy a fine-tuned SLM onboard the CubeSat so the satellite can reason about its own health during the silent phase. The system targets the Aethero NxN-ECM, which carries an NVIDIA Jetson Orin NX (157 TOPS INT8, 8–16GB LPDDR5 RAM) and has flight heritage on the SpaceX Falcon9 Transporter-16—noting this is roughly 40,000 times more RAM than the 192KB ARM Cortex-M4 used in prior work. The onboard model is TinyLlama 1.1B or Phi-1.5 1.3B, quantized to INT4 via llama.cpp and fine-tuned with LoRA adapters on satellite telemetry data, with estimated inference power draw is 2–5W.

Phase 1: Orbit-Aware Semantic Data Suppression. The SLM monitors all sensor streams every few seconds: battery voltage, solar panel current, subsystem temperatures, reaction wheel speed, attitude sensor outputs, and radio transceiver health. Instead of fixed thresholds, the SLM reasons over the full multi-channel context, asking whether a reading is anomalous or expected given the current orbital phase and recent history. TLE (Two-Line Element) orbital data from SatNOGS provides orbital context, so a battery voltage dip during eclipse entry is suppressed; the same dip 20 minutes after sun acquisition is flagged as an EPS anomaly—a distinction threshold-based systems cannot make.

Phase 2: Semantic-Cache-Assisted Self-Healing. Before invoking the SLM, PHOENIX checks a FAISS semantic cache of past fault descriptions and successful repairs. If close enough to a known past fault (similarity above 0.92), PHOENIX applies the cached repair directly in microseconds without running the SLM. On a cache miss, the SLM reasons through the fault and the new solution is saved with LRU eviction. The cache design is grounded in Liu et al. [3], which prove this greedy cache policy reaches at least (1 − 1/e) ≈ 63% of the best theoretically possible solution. The paper describes both reactive self-healing (e.g., reaction wheel overheating shifts load to the magnetorquer; a solar panel output drop redistributes load) and predictive self-healing: "The fine-tuned SLM recognizes early degradation signatures from training: a battery cell voltage curve matching the slow-drop pattern observed in ESA-ADB training data three weeks before confirmed cell failure triggers a ground-destined warning with a failure timeline estimate. This is absent in all prior CubeSat onboard AI works."

Phase 3: Compact Health Report Transmission. Instead of raw telemetry dumps, PHOENIX transmits a compact structured health report containing three fields: self healed (list of faults resolved autonomously), predicted risks (degradation warnings with failure timeline estimates), and needs ground (unresolved events requiring operator action).

At each contact pass, six AI agents process it in a pipeline, each a separate instance of Llama 3.1 8B fine-tuned on data relevant to its role, coordinated by a workflow framework (LangGraph or AutoGen). The agents are Supervisor, Triage, Memory, Diagnosis, Command, and Safety, with fine-tuning data including Coordination logs, workflow patterns, ESA-ADB anomaly labels, severity records, Root cause reports, FMEA catalogs, CCSDS Blue Books, operator command logs, and Constraint tables, failure mode catalogs. The safety constraint is explicit: No command reaches the satellite without both Safety Agent validation and Supervisor approval, addressing the risk of irreversible damage from an incorrect command.

The experiment uses ESA-ADB Mission 1 [2], downloaded from Zenodo (DOI: 10.5281/zenodo.12528696) with verified statistics: "Time range 2000-01-01 to 2013-12-31 (14 yrs), Readings per channel 487,448, Total channels 76 (58 target, 18 support), Subsystems monitored 4, Total annotated events 200 (118 real, 78 rare, 4 gaps), Anomaly-channel mappings 3,589, with Anomaly density 1.80%. LoRA fine-tuning on TinyLlama 1.1B uses ESA-ADB Mission 1, SatNOGS Network API with 702 verified payloads from 16 CubeSats including TLE orbital context," ESA Kelvins Mars Express power degradation data covering 3 Martian years of EPS telemetry, and DDPM-generated synthetic fault sequences. The protocol: LoRA adapters target the query and value projection matrices (r = 16, α = 32, dropout 0.05), trained for 3 epochs with AdamW at learning rate 2 × 10−4, with a chronological split: 2000–2009 train, 2010–2011 validation, 2012–2013 test, and Two anomaly classes from anomaly types.csv are additionally held out of training so the test split measures generalization to unseen fault types.

A DDPM (Denoising Diffusion Probabilistic Model) generates synthetic training data because Only 0.57–1.80% of the ESA-ADB data contains actual faults, with generated-data realism measured using the FID score (Fréchet Inception Distance).

• Semantic cache simulation: Simulating cache behavior on the 118 ESA-ADB anomaly events chronologically with cosine similarity threshold τ = 0.92, the simulation finds a cache hit rate of approximately 62% after the first 30 days, translating to a 62% reduction in SLM inference calls and energy expenditure per orbit. Energy savings: with SLM inference at approximately 3 W for 2 s per query (6 J per call), this is 0.62 × 118 × 6 ≈ 439 J saved relative to running the SLM on every anomaly.

• Data volume reduction: Raw ESA-ADB Mission 1 contains 487,448 float32 readings per channel across 58 target channels, 28.27 million readings per full dataset segment. Since anomalies and rare events account for 1.80% of the Mission 1 timeline, 98.2% of readings are suppressible as nominal.

• Bandwidth budget: Raw telemetry is 58 × 4 B × 5760 s/orbit = 1,336,320 B ≈ 1.27 MB/orbit, which at 9.6 kbps UHF radio (common in student CubeSats) takes 1,114 s ≈ 18.6 min to downlink—This exceeds the 5–10 minute contact window. After Phase 1 suppression, the payload shrinks to 1,336,320 × 0.018 ≈ 24,054 B ≈ 23.5 KB, with downlink time dropping to 24,054/1,200 ≈ 20 s, well within any contact window.

The authors state that "every prior onboard AI work stops at detection: it flags that something is wrong and waits for ground contact. PHOENIX acts on that detection immediately via the cache or the SLM, then reports the outcome rather than the raw signal. The detection comparison table lists Horne et al. at 89.1% CEF0.5, 192KB, 9 channels (EduSat, not ESA-ADB) and Goetze et al. at 88.8% CEF0.5, 59KB, 58 channels as the like-for-like baseline, with PHOENIX (target) ≥88.8% explicitly noted as a design target, not a measured result, since the SLM has not yet been trained."

The paper is candid that the current proof of concept demonstrates data pipeline feasibility and cache simulation on ESA-ADB Mission 1. Full evaluation requires (a) training the LoRA fine-tuned SLM per Section III-F, (b) training the DDPM for synthetic fault augmentation, and (c) end-to-end multi-agent evaluation on generated telecommands. Deployment challenges include: a short context window limits multi-orbit history, so the semantic cache acts as external memory; INT4 weights are more sensitive to radiation-induced bit flips than full precision, so periodic checksum verification with fallback to threshold detection is a required safeguard not yet implemented; and "continual onboard fine-tuning, needed as fault distributions drift over the mission, risks catastrophic forgetting of rare fault classes, for which a frozen base model with swappable LoRA adapters is the safer alternative we plan to evaluate."

The paper concludes: "A CubeSat spends roughly 97% of each orbit out of radio contact with the ground, the window where failures start and, without onboard intelligence, go unnoticed until too late. PHOENIX fills that window with something more capable than threshold checks. The preliminary results are encouraging: a simulated 62% cache hit rate resolves many recurring faults without invoking the SLM at all, and 98% of raw readings are suppressible as nominal. Training and deploying the fine-tuned SLM and DDPM on real hardware is left for future work, but the data pipeline and theoretical foundations are in place, and the gap between a CubeSat's designed and actual operational lifetime may finally be closeable from the inside."

Improvements to make:

1. Replace fixed cache threshold with a learned success reranker.

Train a small cross-encoder on historical fault-repair outcomes to predict whether a cached repair will succeed for the current telemetry context, instead of using a static cosine similarity τ=0.92. This reduces false-positive cache hits that would otherwise apply a wrong repair.

2. Add uncertainty estimation to the onboard SLM's decisions.

Use Monte Carlo dropout or an ensemble entropy head on the fine-tuned TinyLlama/Phi-1.5. When predicted uncertainty is high, the system escalates to ground or falls back to a safe default action, preventing catastrophic repairs on novel, out-of-distribution faults that the SLM was never trained on.

3. Predict component survival curves, not just risk labels.

Extend the fine-tuning loss to quantile-regress Weibull or Kaplan-Meier survival estimates for each subsystem, using the paper's infant-mortality statistics. The SLM then outputs a failure-time distribution (battery cell failure expected in 2.3 weeks, 80% CI) rather than a binary flag, enabling predictive maintenance scheduling.

4. Simulator-in-the-loop command validation.

Before applying any self-healing action, run the proposed command in a fast digital twin of the satellite (using the same telemetry channels) to verify voltage, current, thermal, and actuator constraints. Only commands that pass simulation are executed, dramatically reducing the risk of irreversible damage.

5. Radiation-tolerant weight storage and fallback orchestration.

Implement error-correcting codes and periodic checksums over INT4 LoRA/SLM weights, with redundant model copies and majority voting. If corruption is detected, the system automatically swaps to the last-good weight snapshot and reverts to threshold-based protection until the next ground contact.

6. Time-decayed cache with drift-aware eviction.

Modify the LRU semantic cache to include a temporal credibility score: repairs that succeeded a long time ago are down-weighted unless reinforced by recent similar anomalies. This prevents stale repairs from being applied as the mission's fault distribution drifts.

7. Ground-to-orbit memory consolidation via LoRA adapter swaps.

Have the ground multi-agent system aggregate all cached repairs, successful self-heal actions, and new anomaly types from each contact pass into an updated LoRA adapter. The satellite then swaps its adapters on the next pass, enabling continual, forgetting-minimal learning across the whole mission.

8. Structured taxonomy with contrastive generalization.

Use the ESA-ADB anomaly types as a semantic label space and train the SLM with a contrastive loss to embed telemetry context near known fault embeddings. This enables the model to recognize unseen fault combinations as combinations of known root causes, improving generalization beyond the holdout classes.

9. Uncertainty-driven synthetic data generation.

Instead of using FID only as a quality gate, use the DDPM to generate new synthetic fault sequences specifically in regions where the SLM's uncertainty is high (active learning). This iteratively closes rare-fault coverage gaps with minimal manual data curation.

10. Energy-aware inference scheduler.

Dynamically adjust the SLM invocation rate based on available power: during eclipse, use the semantic cache and threshold fallback almost exclusively; during high-power sunlight intervals, run deeper reasoning and predictive scans. This keeps the system within the 2–5W budget while maximizing diagnostic coverage.

---

What the improved AI system can do:

• It can autonomously decide between repairing immediately, deferring to ground, or taking a safe default, with a quantified confidence for each choice.

• It will never apply a self-healing command that violates power, thermal, or actuator constraints, because every command is pre-validated in a digital twin.

• It can predict failures with calibrated time-to-failure estimates, allowing operators to prioritize limited ground contact windows for preemptive interventions.

• It remains robust to radiation-induced memory corruption by self-detecting weight damage and degrading gracefully to conventional protection.

• It adapts to mission drift without catastrophic forgetting by swapping specialized LoRA adapters and using time-decayed cache credibility.

• It generalizes to novel anomalies by interpreting them as combinations of known fault mechanisms learned from a structured taxonomy.

• It continuously improves over the fleet lifetime: each satellite's repair successes are consolidated on the ground and redistributed as enhanced model adapters, making the entire constellation progressively more reliable.

• It stays within tight energy budgets by scheduling expensive SLM inference only when power is abundant, while still resolving most routine faults via the cache alone.