Starfish Space Loses Contact With First Otter Servicing Spacecraft After Fault-Protection Software Silences Radio on NASA SSPICY Demo

NASA and Seattle-based aerospace company Starfish Space have officially declared the first full-scale Otter satellite-servicing vehicle (designated Otter 24C) unrecoverable after an onboard software anomaly permanently severed two-way radio communications in low Earth orbit (LEO) ^{[1, 2]}. Launched on October 1, 2026, aboard a SpaceX Falcon 9 rideshare mission, Otter 24C was the flight demonstrator for NASA's Small Spacecraft Propulsion and Inspection Capability (SSPICY) mission, a $15 million Small Business Innovation Research (SBIR) Phase III contract designed to validate autonomous rendezvous, proximity operations, and close-up debris inspection of defunct U.S. government space objects ^{[1, 2]}. While telemetry and solar-array power generation were nominal immediately after orbital insertion, a fault-protection routine embedded in the third-party host spacecraft bus erroneously powered down the transceiver during early commissioning and locked out ground recovery commands ^{[1, 3]}.

Anatomy of a Fault-Protection Lockout: When FDIR Silences the Transceiver

In spacecraft avionics, Fault Detection, Isolation, and Recovery (FDIR) software acts as an autonomous reflex system. When telemetry parameters—such as bus voltage, battery state of charge, thermal thresholds, or command-receiver watchdog timers—drift outside nominal bounds, the FDIR state machine automatically transitions the spacecraft into a "safe mode," shedding non-essential payload loads and orienting solar panels toward the Sun while maintaining a low-rate beacon link with ground stations ^{[4, 5]}.

A joint anomaly review board convened by Starfish Space, NASA's Space Technology Mission Directorate, and satellite bus manufacturer Astro Digital traced the loss of Otter 24C not to a propulsion failure, collision, or solar-array deployment fault, but to a logic error within the host bus's fault-protection configuration ^{[1, 3]}. During initial orbital commissioning, the fault-protection routine triggered an off-nominal response that commanded the spacecraft's primary radio transceiver off and inhibited the state-machine transition required to re-energize the receiver hardware ^{[1, 2]}. Because a spacecraft without an active command receiver cannot parse uplinked software patches or reset discrete power switches from Earth, an FDIR routine that latches the radio off without a hardware watchdog timer override converts a recoverable software bug into permanent mission loss ^{[4, 5]}.

Mission Telemetry & Architecture: Otter 24C and the SSPICY Campaign

Prior to the communications lockout, Otter 24C was slated to execute a multi-month orbital campaign demonstrating low-cost, autonomous inspection of non-cooperative resident space objects (RSOs)—defunct satellites and spent rocket bodies that lack reflective laser retroreflectors, active transponders, or mechanical grappling fixtures ^{[1, 2]}.

Orbital Mechanics of Non-Cooperative Rendezvous and Proximity Operations (RPO)

Approaching an unpowered, tumbling satellite in low Earth orbit at orbital velocities near 7.6 km/s is one of the most computationally demanding problems in astrodynamics ^{[5, 6]}. Unlike cooperative dockings at the International Space Station—where the target vehicle maintains three-axis attitude stabilization and broadcasts differential GPS and laser rangefinder telemetry—non-cooperative RPO requires the chaser spacecraft to characterize an unknown target's principal moments of inertia and rotational tumble state purely from passive sensors ^{[2, 6]}.

In the relative orbital reference frame (commonly modeled via the linearized Hill-Clohessy-Wiltshire equations), radial, along-track, and cross-track maneuvers are tightly coupled by Coriolis and gravitational gradient accelerations. Starfish Space previously validated its CETACEAN (computer-vision relative navigation) and CEPHALOPOD (autonomous guidance and control) software suites in orbit during the Otter Pup 1 demonstration (which achieved a 1-kilometer close approach in 2024 despite thruster anomalies) and the subsequent Otter Pup 2 docking mission ^[2]. On Otter 24C, these algorithms were intended to guide electric propulsion burns along passively safe walking-safety-ellipse trajectories—orbital paths configured so that even if all thrusters fail mid-approach, natural orbital mechanics keep the servicer from colliding with the target object ^{[4, 6]}.

Implications for In-Space Servicing, Assembly, and Manufacturing (ISAM)

The premature termination of the SSPICY flight highlights a recurring engineering vulnerability across the commercial space sector: while startup payload developers invest heavily in specialized guidance algorithms, electric thrusters, and robotic capture mechanisms, mission survival often hinges on legacy fault-management logic inside commercial off-the-shelf (COTS) satellite buses ^{[1, 3, 4]}. As commercial constellations proliferate in LEO and geostationary orbit (GEO), both NASA and the U.S. Space Force have prioritized In-Space Servicing, Assembly, and Manufacturing (ISAM) to extend the operational lifespan of healthy satellites in GEO and de-orbit hazardous debris in LEO ^{[1, 2]}.

Because Otter 24C remains in a stable, non-interfering LEO trajectory with its propulsion system passivated, it poses no heightened collision hazard beyond standard tracked orbital payloads, and its orbital decay will follow natural atmospheric drag profiles ^{[1, 2]}. Starfish Space and NASA confirmed that telemetry gathered prior to the communications blackout—combined with strict hardware-in-the-loop verification of radio-transceiver watchdog overrides—has already been integrated into upcoming commercial and defense Otter vehicles scheduled for launch over the next 12 to 18 months, which may assume several of SSPICY's unfulfilled orbital inspection objectives ^{[1, 2, 3]}.