Keywords

These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

1. Introduction

Current Space utilization practices are unsustainable: they lead to an increasing population of defunct satellites and other man-made debris in orbital Space.

The growing mass of objects parked in orbit makes collisions increasingly likely, a fact which is in turn leading to an exponentially increasing concentration of debris in the most utilized orbits, which are naturally also the most useful. This will shorten the life of new spacecrafts in the most useful orbital slots until any further use of those slots will be impossible.

In terms of space safety, debris is posing an increasing threat to human space exploration, be it manned or unmanned: debris impact with costly satellites carrying scientific payload and with the International Space Station is a threat and a source of increasing cost, affecting the design, deployment and operational phases of a mission. In some cases, safety countermeasures are impossible and the only option consists minimizing the probability of occurrence of a space-critical event by minimizing risk exposure, like with the extra-vehicular activities of astronauts from the ISS.

As such, like with terrestrial pollution issues in the past and today, space debris it is now creeping into the focus of legislators, agencies and industry. A variety of new practices and technical solutions are on the table, most of which are merely mitigating or helping diagnose the problem, but are not solving it, simply delaying a break point in the business model related to space activities.

Recognizing that the orbital slot and the capability provided by a spacecraft in that slot are the actual valuable items in the business model, the spacecraft itself is both an enabler and a source of cost and concern; it needs to be launched and maintained in operation at a cost and, once it occupies the valuable slot in orbit, it needs to be removed before a replacement providing the same or a better capability can be placed in the same slot. If the removal is incomplete, the spent satellite will require permanent monitoring to avoid collision with the new operational satellite or other property in space.

Looking at the matter from an item perspective, it would be ideal if the item removed itself completely from the useful orbital slot at the end of life, when its replacement needs to be parked in the valuable slot to secure continuity in the required capability.

1.1 Orbit utilization by passive monitoring

Another way of looking at the space debris issue bears analogies with thermodynamics and ecology: given a single orbit, whenever the mass placed per unit time in that orbit is higher than the natural self-cleaning rate of the orbit, the mass in that orbit will accumulate, making collisions more likely. Because collisions lead to fragmentation, the number concentration of debris in that orbit will also increase in a chain reaction, following an exponential trend. Since a spherical fragment of aluminium of a few millimeters would lead to a lethal collision with a satellite, the number concentration (number of fragments/volume), rather than the mass concentration in the orbit (total mass/volume), drives the probability of a lethal collision per unit time and hence the average life of a satellite in the orbit of concern. Upon collisions, debris will decrease in size and increase in number (a mass diffusion mechanism), until the orbit becomes unusable, after which no new mass will be placed in that orbit and natural forces will clean it at a specific rate. Then, as long as the debris concentration stays above an acceptable limit related to average orbital life due to collisions, the orbit will not be used and the provider of a capability will have to resort to another orbit, shifting and propagating the problem. The limit number concentration of debris is the value at which orbital life due to debris collision is higher than orbital life driven by normal system ageing.

This scenario can be described as a periodic utilization of an orbit: the orbit is used until a break point is reached and is then avoided until sufficiently clean. The issue is that the spent satellites in that orbit will continue to collide and fragment, increasing debris concentration for a long time after, until things start to improve again. One could call it “passive orbit monitoring”: orbit maintenance shifts the focus from a single spacecraft (an item) to safe orbital use (a capability or function); passive means that safe orbital use is not ensured actively (by missions to remove spent satellites), or through prevention (by removing spacecrafts at the end of service life), but is simply estimated periodically by looking at collisions or monitoring debris. Considering the durations involved in the processes of debris concentration increase during the utilization phase, post-utilization concentration increase and self-cleaning, the duration of non-use of the orbit is so long that industry is likely to lose the capability to service the orbit.

The model is shown in the conceptual graph of Fig.1. The exploitation phase of a particular orbit starts when a provider of satellite services or an agency decide to place the first satellite in that orbit. If the mission goes well and yields as desired, more launches by the same operator or more operators in competition will follow, initially at an increasing rate until launch capabilities or the end-user market are saturated. Launch frequency is then constant. The mass concentration in orbit (in mass per unit volume of orbital space) will increase, initially more than linearly, then linearly at constant launches.

Figure 1
figure 1

Orbital use by passive orbit monitoring

Full size image
Figure 2
figure 2

Debris spatial density in the LEO protected region by type; comparison between years 2004 (on the top) and 2014 (bottom graph) – From [1] and [2], courtesy of the authors and editors.

Full size image

The number concentration will be very small initially and growing exponentially with the number of satellites and launch-caused debris. After a first collision, the number concentration of objects will increase suddenly, then increase further as long as the fragments fly close, then stabilize when the items are distributed more uniformly in orbit. After a second collision, operators will hesitate before launching in the same orbit: launches to that orbit will decrease, and the total mass concentration will increase more slowly. After a third collision it can be assumed that nobody will launch in that orbit if an alternative exists. Unfortunately, most large objects will be colliding either among each other or be fragmented by smaller debris for a long time thereafter, unless they are retrieved. The number concentration of objects and the number of collisions will increase more and more until stabilization, after which self-cleaning effects will dominate the evolution and decrease the number concentration of debris and the collision probability. The non-use phase will be very long if the self-cleaning rate is low and will continue until an acceptable collision probability for further use has been reached and a first operator “dares” to launch in that orbit again. By nature of exponential trends such as those following chain reactions, the time between the initiation of collisions and when the rate of collisions will explode, making the orbit unserviceable, is limited. Using this model, orbital space can be divided in three regions:

  • Lower LEO, where self-cleaning is very fast and a non-use phase is never reached: exploitation is limited by launch capabilities or market;

  • Higher LEO, where the evolution will follow the above model;

  • MEO and GEO, where the evolution will follow the above model, but the exploitation phase is very long because of two reasons: the orbit is very large and very far. Therefore, launch costs are high and launch capability is limited: spacecrafts are designed to have a very long service life and concentrate the required capability in fewer items; also, slots are expensive, so that the operators have a strong interest in removing the older satellite generation and occupying the same slot instead of seeking new slots.

Looking at numbers, space is generally getting crowded. Since 1957, more than 6000 satellites have been launched and only approximately 900 are still operational. The majority of the others are still orbiting uncontrolled around the Earth. Due to collisions and in-orbit explosions, the number of fragments and debris is increasing. Today, more than 300 million fragments are estimated to be flying in space. The increase of space debris density affects all serviced earth orbits (LEO, MEO and GEO), particularly those which are most useful and profitable for satellite launches. Space debris is becoming a critical limitation to the development of space business for satellite operators. The following graphs present the density of space debris in LEO distributed by orbital altitude, taken from [1] and [2]. Particular attention should be paid to the increase in spatial density that has occurred in the last ten years due to in-orbit collisions and explosions.

The two peaks just below the 800 km and 1400 km altitude are caused by the Iridium and the Globalstar constellations. It is worth mentioning that:

  • Iridium satellite # 33 crashed with a dead Cosmos 2251 military satellite in February 2009 at a relative velocity of 11.6 km/s, generating an increase of debris.

  • The premature, unexpected aging of Globalstar satellites at 1400 km is causing an increase of debris in this orbit despite the larger orbital volume spanned by this constellation.

The debris flux per year (in impacts per square meter per year, proportional to the number concentration) can be estimated by multiplying the density figures in LEO by 300 [1].

The problem with passive orbit monitoring is that the number concentration of debris follows an exponential trend. Exponential trends are strongly dependent on errors on initial conditions and on uncertainty in model parameters.

A variety of parameters affects the evolution of the number concentration of debris, depending on the orbit, such as:

  • Environmental factors (solar activity, third-body forces, natural debris concentration, etc.);

  • Spacecraft design (materials, architecture and components design);

  • One-time events, such as the intentional destruction, removal or maneuvering of a satellite for military purposes.

The interesting feature to be predicted about the exponential evolution of debris in an orbit is the duration of the service phase (during which satellites are launched in that orbit) and the duration of the utilization phase (during which at least one satellite is functioning). There is consensus about some orbits on the fact that the utilization phase will be very long, on others that the service phase is likely to end soon. In view of the sensitivity of the exponential trend and the uncertainties about the parameters, on many LEO orbits there is no clear picture about how long the service phase will last and whether the conditions are such that even a moratorium on launches will not suffice in stabilizing the situation and a point of no-return has already been reached by parking excessive mass in the orbit. Predictions depend on whether the parameters are chosen conservatively or not.

In any case, the number concentration just above 600 km and at 800 km has doubled; it has tripled at the peak just above 800 km, has doubled on the peak above 900 km, seems constant on the first peak above 1400 km and has doubled on the second peak.

Assuming that a user intends to launch a new constellation or merely a new satellite, if there is no hard constraint on a fixed orbit altitude, the user will avoid these orbits, placing its satellites either just above or below. We can therefore say that the service phase of these orbits has been reached, and as long as a user will not be confident on a number concentration decrease, these orbits will be avoided.

1.2 Orbit utilization by active maintenance

The alternative scenario is a permanent utilization, where activities are such that:

  • The accumulation of mass in orbit is smaller than the rate of self-cleaning;

or such that:

  • Fragmentation does not occur because large objects are removed by whatever means (retrieval or removing through on-board propulsion).

Regardless of whether one looks at this option from the previous “single item” or orbital slot vacation perspective, or through the mass concentration model of Fig. 1, having the items removed before collisions occur would:

  • Allow using available orbital space to the full extent, thereby maximizing the number of satellites in orbit and the number of launches. The number of spacecrafts would be limited either by service market size or orbital space availability, and the launch frequency will reach a stable maximum given by the number of orbital slots divided by the service life of the satellite.

  • Avoid mass fragmentation of spent satellites, the root cause limiting the utilization time of an orbit.

This would lead to a continuous, sustainable orbital Space utilization model which could be called “active orbit maintenance”.

Collision events would be rare, because the number of available slots would be assigned to minimize collision. risk and two non-operational satellites would never be in orbit at the same time; operational satellites would be capable to avoid other satellites, preventing collisions. A rare, single collision event would lead to a sudden debris number concentration rise, followed by decay by natural causes (Fig. 3). Collisions would therefore be so rare that they will not lead to a chain reaction characterized by an exponential increase in collision frequency.

Figure 3
figure 3

Active Orbit Maintenance

Full size image

Looking at debris mitigation policies, the following options have been proposed or are at least partially in practice today:

  • Debris monitoring and modelling is beneficial for two reasons: it allows forecasting when a critical point for an orbit is likely to occur before it actually does, allowing agencies and governments to limit the number of launches in that orbit, delaying the onset of collision number explosion and therefore stretching the utilization phase. On the other hand, for larger debris, it allows to issue warning to satellite operators so that they can manoeuvre to avoid a collision. This will initially reduce the number of collisions and stretch the utilization phase of the orbit.

  • Design measures, whereby satellites and launcher upper stages are designed to reduce debris emission. With reference to the model of Fig.1, this will reduce the increase of debris number concentration, thereby delaying the time when a critical point is reached, stretching the utilization phase.

  • Design measures to shield an operating spacecraft against debris of a few millimeters through Whipple shields. This option will protect the satellite against impact from the smallest debris (a few millimeters in size). Such measures will not improve the rate at which the number concentration of debris increases, but stretch the utilization phase of the orbit at a design penalty for the spacecraft, which becomes heavier and larger in size.

  • On-board propulsion system passivation, through which collisions generate less fragments and are not projected into neighbouring orbits, will reduce the rate of fragmentation if a collision occurs, again stretching the utilization phase.

  • Active Debris Removal (ADR) missions, where a spacecraft docks on a spent satellite and removes itself and the spent satellite from orbit. ADR will prevent the fragmentation of large vehicles if the rate of launch and execution of ADR missions is adequate and more satellites are removed than new ones parked in orbit. In this case, it is a tool enabling Active Orbit Maintenance but will impose a constraint on the satellite launch frequency: at a given maximum launch frequency to service the orbit at regime, part of the launches will be ADR missions, which will limit the number of new launches of satellites which actually generate a profit (Fig. 4, compare with Fig.3).

    Figure 4
    figure 4

    Exploitation phase constraint imposed by active maintenance through ADR

    Full size image

The window of opportunity for and ADR missions is limited to the initial phase of orbital pollution, when the number of fragments is limited and the probability of impact between recovery vehicle and debris is therefore acceptable. If low-thrust solutions are used, like electric motors, the ATR window of opportunity will be naturally shorter because of the longer permanence of the vehicle in the polluted orbit.

Active removal vehicles removing one satellite per launch would need to be launched at the following yearly rate to prevent the orbit from reaching the critical point in the long term:

Where LRadr is the yearly launch rate of recovery vehicles required to avoid mass accumulation in one orbit, LRsatellites is the yearly launch rate of new satellites to that orbit, Lsatellites is the average service life of the new satellites in years, D the duration of the recovery mission and R the cumulative reliability of a recovery mission (1 for 100 % reliability), including vehicle launch, deployment, rendez-vous with the dead satellite, docking, stabilization, and removal of the mated duo. This long sequence of critical steps suggests that it will be difficult to achieve a true reliability anywhere close to one except for special missions. Moreover, the costs of such a vehicle will be high in view of its complex function. These costs, including the launch itself, will have to be shared by every new satellite launch, regardless of who will “pay the bill”. The final requirement of Active Debris Removal is that the recovery vehicle must be capable of providing the following total impulse (It, adr):

With Δv’ the velocity difference required to de-orbit or re-orbit from a particular orbit, Δv” the impulse needed to achieve rendez-vous with the satellite to be de-orbited from the original launch orbit, Δvlaunch the launch impulse provided by the launcher and mlauncher is the mass of the upper stage of the launch vehicle which is separated from the vehicle after launch.

  • The other option is to have the satellite remove itself at the end of life.

Within a preventive approach, the total impulse requirement to de-orbit (It,DD) will be merely:

With mp the mass of propellant to de-orbit the satellite and Δvsk the velocity difference required for station-keeping and manoeuvring during life. In words: an onboard propulsion system will not require an extra launch as it is launched with the satellite, and will not require independent launch orbit to target orbit transfer and rendez-vous for the same reason. This will reduce mp to a few % of the mass of the satellite for most LEO satellites for a direct, controlled re-entry to Earth, and a few tenths of a % for GEO satellites to achieve the IADC graveyard orbit.

The question of whether the onboard, station-keeping propulsion system should be used or a dedicated, decommissioning device/propulsion system is easily answered. There should be a preference for having a dedicated device on board because the normal station-keeping system is not designed for de-orbiting, making the manoeuvre less efficient, and, above all, because the reliability of de-orbiting using the on-board station-keeping system suggests that only one third of the satellites are actually removed [3]. The decommissioning manoeuvre is apparently complex enough to pose a challenge to a spacecraft at the end of its life and a propulsion system which has been fired many times or has many working hours and is at the end of life is significantly degraded in terms of performance and reliability.

The reliability of de-orbiting or ADR is in any case a key parameter: if ADR or de-orbiting is not sufficiently reliable, the occurrences of missed de-orbiting will be such that the frequency of collisions will exceed the self-cleaning rate of the orbit: this case would end up being like in Fig.1 and the efforts will merely stretch the utilization phase.

Logically, the minimum required reliability depends on the orbit, in particular on its natural cleaning rate, the number of satellites in orbit and the size of the orbit. The numbers set in current standards for de-orbiting [4] are such that some key orbits (like GEO, MEO and higher LEO) are probably not sustainable.

This is related to another feature of exponential trends: whenever the time constant typical of the exponential trend is longer than one human work career duration (the pessimistic observer will say than the average duration of a political career or CEO assignment), mankind finds it difficult to adopt sustainable practices.

In any case, an on-board decommissioning device is an enabler of Active Orbit Maintenance. It is more economical than ADR for a single satellite, and does not impose any limit on the number of satellites in that orbit, which would only be limited either by launch capabilities and market size.

A mixed scheme for AOM would be to use a light an compact, dedicated decommissioning device with high reliability and execute an ADR mission for large satellites where the system fails. This is probably the most beneficial scheme both in terms of cost-benefit and in terms of orbital sustainability.

Once again, prevention seems better than the cure and it is hard to imagine that ADR alone will be able to stabilize the debris issue in most orbits without imposing a severe constraint on the number of space launches.

1.3 Legislation and Policy efforts

Best practices formulated by the IADC inter-agency committee are being implemented by default in new licensing, satellite manufacturing and insurance contracts. In some cases, best practices have been implemented in national legislations [5]. France took a world-wide leading role and requires all national and international operators active on its territory (including French Guyana) to actively remove all LEO satellites orbiting within 2000 km for a controlled re-entry and only grants a waiver if this is technically unfeasible. In this case, it requires an end-of-life maneuver leading to re-entry within 25 years. Moreover, at any time, the reliability of de-orbiting, including fuel margin is required to be 90 %. As such, de-orbiting is becoming expensive in terms of station-keeping fuel budget and launch mass. Propulsion system components redundancy is required to match a good level of reliability at the end of life in order to avoid premature withdrawal after component failures.

This has and will have an impact on satellite design. For standardized platforms, to avoid redesign and a new qualification, debris mitigation countermeasures would have to take into account future scenarios (the orbital debris concentration in 20 years), making the satellite heavier and more expensive and leading to an immediate increase in launch costs.

2. Decommissioning Device for Debris Prevention

D-Orbit proposes a decommissioning device based on solid propulsion technology. The device should be installed on new satellites as soon as possible, in order to transition to a fully sustainable Active Orbital Maintenance practice.

Such a device would be:

  • Compact, suitable for on-board or strap-on integration; the volume-specific impulse of solid propellant is higher than storable liquid or gel propellant systems: propellant density is higher, the propellant is located directly in the combustion chamber and therefore no need for a feed system and an injector between tanks and combustion chamber.

  • Reliable. The propellant carries all energy required to generate the desired thrust level and total impulse; the amount of energy needed for ignition is minimal. Other systems, most notably electric systems, require a heavy electric power unit converting primary power generated by another onboard system which is used continuously for the mission. Alternatively, a dedicated unit is needed. In the case of electric propulsion systems, the reliability of the engine will be constrained by the reliability of the on-board electric power system.

  • A cold redundancy for re-orbiting, therefore compliant with all current and future regulations on debris as it will increase the reliability to carry out de-orbiting to a sensible maximum. The rocket motor would be depowered for the entire mission and ignited to decommission the satellite. This feature will make it more reliable than on-board propulsion; in most cases, more efficient.

  • Be readily available: solid propellant ignites immediately even after decades of storage or flight;

  • Simplify operations and maximize flight performance. The thrust level is such that decommissioning will occur through a Hohmann trajectory and the time of flight will be very short (fire and forget item).

3. Safe Design and Operation

A dedicated solid propellant motor seems therefore a suitable and reliable solution to execute satellite decommissioning with current technology. One concern with respect to the use of a solid-propellant system is its safe use. The primary driver is the inadvertent ignition of the rocket motor. Rigorous application of safety regulations and standards must cover all phases of the design, production and use of a Decommissioning Device based on solid rocket motor technology, in particular:

  • Design and Qualification

  • Production and Acceptance

  • Ground Handling and Transportation to the Launch Range

  • Range Handling and Storage

  • Launch

  • Orbital Life

  • Satellite Disposal

This might seem challenging but is definitely feasible. In principle, a solid propellant decommissioning device is like a solid rocket motor for military or emergency rescue applications (like airbags, flares, signalling rockets and emergency explosive devices), where solid propellant technology is the technology of choice due to reliability, compactness and cost.

From a rocket motor design point of view, it makes little difference if the motor is to be operated at a space launch site or on a military platform.

One can easily think of the torpedoes stored in the launch tube of a submarine instead of the rocket motor being onboard a satellite, the only significant difference in terms of hazard is that in the case of a US navy Virginia class submarine, for instance, a catastrophic event related to the inadvertent initiation in deployment will likely kill about 120 sailors and destroy a property of 2.7 bn $ (FY 2014, not including costs related to achieving operational capability after delivery, and in-service costs of 50 M$ per year), which seems definitely worse than an event related to an unmanned satellite costing definitely less.

The same can be said about launch and ground operations: on the ground, the inadvertent initiation of a rocket motor for military application can cause the sympathetic ignition of other motors. For launch, there is little difference between a space launch complex and a base storing ballistic missiles. In fact, in some cases, the same base operates military missiles and space launch vehicles, like Vandenberg in the United States and Dombarovsky in the Russian Federation.

For space applications, large pyrotechnical payloads such as the Inertial Upper Stage propulsion system were indeed used extensively in the 1980s and 1990s and until 2004. They were operated both as upper stages of launchers and from the NSTS Shuttle, and therefore from a manned vehicle. At launch ranges, large solid propellant motors are in use today.

It is therefore no surprise that the key standards securing safety on the ground and in orbit match military design specifications for solid propellant systems. The following standards cover the safe design of pyrotechnical systems and ordnance devices.

  • MIL-STD-1576 “Electroexplosive Subsystem Safety Requirements and Test Methods for Space Systems”;

  • ECSS-E-ST-33-11C “Explosive Systems and Devices”;

  • ECSS-E-ST-35-02C “Solid Propulsion for Spacecrafts and Launchers”.

The most important launch complexes have the infrastructure to store and install a large solid propellant motor in compliance with national safety requirements and require the implementation of safety practices to ensure safe handling. Safety practices are in the following documents:

  • AFSPCMAN 91-710 “RANGE SAFETY USER REQUIREMENTS MANUAL“ (former EWR-127);

  • KNPR 8715.3 “KSC Safety Practices Procedural Requirements”;

  • CSG-RS-22A-CN “CSG Safety Regulations, vol. 2 – part 2 “Specific Rules Spacecraft”;

  • NASA STD 8719.12 “Safety Standard for Explosives, Propellants, and Pyrotechnics“.

They involve, among others, procedures on safe storing, handling and mounting of solid rocket motors and ordnance devices such as electro-explosive initiators in a spacecraft at the launch range. Procedures and requirements include hazard classification, technical operating procedures requirements, storing, grounding, tooling, ground support equipment, material control, safe and arm devices operation, etc. (see, for instance, section 14.2 of KNPR 8715.3)

From a design point of view, the highest possible safety level is achieved if design is compliant with requirements valid for a manned system. SSP 51700 “Payload Safety Policy and Requirements for the International Space Station” is the standard valid for payloads deployed from the International Space Station. It includes the NSTS 1700.7B requirements for operating solid rocket motors from the space shuttle (Appendix D).

This standard covers, among others:

  • The number of required inhibits, defined as the design features providing physical interruption between the energy source and the hazardous function, in this case motor ignition;

  • Criteria for determining whether two inhibits are actually independent;

  • The controls operating the inhibits, i.e. the devices operating the inhibits;

  • Monitors to determine the safe status of inhibits.

3.1 Key requirements analysis

Firstly, it is clearly indicated that the premature firing of a solid propellant rocket motor while close to a manned system (in case of NSTS 1700.7B the Orbiter, for SSP 51700 the ISS) is a catastrophic hazard by definition (requirement 202.1).

Secondly, the minimum number of inhibits for a manned system is three independent inhibits (requirement 3.2.3). Inhibits are independent if no single, credible failure, event or environment can eliminate more than one inhibit. In addition to that, one of the inhibits must preclude operation by an RF command, the ground return for motor ignition must be interrupted by one of the inhibits and:

Either two out of the three inhibits are monitored (requirement 3.2.1.3) or the ignition function power is de-energized until the motor is within the safety distance from the ISS, which implies the presence of a fourth inhibit between the power source and the three required inhibits and their control circuits are disabled.

Additional requirements are that:

  • If timers are used to control inhibits, they must not initiate sooner than complete separation from the ISS. If a credible failure exists that timers start prior to complete separation, then a safing capability is required (requirement 3.2.1.4).

  • Also, all solid propellant rocket motors must be equipped with a safe and arm device (SAD) that provides a mechanical interruption between the initiator and the rest of the firing line. The SAD and initiators are to be designed and qualified as a product according to MIL-STD-1576 (requirement 202.1b). The SAD counts as one inhibit.

3.2 Design and architecture of a safe decommissioning device

The decommissioning device contains the following subsystems as a minimum:

  • A Command and Control Unit (CCU)

  • A Propulsion System

Other subsystems could be added if required, most notably a TAU system (Terminal Attitude Unit), a simplified attitude control system recovering the attitude of the satellite if the primary system fails and manoeuvring it to initiate decommissioning.

The CCU can be independent (with an own electric power system and a radio), or entirely managed by the satellite, depending on end-user requirements.

To achieve a reliable operation, the scheme of Fig. 5 is suggested, where the propulsion system can be commanded either by the satellite, or by the CCU, or by both systems upon configuration by the end user. Priority of operation and the ability of shutting down the CCU power (see below) should be warranted to the satellite.

Figure 5
figure 5

Architecture of a decommissioning device based on solid rocket technology

Full size image

3.3 Rocket motor

The rocket motor can be designed to be safe, performing and functional by implementing the standard designs of tactical rocket motors [6, 7]. If a low-thrust solution is required, the required amount of propellant must be split in several sub-units, ignited in pair simultaneously and arranged symmetrically around the principal axes of inertia of the satellite for yaw and pitch. This will significantly increase the inert mass and make the system less efficient. Otherwise, a case-bonded, centrally perforated rocket motor charge design or a cartridge charge can be implemented and will be more efficient.

A non-polluting propellant should be used: the propellant should therefore not contain aluminium. Particles to improve the stability of the motor should be ceramic oxides which are ejected without agglomeration and of a size that poses no concern in terms of debris impact (e.g. dust, far below 1 mm in maximum diameter).

The seal should not generate debris.

The case can be designed to leak before exploding in case of inadvertent initiation.

In view of the short storage time, particular design provisions to mitigate the reaction of the motor in case of accident, such as slow or fast cook-off mitigation devices, intumescent paint layers, etc., seem useless. Storage safety will be achieved through an appropriate container design and monitoring using temperature, humidity and shock sensors which deliver an alert to a control centre.

To avoid inadvertent initiation in orbit, the motor must be shielded against debris impact.

3.4 Safe and arm device and inhibits

The safe and arm device of the motor should be electromechanical as required by the MIL-1576 and ECSS-E-ST-33-11C standards.

The rocket motor could use a standard, 1A no-fire current initiator such as the NSI or an exploding bridgewire initiator to ignite the firing line to the motor; the SAD would put the initiator out of line, so that in case of inadvertent initiation its gases will not ignite the motor. A rotor or slider can be used for the purpose.

An additional switch can be put in place which is enabled only by moving the rotor or slider and which enables the firing line ground return of the EED or both the power line and ground. This provision does not increase safety but makes it less likely that the initiator alone is activated inadvertently and implements one of the key requirements of MIL-STD-1576 for the SAD (requirement 5.12.3.1: “in the safe position, both power and return lines shall be disconnected”). The safe position switch function is important for monitoring purposes. All standards set requirements to determine if the SAD is in its safe position from remote. In view of the implications, the function should therefore be made redundant, using two different technologies, such as a mechanical switch and an optical switch.

An actuator pair is needed to operate the SAD. One actuator will move the rotor or slider, another will block the rotor or slider in the safe position, providing a locking function.

Interestingly, MIL-STD-1576 sets a requirement on the time to arm and disarm, namely one second, whereas ECSS-E-ST-33-11C does not and merely states that the SAD actuation time must be agreed with the procurement authority. This can have a significant impact on the current and power rating of the connectors and cables in the SAD and therefore on their size.

Provisions for manual disarming is required. This can be achieved through a safing pin puller, normally blocked into position by a detent. Safe and/or Arm plugs must be used to make the design compliant with MIL-STD-1576. Additionally, Faraday caps can be used to safe electrical connectors until the SAD is integrated with the rest of the system.

In general, environmental and EMC requirements are as stringent as requirements for military applications. Having a fully sealed design could be a solution to prevent common mode issues and radiated or conducted EMC issues.

D-Orbit has designed the following inhibits in the decommissioning device:

  • Two power inhibits, consisting in two switches in series; the bus power interruption is single fault redundant. Bus power interruption is secured by a pin to be removed before flight.

  • Power interruption is needed for manned systems but could be implemented in a satellite as well; in this case, the switches would be operated, for example, by an electrically actuated piston or rotor commanded by the satellite and one electrical switch (transistor or relay). Alternatively, the switches can be both transistors or relays, for instance bi-stable devices activated by the satellite or by one or two particular conditions on the satellite bus (sudden power drop, the flag of a timer) if pre-selected. In any case, the satellite should have the possibility to switch on and off the CCU power.

    A suitable switch and timers configuration with single fault redundancy is shown in Fig.6. Timers, pre-set at an arbitrary value, are required to ensure that safe separation from a manned system or launch vehicle is achieved. Alternatively, they could be used to wake up and/or switch off the device after a pre-set duration.

    Figure 6
    figure 6

    Bus power inhibit

    Full size image

  • One safe and arm slider interrupting the firing line. The slider is locked according to MIL-STD-1576 through a solenoid actuator. The position of the slider is monitored.

  • One “Fire Pre-Arm” power transistor (monitored).

  • One “Fire Arm” power transistor (monitored).

  • One “Rocket Motor Fire” power transistor.

One further inhibit, a power relay enabling the power source to the initiator, is not independent since it is commanded automatically through a sealed microswitch when the safe and arm slider is potentially armed. This inhibit is monitored through two different switches.

The firing circuit is powered by independent batteries.

A total of 6 independent inhibits, comprising two inhibits on bus power are designed in the Decommissioning Device.

4. Re-Entry Safety

Re-entry safety is straightforward: for satellites in LEO disposed by re-entry, the high thrust level and fast total impulse delivery achieved by solid propulsion make re-entry completely independent of the fluctuations of the upper atmosphere. Such fluctuations make an accurate prediction on the location of the impact area impossible up to the very last minutes before re-entry with passive de-orbiting (i.e. without thrust) or low thrust devices.

With solid propulsion, once the asset of the spacecraft is achieved, ballistic re-entry can be easily operated and targeted at uninhabited areas of the Earth (Fig.7). Once again, technologies developed for military application can be applied with confidence.

Figure 7
figure 7

Re-entry simulation targeted towards the southern Pacific Ocean after solid rocket motor ignition

Full size image

5. Conclusions

A sustainable development of space activities will only be possible if space users will implement suitable technologies to avoid the accumulation of objects in orbit.

In view of current launch rates, D-Orbit suggests the embodiment of an on-board dedicated decommissioning device in satellites. A device using a solid rocket propulsion system seems a practical and efficient option and can be implemented using current technologies. Such a device would have the following features:

  • works even if the satellite is malfunctioning;

  • compliant with ESA and NASA standards on safety;

  • single point of failure free (except for the motor);

  • reliable for the entire life of the satellite;

  • scalable and adaptable to different kinds of missions.

Since debris threatens the safe use of space by unmanned and manned vehicles, space safety will have a pivotal role in supporting a sustainable utilization of Space in the decades to come. Its role is dual: as an engineering discipline, safety is a primary design driver of debris removal devices based on solid propellant technology; knowing the importance of debris mitigation for ensuring safe space operations, the IAASS could be a strong support towards the adoption of sustainable practices in space.