Source: Global Security (PDF)
Abstract: Recognizing that
the projected growth in the number of satellites over the next few years
threatens to increase the risk of on-orbit collisions, mission planners are
voluntarily incorporating deorbit maneuvers in mission planning, and regulators
are establishing requirements to reduce orbital lifetime for satellites in LEO
orbits. Lifetime reduction can be
achieved effectively for LEO satellites by lowering the perigee altitude, which
increases atmospheric drag on the spacecraft and leads to random reentry and
destruction of the hardware by reentry heating and loads. In these scenarios, the reentry breakup
process is assumed to effectively dispose of major components of spacecraft
hardware. However, the risk to people and property from satellite components
that survive reentry, while small, may not be negligible as one might
assume. Reentry survivability models
have not been adequately tested against flight data and appear to underestimate
component survivability. The scarcity of
flight data has hindered improvement in aeroheating models at a time when good
models are especially needed. Therefore,
the hazard to people and property due to randomly reentering satellites, spent
stages, and other manmade hardware should be factored into deorbit mission
planning. Improved methods to predict
and mitigate the hazard need to be developed and implemented.
The projected increase in the number of telecommunication satellites is significant enough to have constellation developers and government regulators concerned about the increased collision hazard among satellites. A total of 1,771 payloads have been proposed for launch worldwide from 1997 through the year 2006.
Of these, 1,062 are low Earth orbit (LEO) or medium Earth orbit (MEO) commercial communication satellites. [LEO orbits are generally in the altitude range below 2,000 km (1080 nmi); MEO orbits from 2,000 km to 35860 km (1080 nmi to 19365 nmi).] Owners of constellations that have overlapping orbital altitude ranges are coordinating among themselves to ensure that the collision risk is acceptable. Government authorities are in the process of developing regulations to mitigate the collision risk, which if unchecked could leave various altitude ranges hazardous for satellite operation. NASA has developed guidelines for post-mission disposal of space structures.
These guidelines state that, for vehicles in or passing through low Earth orbit, orbital lifetime should be limited to 25 years. The ESA (European Space Agency) recommends similar guidelines in its Space Debris Mitigation Handbook.
Generally, a satellite reentering the Earth’s atmosphere is not viewed
as a major hazard because the tremendous heat generated upon reentry is
expected to completely destroy the satellite.
Only very large space structures and those satellites containing
radioactive or other toxic materials are deemed significant threats. This viewpoint appears to be supported by the
fact that many satellites have reentered the Earth’s atmosphere, but very few
pieces of reentered satellites have actually been recovered. However, the reason for this is not
necessarily that the objects completely burn up in the atmosphere, but rather
that the probability of impacting a populated area on the Earth’s surface is
Reentries of Skylab in 1979, Cosmos 954 in 1978, and the Delta II second stage in 1997, discussed later, suggest that, while the spacecraft may be destroyed, a significant number of debris objects can survive the reentry heating and loads environment. In particular, recovered debris shows that satellite components made of materials with high melting temperatures, such as stainless steel, titanium, and beryllium tend to survive reentry and impact the Earth’s surface.
Heating indicators, such as stagnation point heating for convective heat transfer tend to underestimate reentry debris survivability and predict that some of these components should have burned up. Incorrect modeling assumptions may be the cause of the discrepancy, but with only limited ability to simulate reentry conditions in ground-based tests, limited recovered debris, and a lack of adequate tracking data to establish the true reentry trajectory for a given object, there is a general lack of information for model validation.
Since survivability directly affects casualty expectation, mission
planners need a reliable prediction capability to decide whether random reentry
is acceptable. If casualty expectation
is too large, controlled reentry should be considered. Moreover, as the satellite population
increases so do the associated random reentries and risk to people and
property. The growth in global
population further increases the casualty expectation and adds urgency to the
satellite debris reentry hazard problem.
This paper provides an overview of reentry disposal, addresses the risks
associated with random satellite reentry, and suggests methods to mitigate the
REENTRY DISPOSAL MECHANISMS
There are two primary means for disposing of spacecraft via reentry breakup: Disposal by orbit decay, and disposal by actually deorbiting the spacecraft to a known location. The easiest method of deorbiting a satellite is to lower the perigee altitude such that atmospheric drag causes the satellite’s orbit to decay, and the spacecraft to reenter in a random fashion. If the spacecraft is in reasonable health and has sufficient consumables, insertion into an orbit with a low perigee altitude can be accomplished with existing spacecraft attitude control and propulsion systems. Some spacecraft plan to use onboard electric propulsion systems to lower perigee altitude.
These low-thrust motors, however, do not provide sufficient impulse to allow targeting the spacecraft to a specific reentry point. A major characteristic of this disposal method is the lack of knowledge of exactly where on Earth the object will actually come down. Even during the last orbits, predicting the exact orbital revolution in which reentry occurs is difficult, with prediction uncertainty roughly 10% of the remaining lifetime.
This uncertainty is in the time of reentry, which means that a 10-minute error corresponds to approximately 3,000 miles of uncertainty in the impact point. Thus, warning population centers of an impending reentry is virtually impossible. Disposal by controlled deorbit provides certainty in the impact location by targeting the spacecraft to a safe area, generally a broad ocean area, to minimize the hazard to people and property. Controlled deorbits are most desirable when (1) the mass of the satellite is so large that the number of surviving debris objects is thought to pose an unacceptable risk to life and property, (2) the satellite contains hazardous materials, such as radioactive fuel used in a radioisotope thermal generator, or (3) the satellite contains sensitive components, and recovery of these is not desirable. Disposal via controlled deorbit requires a relatively healthy spacecraft and more propellant than the orbit decay method.
In both cases, satellite reliability issues arise because an errant deorbit or perigee-lowering burn can place the satellite impact footprint in a populated region or leave the satellite in an orbit that could be hazardous to other satellites, raising liability issues for the spacecraft owner. In addition, both techniques require careful planning, execution, and follow-through to assure that the spacecraft, whose systems may be near end-of-life, has performed maneuvers as desired. Confirmation of reentry should be a requirement.
An interesting consideration for both deorbit scenarios is the hazard posed by the deorbiting spacecraft to other on-orbit assets. For example, if the spacecraft is using a low-thrust motor to lower the perigee altitude, the spacecraft will make repeated passes through regions of space below its normal operational orbit. An important part of planning such deorbits must be assessing the hazard posed to Mir, the Space Station, and the Space Shuttle, as well as to active spacecraft that may be using this area of space. While this may be more of a concern for low thrust deorbits, care should be exercised in all such maneuvers.
In addition to the satellites at end of mission, disposal of the associated upper-stage rocket bodies is also of great concern. Not only do rocket bodies pose an on-orbit collision hazard, but they can explode if passivation measures such as propellant venting, battery discharge, and ordnance safing are not performed. The recent explosion of a Pegasus upper stage, which created over 700 pieces of debris, is an excellent example of the potential hazard.
Therefore, methods for speedy removal of spent rocket stages from orbit
are being developed. Options being considered are (1) mission modifications
that result in lower perigee altitude, (2) post -separation maneuvers using
residual propellant to lower perigee altitude, (3) altering the launch windows
for geosynchronous missions to use the lunar-solar gravitational perturbations
to lower perigee, and (4) using small solid rocket motors to lower perigee
SATELLITE REENTRY BREAKUP OVERVIEW
Once an object begins to experience the severe heating and loads environment of reentry, the shell and supporting structure will melt and release internal components. As internal components separate, they follow trajectories and heating rates based on the state vector at separation and their respective ballistic coefficients (defined as W/CD A, where W is the object’s weight, CD is the drag coefficient, and A is a characteristic area). Figures 1–3 illustrate load factor, heating rate and range vs altitude, respectively, for two constant ballistic coefficients.
Internal components can suffer breakup themselves, thus releasing
smaller debris pieces with individual ballistic coefficients. This process continues until the heating
rates are low enough to prevent further disintegration. Factors that affect satellite breakup and
debris survivability are initial speed, flight path angle, melting temperature
of components, and the ballistic coefficient of the primary body and the
subsequent pieces. The survivability of
a particular component also depends on how deep within the structure it is
since it could be shielded through much of the peak heating regime. Figure 4 illustrates a generic reentry
breakup trajectory and footprint dispersion.
There have been several noteworthy reentry events where debris was recovered, and this debris helps illustrate the hazards and challenges associated with reentry disposal.
Skylab reentered the Earth’s atmosphere on July 12, 1979 and scattered its debris over western Australia. Prior to reentry, NASA modulated Skylab’s drag via vehicle attitude changes in an attempt to place the impact footprint in the Atlantic or Indian Oceans. Near the time of reentry, incorrect breakup altitude prediction, and uncertainties in the ballistic coefficient and atmospheric density caused the impact area to shift downrange to Australia. The debris footprint was estimated to be 6,500 km (3,500 nmi) in length and 150 km (81 nmi) in width.
Shortly after reentry, one of the six Skylab oxygen tanks was recovered and analyzed by the Western Australia School of Mines. The tank was made of stainless steel and was protected by calcium aluminum silicate insulation. Although ruptured at one end, the tank was in very good condition, which was attributed to the insulation. The insulation was singed, but also was in good condition although the predicted peak temperature was estimated to be 2,500°C. A steel collar was also recovered and found to be in good condition.
The Skylab reentry demonstrated how difficult it is to perform a controlled reentry having a modest-sized footprint. Uncertainties in breakup altitude, the ballistic coefficient, and atmospheric density can combine to shift the footprint a significant distance. In addition, the relatively good condition of the oxygen tank indicates that even though the heating environment was severe enough to disintegrate the main structural components of the vehicle, some large components survived because of insulation or their placement within the vehicle.
A Soviet reactor-powered radar ocean reconnaissance satellite (RORSAT), known as Cosmos 954, reentered the Earth’s atmosphere and landed in northern Canada on January 24, 1978. It scattered radioactive debris over an area of approximately 124,000 km (36,150 nmi).
A major effort, called Operation Morning Light, was undertaken to
recover the radioactive
material. Fortunately, some of the material was deposited on the ice of the frozen Great Slave
Lake, where its radiation could be more readily detected (the background radiation was shielded
by the column of lake water).
It was established that the Cosmos 954 reactor had partially disintegrated before impact. An estimated 3,500 particles having a total weight of 65 kg were retrieved. Recovered debris consisted of 6 solid beryllium cylinders 10 cm in diameter by 40 cm in length, 41 solid beryllium rods 2 cm in diameter by 10 cm in length, and a number of minute spherical particles.
The six beryllium cylinders were in pristine condition. One cylinder is
shown in Figure 5. The rods
were partially melted on both ends, and evidence of melting and oxidation occur on only one
side of each rod. Figure 6 depicts a typical rod. Some of the debris was brought to Lawrence Livermore Laboratory for analysis.
One conclusion was that the microsphere debris were formed rapidly at 1,300 to 1,900°C and cooled slowly for longer than 15 min. Substantial amounts of uranium were vaporized or oxidized. An analysis was performed at The Aerospace Corporation to determine the breakup altitude of Cosmos 954. Results indicated that the cylinders were released from the main vehicle body at about 70 km (38 nmi), whereas the rods were released in the altitude range 59–65 km (32–35 nmi). Apparently, the rods experienced severe heating while still attached to the main vehicle. The cylinders were exposed to a shorter duration heating while attached to the main vehicle.
Once free, the solid beryllium cylinders survived the heating
environment in excellent condition. The relatively high melting temperature,
high thermal capacity, and low ballistic coefficient of the beryllium cylinders
are the primary reasons for their survival. As with Skylab, this reentry
demonstrates that survival of individual pieces cannot easily be predicted,
particularly if the objects of interest are attached to a body where they are
exposed at a particular orientation for a substantial portion of the
reentry. Damage to some of the beryllium
rods, for example, indicates that only one end was exposed for a long
period. It is speculated that this
occurred when the rod, believed to be from the reactor core, was exposed by the
melting of the reactor’s stainless-steel shell.
Other rods were from the interior of the reactor and showed very little
Delta II Second Stage
In a more recent reentry event, a Delta II second-stage rocket body reentered the Earth’s
atmosphere on January 22, 1997. The 500 LB stainless-steel propellant tank landed close to a
farmer’s house in Georgetown, Texas (Figure 7), and a titanium helium-pressurization sphere
impacted near Seguin, Texas, nearly 161 km (100 miles) away. The titanium showed slight
discoloration but no signs of melting. Samples of the stainless-steel tank were delivered to The Aerospace Corporation for metallurgical analysis.
Results of the analysis indicated that the aluminum structure attached to the tank melted, and residual molten aluminum combined with the steel in the tank sample to lower the melting temperature in various regions. Evidence of melting of the aluminum-steel alloy was present in the samples analyzed. A more comprehensive analysis of the entire tank is required to determine whether melting of the uncontaminated steel occurred. This reentry demonstrated that large, heavy objects can survive the reentry heating environment.
OBSERVATIONS ON REENTRY BREAKUP
Based on observations of Space Shuttle External Tank reentries and other data that has yet to be published, several observations may be made about reentry breakup:
1. Existing reentry breakup models may grossly underestimate survivability of reentering space vehicles. (One reason for this is the fact that most models fail to deal with the shielding of spacecraft components in a realistic way. A second reason might be that the models simply are not representative of the heating environment on these complex structures with non-homogeneous surfaces.)
2. Magnesium and
aluminum structures consistently fail at approximately 78 km (42 nmi) altitude,
causing a catastrophic breakup of the reentering vehicle at a point where
structural loads are still relatively low.
3. This catastrophic breakup phenomenon is independent of vehicle attitude and rates, diameter, shape, and entry flight path angle for the range of entry angles between –0.3° and –1.5°.
4. Survivability of individual pieces depends most strongly on the ballistic coefficient and melt temperature of the objects.
BREAKUP PREDICTION TOOLS & DIRECTIONS
Currently, several reentry survivability tools are in operation. For example, ESA, NASA, JPL, and the DOD have reentry breakup simulation tools, and these tools, which have incorporated some of the lessons-learned from actual reentries, can give reasonable macroscopic estimates of satellite survivability. Lack of published reentry data has generally made good validation of the models difficult or impossible, and has also limited the development of more refined models capable of providing accurate estimates of the survivability of individual components and projecting the ground locations where this debris will impact.
Since modeling reentry breakup involves the dependence of the results on
various parameters that are difficult or impossible to predict, development of
a probabilistic reentry breakup model may be the best approach for estimating
component survivability and hazard.
Such a model would include estimates of the uncertainties of heat transfer coefficients, emissivities, attitudes, release points, and other factors. The output from such a model would include a probability distribution for the impact footprint and for individual debris pieces of interest. A model incorporating some of these features was developed as part of the review of the Cassini mission reentry.
In that case, estimates were made of component attitude and rates and associated uncertainties during the peak heating phase, and these estimates were combined in an overall probability of survival of critical components.
For each attitude mode and ballistic coefficient, the simulation would predict whether the melting temperature of the skin and supporting structure is reached. If melting occurs, internal components, illustrated in Figure 8 as A and B, are released. Each of these components assumes unique trajectories and heating rates. Each path in the tree has an associated probability. Using Monte-Carlo techniques, the total probability of ground impact can be determined for each surviving component. As models improve, the uncertainties in various parts of the tree can be updated. This approach would provide a good estimate of the ground impact footprint and would also help develop an overall casualty expectation.
ENHANCING BREAKUP BY DESIGN
The survivability of satellite components can be reduced by choosing low-melting-point materials. In addition, the satellite can be constructed in a manner that will assure a particular breakup scenario. For example, if the total vehicle tends to survive, the vehicle can be separated into two or more less survivable segments during reentry. If survivable components tend to separate from the core vehicle early, thereby avoiding the peak heating loads, methods should be found to prevent early separation. By keeping them attached, the higher ballistic coefficient of the core vehicle may lead to heating loads sufficient to destroy these more resilient components. Once reentry breakup phenomenon is more fully understood, mitigation techniques could be tailored to each satellite design. Other techniques should be found and investigated for feasibility.
CONCLUSIONS & RECOMMENDATIONS
It is clear that constellation developers are recognizing that removal of satellites at the end of mission life is necessary for the survivability of the constellations themselves and to help reduce the overall space debris environment. A low-cost option for satellite and launch hardware removal is lifetime reduction, which requires less propellant than a direct deorbit targeted to a safe area on the Earth’s surface. Disposal by lifetime reduction leads to random reentry of satellites and the associated risks from surviving hardware components. A significant amount of evidence exists that indicates higher than expected survivability of many satellite components.
With the increasing number of reentry events, the total risk to people
and property may become unacceptable.
Spacecraft owners and operators can incorporate features in the design of the mission and the hardware that will enhance reentry breakup. These include choosing materials with lower melting temperatures, designing satellites to expose more robust components to the maximum heating upon atmospheric reentry, and planning a controlled deorbit if a satellite contains a significant number of survivable components or potentially hazardous debris.
Improving reentry breakup modeling is also critical to developing confidence in our ability to use this disposal technique safely. Specific recommendations include:
1. Collecting reentered
objects, such as the Delta II second stage fuel tank and performing laboratory
analyses to establish the reentry heating environment.
2. Using every available opportunity to gather data on reentering satellites by deploying the appropriate sensors in the predicted reentry areas.
3. Conducting an instrumented controlled reentry test to provide accurate data.
4. Developing a reentry breakup simulation tool that employs a probabilistic methodology. Such a tool could be used to make realistic predictions of survivability for specific satellite components.
Increased knowledge and understanding of reentry breakup will lead to improved techniques for assuring that end-of mission disposal of spacecraft and launch hardware by lifetime reduction and orbit decay is safe and reliable (Global Security, 1988).