Active debris removal rule No. 1 must be “do no harm”

Space junk poses an existential threat to ambitious proposals to surround Earth with habitats, factories and vast constellations of satellites. What if the most dangerous debris could be grabbed and hauled out of orbit? Kerry Buckley of the MITRE Corp. offers safety advice for those who want to prove it can be done.

BY KERRY BUCKLEY

It’s a few years from now. 

An obsolete satellite tumbles through low-Earth orbit end over end at 28,000 kilometers per hour. An autonomous active debris removal (ADR) tug sets up a rendezvous and begins matching the spin rate. At the right moment, it captures the tumbling satellite. Once it has gained complete control, the ADR tug slows the satellite to lower its altitude and releases it to burn up in the atmosphere. 

That’s an ideal scenario. 

In the worst case, the ADR tug collides with the satellite and creates a 15-kilometer-wide debris field that not only closes off a valuable orbit for decades but also accelerates the Kessler Syndrome of cascading collisions, wiping out numerous communications, surveillance, and scientific satellites. 

These days, there’s a lot of buzz about ADR, and I can appreciate why. ADR has the potential to help solve a massive problem and be very lucrative in the process. Unfortunately, the challenges of ADR are probably harder than many people realize, and the ramifications of failure are also likely higher than most suspect. So, before any demonstrations in space, companies on the cutting edge of ADR need to borrow from the Hippocratic oath and “first, do no harm.” 

Ultimately, there should be many federal, industry and international organizations involved in establishing the safety standards and regulation of ADR. Yet right now, this capability is accelerating in the absence of regulation. To minimize the negative impacts of space debris, those on the cutting edge of ADR must — at a minimum — take a cue from the aviation and nuclear sectors by establishing a safety management system.

An SMS provides a framework for achieving an acceptable level of risk. Each SMS is built on four foundational pillars: safety policy, safety risk management, safety assurance, and safety promotion. 

To illustrate how this would work in space, let’s build an imaginary company on the cutting edge of ADR. Let’s assume that you and an SMS-trained friend want to start an ADR company. First, you need to decide what “active debris removal” means in your company. 

ADR means different things to different people, and this can lead to confusing risk and consequence discussions between internal decision-makers, potential customers and operational orbital neighbors. In entrepreneurial terms, the ADR definition is directly related to the “why” for the company and provides a tangible yardstick for success. For instance, you could do anything from a) moving debris into orbit to burn up, b) taking it to high orbits to leave in “graveyards” or c) repurposing debris — everything from refueling and minor upgrades to recycling the materials on orbit. Each of these disparate missions has unique risks, so be sure your company doesn’t act as if they are all the same. Imprecise communication cripples the ability to make data-driven decisions. 

You arrive at the following concrete definition of ADR for your company: XYZ Corporation will apposition a grappler satellite to capture defunct satellites weighing less than 1,000 kilograms and orbiting no more than 1,000 km above Earth and relocate them to a near-term reentry orbit at 300 km. Afterward, the grappler will recover to a working altitude of 500 km.

With ADR defined, here’s how your SMS implementation should play out:

#1) Start with safety policy, the first pillar of SMS 

The top safety objective for every ADR company should be “first, do no harm.” This should drive your vision for ADR and serve as a focal point for risk-based decision making. After laying this foundation, you can develop the rest of the safety policy, including a nonpunitive safety reporting system. 

#2) Apply safety risk management to your business operations 

Applying safety risk management means asking the hard questions, identifying hazards and analyzing and controlling risks to provide the highest probability of mission success. 

Fast-forward a bit: Your team has been hard at work applying safety risk management to make sure your grappler design can complete the ADR mission you defined. Finally, a big government contract you’ve anticipated opens for bids to remove a piece of debris. This is your chance to impress the world and literally get your work off the ground. The contract provides three candidate debris objects: two rocket bodies at 850 km and one defunct satellite at 600 km. Which should you choose?

The board meeting to decide on the bid specifics is electric; everyone is excited. The rocket bodies are big, tempting targets, and rescaling your grappler is probably doable on the timeline. You really want to go after those rocket bodies, but your friend takes over the room by applying safety risk management and pointing back to your top safety objective: To first do no harm, you must first know that your technology will work. The rocket bodies still contain fuel, so the risk of explosion is too high. Therefore, your proposal must target the defunct satellite, enabling you to mature your technology and operations. Everyone leaves in agreement, recognizing that even for the defunct satellite disposal, there are many challenges to overcome. 

Fast-forward another few months, and your application of safety risk management is bearing fruit. Your most junior engineer uses the safety reporting system after two days on the job to point out a critical design flaw, saving the mission. You’ve chopped down that long list of open-ended questions and unmitigated risks, and evidence pointing to a successful mission is piling up. You’ve made some momentous achievements: 

• Developed a new way to determine and match the tumble of the satellite
•  Performed countless simulations showing that your grappler, Grappler-1, will successfully capture, de-spin and control the satellite
• Simulated control of the satellite even if one of your thrusters fails midoperation 
• Verified that you have enough Delta-V (change in velocity) to regain station at 500 km and perform another similar disposal before retiring Grappler-1

You’ve also developed some robust risk mitigations, such as: 

• Perfecting the close-approach procedure without making accidental contact (and along the way, producing a few patentable technologies) 
•  Requiring the capture maneuver to occur below 30 degrees latitude to ensure dependable connectivity with your ground stations
•  Protecting Grappler-1 and your distributed network components from malicious actors and tampering by implementing a zero-trust cyber architecture that allows only authorized users to interface with the spacecraft

Armed with your digital mountain of safety risk management-derived evidence of success, you breeze through the final contracting process and are officially on the path to being well compensated and on the clock to remove the defunct satellite. Now your SMS will really be tested. 

#3) Safety assurance, the bedrock of successful ADR operations 

Your company has grown, hiring is at an all-time high, and everyone is working full steam on finishing Grappler-1 to fly on your scheduled launch date. Working at this pace, it’s easy to lose track of safety, which is why your first hire after landing the contract was a dedicated safety assurance manager — let’s call her Sam. 

•  Sam makes sure everyone is complying with the policies, plans and procedures you developed by applying safety risk management to develop your contract proposal, and she’s helping the company perform even better than you initially planned. Sam uses data analysis methods, spotting performance trends and employing training improvements to prevent problems before they happen. The company sails through construction smoothly. 
•  During pre-launch rehearsals, Sam proves even more valuable. She notices one of the operating teams is not performing as required and provides insights, allowing you to reshuffle the teams for optimum performance. 
• Of course, there is one launch delay: a pop-up thunderstorm that wastes a short launch window. 
• The new operating teams then notice that there’s an unreliable data link in the South Pacific and report it up to Sam, kicking off a safety risk management review process that develops an additional operational restriction on the capture maneuver to maximize the reliability of the control signal. It means delaying the capture by a day, but looking back to “first, do no harm,” it is an easy delay to accept. 
• The mission is flawless, and after returning Grappler-1 to the 500-km loitering orbit, you get calls from four governments wanting to hire your company for the next mission. It’s the best day of
  your career. 

#4) Safety promotion — a pillar and a product

Because you did this SMS implementation right, it’s now become the foundation for how you do business, and the safety culture at the employee level is tangible. Sam trains a great replacement and tells you her next job will be at the United Nations, promoting safety as the key to expanded space operations on an international level. Sam says that the safe and successful ADR work done at your company was the key to developing international consensus that ADR is safe and viable. She hopes from there to develop consensus that enables answering the most challenging ADR question of all: Who can actually authorize removing the spent Soviet rocket bodies trapped in low-Earth orbit?

Congratulations! You’ve done it. Your company has a bright future, investors and customers are lining up, and there are rumblings about a Draper Prize. How did you get there? By building an ADR enterprise on SMS principles, overcoming challenges and producing amazing results through a repeatable safety process. 

Jumping back to reality from this imaginary company, ADR is without a doubt an extremely complex challenge. Yet, given the right resources and effort, it’s achievable, so long as the ramifications of failure are always kept in mind. We must learn from other high-consequence industries and build on a foundation of SMS, making sure to first do no harm.