1. © Copyright QinetiQ Limited 2011 1 Overview of space weather impacts on satellites Keith Ryden QinetiQ Fellow Farnborough, UK karyden@qinetiq.com 9 th ESWW Brussels 8 th November 2012

2. © Copyright QinetiQ Limited 2011 2 Growing reliance on space assets Communications Broadcast Weather Defence & Security Intelligence, surveillance, command, control Mobile Systems e.g. maritime Navigation (GPS/Galileo) accurate timing Dependence on space will grow in the coming decades……

3. © Copyright QinetiQ Limited 2011 3 Stormy weather …... Anomalies, upsets etc −Equipment switch-offs, phantom commands etc −De-pointing, spin-up/down −e.g. Loss of fuel Permanent damage and loss −E.g. power loss, equipment failure, satellite failure Ongoing cumulative damage

4. © Copyright QinetiQ Limited 2011 4 Example failures and anomalies attributed to space weather DSCSII (11 Jan 1971) - GEO Satellite 9431 lost, power system disabled Led to major ESD investigations ANIK E1, E2 disabled (20 January 1994) - GEO Some recovery, but life shortened considerably $350m loss overall, 100,000 home sat users had to re-point dishes Intelsat K (20 January 1994) – GEO Outage for several hours but recovered. NASA MAP (5 Nov 2001) - MEO Went into de-pointing/safe mode for some weeks, recovered later Single event effect diagnosed Telstar 401 (11 Jan 1997) - GEO Completely lost – short circuit of power bus diagnosed due to ESD. ‘Killer electrons’, ESD ADEOS-2 (November 2003) - LEO Lost Solar array / charging problem

5. © Copyright QinetiQ Limited 2011 5 Anomaly diagnosis Correlate anomalies with the environment −Space weather services / on-board monitors −Anomaly repetitions are invaluable −One off (sudden/catastrophic) failures are the hardest to diagnose! Obtain plausible engineering mechanism −Radiation and plasma effects −Circuit analysis −Shielding analysis High level of commercial, technical and political sensitivity −Reputation at risk, vulnerability may be exposed −Alternatively it may be convenient to blame space weather Merlin on-board monitor

6. © Copyright QinetiQ Limited 2011 6 Galaxy 15 Sudden failure April 5 2010 Space weather blamed GPS service augmentation payload on board Hazardous to other satellites while drifting Recovered late Dec 2010 Intelsat stated ESD was the cause but solar activity ‘ruled out’ (Intelsat) Conditions at the time of failure consistent with space weather cause (NOAA, 11 th SCTC 2010)

7. © Copyright QinetiQ Limited 2011 7 THAICOM-5 outage 22 April 2011

8. © Copyright QinetiQ Limited 2011 8 The space environment Satellites are designed to operate in a hostile environment Cosmic rays Van Allen trapped radiation Solar particle events Plasma environment Track record of satellite survivability has actually been good But problems still occur....... Bastille day Halloween Guy Fawkes >38 MeV proton flux

9. © Copyright QinetiQ Limited 2011 9 Cumulative dose effects Displacement damage Caused by protons Optical devices especially vulnerable

10. © Copyright QinetiQ Limited 2011 10 Cumulative ionising dose

11. © Copyright QinetiQ Limited 2011 11 Switching anomalies and ESD 1970s and 80s saw a spate of ‘phantom command’ switching problems and equipment damage Terminated a DSCSII (military) and the MARECS A spacecraft missions Correlated with local time and geomagnetic disturbance (Kp index) Led to major research programmes and even a dedicated research satellite (SCATHA)

12. © Copyright QinetiQ Limited 2011 12 Surface charging mechanism Surface potentials of up to 20kV measured Charging timescale – minutes Solutions developed – improved grounding and new conductive surface materials

13. © Copyright QinetiQ Limited 2011 13 1990s - more anomalies…. Anik E1 & E2, Intelsat K disabled DRA-Δ anomalies

14. © Copyright QinetiQ Limited 2011 14 GEO comsat switching anomaly G. Wrenn, D. Rodgers, K Ryden, Annales Geophysicae (2002) 20: 953–956 Solar minimum Solar maximum

15. © Copyright QinetiQ Limited 2011 15 Coronal holes Outer belt electron enhancements

16. © Copyright QinetiQ Limited 2011 16 Internal charging / ESD Energetic, penetrating electrons Slow charge build up (>24 hours) leading to ESD Affected items not previously thought to be vulnerable More sensitive / vulnerable on-board systems Some materials have very long time constants (months, years) −0.01pA cm-2 rather than 0.1 pA cm-2 safe level? Still important questions over long term behaviour of dielectrics in space

17. © Copyright QinetiQ Limited 2011 17 2000s: more solar array ESD/arcing damage Surface ESD has again become a significant issue in recent times Higher array voltages Small ESD event on array becomes an arc driven by the power supplied by the array Insulation is heated and provides more plasma to sustain arc May be temporary or sustained May cause permanent short circuit of the array by kapton insulation Several satellites have suffered sudden power losses, even 30-50% Courtesy M. Cho, JAXA, M Bodeau, NG

18. © Copyright QinetiQ Limited 2011 18 Single event effects Single event effects (SEE) result from interactions of single particles and include: Upsets (bit-flips), Transients Functional Interrupts, Latch-up, Burnout, Gate rupture, Dielectric failure, DNA rupture Single events can cause multiple effects!

19. © Copyright QinetiQ Limited 2011 19 SEE history Problem first predicted in 1962 as a limit to scaling (Wallmark & Marcus) Observed in space with increasing frequency since 1975. Major problem realised in 1984 when TDRS-1 attitude control memory showed several upsets per day (several hundred during major solar particle event) Latchup failure of ERS-1 PRARE instrument after 5 days of operation in July 1991. PCs on Shuttle and MIR required frequent reboot, typically every nine hours. Remains a significant source of anomalies in space systems, eg NASA Microwave Anisotropy Probe on 5 Nov 2001. Multiple bit upsets are now an increasing issue

20. © Copyright QinetiQ Limited 2011 20 Single event effects (SEUs) during Bastille day event

21. © Copyright QinetiQ Limited 2011 21 LET Spectra for Major Events Compared to CREME96 Worst Day Model

22. © Copyright QinetiQ Limited 2011 How is protection engineered? Note: impractical to test at satellite and equipment level Contrast to vibration, thermal, vacuum, solar flux etc Use component-level test data coupled with detailed analysis to give mission-level confidence Large ‘human factor’ in review and assessment First step: use available models to define the space environment i.e. the satellite specification Many available – no one standard in the commercial world Various choices to be made within models (e.g. confidence level, worst cases) ‘Old’ models very much in use, AE8, JPL-91 etc Based on space era observations with many extrapolations 22

23. © Copyright QinetiQ Limited 2011 Ionising dose and displacement damage (cumulative, ageing) Experience is that these effects are very well accommodated in satellite design −Most satellites carry on for very many years beyond design life 3D modelling is standard −1000s of individual component doses calculated per satellite −Hitherto often only 50% of the mass has been modelled (very large safety margin) Minimum safety margins applied e.g. x1.2, x1.5, 1.8, 2.0…to account for uncertainties in models and methods in dose calculation but most components will have much more Further safety margins at circuit level (e.g. parametric vs functional failure) Large safety margins for most components However fidelity of 3D modelling is now becoming very high (90-95% of mass) so this large safely factor is being removed! Soft COTS components with high levels of shielding – low margins 23

24. © Copyright QinetiQ Limited 2011 Single Event Effects protection Fault avoidance and fault tolerance approaches Identify susceptible components (memories, op-amps, power MOSFETS etc) Obtain test data Calculate worst case upset rates or failure probability: review consequences (if any) Mitigations: change technology, error detection and correction, de-rating, watchdogs, voting, shielding Each equipment has an SEE analysis and justification Effective engineering processes are available - diligence essential Solar energetic particle event will find any omissions in the process and may cause surprises during major solar particle event. 24

25. © Copyright QinetiQ Limited 2011 Charging and ESD protection Identify susceptible structures and avoid −e.g. avoid large insulating exterior surfaces, ungrounded metal items, very thick insulators etc Analyse risk situations in detail (e.g. DICTAT, SPIS) −Apply mitigation: e.g. shielding or change surface coatings, change materials Implement transient filtering on equipment I/O lines; ESD tests on equipment No simple ‘irradiation’ tests Can be difficult to obtain all the materials data for accurate analysis: long term charging issues not well understood System level issues as well e.g harness, filtering, structure, exterior Environments are very dynamic and still weakly understood: worst cases not always easy to define (e.g hard vs soft spectrum) New technology (e.g. HV arrays) and mechanisms Old lessons can be forgotten 25

26. © Copyright QinetiQ Limited 2011 26 Causes of satellite environmental anomalies Aerospace Corporation study of satellite anomalies (Koons et al, 1999) attributed to space environment (326 anomaly reports) ESD & charging 54% Single Event Effects 28% Cumulative effects e.g. dose 5% Others 13%

27. © Copyright QinetiQ Limited 2011 Last solar cycle - major events 27 Halloween 2003 – in open literature 47 satellites reported to have anomalies, 1 loss, 10 with outages for >1 day Experience varies! Inmarsat says it has not experienced any space weather problems [IET seminar 2012]

28. © Copyright QinetiQ Limited 2011 Operational mitigations Satellites are highly autonomous and intended to operate through a space weather event……up to a limit! Modern satellites have system level fault isolation and recovery to mitigate against anomalies and failures − In worst case satellites may take up safe states to minimise deleterious effects e.g. sun pointing mode (but means an outage) Operational measures can further reduce risk: − Nowcasts and forecasts can help to be prepared and plan operations −e.g. delay satellite operations until after space weather event subsides −manage space weather anomalies when they do arise 28

29. © Copyright QinetiQ Limited 2011 29 The 1859 Carrington event Monthly Notices of the Royal Astronomical Society, Vol. 20, p.13-15 -- the original report by R.C. Carrington Saw brilliant white light projected over sunspot images (a solar flare) Aurorae seen in the Caribbean Some effects on technology reported as well (telegraph lines) Large magnetic signature However space environment during this event is not known −Ice core nitrate data not thought reliable Magnetometer data from Kew Observatory, London

30. © Copyright QinetiQ Limited 2011 30 SEE and dose SEE, ionising dose, displacement damage Extreme storm event timeline Solar flare Coronal mass ejection Relativistic protons / ions 15 mins Geomagnetic storm Surface charging and ESD CME arrives at Earth Internal charging, ESD, ionising dose 1 day

31. © Copyright QinetiQ Limited 2011 Engineering effects measured in MEO (2005-2008) 31 Ryden et al, Proc. RADECS, 2008

32. © Copyright QinetiQ Limited 2011 Possible impacts of Carrington Event? For Carrington event, present day environment specifications of satellites could be exceeded: In GEO max >2MeV electron flux in most specs. is currently 10 5 electrons cm -2 sr -1 s -1 averaged over one day (e.g. March 1991 electron event) −Theoretical considerations suggest a x10 increase is possible [Shprits et al., 2011] for extreme eventShprits et al., 2011 −Severe internal charging - historically quite dangerous −Significant dose increment likely −More work is needed to define and assess such events and impacts. Previous estimates of >30MeV solar proton fluence for Carrington would ‘use up’ the typical protection level for a GEO sat in one event −i.e a newly launched satellite would be immediately aged to EoL in in this respect −Replace early? May overwhelm older or short mission satellites.. 32

33. © Copyright QinetiQ Limited 2011 33 Odenwald analysis Odenwald (Adv. Space Res., 38, (2006), 280-297) has estimated impact on global space assets from ‘Carrington- like’ event −Major loss of power from solar arrays −1000s of upsets due to ESD and single event effects per day over the fleet −80 satellites disabled (GEO, MEO, LEO) Major economic and societal loss predicted −loss of revenues and service from satellites (inc. GPS) - $70bn −bottleneck in manufacturing and launch capacity for replacements Odenwald actually uses 3 x Carrington event proton fluence Fluence of 5 x 10 10 protons cm -2 of energy >30MeV a 1 in a million year event (?) But ice core data subject to uncertainty

34. © Copyright QinetiQ Limited 2011 34 Conclusion Critical dependence on space assets is increasing Track record of satellite reliability to date has been very good but not perfect Technology evolution (e.g. more COTS, high voltage solar arrays) Engineering practice is changing - lower hidden margins in future? Current question: how well space infrastructure survive extreme storm events? Extreme storm events will occur in future Picture is complex and not well quantified Better environment definition and vulnerability studies are needed but will not be easy −complex technical, political and commercial issues and sensitivities What level of survivability do we really require? Protecting all satellite against a Carrington Event may unlikely to be economic Consider the effect of satellite outages on your application!

35. © Copyright QinetiQ Limited 2011 35 Overview of space weather impacts on satellites Keith Ryden QinetiQ Fellow Farnborough, UK karyden@qinetiq.com 9 th ESWW Brussels 8 th November 2012

36. © Copyright QinetiQ Limited 2011 36 Why do problems still occur? Environment specifications not accurate space-era observations, limited coverage storm (transient) conditions not well represented −difficult to define ‘worst case’ conditions New technology e.g. high voltage arrays new interactions more sensitive on-board systems Incomplete understanding of detailed physics Test facility limitations cannot replicate the space radiation environment −Unlike vibration and thermal environments −Component level testing only considerable extrapolation and judgement needed Build / manufacture errors; old lessons can also be forgotten Space weather event may exceed designed survival level Not economic to design all satellite against the most extreme events