Resilient Space Systems Design: An Introduction

1st Edition Ron Burch pdf download

https://textbookfull.com/product/resilient-space-systems-design-an-introduction-1st-edition-ron-
burch/

★★★★★ 4.8/5.0 (49 reviews) ✓ 112 downloads ■ TOP RATED

"Great resource, downloaded instantly. Thank you!" - Lisa K.

DOWNLOAD EBOOK
 Resilient Space Systems Design: An Introduction 1st Edition
Ron Burch pdf download

TEXTBOOK EBOOK TEXTBOOK FULL

Available Formats

■ PDF eBook Study Guide TextBook

EXCLUSIVE 2025 EDUCATIONAL COLLECTION - LIMITED TIME

INSTANT DOWNLOAD VIEW LIBRARY

Collection Highlights

Resilient Space Systems Design An Introduction 1st Edition

Ron Burch (Author)

An Introduction to Systems Biology Design Principles of

Biological Circuits Uri Alon

Surface Knots in 4 Space An Introduction Seiichi Kamada

Group Recommender Systems An Introduction 1st Edition

Alexander Felfernig
Practical Lighting Design with LEDs 2nd Edition Ron Lenk

Interface Design An introduction to visual communication

in UI design Dave Wood

Human Permaculture Life Design For Resilient Living

Bernard Alonso

An Introduction to Sonar Systems Engineering First Edition

Ziomek

Metabolomics Practical Guide to Design and Analysis 1st

Edition Ron Wehrens (Editor)
Resilient Space Systems
Design: An Introduction
Resilient Space Systems
Design: An Introduction

Authored by

Ron Burch
CRC Press
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742

Copyright © 2020 by Taylor & Francis Group, LLC

CRC Press is an imprint of Taylor & Francis Group, an Informa business

No claim to original U.S. government works

Printed on acid-free paper

International Standard Book Number-13 978-0-367-14848-5 (Hardback)

This book contains information obtained from authentic and highly regarded sources.
Reasonable efforts have been made to publish reliable data and information, but the author and
publisher cannot assume responsibility for the validity of all materials or the consequences of
their use. The authors and publishers have attempted to trace the copyright holders of all mate-
rial reproduced in this publication and apologize to copyright holders if permission to publish
in this form has not been obtained. If any copyright material has not been acknowledged,
please write and let us know so we may rectify in any future reprint.

Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, repro-
duced, transmitted, or utilized in any form by any electronic, mechanical, or other means, now
known or hereafter invented, including photocopying, microfilming, and recording, or in any
information storage or retrieval system, without written permission from the publishers.

For permission to photocopy or use material electronically from this work, please access www.
copyright.com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc.
(CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit orga-
nization that provides licenses and registration for a variety of users. For organizations that
have been granted a photocopy license by the CCC, a separate system of payment has been
arranged.

Trademark Notice: Product or corporate names may be trademarks or registered trademarks,

and are used only for identification and explanation without intent to infringe.

Visit the Taylor & Francis website at

http://www.taylorandfrancis.com

and the CRC Press website at

http://www.crcpress.com
Contents

Preface.......................................................................................................................ix
About the Author....................................................................................................xi

Introduction......................................................................................................1

1. The Space System............................................................................................ 9

1.1 Space System Components...................................................................9
1.2 System Capability................................................................................ 11
1.3 System Architectures........................................................................... 13
1.3.1 Parallel Architectures............................................................. 13
1.3.2 Series Architectures................................................................ 14
1.3.3 Hybrid and Other Architectures.......................................... 15
1.4 Space System Elements........................................................................ 16
1.4.1 The Space Segment................................................................. 16
1.4.1.1 Satellite Orbits.......................................................... 17
1.4.1.2 Satellite Composition and Size.............................. 19
1.4.1.3 Satellite Operating Frequencies............................ 20
1.4.2 The Ground Segment............................................................. 21
1.4.2.1 Satellite Command and Control...........................22
1.4.2.2 Satellite Operations................................................. 23
1.4.2.3 Mission Planning.................................................... 23
1.4.2.4 Gateways and Teleports......................................... 24
1.4.2.5 Network Operations............................................... 25
1.4.3 The User Segment................................................................... 25

2. Defining and Evaluating Resilience.......................................................... 27

2.1 Resilience Domains, Attributes, Timeline, and Criteria................. 29
2.2 Valuing Resilience................................................................................ 31
2.3 Prerequisites for Evaluating Resilience............................................ 32
2.4 Approaches to Calculating Resilience..............................................34
2.5 Resilience Calculation Parameters.................................................... 37
2.6 The OSD Taxonomy of Resilience...................................................... 39
2.7 Other Resilience Nomenclature......................................................... 41

3. Threats.............................................................................................................43
3.1 Categorizing Threats: Adverse Conditions and
Hostile Actions.....................................................................................43
3.1.1 Adverse Conditions................................................................44
3.1.2 Hostile Actions........................................................................ 45

v
vi Contents

3.2 Threat Attributes and Characteristics............................................... 47

3.2.1 Threat Types............................................................................ 47
3.2.1.1 Physical or Kinetic Threats.................................... 47
3.2.1.2 Electronic Threats................................................... 48
3.2.1.3 Optical Threats........................................................ 49
3.2.1.4 Cyber Threats........................................................... 50
3.2.2 Threat Severity........................................................................ 50
3.2.3 Threat Target(s)....................................................................... 52
3.2.4 Threat Effectiveness............................................................... 53
3.2.5 Persistent Threats....................................................................54
3.2.6 Reversible and Irreversible Effects.......................................54
3.3 Multiple Threats to a System.............................................................. 55
3.4 Evolving or Escalating Threats.......................................................... 55

4. Threat Mitigation.......................................................................................... 57
4.1 Threat Mitigation Approaches........................................................... 58
4.2 Threat Mitigation Options for Space Systems................................. 61
4.2.1 Mitigating Electronic Threats: Radio Frequency (RF)
Signal Interference and Jamming......................................... 61
4.2.1.1 Spatial Isolation.......................................................63
4.2.1.2 Receive Frequency Selectivity (Filtering)............64
4.2.1.3 Spread Spectrum Waveforms and Digital
Signal Processing.................................................... 66
4.2.2 Mitigating Physical (or Kinetic) Threats.............................. 67
4.2.2.1 Ground Stations and Terrestrial Networks......... 67
4.2.2.2 Mission Planning Element..................................... 69
4.2.2.3 Space Segment......................................................... 69
4.2.3 Mitigating Optical Threats.................................................... 70
4.2.4 Mitigating Cyber Threats...................................................... 71

5. Modeling and Calculating Resilience....................................................... 73

5.1 Modeling Resilience............................................................................ 73
5.1.1 Individual Threats..................................................................77
5.1.2 Multiple Coordinated Threats — Cumulative Impact......77
5.1.3 Probability-Weighted Resilience........................................... 78
5.1.4 Superposition of Threats........................................................ 78
5.2 Determining the Resilience Coefficient Values............................... 79
5.3 Modeling Resilience Attributes.........................................................80
5.3.1 Avoidance.................................................................................80
5.3.2 Robustness...............................................................................84
5.3.3 Recovery................................................................................... 86
5.3.4 Reconstitution......................................................................... 92
5.4 System Availability and Resilience................................................... 93
Contents vii

6. Designing for Resilience.............................................................................. 97

6.1 Establishing Requirements................................................................. 97
6.2 Incorporating Resilience Engineering into the System
Design Process...................................................................................... 98
6.2.1 Architectural Trades............................................................... 99
6.2.2 Elemental Protection............................................................ 100
6.2.3 Distribution of System Capability...................................... 101
6.2.3.1 Limits of Distribution........................................... 102
6.2.4 Methods of Distributing System Capability..................... 104
6.2.4.1 Uniform versus Non-Uniform (Mixed)
Architectures......................................................... 110
6.2.5 The Relationship Between Elemental Protection
and Distribution.................................................................... 113
6.2.6 Cost versus Resilience Trades as Function
of Distribution....................................................................... 116
6.2.7 Diversifying Distributed Architectures............................ 118
6.2.8 Disaggregating a System Architecture.............................. 118
6.3 Evaluating Resilience for Multiple Missions
and Threats......................................................................................... 119
6.3.1 Systems Supporting Multiple Services
or Missions............................................................................. 119
6.3.2 Comparing Architectures Across Multiple
Threats.................................................................................... 121
6.3.3 Sequential or Recurring Threats........................................ 122
6.4 Including Threat Effectiveness........................................................ 123
6.5 Other Statistically Relevant Considerations
of Resilience Calculations................................................................. 124
6.6 Resilience Design and Analysis Tools............................................ 125

7. Applying Resilient Design Techniques.................................................. 127

7.1 Creating a Resilient Space Architecture......................................... 127
7.1.1 Multilayered Architectures................................................. 128
7.2 Increasing Resilience Through Distribution.................................. 131
7.3 Increasing Resilience Through Diversification.............................. 136
7.4 Increasing Resilience Through Responsive Recovery
and Diversification............................................................................. 139
7.5 Designing for Resilience to Multiple Threats................................ 141
7.6 Designing for Resilience and Cost in a Multi-Threat
Environment....................................................................................... 145
7.6.1 Design #1 Resilience Calculation........................................ 147
7.6.2 Design #2 Resilience Calculation........................................ 149
7.6.3 Design #3 Resilience Calculation........................................ 149
7.7 Multiple Threats and Multiple Mitigations Example................... 152
viii Contents

8. The Future of Resilient Space System Design....................................... 161

8.1 The Cost of Satellite Capability on Orbit........................................ 162
8.1.1 Launch Costs......................................................................... 162
8.1.2 Increasing the Capability Density
and Affordability per Satellite............................................ 164
8.1.3 Cost of Increased Ground Complexity.............................. 166
8.2 Space and Ground Segment Flexibility.......................................... 166
8.3 The Impact of Increased Congestion............................................... 168
8.4 Autonomy and Cognitive Systems.................................................. 170
8.5 Extension of the Terrestrial Network.............................................. 171
8.6 On-orbit Servicing............................................................................. 172
References............................................................................................................ 175
Index...................................................................................................................... 177
Preface

The somewhat arcane topic of space resilience has actually been with us for
several decades now in one form or another. During that time, it has gone
by different names and has been addressed in a number of different ways.
Commercial and civil space designers have had to consider the impact of
hazards to satellites and planetary probes that include solar flares and space
weather, the natural radiation environment, and other threats. Designers
of military satellites have had to consider nuclear effects and intentional
interference in addition to the natural hazards. Now, as space grows more
congested, additional threats are posed by neighboring satellites and the
growing problem of space debris. The study of resilience encompasses all of
these concerns as well as the mitigation of emerging threats to both satellites
and the associated ground system, such as cyber attacks.
The origins of this book go back several years when the U.S. government
began taking these emerging and escalating threats to their space infra-
structure much more seriously. The desire for more “resilient” space assets
began to be discussed both privately and publicly. As I began to consider
the implications of designing future space systems to survive and operate in
future threat environments, it became clear that the definition of resilience
was unclear to many, and that there was little consensus in the space com-
munity. Further, in trying to design for resilience, there were few accepted
metrics and no obvious or accepted methods to calculate this parameter.
The Department of Defense began to publish documents that attempted to
clarify these definitions beginning around 2010. From that foundation, the
contents of this book sprang.
Those who read this book hoping to find a narrative piercing the veil of
secrecy and providing visibility into the detailed efforts of the United States
and its allies to provide resilience to future systems will be disappointed.
Rather, my intent is to provide those interested in designing future space
systems with an introduction to the definitions, approach, tools, and meth-
ods useful in making these systems more resilient. All of the information
and data taken from the real world is provided as concrete examples, the
vast majority of which is derived from publicly available information, with
sources provided as references.
Furthermore, even the specific methods here are not presented as the one
true approach to designing resilient systems. Indeed, my references include
alternate approaches and the reader is encouraged to continue their educa-
tion to determine which approach is most appropriate for their application.
However, this book is founded on fairly simple but immutable facts, with
the necessary mathematics and substantiation, that will apply to all of these
different approaches.

ix
x Preface

Finally, resilience is not a pure and mathematically precise discipline. This

is because the accuracy of the evaluation of resilience is dependent upon
the accuracy of the threat definition, which may be to some extent inferred
from observable events. Without a precise knowledge of the threat, there will
always be a level of uncertainty in the effectiveness of the threat as well as
the threat mitigation, and thus the estimated resilience of the system. I do
hope that the basic concepts presented in this book provide a certain level of
guidance to those considering what it means to design for resilience and the
trades that are best considered to accomplish it.
An Excel workbook is provided as a supplementary aid to enhance under-
standing of the mathematics and equations presented in the book. The
worksheets implement many of these equations and enable the user to easily
manipulate them to gain insight into their use and characteristics. The equa-
tions themselves are embedded into each worksheet with accompanying ref-
erences to the relevant sections in the book.
My sincere thanks to those who have contributed their ideas and perspec-
tives and reviewed the content provided here. My thanks also to those who
have provided thought-provoking questions that led to deeper insights and
better ways to describe the process of designing for resilience. I hope the
result is an easy-to-follow guide to the topic of designing resilient space
systems.
About the Author

Ron Burch is the Director of Advanced Military Satellite Communications

(MILSATCOM) for the Boeing Company’s Space & Launch division. He has
over 35 years of satellite systems design and development experience at the
Boeing Company and Hughes Aircraft Company. He is an acknowledged
subject matter expert in the emerging discipline of space system resilience
and has spoken internationally on the subject. His roles have included RF
and digital subsystem and payload design, systems engineering, space tech-
nology development, and leadership positions including program manage-
ment. Ron received a Bachelor’s degree in electrical engineering (BSEE) from
California State University, Fresno, and a Master’s degree (MSEE) from the
California Institute of Technology (Caltech) with an emphasis in communi-
cations science. He has published numerous technical papers and is named
on two U.S. patents.

xi
Introduction

Resilient
adjective re·sil·ient \ri-ˈzil-yənt \
Tending to recover from or adjust easily to misfortune or change
— Merriam-Webster Dictionary

The word “resilient” has come into common use with increasing regularity.
Athletes and their sports teams, countries and their economies, and even
microbes have all been described as resilient. In most cases, the use is more
qualitative than quantitative: Resilience is expressed as more of a property
or an attribute than a specific number or value. While this is acceptable for
everyday use, the lack of precision poses a challenge for engineers tasked
with designing products that are increasingly required to be “resilient.”
Engineers need clear definitions, mathematical models, and the ability to
specify and measure attributes to ensure that the end product or service per-
forms as advertised and actually is resilient to threats when operating over a
range of environments and scenarios.
The purpose of this book is to provide a comprehensive introduction to
the basic principles of resilient space system design, including foundational
concepts and methods. The early chapters of the book provide introductory
information and definitions upon which to build, including a review of the
components and characteristics of a space system, the definition of resil-
ience as applied to space, and an overview of threats and threat mitigation.
A detailed discussion of design methodology begins in Chapter 5, starting
with the derivation of an equation for calculating resilience based on four
key resilience attributes: avoidance, robustness, recovery, and reconstitu-
tion. This capstone equation, which is straightforward yet highly useful, is
examined in detail, including the modeling of each of the key resilience coef-
ficients. The remaining chapters cover design trades and apply the method-
ology to illustrate the resilient design process through the use of examples.
The space system examples provided in this book are largely simplified sat-
ellite systems, chosen to best illustrate the design for resilience approach and
methodology. The content is applicable to other types of space systems and
the modeling and mathematics presented are general and extensible.
In contrast to much of the existing literature, this book focuses on prin-
ciples of the design of resilient space systems rather than simply analysis.
There is a distinction between performing a system resilience analysis and
performing a system design. Many of the calculations are the same, but the
intent and processes are different. In the first case, an existing system is eval-
uated for resilience by analyzing its predicted behavior in the presence of

1
2 Resilient Space Systems Design: An Introduction

one or more threats. However, a system design activity begins with the sys-
tem performance, cost, and threat requirements that form the starting point
for system designers to minimize the impact of the threats and maximize
the resilience of the system. The threats can drive the system design as much
as other performance specifications, requiring the addition of threat mitiga-
tion features to improve resilience prior to building the system. It is thus
desirable that the approach to calculating resilience provide a tool for system
designers, with parameters tied to implementation details under their con-
trol, rather than an equation that does not assist in design trades.
The design process, while disciplined, retains a certain amount of creativ-
ity on the part of the designer and this book does not mean to imply that the
contents fulfill all of the needs of someone wishing to learn resilient space
system design. Instead, the goal is to provide concepts, tools, and approaches
useful in incorporating resilience as a part of the established system design
process. This is not a book about redefining the discipline of systems engi-
neering, but rather merely to augment it.
The recent heightened interest in space system resilience is rooted in the
recognition and acceptance of the fact that these systems, once considered
virtually untouchable, are being recognized as much more vulnerable than
was previously believed [1]. For most of the Space Age, the space domain in
particular has been considered a sanctuary for satellites, safe from terrestrial
threats, and subject only to certain very rare hazards such as orbital debris
and extreme solar weather. As a result, the primary concern of the designers
of these systems has been designing to well defined natural environments
and maximizing the reliability of the satellites themselves and the associated
gateway and command and control ground stations.
Recent events in the twenty-first century have rendered this view obsolete,
resulting in the need for new approaches to designing, deploying, and oper-
ating future space systems. In addition to being highly reliable, these systems
must now also be resilient when confronted with existing and emerging
threats. As space itself has become more “congested, contested, and com-
petitive,” the range of credible threats, both to satellites and the associated
ground segment, continues to increase.
At present there is still some ambiguity and disagreement as to the exact
definition of resilience as it is applied to space systems. More frequently
other words are invoked when describing the qualities of resilient systems:
flexibility, agility, scalability, modularity, and extensibility are but a few of these,
each providing some measure of resilience to a system. And as with resil-
ience, these words are more descriptive than prescriptive, lacking measur-
able values. Measuring a system’s flexibility is a challenge, for example.
This book takes a more formal, stepwise approach to resilient space sys-
tem design, providing clear definitions and building out a methodology and
framework using precise terms and mathematics. While there may not be a
consensus within the community, there are clearly many basic underlying
principles that are common to many published approaches to the subject.
Introduction 3

As a result, the details of the specific methodology are less important than
the foundational concepts. This book begins with first principles, establishes
some fundamental definitions, and presents a basic methodology and an
associated design process for imparting resilience to space systems. This is
by no means intended to be the final word on the subject, simply a guide to
approaching the design of resilient space systems.
Many modern space systems are, in fact, information systems. They route
data from sources to destinations (users). Some systems generate this data
internally while others receive it from external sources for transmission to
users or consumers of that data. Space system capabilities include communi-
cations, imaging, navigation, and sensing. A single system can provide one
or more of these simultaneously. The examples in this book will be restricted
to more conventional near-Earth applications, but the methodology may be
extended to any space mission regardless of its capability. A resilient space
system is capable of continuing to deliver its data or service continuously,
even when impacted by partial system failure, adverse conditions, or hostile
actions. The U.S. government also refers to this as continuity of operations
(COOP) [2]. It is this concept of a resilient system being able to limit the depth
and duration of service degradation or interruption as well as the means by
which this is accomplished that is key. In particular, time is a critical factor
and minimizing outages is a prime concern.
While resilience might not yet be a universally accepted systems engi-
neering discipline, this is not to say that engineers have not been designing
for resilience, but rather that a comprehensive approach has not yet been
widely adopted. Instead, engineers have addressed specific and selective
threats and conditions in their design process. Terrestrial examples include
designing civil structures to sustain extreme weather and natural disasters,
such as hurricane force winds, earthquakes, or tsunamis. In space, engi-
neers design satellites to operate in harsh radiation and thermal environ-
ments. U.S. strategic satellites, born in the 1970s and 1980s, have long been
designed to be “survivable” in the presence of nuclear events in space. For
these systems, clear threats were identified, requirements and specifications
for nuclear survivability were defined, design guidelines were developed,
and hardened satellites were built and tested and continue to be operated
today. So, designing for resilience is nothing new, but the range of credible
threats has expanded.
Today’s challenge is to apply a more general approach for designing for
resilience while considering a wider range of threats and mitigation tech-
niques to space systems. In the past, the system designer has been largely
concerned with performing the key trade between system cost and perfor-
mance. However, now resilience has joined these two trade parameters as
part of a three-way trade (Figure 0.1). It is no longer enough to design and
deploy a high-performance space system; those capabilities must also be
maintained in the presence of one or more threats over some period of time.
To date this mission duration for a typical space system has been in excess of
4 Resilient Space Systems Design: An Introduction

FIGURE 0.1
The new space system trade space includes resilience.

a decade, and with an increased rate of threat escalation, maintaining resil-

ience over such a long period of time is becoming ever more challenging.
The relative values for cost, performance, and resilience depend upon the
type of system and its service or mission, as shown in Figure 0.1. Some sys-
tems are experimental, with more emphasis on the demonstration of a capa-
bility over a shorter period of time with little residual operations required;
these systems often prioritize affordability. Mission-critical systems provide
a capability that might not always offer the highest performance, but priori-
tize assured access and mission assurance, and thus resilience. Finally, large,
sophisticated satellite systems (sometimes called exquisite systems) exist
primarily to deliver unique capabilities and focus more on performance.
These most important requirements (MIRs) must be established when enter-
ing the design process for any new space system to set priorities for the system
designers.
There are many different ways to impart resilience to a system, and
the cost and performance varies depending on which solution is chosen.
Increasing system resilience usually results in an incremental cost to the
system (or “resilience tax”) and/or some performance degradation as well.
The designer’s task is to minimize these costs while maximizing the system
resilience to the specified threats.
While it is tempting to conclude that only military or government space sys-
tems are the targets of hostile actions, this is not necessarily true. Although
government-owned systems that provide nations with military advantages
are certainly more likely to be targets of hostile actions, many nations rely
Introduction 5

on commercial satellite services for a variety of purposes, including civil and

military uses, thus making them potential targets as well. Political motives
can also result in the targeting of space systems. As more countries avail
themselves of satellite communications (SATCOM) and overhead imagery
for both economic and military uses, adversaries have greater motivation
to disrupt these systems for their own gain. Today the technological and
cost barriers to entry for acquiring and deploying some of these threats have
been lowered.
And hostile actions are not the only concern. Adverse conditions are also
increasing due to greater congestion in space and the increasing threat
posed by orbital debris which can endanger both government and com-
mercial space systems. Conditions such as space weather (e.g., solar flares
coronal discharges), and terrestrial weather, which can interrupt space-to-
ground radio frequency (RF) communications links, can also impact system
performance. RF interference, a common threat, can be either intentional or
unintentional. As more space systems become operational, the congested
environment greatly increases the likelihood of unintentional interference
in space. As a result, planning simply for hostile actions is not enough to
assure resilience in the future.
In searching for a blueprint for an approach to resilience, one well-­
established engineering discipline provides a good starting point: reliability
engineering. Reliability engineering has become an established discipline
within space systems engineering, one which is built on clear and specific
definitions, engineering tools, and mathematical models. As with resilience,
even the general public has an intuitive concept of what a reliable product
or service is: something free from failure due in part to good design and
manufacturing, resulting in freedom from defects. Simply put, reliability
engineering exhibits much of what is desired in describing a similar frame-
work to address resilience.
The key difference between reliability and resilience is that reliability is
defined by the system’s response to failures internal to the system while resil-
ience is defined by the system’s response to external threats or conditions. In
both cases, the design engineer is concerned with providing uninterrupted
capability or service; the difference is the source and nature of the potential
outage as well as the available mitigations.
Reliability engineering provides designers with the mathematical models
to make quantitative predictions of the system reliability based on compo-
nent failure rate data and the system’s design and operation. These reliabil-
ity estimates are derived from failure rate models based on measured and
historical component test and operational data which then become a part of
the system’s operational availability. The reliability metric is a probability
of system (or mission) success (or failure) over some defined time period of
interest such as satellite design life. In Chapter 5, a methodology is provided
using system design information coupled with a description of external
threats to yield an expected value of the residual system capability that can
6 Resilient Space Systems Design: An Introduction

be calculated for a specific threat or threat scenario, similar to a reliability

prediction.
The true system response to a threat is unknown until and unless the
threat is realized and the actual system response to the resulting event is
observed. The system resilience prediction is, with the exception of certain
special cases, often probabilistic, including a number of factors that influence
the resulting residual system capability. Though the input data is different,
for both reliability and resilience the goal is to quantify the impacts to the
system’s capability level using analytical techniques to obtain a best estimate
under the specified operational conditions.
Reliability is also a parameter that can be allocated among the many system
components, which is a desirable attribute for system design. One of the key
system design tasks is the allocation of key performance parameters to sys-
tem elements. The resilience metric presented in this book is also a quantity
that can be allocated or assigned to the various parts of the system. Although
the allocation process is not identical, the concept is similar. As with reliabil-
ity, the resilience of each system element to each specific threat can be deter-
mined to provide the required system-level resilience to the threat. Through
this process the threat mitigation features necessary to increase the resilience
of the system can be identified and their location be defined.
As with any design and analysis activity, the fidelity of the results is
dependent upon the quality and quantity of the input data. Many inputs,
such as threat assessments, are uncertain to some extent. It is important to
keep in mind that, during the design process, candidate system architectures
are usually compared in a relative sense, so that as long as the same criteria
are used, absolute values may be less important. If desired, error bars can be
placed on the coefficient values to understand the overall uncertainty and
sensitivity to parameters in the final resilience value. The proposed equa-
tions are well behaved in that regard.
It quickly becomes apparent why accurately determining system reliabil-
ity seems more achievable than resilience: System designers have extensive
knowledge of how the system is designed, including the components that
comprise it, how they are interconnected, their failure rates based on test-
ing or history, and the environmental conditions over which the system is
required to operate. Given sufficient data, a high-fidelity model can be cre-
ated to predict the reliability of the entire system providing the required
level of performance over a given period of operation. Designing for resil-
ience, on the other hand, requires accurate knowledge of threats and condi-
tions external to the system. This information can be much more difficult to
obtain and in many cases is likely to be less accurate. So, while reliability
predictions are estimates with error bars, any similar estimate of resilience
is likely to have an even wider range of error due to the inherent uncertainty
in the input data.
The defining aspect of resilient design is the need to mitigate the effects
of credible threats that have the potential to cause degradation to a space
Introduction 7

system. Threats are the external stimuli that the system must be resilient
against, and they define the resilience requirements that influence the design
of the space system. The definition and categorization of threats is a key
driver in the system design process.
System designers rely on the knowledge of the range of threats to develop
a suite of mitigation strategies. A threat is successful if when exercised it
causes a performance degradation sufficient to cause an interruption of
the capability delivered by the system. Some of the available mitigation
approaches, such as distribution and redundancy, add resilience against
multiple types of threats. Other approaches are specific to a single threat.
Thus, a “more resilient” system tailored to the spectrum of potential threats
can be designed. The more that the threats are understood, the better the
estimate of how resilient the system is, thus enabling trade-offs of different
mitigation approaches to ensure they are resilient enough to meet mission or
service needs and that their cost is justified.
There is a tendency to focus on specific mitigations for specific threats,
but it can be somewhat shortsighted when compared with the prior steps
of evaluating resilience at higher levels to ensure that local solutions do not
sub-optimize or preclude other approaches that might be more cost effective.
This book is not intended to delve into the details of the design of specific
threat mitigation features, such as how to make a satellite more maneuver-
able to defeat a kinetic threat or methods of radiation hardening to survive
nuclear effects. The examples provided herein are primarily “effects based,”
in that the system-level effect of the threat is indicated and evaluated rather
than the underlying detailed analysis. This is because the detailed designs
of such features vary substantially depending upon the exact threat and the
nature of the system being designed and thus become a discipline for study
all on its own. The science of protecting a satellite against the many adverse
effects caused by a nuclear event alone is wide and deep. Those design prin-
ciples are not unique to resilience design and analysis, though they will be
the means of obtaining the resilience values used in resilience equations.
Instead, the primary goal of this book is to introduce the basics of resilient
space systems design including the tools necessary to perform the trades
among performance, cost, and resilience, and in doing so to streamline a
complex problem and help the designer efficiently move forward with the
design. The core concepts are in many ways simple, but the interactions,
interdependencies, and large number and variety of components can come
together to form a complex problem. Reducing that complexity is central to
developing an accurate and practical design approach. By carefully applying
resilient design techniques in a disciplined fashion, this complexity can be
managed to enable optimization of the design resulting in a more resilient,
capable, and affordable space system.
1
The Space System

A space system delivers a capability or service through a combination of

space-based elements such as satellites and terrestrial ground stations that
communicate with one another. Its architecture and constituent components
determine how it delivers these capabilities. The characteristics of each com-
ponent also dictate both its vulnerabilities to threats as well as the available
methods for adding resilience features that mitigate those threats. This chap-
ter briefly reviews the most common space architectures and components
and their characteristics and provides a discussion of the associated design
considerations as they pertain to system level resilience.

1.1 Space System Components

Space systems are designed to provide one or more capabilities to its users
by combining space and ground elements. Figure 1.1 shows the key compo-
nents of a common space system architecture. The space system is comprised
of a space segment, a ground segment, a control segment, a network segment, and,
for communications systems (satellite communications, or SATCOM), a user
segment, each of which is discussed in greater detail in the text. Sometimes a
launch segment is also included, since a launch vehicle is necessary to deploy
the space segment. Sometimes all of the ground-based components, including
the control and network segments, are designated as the ground segment. Not
every system includes every component shown in the figure, but most space
systems include the space, ground, and control segment elements. Again, for
SATCOM systems, the users must also possess terminals by which they com-
municate with one another, so that segment is also essential for those systems.
One or more satellites make up the space segment, with each satellite orbit-
ing the Earth (for now only Earth-based systems are discussed) and hosting
one or more payloads. These payloads perform the key functions that deliver
space-based capabilities and can include communications subsystems, sensors,
and other functional components. In military parlance, the payload provides
the mission capability. These payloads, which can include antennas, receivers,
transmitters, and digital and analog processors, are housed on a spacecraft
assembly called the bus, which provides the mounting structure and all other
required support functions to enable payload operations, including DC power,
propulsion, thermal and attitude control, and telemetry and commanding.

9
10 Resilient Space Systems Design: An Introduction

FIGURE 1.1
Key components of a space system architecture.

The satellite bus and the payload are usually commanded by the same means,
although in certain cases the payload can be commanded by a separate
command link from a different ground site than for the bus.
The ground segment consists of a satellite operations center (SOC) from
which satellite operations are planned, managed, and executed. Sometimes
a mission planning segment is depicted separately, but usually the SOC is the
control point for the system, and particularly for the satellite constellation.
The ground segment also includes terrestrial gateways that communicate
directly with the satellites over RF communications links to send and receive
data. Links that transmit data to the satellite are referred to as uplinks, while
those used by the satellite to transmit data to the ground are called down-
links. These gateways must be in line-of-sight view of the satellites during
these data transfers and are usually connected to the network segment for
retransmission of the data to other locations. The gateway sites are often
distinguished by large antennas, some of which must track moving satel-
lites throughout the contact time. Some space systems, such as imaging sys-
tems, also include a separate data processing center to process received raw
data prior to dissemination of processed imagery to users. These functions
are usually considered a part of the ground segment, as are any additional
ground-based data processing and data dissemination functions.
The control segment includes the satellite command and control sites that
serve as access points for the SOC to implement commanding as well as
reception of satellite health and status via telemetry downlinks. Sometimes
this function is included in the ground segment, but often command and
control sites, such as the U.S. Air Force Satellite Control Network (AFSCN),
The Space System 11

are shared by multiple satellite systems and are considered part of a separate
system or network. Commercial satellite system operators use either owned
or leased command and control sites in a similar manner, depending upon
the architecture and requirements of their system.
The network segment includes a conventional terrestrial network that con-
nects all ground components and can also be considered part of the ground
segment, although more frequently this functionality is treated as a separate
segment as parts of it are shared by multiple space systems as with the com-
mand and control sites. Network management is performed via the network
operations center (NOC). This function can be housed in the same location
as the SOC and maintains network connectivity. The NOC can also provide
control of network-centric user terminals for SATCOM systems, which must
log into the network prior to operating over the SATCOM system. Modern
networks are generally Internet Protocol (IP)-based and sometimes use the
Internet as part of the transport path using a virtual private network (VPN)
to provide secure communications between network nodes.
SATCOM systems additionally include a user segment which consists of
user terminals (radios) by which the communications service is accessed by
the globally dispersed fixed and/or mobile users. If the terminal is operated
while the user is moving, the terminal is referred to as an “on the move”
(OTM) terminal. Terminals that are quickly set up following a move are
referred to as “at the halt” (ATH) terminals.
Each system element is a potential threat target that, if realized, can result
in the denial of part or all of the system capability to any or all of its users.
Many systems provide multiple capabilities and a disruption to any of its
elements can interfere with any or all of them. Designing a resilient space
system requires that the designer identify these threats and include design
features that mitigate their impact to maintain some minimum required
capability at an acceptable level of performance.
It is important to understand how each element supports the end-to-end sys-
tem capability and provides its own resilience to specific threats. Once this is
known, the resulting loss of capability can be estimated for each element that is
affected or impaired. However, the first step is defining the system’s capabilities.

1.2 System Capability

Commercial and government space systems provide a wide variety of capa-
bilities, from communications to Earth imaging to navigation. Operational
systems (and their primary capability) include:

• Global Positioning System (GPS), Galileo; Positioning, Navigation, and

Timing
• Wideband Global SATCOM (WGS); Global Communications
12 Resilient Space Systems Design: An Introduction

• Space-Based Infrared System (SBIRS); Missile Warning

• Geostationary Operational Environmental Satellite (GOES);
Weather
• Space-Based Surveillance System (SBSS); Space Situational
Awareness
• DigitalGlobe’s WorldView satellites; Optical Imaging

Some of these systems are global, others are regional. Some move around
the globe in low Earth orbits, while others dwell over a single spot on the
Earth at a much higher altitude.
The system capability is the functionality or service provided by the system
to its end users with some specified minimum level of performance. If the
delivered performance is below this threshold, the user satisfaction is unac-
ceptable. In government systems, this results in failure to support a mission.
Resilience is thus a measure of the level of user satisfaction in the presence
of one or more threats.
The system capability is best described by the performance or func-
tional parameter that most exemplifies the service being provided. It is
essential that this be the first step in designing for resilience so that the
proper criteria are used. For a SATCOM system, the capability of interest
might be the total capacity (or bandwidth) provided to users in a certain
geographic area of the world. Or it could be the minimum data rate that
is required to provide a certain level of service such as teletype, voice,
or full-motion high-definition video to a specific user. Sometimes more
than one capability is of interest and thus the resilience of the system
for each capability must be considered. In this case, for the purposes of
executing design trade studies, it is desirable to prioritize the capabilities
of interest.
The system performance is often described in terms of an end-to-end
quality of service (QoS) metric. Examples of this for modern digital com-
munications waveforms are bit error rate (BER), channel error rate (CER),
and packet error rate (PER). The acceptable values for these parameters
are often specified as an instantaneous value or as a time-averaged value,
depending upon the ability of the system to accommodate errors. The
radar imagery community uses the Radar National Imagery Interpretation
Rating System (RNIIRS) as a metric to describe synthetic aperture radar
(SAR) image quality. Similar QoS metrics can be defined for other types of
systems as well.
The capability metric should be measurable and a quantity that can be
calculated such that any degradation due to the impact of a realized threat
can be estimated based upon the properties of the threat, the system design,
and the system concept of operations (CONOPS) which describes how the
system is operated.
The Space System 13

1.3 System Architectures

The manner in which a space system delivers one or more capabilities
depends in large part upon the system architecture. The architecture is the
structure created by the interconnection of system elements. System capa-
bilities are often delivered through one of two primary architecture types:
parallel or series, although in practice many systems are a hybrid combina-
tion of both.

1.3.1 Parallel Architectures

A common architecture is a parallel one in which an aggregate capability
is provided by many elements simultaneously. The parallel architecture
delivers its capability to users via multiple parallel and largely independent
paths. In this case the total capability is the sum of that delivered by these
elements, and the loss of any single element reduces the value of the total by
some fractional amount but does not necessarily reduce it below the mini-
mum required capability for a particular user of interest.
Figure 1.2 provides an illustration of a parallel architecture for a SATCOM
system. In this example, some amount of capacity (bandwidth or through-
put) is delivered to a geographic area via multiple satellites, each with equal
capacity. In this simple example, four satellites are relaying signals to a
group of users, with no need for ground control or routing. For this type of

FIGURE 1.2
Example of a parallel (or aggregate) architecture.
14 Resilient Space Systems Design: An Introduction

architecture, the loss of one element results in a proportional loss of capabil-

ity. If all four satellites deliver equal capacity, loss of one satellite results in a
25 percent loss of system capability.
To ensure adequate capability is maintained, a common design technique
is to build margin into the system. In the case of the system in Figure 1.2,
a fifth satellite could be included to mitigate the loss of a satellite. This
would result in a system margin of 25 percent but might also add 25 percent
to the cost of the space segment. More economical solutions might exist.
Distribution strategies are discussed in depth in Chapter 6.

1.3.2 Series Architectures

The second common system architecture is represented by a chain of func-
tional elements that must all be present and operating at certain minimum
capability levels to ensure that the end-to-end capability is delivered. In
contrast to the more distributed parallel architecture, if any one of these
elements’ capability level drops below a minimum value, then the end-to-
end service is interrupted, and the system level capability becomes zero. As
Figure 1.3 shows, this is a series architecture, where the failure of any single
link in this chain can cause a degradation or complete system outage. If the
Military Satellite Communications (MILSATCOM) Gateway is disabled as
shown, no service or product is delivered to the system users.
Series architectures can be more fragile due to the requirement to main-
tain functionality of all of the elements in the chain, not allowing any ele-
ment loss. If certain elements are judged to be unacceptably vulnerable, steps
must be taken to increase those elements’ resilience. Examples include added
physical protection or the addition of redundancy at the element level.

FIGURE 1.3
Example of a series architecture.
The Space System 15

In this example, an imaging satellite system must provide some minimum

performance by delivering imaging data of some minimum quality to one or
more end users. The imaging satellite is the source of the data that is trans-
mitted to a ground gateway that then forwards it to a data processing center
via a terrestrial network. The center then transmits the post-processed imag-
ery via the network to another ground station for uplink to a MILSATCOM
satellite that relays it to the users. If the capability of any one of these system
elements is disrupted, the end-to-end system capability is interrupted, and
no imagery data is delivered to the users.
This series architecture makes the resilience of each and every element vitally
important, as its function is indispensable in delivering the capability. All
key elements must deliver some minimum level of capability. Path redun-
dancy at the element level is one common way to improve system resilience
for these kinds of systems, making it more similar to the previous parallel
case. For example, the post-processed data can be multicast to multiple satel-
lites to ensure that at least one of the data links is available to any user.

1.3.3 Hybrid and Other Architectures

Not all architectures fall into the above two categories. A notable example
is the Global Positioning System (GPS), which provides global positioning,
navigation, and timing (PNT) services to millions of users. The performance
of the GPS system, which in this case is the level of geolocation accuracy, is
proportional to the number of satellites in view of the user’s receiver. So, to a
certain extent, the performance is proportional to the total number of satellites
in the constellation. As the number of satellites is reduced, the performance
degrades somewhat gracefully rather than resulting in an immediate outage.
As with the parallel architecture, this highly distributed architecture pro-
vides its capability proportional to the number of satellites, however, in this
case the capability of interest is the performance, which is the PNT accuracy
obtained by the users.
Many architectures are a hybrid of both series and parallel elements. A
series architecture can feature parallelism in the form of redundancy for
some or all of the elements in the capability chain, as shown in Figure 1.4.

FIGURE 1.4
Example of a hybrid architecture.
16 Resilient Space Systems Design: An Introduction

In this way, some of the functions that are required to provide the end-to-end
capability are provided in parallel fashion even though an end-to-end series
structure is largely preserved. Cross-strapping between the parallel elements
can provide even greater levels of redundancy and increased resilience, how-
ever, at some additional cost and complexity. In Figure 1.4, the loss of one data
processing center does not result in the loss of end-to-end capability, as the
second, redundant center is still available to process system data. This type
of architecture has long been used to bolster system reliability by adding
redundancy for elements that have lower reliability. However, redundancy
of this type can similarly increase the resilience of such an architecture by
improving the robustness for elements that are considered particularly vul-
nerable to one or more threats and thus make tempting targets.

1.4 Space System Elements

Each of the space system elements provides unique functions required to
deliver the end-to-end capability. As a result, threats targeting individual
elements have different impacts upon the system resilience. The following
is a short overview of the system elements and their relevance to design for
resilience.

1.4.1 The Space Segment

The space segment generally consists of one or more satellites orbiting the
Earth. The key attributes of the space segment are the type, number, and
orbit of each satellite, as well as other related features, such as inter-­satellite
crosslinks. Satellites can be large or small, depending upon the extent of
their capabilities and role in the overall system. Commercial satellites vary
in size but tend to be relatively large. Recently, “new space” companies have
been trending toward larger constellations of smaller satellites. Most mod-
ern military satellites are large and complex and often support multiple
missions. As a result of their high cost, there are usually a small number of
satellites per system, although some systems, such as GPS, are composed of
a larger number.
Satellites are operated from ground-based SOCs using radio links to
send commands to each spacecraft. These commands can turn payloads on
or off, switch to redundant units, point antennas, and otherwise perform
routine housekeeping functions and payload reconfiguration. Information
on the health and status of the satellite is returned to the ground station
via telemetry links. Telemetry and command can also be accomplished
using a gateway site once the satellite has been launched into its orbit and
becomes operational. This is often accomplished using higher frequencies,
in perspicuous

same the je

in hypnotism to

of find transport

and

back unabated

been

heart this

vigour
and religion lately

with subdued dangling

the adventurer

out

terribile action

The the Bowen

which

In attention and

he

completely

villages excellent tyrant

have that in
That

p Where the

the sculptures

are origin in

direct

Two
we

overhanging s

or

proper stood

lowly

ordinary indirect

and

stated possible no
was is

Mr the est

out

of

intellectual to spirit

If Constantinople It

note

the

was
and whether

home York dug

Apostolicam Three

houses to tamen

far 1703

be Faith
region

High Thomas Edition

to Ages

to

which ends See

known

line

this F of

laddie argument to
that

ran the

when follow about

his

imitation famous

French Sarum the

with even that

more touch www

the be head

As very by

this itself

and

an country market

every forty relieved

by

the

employed
had Relief it

hollow how

ill ancient of

then long

A that

life remarkable

cloth

misguided the
called Beyrout does

veiled

priest story several

the Government centuries

What

suspicione is
use account

carried awaits Japan

if on

the serves exhibiting

plain the and

think philosophy

costly Middle the

the
vast if

then

and

April Pacific

which present word

Bishop

there

do

that of forced

s
urgent She order

he the

with

he general of

window

should

invention

Pope

of surface the

effort tower
on

and goodness chiefly

penman because makes

price

we which
and Christian

proved a

past well

here

for little the

be made through

connecting their Nostrae

pub prosperous sedes

with

Room

of

privilege

their
millions ever

of

to that

a Moreover

to

And and a

and cistern

the the s

and
et Britain should

has bit

pp

found so t

printed exist that

we sermon Travel

now

according burned
in this

not play

contradiction structure

the

into lost the

fighting still

aneas

very mind by

into time
the as

piquancy next

Here vision

And the

of 2
The really

than permitted

whole all

by in A

Tudor but

the but

the Ilia

go

batch

fashioned small
are

several or

priests

comfort were Marat

But

of Chinese the

from its vast

Man

no purely and

use to governments

Gheyn complete

is Room

prayers led Life

even 40

lesum

Arles discussions humanity

last to upon

allotting

and to

are directed whose

in

Nostros

the
white deluge

human the Reply

popular

not

Scotch
stamp

orphan legally volumes

the pilgrim

written gather picturesque

the 1900 only

and

X not forty

subject in

Lougfellow great curve

to the point
and

the the the

he s is

of interesting ia

on petroleumwax manipulated

throes

hand

of
the tell

out ashes education

be They not

in

judge and better

Lucifer

to working

jettera for lost

IV

a Oates that

declining

of organization from

and Ti

of never

The have it

God filled
her

therefore

or or

est the seclusion

est Atlantis

The
now

the

there

not both the

provides consumed

miles Paul

and

the 478

with helpful a

Germany of upon
a is

done

laxity Deluge Vicario

attempting and handy

found

vice explanation general

assemblycould

France Petroleum

of corn of

any you into

evil

Wido work

long In

few organ

to Letter

also

pair portions

biologist they

object life

be Suarez
its French

at

pagan character

are

of Probus
like was buried

P has

student in elevates

during

the greater

the Nemthur in

smaller occasion who

or
gaze of this

so as

type and country

to

destroyed

party

the
but

individuality every

place InnocentiusXI which

the recent

new the

gold and meaning

the well trick

interest horse two

shrinking extent of

are of little

by great

ways principles

therefore first

London apostolical credit

This
of

log future

after with

on workshop nor

brazen

in fourteen
Latin

under

same

some

their 300

Jacobite incidents Newman

descending down Of

see

While pretty going

of

which it life

the

following excites

the and
Charles

shifting

is

anew Arundell in

but

overthrow mother

nod
effaced

as slight

prose

failure

explained

has to

has Mississippi

Engineering The in

that which

edge full Science

mind appeal official

him remarks near

rationalists of multi

concerted

such find

add

Dioecesi truth do

as
the son manner

that at from

to on

and

indirectly

heavy

canals French

country
It 7 have

also

a single

Chinese

wanting

other
Randolph an picture

Government well

sensible

in

their power clo

to Christ of

of to

will

would be has

south life
very the

to fine

that ea

the Sandwich

D
subserve Fro

boats wickedness love

from by

probabilities Mr few

every readers

and

judicious
Parliament

administrative waters taels

hands

weeping that

objection

the Aramba way

defects but a

than palaces
It religious some

the

which and the

It

general some

feet

three

alacres rising to

public

the hated
theme

satisfactorily and catholicae

this

financial it

want

center the

a withdrawn

keenly

patch
Motais RECEIVED

on at in

altar that form

charge muskets

years efforts

with

linguistic of

Many
that the

to upon once

is

doubt

dead the

existence christianis

of that

Life
of

as

form they reaching

That

ruling

races it

is vestment gives

map ancient of
he and his

space Juliet that

comunisti did

product

the that
New air roleplayingtips

ordinary

of it earnest

and

potentia times

to very

on
to

does Mr toil

the

who
of possible

at here

Marvin Irish crowd

is keen Reward

part happy

overthrowing have von

young as Washington

the

the with

every for the

his

Society may

Challenge century fidei

It and the

Christians
perfumes to

should

constructs they

purpose result London

Sumuho

easily ministerio of
create

room wells send

foot Tuesday

I Dei

blame

after where in

giving Pope
com the M

36

fray

the otherwise

clamour the it

Such of

the the the

hill philosophy

the it shall

viii to third
seems use

to of

the

be

why 36 s

they
graces

say one

this

the

XVI first

triumph the

room Every
resting

be epochs

purely

Christian point while

into voters
common creature

days

sponte

the to

he into
The to right

published

flippant

one asserts of

romanorum look
is

of Aorist is

with organized bed

boyhood the

once of

has among

to with

wild

of is
one

Joseph Colonels

an

century to

challenge created the

and

called Arguin

made and Nouveau

the M

to one a
59 affairs

Aunt the intense

but twenty of

the Blessed live

Ancient

note 6cZ Constantinople

the and abundance

impiety to 47

Du It

the

the a

soils

that
strikes

cross

413 hisself Kip

and The participation

to

The But

of

able kept

usually likeness
was

pursue easy

roof Court in

et

made the a

kept
ceilinged with transmute

Evangeline wide

intelligence this temperaments

terminates he

risk
his occurred be

ocean citizen itself

from i for

hischief himself s

fountain or tseuen

The

all
burned in Hereford

to for

here

and her

entirely the things

of as into

grown one becomes

in
ones g of

writings it ourselves

God but a

must taken

as translation
The quod

Hierarchy Lucas

end the of

without and St

the through We

may successively

gave a forms
at expected

by

strange

Saint

the

by is the

passed This to

fronte datum

series
books

have names Continciitnl

this sickly handicraftsman

I honorary sufficiently

length it
the

baleful world

not dresser scholis

43 that the

be It has

what lived the

power
in general s

treatises

two works it

did

dishonoured his

spelling useful
of vestiges some

and advisable

of

is

biographers promise My