Maintenance and Recycling in Space: Functional Dependency Analysis of On-Orbit Servicing Satellites Team for Modular Spacecraft

Transcription

1 AIAA SPACE 2013 Conference and Exposition September 10-12, 2013, San Diego, CA AIAA Maintenance and Recycling in Space: Functional Dependency Analysis of On-Orbit Servicing Satellites Team for Modular Spacecraft Cesare Guariniello * and Daniel A. DeLaurentis School of Aeronautics and Astronautics, Purdue University, West Lafayette, IN, Downloaded by Cesare Guariniello on October 16, DOI: / This paper introduces an innovative perspective in the problem of on-orbit servicing and maintenance. A network of modular satellites and servicing satellites is modeled as a two-level System-of-Systems. At the lower level, the architecture of the modular satellites is analyzed in terms of functional interdepencies between the component modules. Analysis of the impact of such interdependencies gives insight into the operability of the satellite, and accounts for partial failures, redundancies, and criticality of the modules. At the higher level, communication, observation, and experimental satellites and constellation are constituents of a System-of-Systems functional network. The other components of this network are servicing satellites, able to perform inspection, refueling, maintenance. At this level, results from the overall functional dependency analysis are used to evaluate and compare different architectures, i.e. different number, capabilities, and location of servicing satellites. We discuss the innovation brought by the proposed approach with respect to the current practice. A hypothetical scenario is considered, featuring satellites with different architectures, whose parts are susceptible to aging and to failures over time, and on-orbit servicing satellites. Results show not only the general applicability of the method in order to perform analysis, but also possible future applications of both the proposed concepts and the analytical tool in space systems architecture and design. Nomenclature COD ij = criticality of dependency between node i and node j COD_O j = part of the operability of node j depending on the criticality of all its dependencies COD_O ji = part of the operability of node j depending on the criticality of the dependencies from node j O i = operability of node i SE i = self-effectiveness of node i SOD ij = strength of dependency between node i and node j SOD_O j = part of the operability of node j depending on the strength of all its dependencies SOD_O ji = part of the operability of node j depending on the strength of the dependencies from node j I. Introduction n 1993, the concept of on-orbit servicing had its greatest and most famous exposure, when the first servicing I mission to the Hubble Space Telescope saved a project whose cost at the launch was 1.5 billion dollars. The error that could have been so expensive was due to an excessive flatness in the primary mirror surface of just 2.2 micrometers. Many other examples can be found that show the enormous complexity and vulnerability of space systems. In addition to cost, another worrisome issue can be alleviated by on-orbit servicing: currently, three thousands artificial satellites are still orbiting Earth, along with nineteen thousand pieces of space debris larger than 2 inches. Deorbiting maneuvers of satellites that reach their end-of-life are not always provided for, or cannot be executed due to failures. Furthermore, satellites may need simple servicing operations, like refueling, deployment of * Graduate Research Assistant, School of Aeronautics and Astronautics, Purdue University, 701 W Stadium Ave., West Lafayette, IN, 47907, AIAA Student Member. Associate Professor, School of Aeronautics and Astronautics, Purdue University, 701 W Stadium Ave., West Lafayette, IN, 47907, AIAA Associate Fellow. 1 Copyright 2013 by Cesare Guariniello and Daniel A. DeLaurentis. Published by the, Inc., with permission.

2 entangled structures, or recovery from failed orbit insertions. Therefore, on-orbit servicing is suitable to lengthen the life of old or disrupted satellites, as well as to reduce the production of more space debris. In 2011, the first commercial contract for on-orbit servicing was signed, but much more is needed to better exploit the huge potential of these activities. First of all, space operations are highly complex, and only a few autonomous on-orbit servicing missions have been proposed, validated, and executed. Then, purposely launching a spacecraft to perform maintenance on a satellite has a high cost, that could match the cost of assembling and launching a brand new satellite, instead of repairing it. This paper addresses both these issues, by analyzing the advantages of the proposed concepts with respect to the current practice. We begin by describing the idea of modular spacecraft, an architecture that helps to both increase the flexibility of the spacecraft and to facilitate on-orbit operations. In modular spacecraft, each module (performing a different function) is connected to the others only through simple interfaces, so that it can be rapidly and easily accessed and/or replaced even if belonging to the same structure as the other components. Then the paper introduces the concept of on-orbit servicing satellites team, that is a group of satellites able to perform inspection, refueling, maintenance. Such satellites, equipped with fuel and replacement modules, can perform more than one on-demand servicing operation, thus introducing flexibility. This flexibility results in lower cost than purpose-launched satellites. The entire architecture is characterized as a two-level System-of-Systems (SoS): the higher level is constituted by the servicing satellites, the modular satellites, and their operational interdependencies. The lower level describes the inner architecture of the modular satellites, i.e. the modules and their operational interdependencies. These satellites have their own objectives, and may be independent from the other satellites or may be part of a constellation, but we want to analyze the entire set of both modular and servicing satellites, that constitutes a SoS. A full definition and description of the concept of SoS lies outside the objective of this paper (basic principles of what constitutes a SoS can be found in ref. 1). A Functional Dependency Analysis technique analyzes the effects of interdependencies on operability over time, and identifies metrics to assess and measure the system value, like robustness, criticality, flexibility. Thanks to the System-of-Systems representation, the analysis is conducted at different levels: in the lower level, the functional dependencies between the component modules of a single satellite are accounted for. Degradation of the modules over time, as well as major disruptions, are then considered, and different architectures and patterns can be compared based on the cost and the level of partial operability still achievable after the disruptions. When the operability of a satellite is lower than a given threshold, maintenance can be requested. The global operability level is hence dependent not only on the operability of each satellite, but also on the architecture and the dependency features of the entire System-of-Systems (i.e., the possibility to obtain servicing). Analysis of the upper level is then performed, using the results from the lower level analysis, to evaluate and compare different architectures of the whole set. Therefore, the representation of the entire architecture as a System-of-Systems allows us to address the aforementioned issues, and to cope with the complexity of the systems at different levels, with both a top-down viewpoint (the goal of the entire collection of modular and servicing satellites is to increase the total operability and lifetime) and bottom-up considerations (the modules composing each system). The paper is organized as follows: in Section II, we describe the background of this research, and present a brief survey of current practice in on-orbit servicing, and space system architecture. Section III offers a description of the Functional Dependency Network Analysis (FDNA) method, used to analyze the on-orbit servicing SoS. In Section IV, we introduce the two-level architecture of this SoS, a few simplifying assumptions, and the modelization used in this study. Various results from the analysis of a case scenario, both at the lower level and at the global SoS level, are presented and discussed in Section V. Section VI reports the conclusions of this research, as well as a discussion of possible applications and future extensions of the concept. II. Background and Current Practice In 2010, NASA published a report about on-orbit satellite servicing operations (2). Such operations are the process of improving a space-based capability through a combination of on-orbit activities that may include inspection, rendezvous and docking, refueling, and value-added modifications to a satellite s position, orientation, and operational status (3). Historic surveys shows that many of the past satellite servicing missions have been based on the use of the Space Shuttle, and have been performed by astronauts. Later, automated servicing missions have been developed and tested: in 1997, the Japanese Agency for Space Development (NASDA) launched the Engineering Test Satellite VII (ETS-VII), an unmanned spacecraft that successfully performed rendezvous and Between MacDonald, Dettwiler and Associates, and Intelsat. The agreement was later withdrawn. 2 Copyright 2013 by Cesare Guariniello and Daniel A. DeLaurentis. Published by the, Inc., with permission.

3 docking with a non-cooperative target, Orbital Replacement Unit (ORU) exchange, deployment of space structures, capture of a target, and other robotic experiments (4). An entire decade elapsed before NASA, in 2007, launched the Orbital Express mission. In this experimentation, two satellites, ASTRO and NEXTSat performed robotic experiments similar to those executed by ETS-VII, but with increased complexity. In addition, the satellites successfully completed refueling, and orbit change maneuvers. Both these experiments, and most of the proposed concepts, are based on complex robotic operations, and the main focus is on the dynamics of the rendezvous, capture, and robotic arms in space (5-7). To deal with the complexity of on-orbit servicing, the experimental satellites were designed taking into account serviceability and ease of access of replaceable parts. For the same reason, and since complexity prevented the commercial development of on-orbit servicing, Neema et al. (8) proposed the concept of designing modular satellites with easily accessible and replaceable modules, to allow rejuvenation of satellites experiencing a failure, as a means to mitigate the issue of debris in space. NASA report also addressed two popular myths about on-orbit servicing. The first one is that Servicing is costly. Sullivan (9) studied economical feasibility of telerobotic on-orbit servicing, finding that on-orbit servicing is commercially valuable. Ref. 3 shows how new concepts of design, with less redundancy, result in cheaper satellite, and the increased risk of failure is mitigated by the possibility of receiving on-orbit servicing. This reduces the cost of satellites, and increases flexibility and reliability of the entire system. The other popular myth is that There is nothing to service, meaning that the prevailing assumption is that a satellite experiencing a malfunction cannot be repaired to recover operability. This consideration comes primarily from the current practice in satellite design, reliability, and risk management: failure of components is always considered absolute, without models for partial failures and partial operability loss, even when fault trees are used and the importance of components on the operability is quantified (10). In the past, some authors specified that their performability analysis, even if performed at the components level, and taking into account the interdependencies, was only applied to unrepairable system (11, 12). A similar approach is followed by Castet and Saleh (13), in their statistical data analysis of satellite reliability: this study addresses the criticality of components in terms of their impact on failure, but the failures are always absolute, and the interdependencies between components are not analyzed. Greenberg (14) added maintenance strategy to the simple reliability analysis: satellites have spare redundant parts that can be activated if needed, to maintain the desired level of operability. Also Tafazoli (15) studied on-orbit failures, and the impact of components on failures. In his recommendations, in addition to the usual testing and redundancy, he added flexibility as a factor to decrease the impact of failures. However, Sullivan (9, 16) followed a different approach from the current practice of just analyzing and increasing reliability: he studied failures of US satellites launched between 1984 and 2003, classified them in categories (launch failures, deployment failures, component failures, unknown failures), and determined the technical and economical feasibility of performing servicing of dysfunctional satellites. He also underlined that since a spacecraft is a complex coupled system, even a single malfunction can trigger cascading failures which may make the system nonoperational. Nai Fovino and Masera (17) extended this concept to System-of-Systems, emphasizing emergent disservices that can arise in complex systems, when a malfunction that is not critical for the system where it occurs, can have a significant impact on the overall operability. Mane et al. (18) analyze the impact of interdependencies on failure propagation through Markov networks. On the basis of these considerations, this paper addresses the problem of failures and on-orbit servicing in a complex System-of-Systems satellite networks. To address the gaps found in literature, the study will be based on the analysis of the impact of functional dependencies between subsystems and between systems, and will account for degradation and failures that cause only partial loss in operability. III. Functional Dependency Network Analysis (FDNA) Functional Dependency Network Analysis (FDNA) is the main tool used in this paper to study the effect on interdependencies between systems on the overall operability, when failures occur. The method was originally formulated by Garvey and Pinto (19, 20), who applied it to capability portfolio analysis and risk assessment. FDNA has been modified to be suitable to analyze interdependencies in SoS, and successfully applied to aerospace SoS (21). In FDNA, the architecture of SoS has been modeled as a directed network. The nodes represent either the component systems or the capability to be acquired. Accordingly, the links represent the operational dependencies between the systems or between the capabilities (fig. 1). Each dependency is characterized by strength and criticality, that affect the behavior of the whole SoS in different ways: strength of dependency accounts for how 3 Copyright 2013 by Cesare Guariniello and Daniel A. DeLaurentis. Published by the, Inc., with permission.

4 much the behavior of a system is affected by the behavior of a predecessor system, while criticality of dependency quantifies how the functionality of a system is degraded when a predecessor system is experiencing a major failure. As in the original formulation, this method is used to evaluate the effect of topology, and of possible degraded N i Predecessor functioning of one or more systems on the operability of each system in the network. To adapt the technique to SoS analysis, a term has been added to account for possible degraded functioning of a component system due to its own malfunctions. Also, a stochastic version of FDNA, involving a probability distribution for the operability of the systems, has been developed and tested, and the results are described in ref. 21. FDNA identifies the most critical nodes in the network, as well as the most important dependencies. Comparison of different architectures can be performed, by assessing the operability of the systems. The resilience of a SoS can be evaluated in terms of capability to reduce the loss of operability when single systems are affected by partial failures. Further analysis can be executed to assess the benefits of adding or removing systems. The operability of a node is defined as the percentage of effectiveness, that is the level at which the system is currently operating, or the level at which the desired capability is being currently achieved. Operability, ranging between 0 and 100, can be related to performance by means of an input function. In the example in fig. 2, a planetary probe communication system is evaluated based on the number of valid data downlinks per week (performance), with its operability (effectiveness) being 100 when the system performs 1000 valid data downlinks per week, and the degraded operability being 25 when the system performs 380 valid data downlinks per week. In this paper, only operability will be used as output from the analysis. The required inputs for FDNA analysis are as follows: for each node Ni, a self-effectiveness level SEi is needed, ranging between 0 and 100. For root nodes, this is just the operability; for nodes that have at least one predecessor, the self-effectiveness is the level of operability that the node would have, if it were a root node: therefore, the self-effectiveness assess the current status of a node, not accounting for its dependencies. In this study, the self-effectiveness of each component will be a probability distribution computed according to a simplified model, accounting for aging, degradation, and major failures. For each link, two values are needed. The strength of dependency (SOD) between node N i and node N j, SOD ij, and the criticality of dependency (COD) between node N i and node N j, COD ij. The SOD ranges between 0 and 1, and can be evaluated as the fraction of the operability level of node N j due to the dependency by node N i. The COD must be comprised of values between 0 and 100, and it can be evaluated as the maximum level of operability reachable by node N j, when the operability of node N i is 0. A lower value of COD corresponds to a higher criticality of the interdependency. N j Successor Figure 1. Operational dependency of node N j from node N i 100 Operability (Effectiveness) Performance (valid downlinks per week) Figure 2. Correlation between Performance and Operability of a system. SE 1 Predecessors N 1 SOD 13, COD 13 Successor N 3 SE 3 SE 2 N 2 SOD 12, COD 12 Figure 3. A small network, showing the required input for FDNA. A. Dependency analysis The operability of root nodes is simply their self-effectiveness: O i = SE i (1) The operability of nodes that have at least one predecessor is computed as the minimum of two terms, one 4 Copyright 2013 by Cesare Guariniello and Daniel A. DeLaurentis. Published by the, Inc., with permission.

5 depending on the SODs, one depending on the CODs: O j = min(sod_o j, COD_O j ) (2) For a node N j having n predecessors, the two terms are computed according to equations 3-6: SOD_O j = Average (SOD_O j1, SOD_O j2,, SOD_O jn ) (3) SOD_O ji = SOD ij O i + (1-SOD ij )SE j (4) COD_O j = Min (COD_O j1, COD_O j2,, COD_O jn ) (5) COD_O ji = O i + SOD ij (6) The term accounting for SOD is the average operability values of node N j, computed for each dependency from a predecessor node N i, thus reflecting the relationships between the n predecessors and the node Nj. The term accounting for COD is the minimum of the values of the operability of node N j computed for each dependency from a predecessor node N i, thus reflecting the importance of the most critical dependency. Using equations 1-6, the operability of each node can be sequentially computed, starting from the root nodes, in a breadth-first way: after the roots, nodes directly depending from the root are analyzed, and so on. IV. On-orbit Servicing System-of-Systems To analyze the problem of on-orbit servicing under the viewpoint of operational interdependencies, we need to model the systems of interest as a Functional Dependency Network, as described in section III. This network will comprise two levels (fig. 4): at the lower level, each satellite is decomposed into a simple model of its constituent subsystems and their operational interdependencies. At the higher level, satellites and constellation of satellites are represented together with the functional dependencies required to achieve the desired capabilities. At this level, the servicing satellites are also depicted. Capability 1 Servicing Higher level Capability 2 Lower level Figure 4. Two-level functional dependency representation of the on-orbit servicing System-of-Systems A. Lower level At the lower level, this study considers modular satellites, in which a structure containes modules that are supposed to be easily accessible to be replaced or maintained. Simplifying assumptions about the level of detail (described in section IV.C) can be relaxed, and more detailed and realistic models can be used, in order to refine the results. The satellites are divided into three groups: Communication Satellites, Observation Satellites, Experimental Satellites. Some of the modules are present in all the satellites, other modules are specific to a certain type of satellite. For a few of the systems (power, thrusters) alternative choices can be made. Table 1 shows the main 5 Copyright 2013 by Cesare Guariniello and Daniel A. DeLaurentis. Published by the, Inc., with permission.

6 properties of the satellites in the model used in this study, as well as type and number of modules that constitute the satellite. Table 2 lists the alternatives for the systems for which alternative choices are available. Table 1. Properties and modules of the satellites. Systems for which alternative choices are available, are underlined Downloaded by Cesare Guariniello on October 16, DOI: / Orbit Communication Satellites Observation Satellites Experimental Satellites Geostationary (GEO), Molnyia, Tundra Low Earth Orbit (LEO), Medium Earth Orbit (MEO) GEO, LEO, MEO Structure Power Controller Power Source and Storage X X X Power Regulators Communication / Main Software Transponder and Gyros Guidance, Navigation and Control (GNC) System Thrusters Payload X X X Table 2. Systems for which alternatives are modeled, and properties of the alternatives. Orbit Power Source and Storage Payload GEO Molnyia Tundra LEO MEO Fuel Cells Alternatives Solar panels on the surface + batteries Deployed solar arrays + batteries Communication antennas Sensors and data handling system Experiments and data handling system Properties Geostationary orbit: circular, inclination = 0, radius = km Semigeosynchronous orbit, inclination = 63.4, semimajor axis = km Geosynchronous orbit, inclination = 63.4, radius = km Circular, inclination = any, with preference of polar orbits for observation satellites, radius = km (height = km) Circular, inclination = any, with preference of polar orbits for observation satellites, radius = km (height = km) 1-2 fuel cells. No recharge, no batteries Surface of the satellite covered with solar panels, 1-3 batteries 1-2 solar arrays, 1-3 batteries Between 2 and 6, only in communication satellites Between 3 and 5, only in observation satellites Between 1 and 3, only in experimental satellites 6 Copyright 2013 by Cesare Guariniello and Daniel A. DeLaurentis. Published by the, Inc., with permission.

7 B. Lower level modeling and preliminary results Satellites with different characteristics can be modeled and analyzed with FDNA at the lower lovel, to gain better insight into the effect of interdependencies, redundancy, various architectures. The architecture of a satellite can be specified by the user, or a random generator can be used: satellites are modeled, with a given probability for the choice of the type, and of the component modules. In this study, a random generator has been used, with the probabilities suggested by current practice. The generator can be easily modified according to the user s needs. Fig. 5 shows a communication satellite, created by the random generator: it is in Geostationary orbit, gets power from panels on its surface, and has two batteries, three power regulators, six thrusters and two antennas. The figure also gives an idea of the complexity of the functional interdependency between the modules. Downloaded by Cesare Guariniello on October 16, DOI: / Figure 5. Functional Dependency Network of a communication Satellite. Ctrlr: controller. Reg: power regulator. Comm SW: communication software. Xpdr / gyro: transponder and gyroscopes. GNC: guidance, navigation and control. T: thruster. C: communication antenna. The required inputs for FDNA are the topology of the network, i.e. the functional interdependencies between the modules, and the strength and criticality of such dependencies: for example, the operability of a battery will depend both from the effectiveness of the battery itself, and from the correct operability of the recharge system. The dependency of an observation sensor will be critically dependent from the GNC system, while the criticality of the dependency from a power regulator will be low, if the satellite has three regulators. There are different ways to quantify such inputs: they can come from knowledge by experts, from simulation and Design of Experiments, from historical data analysis. In this conceptual study, values coming from experience have been used to characterize the interdependencies. As for the self-effectiveness of the systems, a simple model of the evolution of this value for each module has been implemented. A timestep of one month is considered. Starting from the maximum level of operability, i.e. 100, each module experience a decrease in self-effectiveness due to three factors: 1) Aging / wearing out / losses: modeled as a small, but always greater than zero, random loss in selfeffectiveness. 2) Degradation by minor failures: modeled with a beta distribution for the small loss in self-effectiveness. 3) Major failures / accidents / catastrophic events: if the event occurs (there is a low probability), the loss in self-effectiveness is sampled from exponential distribution, and ranges between 70 and 100. Fig. 6 shows some preliminary results from the analysis of an instance of the evolution of the same satellite modeled in fig. 5. The evolution of four modules is depicted in the graph: the power controller, solid electronic 7 Copyright 2013 by Cesare Guariniello and Daniel A. DeLaurentis. Published by the, Inc., with permission.

8 part inside the satellite, is mostly subject to some aging. The structure and the communication antenna, subject to weathering from the harsh space environment, show a steeper decrease in operability, and some jump due to minor disruptions (like meteorite hits, for example). The power regulator no. 3 experienced a major failure in this instance, and could be a candidate for on-orbit maintenance. Downloaded by Cesare Guariniello on October 16, DOI: / Figure 6. Self-effectiveness of modules over time. Left: self-effectiveness of Structure, Power controller, and Communication antenna. Right: the same modules as in the left figure, plus Regulator 3, which experiences a major failure. The evolution of the self-effectiveness over time is used as input to the FDNA tool, to quantify the operability of each module over time. Fig. 7 reports the results of FDNA analysis for the same communication satellites as in the previous examples. First of all, we can notice that the structure operability is not affected by the drop in the operability of the regulator, as expected. Then, one of the positive impacts of interdependencies is quantified: even if the self-effectiveness of the regulator decreased to 25, its operability, that depends on the batteries and the power controller, can be kept to a higher level. The drop in operability of the regulator has however an impact on the operability of the communication antenna and the gyros, even if this is not a critical dependency, thus the decrease is small. In the right part of fig. 7, the same satellite has been analyzed, without full redundancy of 3 regulators. In this case, the dependency of the gyros from the regulator is more critical, resulting in a bigger loss of operability. Figure 7. Operability of modules over time. Results come from Functional Dependency Network Analysis. Left: lower criticality of the regulator. Right: higher criticality of the regulator. 8 Copyright 2013 by Cesare Guariniello and Daniel A. DeLaurentis. Published by the, Inc., with permission.

9 C. Higher level Results from the lower level are combined in the higher level, where the architecture of possible constellation of satellites is modeled: the overall operability, or other measures of interest, are quantified based on the operability of each satellite. For example, for a mission involving a tandem of observation satellites, we could be interested into the operability of each sensor on board of each satellite, or we could give more importance to the operability of a particular couple of sensors in the tandem. Nodes of interest are modeled as in the lower level, but at the higher level they are more likely to represent capabilities to achieve, rather than actual systems. As shown in fig. 4, at the higher level also the architecture of on-orbit servicing is represented. For example, different analyses could involve the possibility for a satellite to perform servicing only to satellites in the same orbit. Also, a servicing satellite could carry spare parts for a sensor, a part needed only by observation satellites in our model. As a preliminary example, two observation have been randomly generated. Both the satellites are in polar orbits (inclination of and respectively), the first one in MEO, with an orbit radius of 8493 km, the second one in LEO, with an orbit radius of 6850 km. The first satellite has two solar arrays, two batteries, two power regulators, eight thrusters, and four sensors. The second satellite has a fuel cell as power source, three regulators, four thrusters, and five sensors. An instance of evolution of self-effectiveness over time was simulated, resulting in a major failure of thruster no. 5 of the first satellite after 57 months, and a major failure of the fuel cell in the second satellite after 47 months, followed by a major failure of sensor no. 3 after 95 months. While the failures in the first satellite had almost no impact, the failure in the fuel cell of the second satellite was critical to the operability of the sensors, though some operability of the fuell cell was still kept. We considered the satellites to be working in tandem, with the overall operability modeled, in a functional dependency network, as a function of the operability of each sensor and data handling systems of each satellite, and fig. 8 shows the evolution over time of the operability at the higher level. Results show how, in spite of the major failure in a thruster, the first satellite is able to keep its sensors working with a high level of operability. The second satellite instead, relying on a major loss in the operability of its fuel cell, experiences a large decrease in the operability of its sensors (to about 55). The overall operability of the satellite tandem, affected by the degraded sensors of the second satellite, also decreases after 47 months. The critical failure in sensor 3 of the second satellite heavily affects the overall operability after 95 months. Servicing the second satellite by replacing the fuel cell, would keep the overall operability to a level above 93, for 95 months. Figure 8. Higher level operability of a tandem of observation satellites in polar LEO. Critical failures in one of the two satellites affects the functioning of the overall System-of-Systems. 9 Copyright 2013 by Cesare Guariniello and Daniel A. DeLaurentis. Published by the, Inc., with permission.

10 D. Simplifying assumptions To achieve the preliminary results, and to perform the analysis of the case scenario presented in section V, a few simplifying assumptions have been made for this study: servicing satellites are not subject to failures, so they are not decomposed into subsystems the cost analysis is simplified, accounting only for the Δv required for the maneuvers to reach the satellite to be serviced. More complex cost analysis can be found in ref. 9, and a study for optimal rendezvous trasnfers can be found in ref. 22 in this paper, the proposed methods is used only for analysis, and not as a tool to guide decision in architecture and design of the on-orbit servicing SoS the presence of different stakeholders is not accounted for: the servicing satellites that are able to perform the required servicing, always perform it the servicing is always effective. Downloaded by Cesare Guariniello on October 16, DOI: / V. Case Scenario Analysis and Results A case scenario, including 30 operational satellites, was generated through a random generator. The main features of the 30 satellites are listed in table 3. The number of modules for each satellite ranges between 17 and 25. Table 3. Operational satellites in the case scenario. Sat. number Type Orbit Number of payloads (sensors, antennas, experiments) 1 Observation MEO 3 2 Observation MEO 3 3 Observation MEO 3 4 Communication Molnyia 2 5 Experimental LEO 1 6 Observation LEO 4 7 Communication GEO 2 8 Communication GEO 2 9 Communication GEO 6 10 Communication GEO 2 11 Experimental MEO 2 12 Experimental LEO 1 13 Observation LEO 4 14 Observation MEO 3 15 Communication Tundra 4 16 Experimental LEO 3 17 Observation LEO 4 18 Communication Tundra 2 19 Experimental MEO 1 20 Observation LEO 4 21 Experimental LEO 3 22 Experimental LEO 2 23 Communication GEO 3 24 Observation LEO 3 25 Observation MEO 5 26 Communication GEO 6 27 Experimental LEO 3 28 Observation MEO 4 29 Observation MEO 4 30 Observation LEO 4 10 Copyright 2013 by Cesare Guariniello and Daniel A. DeLaurentis. Published by the, Inc., with permission.

11 Based on their orbits and objectives, the satellites have been arbitrarily gathered in ten missions / constellations, described in table 4, that constitute part of the functional dependency network at the higher level. Table 4. Missions / Constellations at the higher level in the case scenario Downloaded by Cesare Guariniello on October 16, DOI: / Mission / Constellation Type Orbit Component satellites number 1 Observation MEO 1 2 Communication Molnyia 4 3 Communication Tundra 15, 18 4 Communication GEO 7, 8, 9, 10, 23, 26 5 Experimental LEO 5, 12, 16, 21, 22 6 Experimental LEO 27 7 Experimental MEO 11, 19 8 Observation MEO 2, 3, 14, 25 9 Observation MEO 28, Observation LEO 6, 13, 17, 20, 24, 30 A. Ananlysis of a scenario with a single satellite In this section, we describe and discuss results of the analysis of the operability and servicing of a single operational satellite (No. 1). The satellite is composed of 21 modules. At the higher level, the overall capability is functionally dependent on the three sensors, and the data handling system. This overall capability constitutes the measure of merit of the entire system, and is used to request servicing when its operability decreases below a threshold set at 70. Since the evolution of the self-effectiveness of each module is probabilistic, a Monte Carlo simulation has been performed, analyzing 1000 instances of the satellite evolution over 100 months. Fig.9 shows the expected value for the overall capability at each timestep, and the best and worst cases, in a scenario where on-orbit servicing is not available. The best and worst cases are defined as the instances with respectively the highest and the lowest average of the overall capability over time. Without servicing, the expected value for the overall capabilities keeps always above 70. It must be noted, however, that in 369 instances out of 1000, this value dropped under the threshold of 70, that means that the satellite would require on-orbit servicing. In fig. 10, the same results from fig. 9 are compared with the same scenario, when on-orbit servicing is supposed to be always available for the satellite constituting the mission No. 1. The analysis shows that the expected value Figure 9. Overall capability of mission No. 1 (satellite No. 1) when onorbit servicing is not available. in this case keeps above 80. In what was the worst case in the scenario without servicing, the satellite is now serviced, and the operability of the whole mission is thus kept above the desired threshold. Using the same definition as we did before for worst case, we notice that when servicing is available, a different instance becomes the worst case. 11 Copyright 2013 by Cesare Guariniello and Daniel A. DeLaurentis. Published by the, Inc., with permission.

12 Figure 10. Left: mission No. 1 without servicing. Right: mission No. 1 with servicing. B. Analysis of a scenario with all ten missions, without servicing In this section, all ten missions listed in table 4 are analyzed instances of the evolution over time of the operability of each module of the satellites described in tables 3 and 4 have been run. Fig. 11 shows the expected value of the overall operability of each of the ten missions considered in this scenario. Figure 11. Expected value of the overall operability of the ten mission in the case scenario, when servicing is not available. Fig. 12 shows the overall operability in the worst case for each mission. Since servicing is not available, some of the instances are subject to large decrease in the operability of interest. 12 Copyright 2013 by Cesare Guariniello and Daniel A. DeLaurentis. Published by the, Inc., with permission.

13 Figure 12. Evolution over time of the operability of the overall capability for each mission, in the worst case. Table 5 lists the percentage of instances of each mission that would require at least one servicing operation. Since in this model most of the satellites are considered critical to achieve the desired overall capability, missions and constellations involving a larger number of satellites are more susceptible to need servicing. Table 5. Percentage of instances requiring servicing. Mission Percentage of instances requiring servicing 36.9% 27% 56.4% 91.7% 58.3% 15.7% 22% 55.9% 39.8% 79.4% C. Analysis of a scenario with all ten missions, with servicing The same scenario analyzed in the previous section has been simulated again, with different architectures for servicing: a variable number of servicing satellites, in different orbits, and with different spare modules onboard, have been tested. Given an architecture, for each instance and at each timestep, if a mission overall operability decreases under the threshold of 70, the satellite causing the major loss can request servicing. If a satellite with the appropriate spare part is available, servicing is executed. The required Δv for the maneuver is computed, and after the operation, the servicing satellite will have the same orbit as the serviced satellite, for computation in the following timesteps. The spare part used for the servicing will not be available anymore in following timesteps of the same instance. The total number of requests, and the number of answered requests, are saved, allowing for the computation of the percentage of requests which were satisfied. Table 6 lists results for some of the architectures tested. Given the long period (100 months), and the high threshold for the operability, easily reachable just by aging, the number of requests of servicing is quite high. The analysis show the efficacy of the on-orbit servicing, resulting in an increase both in the expected value of the overall capability, and in the overall capability of the worst case. The Δv is reported in the table as the average over the instances of a given architecture, but it can also be analyzed in trade-off with the gain in capability. The average percentage of requests satisfied does not depend in the case from the location of the servicing satellites (that instead influences the Δv). A version of the analysis allowing a satellite to be serviced only by satellites having the same 13 Copyright 2013 by Cesare Guariniello and Daniel A. DeLaurentis. Published by the, Inc., with permission.

14 orbit type has been tested, with similar results. In that case, however, the percentage of satisfied requests decreases, because the required spare parts could not be available. On the other side, this causes a reduction in required Δv, but also a lower increase in the expected value of the overall capability. As aforementioned, this analysis leads the way to more complex evaluations, and can guide decision-making in design and architecture of on-orbit servicing System-of-Systems. Table 6. Results of the analysis of different architectures for on orbit-servicing in the modeled scenario (30 operational satellites, 10 missions). For each architecture, 1000 instances of 100 timesteps each have been run. Downloaded by Cesare Guariniello on October 16, DOI: / Servicing Architecture (number of satellites, orbit, [spare parts]) 1 servicing satellite, LEO, [1 Sensor, 1 Battery, 2 Fuel Cells] 1 servicing satellite, MEO, [2 Solar Arrays, 1 Power Regulator, 2 Antennas] 1 servicing satellite, GEO, [1 Solar Array, 2 Batteries, 1 Antenna, 1 Sensor] 3 servicing satellites, LEO, [3 Fuel Cells, 1 Electronics, 1 Gyro, 3 Batteries, 1 Power Regulator, 3 Antennas, 1 Sensor] 3 servicing satellites, MEO, [1 Solar Array, 2 Power Regulators, 3 Sensors, 1 Antenna, 2 Fuel Cells, 2 Batteries, 1 Electronics] 3 servicing satellites, GEO, [3 Solar Arrays, 2 Batteries, 3 Fuel Cells, 2 Antennas, 3 Sensors, 2 Electronics] 3 servicing satellites, LEO, [2 Batteries, 1 Sensor, 1 Antenna, 1 Fuel Cell], MEO, [1 Solar Array, 1 Antenna, 1 Sensor, 1 Electronics], GEO, [1 Antenna, 1 Solar Array, 1 Power Regulator, 1 Battery, 1 Fuel cell] 6 servicing satellites, 2 LEO, [2 Sensors, 2 Fuel Cells, 1 Electronics, 1 Antenna, 1 Power Regulator, 1 Solar Array], 2 MEO, [2 Batteries, 2 Fuel Cells, 2 Electronics, 2 Power Regulators, 1 Sensor], 2 GEO, [2 Antennas, 3 Sensors, 2 Solar Arrays, 1 Power Regulator, 1 Battery, 1 Fuel Cell] Average number of request (100 months) Average percentage of satisfied requests Average Δv Average increase in expected value of the overall capability Average increase in overall capability of the worst case % 8.21 km/s % 9.31 km/s (not serviced in most cases) % km/s % km/s % km/s % km/s % km/s % km/s Copyright 2013 by Cesare Guariniello and Daniel A. DeLaurentis. Published by the, Inc., with permission.

15 VI. Conclusions, Applications, and Future Work In this paper, we presented and discussed an original and innovative perspective to address the problem of onorbit servicing. Literature survey shows the technical and economical feasibility of on-orbit servicing operations. However, many features are usually not analyzed and accounted for, when discussing reliability, maintenance, and on-orbit servicing: for example, the complex interdepencies in space systems, the presence of different stakeholders, the possibility of minor failures with only partial decrease of the operability. We used a two-level System-of- Systems model for the functional dependency architecture of the on-orbit servicing problem: the lower lever is comprised of operational satellites and their constituent modules, while at the upper level constellations and multisatellite missions are considered, together with servicing satellites. A functional dependency analysis technique was used to compute the evolution over time of the operability of each module and each system in the two levels, as a function of the self-effectiveness and of the interdependencies. Using these values, the impact of interdependencies over the entire System-of-Systems can be quantified. The technique was first applied to the analysis of an instance at the lower level, showing the effect of aging, minor failures, and catastrophic events, on the operability. The same analysis was then performed at the higher level, to quantify the evolution over time of the overall capability of a simple mission, consisting of one satellite. A case scenario was generated, with 30 satellites, organized in 10 missions with different size and objectives. Stochastic Functional Dependency Network Analysis (FDNA) has been performed, to analyze the behavior of the System-of-Systems both in absence of on-orbit servicing, and when servicing satellites are available. Results show an increase in the expected value of the overall capability The proposed concept and the analytical tool are suitable for various applications, including analysis and comparison of architectures, decision-driving metrics for architecture and design, architecture optimization, multiobjective optimization for commercial analysis, risk and cost analysis, stakeholder agreement tool. To accomplish such tasks, in the future some of the simplifying assumptions will be relaxed. Servicing satellites and servicing operations may be made prone to failures, thus resulting in a more complex and detailed model for risk analysis. The two-level satellite model can be extended, with more detail into the interdependenies, and inputs from the analysis of historical data. Also, the interdepencies can be time-variant. More accurate cost analysis, including rates of failure, complex maneuvers, cost of the spare parts, can be added to the model. More complex analysis, including weights to rank the importance and the urgency of servicing requests, can be implemented. Finally, the proposed methods and concepts can be integrated with ideas published in the referenced papers, such as evaluation of performability, optimal maneuvers, complex cost analysis.. Acknowledgments This material is based upon work supported, in whole or in part, by the U.S. Department of Defense through the Systems Engineering Research Center (SERC) under Contract H D SERC is a federally funded University Affiliated Research Center managed by Stevens Institute of Technology. References 1 Maier, M., Architecting Principles for SoS, Systems Engineering, Vol. 1, No. 4, 1998, pp AA.VV., On Orbit Satellite Servicing Study, Project Report, NP GSFC, NASA-GoddardSpace Flight Center, October Long, A., Richards, M., and Hastings, D., On-Orbit Servicing: A New Value Proposition for Satellite Design and Operation, Journal of Spacecraft and Rockets, AIAA, Vol. 44, No. 4, July-August 2007, pp Yoshida, K., Engineering Test Satellite VII Flight Experiments for Space Robot Dynamics and Control: Theories on Laboratory Test Beds Ten Years Ago, Now in Orbit, The International Journal of Robotic Research, Vol. 22, No. 5, May 2003, pp Dimitrov, D., Dynamics and Control of Space Manipulators During a Satellite Capturing Operation, Ph.D. Dissertation, Graduate School of Engineering, Tohoku University, Yoshida, K., Dimitrov, D., and Nakanishi, H., On the Capture of a Tumbling Satellite by a Space Robot, IEEE/SRJ International Conference on Intelligent Robots and Systems, Beijing, China, 9-15 October Guariniello, C., Ansalone, L., and Curti, F., Autonomous Capture of Non-Cooperative Spacecraft with a Space Free-Flyer, Proceedings of the 3 rd CEAS Air&Space Conference and 21 st AIDAA Congress, Venice, Italy, October 2011, pp Neema, K., Tamaskar, S., and DeLaurentis, D.A., Innovative Framework for Orbital Debris Mitigation through Satellite Rejuvenation, AIAA 2012 Space Conference and Exposition, Pasadena, CA, September Copyright 2013 by Cesare Guariniello and Daniel A. DeLaurentis. Published by the, Inc., with permission.

16 9 Sullivan, B., Technical and Economic Feasibility of Telerobotic On-Orbit Satellite Servicing, Ph.D. Dissertation, Space Systems Laboratory, University of Maryland, Wang, W., Loman, J., and Vassiliou, P., Reliability Importance of Components in a Complex Systems, Annual Reliability and Maintainability Symposium, Los Angeles, CA, January Ciciani, B., and Grassi, V., Performability Evaluation of Fault-Tolerant Satellite Systems, IEEE Transactions on Communications, Vol. 35, No. 4, April Grassi, V., Donatiello, L., and Iazeolla, G., Performability Evaluation of Multicomponent Fault-Tolerant Systems, IEEE Transactions on Reliability, Vol. 37, No. 2, June Castet, J. F., and Saleh, J. H., Satellite Reliability: Statistical Data Analysis and Modeling, Journal of Spacecraft and Rockets, Vol. 46, No. 5, September-October 2009, pp Greenberg, J., Satellite Reliability Requirements: Effect of Transportation System, Sparing and Maintenance Strategies, Acta Astronautica, Vol. 21, No. 6-7, 1990, pp Tafazoli, M., A Study of On-Orbit Spacecraft Failures, Acta Astronautica, Vol. 64, No. 2 3, January February 2009, pp Sullivan, B., and Akin, D., A Survey of Serviceable Spacecraft Failures, AIAA Paper, Aug Nai Fovino, I., and Masera, M., Emergent Disservices in Interdependent Systems and System-of-Systems, IEEE International Conference on Systems, Man, and Cybernetics,Taipei, Taiwan, 8-11 October Mane, M., DeLaurentis, D. A., and Frazho, A., A Markov Perspective on System-of-Systems Complexity, IEEE International Conference on Systems, Man, and Cybernetics, Anchorage, AK, 9-12 October Garvey, P., and Pinto, A., Introduction to Functional Dependency Network Analysis, Second International Symposium on Engineering Systems, Massachusetts Institute of Technology, Cambridge, MA, June Garvey, P., and Pinto, A., Advanced Risk Analysis in Engineering Enterprise Systems, CRC Press, 2012, Chapter Guariniello, C., and DeLaurentis, D., Dependency Analysis of System-of-Systems Operational and Development Networks, Proceedings of the 2013 Conference on Systems Engineering Research, Procedia Computer Science, Vol. 16, 2013, pp Prussing, J., and Chiu, J.H., Optimal Multiple-Impulse Time-Fixed Rendezvous Between Circular Orbits, Journal of Guidance, Vol. 9, No. 1, January-February Copyright 2013 by Cesare Guariniello and Daniel A. DeLaurentis. Published by the, Inc., with permission.