A risk limit written for one satellite at a time

Every argument about orbital debris in low orbit ends in the atmosphere. Drag pulls dead satellites and fragments down in years or centuries, and the removal rate that drag provides is what keeps the population of a low shell from growing without limit. That is the good news about the atmosphere. The other half of it is that what drag removes from orbit it delivers to the ground. Most of a satellite burns up on the way down, but not all of it: titanium tanks, steel bearings, glass and the cores of reaction wheels can survive the heating and land, and a few tonnes of hardware from a spent rocket stage regularly do.

Nobody has yet been killed by falling space debris. A woman in Oklahoma was struck on the shoulder in 1997 by a light fragment of a Delta rocket’s insulation and was unhurt; Skylab scattered pieces across Western Australia in 1979; fragments of an uncontrolled Long March core stage damaged buildings in a village in Côte d’Ivoire in 2020. The record is clean because the risk per event is small, and the risk per event is small because the Earth is mostly ocean and empty land. That last fact is the whole of the calculation behind the rule that governs uncontrolled re-entry, and the rule is a limit on each event.

This essay works through the calculation — the latitudes an orbit can drop debris on, the population it flies over, the area of what survives — and then asks what happens to a limit written per event when the number of events grows by a factor of a hundred.

Where an orbit can come down #

A satellite decaying from orbit does not choose where to fall. Its last revolution is decided by the air density along its track in its final hours, which is not predictable to better than a fraction of an orbit even a day ahead, so the landing point is effectively drawn at random from the places the orbit passes over. Those are fixed by its inclination: an orbit inclined at fifty-three degrees passes over every latitude between fifty-three north and fifty-three south and nowhere else.

It does not pass over them equally. A satellite in a circular orbit moves uniformly in its orbital plane, so its latitude goes as $\sin\varphi = \sin i \sin u$ with $u$ advancing uniformly, and it spends much more time near its turning latitudes, where it is moving east or west, than near the equator, where it is crossing at the steepest angle.

The distribution has a sharp peak at each turning latitude, formally infinite there and integrable. For the purposes of a falling satellite it means that the latitudes near the inclination are the most likely places for the debris to land, and the equatorial band the least likely per degree. Longitude does not enter: the Earth turns under the orbit, so over the uncertainty of a final orbit the longitude of the landing point is uniform.

Where the people are #

The second factor is the density of people at each latitude, averaged right round the circle — because longitude is uniform, a landing point at forty degrees north is as likely to be in the Pacific as in Beijing.

Averaged this way, the Earth is sparsely inhabited: sixteen people per square kilometre of its surface, against several hundred in a typical European region. Humanity is also strongly concentrated in latitude. About seven-eighths live north of the equator, and half live between twenty and forty degrees north, in a band that runs through the Indian subcontinent, China, the Middle East, North Africa, the southern United States and Mexico. South of thirty degrees south, the inhabited land is a small fraction of the band and its average density is a few people per square kilometre.

The population an orbit flies over #

Multiplying the two distributions and averaging gives the density of people under an orbit — the quantity that, times the area of what lands, gives the expected number of people hit.

The variation is modest — less than a factor of two across the inclinations that are used — and it has a clear shape. An orbit inclined at twenty-five to forty-five degrees spends its lingering time right in the crowded northern band, and it is the most dangerous source of falling debris. An equatorial orbit spends all its time over the tropics, which are moderately populated. Polar and sun-synchronous orbits spread their time over every latitude including the empty south and the oceans of the high latitudes, and they are the safest. A satellite at forty-three degrees is about one and a half times as dangerous to drop as the same satellite from a polar orbit, which is a real difference and a smaller one than the next factor.

The area that lands #

What reaches the ground is a list of fragments: the components that did not melt. For a conventional satellite of a tonne or so, the survivors are typically a few tens of kilograms — propellant tanks, magnetorquer and reaction-wheel parts, optics, structural titanium. Each is assigned a casualty area that is not its own cross-section but that cross-section enlarged by the size of a person, because a fragment hits someone if it lands anywhere within a person’s width of them:

$$A_c = \sum_i \left(\sqrt{A_i} + \sqrt{0.36\ {\rm m}^2}\right)^2 .$$

The person is taken as a standing cross-section of 0.36 square metres. A fragment the size of a coin still has a casualty area of a third of a square metre, and a tank half a metre across has more than a square metre.

The expectation is just the product of the casualty area and the mean density under the orbit, and the limit that most space agencies apply — no more than one chance in ten thousand of a casualty per uncontrolled re-entry — translates into an allowed casualty area of five or six square metres from a mid-inclination orbit and eight from a polar one. That is a handful of surviving components. A large satellite whose structure includes several dense, high-melting-point parts can exceed it easily, and such satellites are required to perform a controlled re-entry, using their last propellant to drive the perigee deep enough that the final plunge happens over a chosen stretch of the South Pacific, far from shipping lanes and land. The corridor a returning capsule must hit has its counterpart here: a deorbit burn aims a satellite’s debris into a footprint a few thousand kilometres long over empty ocean.

A limit per object #

The limit is a reasonable way to regulate a single object. One in ten thousand is small next to the other risks of daily life, and an operator can show compliance with an analysis of one spacecraft’s design. It was written in the 1990s, when the uncontrolled re-entries from the whole world amounted to a few dozen large objects a year.

That is no longer the population. Low orbit is being filled by constellations of thousands of small satellites, each designed for a life of about five years and then replaced. A fleet of forty thousand satellites with a five-year life returns about eight thousand of them to the atmosphere every year, plus the rocket stages that launched them.

Risks add. If every one of eight thousand re-entries a year sat exactly at the limit, the expectation would be nearly one casualty a year — a rate the rule was never meant to permit for the whole of spaceflight, now produced by a single operator in full compliance. At a tenth of the limit, which is still a substantial amount of surviving hardware, the expectation is one person every thirteen years. The rule as written bounds each term and says nothing about the sum, and the sum is what determines whether someone is hurt.

The chance that it has happened #

An expectation is a long-run average. What a regulator or an operator usually has to answer is a probability: the chance that at least one person is hit over a given period.

For independent rare events the number of casualties is Poisson-distributed, so the chance of at least one in $T$ years is $1 - \exp(-\lambda E T)$, where $\lambda$ is the rate of re-entries and $E$ the risk of each. A fleet at the limit makes a casualty a near certainty within a decade. A fleet whose satellites each carry a hundredth of the limit makes it a one-in-twelve chance. The same aggregate can be reached by many safe objects or few dangerous ones, and the figure shows two curves that coincide for exactly that reason: eight thousand re-entries at one in a hundred thousand are the same as eight hundred at one in ten thousand.

This is the same structure that governs debris in orbit. A collision rate is a product of a number density and a cross-section, and adding objects raises it whether or not any one object is unusually dangerous. In orbit the cure is to remove objects; on the ground there is nothing to remove, so the cure has to be applied to what each object leaves behind.

The stages that carry the rest of the risk #

The satellites are only part of what comes down. Every launch leaves an upper stage in orbit, and a stage is a far worse object to drop than a satellite: several tonnes of thick-walled tanks, engines of high-melting-point alloys and pressurant spheres built to survive. The casualty area of a single uncontrolled upper stage can be ten or twenty square metres, several times the limit, and the core stages that some heavy launchers leave in orbit are larger still. For most of the history of spaceflight these stages were left to decay wherever drag took them, and they make up most of the large uncontrolled re-entries in the historical record.

The remedy for a stage is the same as for a large satellite — a final burn that brings it down over the ocean — and it is now standard on many launch vehicles, at the cost of propellant held in reserve and of an engine that must restart hours after launch. Where it is not done, a single stage contributes as much risk as hundreds of demisable satellites, which is why a fleet’s ground risk depends at least as much on how it is launched as on what is launched.

The same population of stages also dominates the collision risk in orbit while it is there, and the two problems pull in the same direction for once: a stage brought down deliberately within days of launch is removed from both ledgers at a stroke, while one left to decay over years or decades stays in the collision budget for that whole time and then delivers its full casualty area to a random point under its orbit at the end.

There is an asymmetry worth naming between the two kinds of harm. In orbit, the expected damage from a derelict grows with time spent there, and drag is the remedy. On the ground, the expected damage is delivered all at once at the end, and drag is the cause. A higher orbit postpones the ground risk and lengthens the orbital one; a lower orbit does the opposite. No choice of altitude removes both, and every choice of altitude decides which of the two budgets a failure is charged to — a decision that is, in effect, made once for every satellite of a constellation by the shell it is designed for.

Even the geostationary ring, where nothing comes down, does not escape the trade: its derelicts stay for millions of years and are moved to a graveyard rather than to the ground, which is a decision to keep the whole of that risk in orbit permanently rather than to deliver any of it to the Earth.

Design for demise #

The lever is in the satellite, not the orbit. Because the casualty area is a sum over surviving fragments, and because each fragment’s area carries a person-sized margin, the most effective reduction is to eliminate fragments altogether rather than to shrink them. A satellite designed for demise uses aluminium where it would have used titanium, composite-overwrapped tanks that break up rather than intact titanium spheres, reaction wheels whose rotors are designed to separate early and melt, and optics that are bonded rather than held in steel. Each component removed from the list of survivors takes away its own area plus the margin of a person.

The large constellation operators have stated that their satellites are designed to demise completely, and the uncertainty in that claim is the uncertainty in re-entry survivability analysis, which is not small. The heating of a tumbling fragment through the upper atmosphere depends on its shape, its attitude, the time at which it is released from the parent body and the material’s response at temperatures where its properties are poorly measured. Recovered debris from previous re-entries has included components that analyses predicted would melt. A 2023 assessment for the United States aviation regulator, assuming more surviving mass than the operators did, projected an aggregate casualty rate that would become significant within the decade if constellations grew as planned; the operators disputed its survivability assumptions. The arithmetic of the aggregate is not in dispute. What is in dispute is the number multiplied by it.

There is a second channel that the casualty calculation, written for people on the ground, does not include: aircraft. The cross-section of an airliner is a few thousand square metres, the density of aircraft in the airspace over busy regions is not negligible, and a small fragment that would be harmless to a person on the ground can be lethal to an aircraft at cruising speed. Airspace closures for controlled re-entries are routine; for uncontrolled ones they are impossible, because the footprint is the whole band of latitudes under the orbit.

A trade that runs the other way in orbit #

Design for demise interacts with the rest of the debris problem in a way that is not obvious. A satellite that burns up completely contributes nothing to the ground risk and everything to a different budget: the material it vaporises in the upper atmosphere. Aluminium oxide particles from re-entering spacecraft are now detectable in samples of stratospheric aerosol, and their amount is growing with the re-entry rate. Their effect on the chemistry and radiation balance of the stratosphere is being studied and is not yet known to be harmful or harmless.

There is also the question of how long satellites stay up before they come down. A constellation in a low shell where drag removes dead satellites in five years produces a steady stream of re-entries and a low orbital collision risk; the same constellation one hundred kilometres higher produces fewer re-entries per year at any moment but leaves its failures in orbit for decades, where they become the large derelicts whose collisions make most of the future debris. The re-entry rate is the price of a clean orbit, and the casualty arithmetic is the bill.

The atmosphere’s own variability enters too. A cooler, thinner thermosphere lengthens orbital lifetimes and lowers the rate of re-entries for a fixed population, at the cost of keeping more objects in orbit longer. The solar cycle modulates the rate by a factor of several: at solar maximum the upper atmosphere swells, drag increases, and dead satellites and fragments come down in waves.

What the calculation leaves out #

The population model is coarse: ten-degree bands with approximate shares of the world’s population, averaged over longitude. A detailed calculation uses gridded population at kilometre resolution and the actual ground track of the final orbits, and it moves the numbers by tens of per cent without changing their shape. Population is treated as stationary and exposed; in reality most people are indoors most of the time, and buildings stop light fragments, which lowers the risk from small debris substantially. The casualty area counts every fragment as dangerous regardless of its energy, and the usual threshold is fifteen joules of impact energy, below which a fragment is not counted at all.

Fragmentation debris is left out entirely. The great majority of objects in low orbit are fragments too small to track or shield against, and almost all of them burn up completely on the way down, so the hazard they pose is in orbit and not on the ground; the ground risk is carried by the few large, intact objects.

The orbits are circular and the landing point uniform along the final revolution. A decaying orbit is slightly eccentric and tends to come down near perigee, which concentrates landings at the latitudes where the argument of perigee places them; over a fleet this averages out. And the re-entries are independent. Debris from a single large object lands in a footprint hundreds of kilometres long, so the fragments of one event are correlated, which is why the casualty area of one object is summed before multiplying by density rather than treated fragment by fragment.

Still open: a limit on the sum #

The calculation shows that a limit applied to each object does not bound the total once the number of objects is large, and the obvious remedy — a limit on the aggregate — has no owner. A per-object rule can be applied by the agency licensing each spacecraft. An aggregate limit would have to be shared between operators and countries: who is entitled to how much of an annual expected casualty rate, and on what basis — first come, fleet size, the benefit each fleet provides? Space agencies have begun to set stricter per-object targets for constellations, effectively reserving room for the sum, and some have proposed requiring complete demise for satellites below a given mass.

Whether that is enough depends on numbers that are still being measured: how many satellites the low shells will hold, how long each will last, and above all how much of each one actually reaches the ground. The survivability of a satellite’s components can be tested in arc-jet facilities and checked against recovered debris, and each recovered fragment from a satellite that was supposed to have melted is a direct measurement of the term that multiplies everything else. The arithmetic says that the sky can absorb thousands of re-entries a year safely only if almost nothing reaches the ground from any of them — and whether almost nothing is what is actually reaching it is an empirical question, being answered one fragment at a time.