Tag: Expert Advice

In 2009, a Government Accountability Office (GAO) report claimed that the GPS constellation was extremely vulnerable to failure, and a recent September 2010 GAO follow-up continues to make that assertion. In this article, we present the technical data to contradict some of the GAO report conclusions.

Fifty-nine GPS space vehicles (SVs) have been put into orbit since 1978. From 1997 to 2009, 13 IIR and eight IIR-M SVs were launched to replenish the GPS constellation, and eight Block II SVs and four Block IIA SVs were deactivated. Three other SVs were put into spare status, meaning that the navigation signal is not currently in use, it has no pseudo-random number (PRN) assigned, but some future capability may still remain if that SV is required. This has led to a robustly populated, but increasingly old, GPS constellation.

A robust constellation is important in many ways. An increased number of SVs provides higher likelihood of an available signal for the user. The greater the number of available satellites visible in the sky at a particular time reduces the measure called dilution of precision (DOP). DOP feeds directly into the accuracy equation such that accuracy improves (reduces) as DOP is reduced with better SV availability and sky geometry. Since Full Operational Capability (FOC) in 1995, the constellation size has grown from the minimum required 24 SVs to a very full constellation of 31 SVs plus a few spares.

GAO Report

The April 2009 GAO report focused on the most conservative (that is, pessimistic) predictions, including the so-called cliff of multiple, nearly simultaneous SV failures. Figure 1 shows the most pessimistic curve of likelihood of GPS constellation outages, 2010–2013. The report states “[I]n 2010, as old satellites begin to fail, the overall GPS constellation will fall below the number of satellites required to provide the level of GPS service that the U.S. government commits to.” The analysis in the body of the report clarifies that this refers to fiscal year 2010, ending in September 2010. In fact, as this magazine goes to press, there is virtually no likelihood of a sudden collapse of GPS service. There will not be an end-of-the-world loss of 10 SVs in a single year.

The warnings of the GAO report are not new to the United States Air Force. The USAF, in particular, Air Force Space Command (AFSPC), has been concerned with constellation sustainment and has managed this issue for many years. AFSPC acknowledged the potential for an availability gap years ago. This was part of the reason for changing Block IIR SVs from launch-on-schedule to launch-on-demand back when they were first being launched. This led to a 13-year launch span for IIR instead of just five years.

Causes of Satellite Failure

The primary reasons for final failure of GPS satellites have varied widely. An early cause on a few Block Is was failure of the last of three atomic frequency standards (AFS). Indeed, the older designs of the rubidium AFS on GPS Block I, Block II, and Block IIA SVs have had a noticeably shorter life span (1–4 years) compared to the cesium AFS added to later Block I SVs, which became the clocks of choice on Block II and IIA.

The myth persists today that GPS SVs, regardless of block number, ultimately fail due to the on-board clock. The facts show that only nine of 24 older SVs experienced final failure due to AFS failure. It may be the most common single cause of final failure to date, but it applies to less than half of the SVs. It is not likely that clock failure will be so prominent for newer SV blocks.

Thus, a culture change was required once Lockheed Martin and its navigation payload subcontractor, ITT, were unable to find a space-qualified cesium AFS for Block IIR and chose to have just three next-generation Rubidium Atomic Frequency Standards (RAFS) on each SV. It was feared that the IIR SVs would only operate for a few years, but it turns out that many on-orbit IIR RAFS will remain unused, as they evidence an extremely long and accurate life.

Solar array failure was the final failure mode on only three Block I SVs and no other GPS SVs to date. Solar arrays in medium-Earth orbit degrade in a substantially different manner than those placed in low orbit or geosynchronous altitudes. This may be from contamination, or from the severe radiation environment. Several degradation models have been developed for the GPS orbit. This has led to strengthened specifications to assure adequate power on later-model GPS satellites. In fact, both IIR and IIR-M show no SV life limitations to date due to solar array degradation. Power limitations due to degraded solar array performance have forced a change in SV operations for a few older Block II and IIA SVs, but they have maintained the navigation mission.

Thus, the GAO report states the issue incorrectly: “[E]xcluding random failures, the operational life of a GPS satellite tends to be limited by the amount of power that its solar arrays can produce.” The evidence concludes just the opposite.

Reaction wheels (used to gently control SV pointing attitude) have been the cause of eight of 24 final failures. Early reaction-wheel designs on older GPS SVs contained inadequate lubricant for the pre-launch storage and on-orbit life of the SV. This led to premature failure of one or more of the four wheels. Several SVs had to be monitored closely for several years in three-wheel or even two-wheel mode. Two Block I and six Block II SVs were deactivated due to wheel failure. Again, newer SVs have applied lessons learned to ensure robust wheel life.

“One component [away] from total failure,” a commonly cited cause for concern, primarily indicates that the designed redundancy on the SV is being employed. Many SVs operate for many years on the redundant component. It does not signify the navigation mission will fail tomorrow. See Table 1.

The list is not comprehensive, but shows a few examples of primary component and redundant component life at the time of final failure of that redundant component. Sometimes the redundant components show significant life when taking over for the primary components, sometimes they do not. In fact, SVN-24 has been single-string for more than 10 years. It has been on the watch list for replacement for almost that long. Though no longer in a primary slot, it continues to provide a valued navigation signal to the users.

Mean Mission Duration

Mean mission duration (MMD) specifies and measures the longevity of an SV in on-orbit operation. The strict definition of MMD is the area under the probability of success curve (the reliability curve), integrating from time zero (launch) up to the contractual design life (also called mission durat
ion). It is the initial pre-launch estimate of how long the SV is expected to survive, given that it fails completely at its design life. MMD is usually imposed as a requirement on the SV design, guiding parts selection, systems design, SV assembly, and pre-launch test to ensure that the SV is robust and will provide service for many years.

Once the SVs for that build are all launched, MMD has less value. Over time, the MMD requirement must be shown to have been met on-orbit, but it is not a good number to estimate how long a specific SV will actually last. Several years ago, Aerospace realized that the MMD was too conservative to use as an on-orbit lifetime estimate. In recent years, another measure called the Mean Life Estimate (MLE) has attempted to better define the SV longevity that can be expected.

Mean Life Estimate. MLE attempts to incorporate the actual projected end-of-life into the reliability calculations, where end-of-life is based on consumables and/or component wearout, such as solar array power degradation. On GPS III, assemblies that potentially have a life limit must be life tested to 2X design life. This almost guarantees that they will live beyond design life. MLE was proposed as a method of improving the estimate of how long the SV will survive. These calculations typically use a normal (Gaussian) distribution with a mean and sigma to predict when individual assemblies wear out. A Monte Carlo simulation then calculates the life of each assembly and the probabilistic loss of the same component due to random failure. The shortest of these times represents the failure time for the assembly for that specific simulated mission. The average of all these runs produces the composite curve for the vehicle that considers real wearout limits for each assembly.

Thus, MMD estimates should be limited to prelaunch estimates that are based on the contractual design life. After launch, any adjustments to lifetime limits or wearout life should employ MLE. Table 2 lists the MMD requirement, design life, and current life estimate (MLE, when available) for all GPS versions to date.

II and IIR Lifetime

GPS Block II SVs have exceeded all MMD and lifetime requirements with one exception. With several SVs still on-orbit, GPS Block IIA SVs have already exceeded all MMD and lifetime requirements, with one exception.

All 13 Block IIR SVs have been launched. To date, no on-orbit IIR SVs have been disposed due to final failure. The oldest Block IIR SV, SVN-43, is now more than 13 years old. The youngest, SVN61, is almost six years old.

The lifetime prediction of the IIR SVs has been examined, incorporating component failures into the reliability prediction. The original MMD requirement was specified at six years, with a design life of 7.5 years and an expendables life of 10 years. Analysis suggests that the GPS Block IIR SVs will exceed all MMD and lifetime requirements.

When analyzed for an expected 15-year lifetime, the current IIR MLE exceeds 14 years. This incorporates all the on-orbit failures experienced to date. As of this writing, there have only been a few failures resulting in components being reconfigured to the redundant sides. Only one of these has been for a RAFS. Thus, 35 RAFS clocks remain on 12 IIR SVs. This bodes well for IIR lifetime: clocks will not be a life-limiting item.

So far, only two IIR SVs have experienced reaction-wheel assembly (RWA) problems. These issues were of an electrical nature as opposed to the lubrication issues on earlier vehicles. The wheels stuck when transitioning through null regions while reversing spin direction. Subsequently, these wheels have been revived through a software modification. A patch to the bus computer software enabled recovery of the stuck RWAs. Thus, there was no loss of reaction wheel redundancy on these SVs.

For IIR, excluding random failures, current evidence suggests the most likely life-limiting item will be battery capacity, or the combination of battery capacity and solar-array output power. This limitation of IIR SV life will not occur any time soon. During eclipse seasons — twice per year with the GPS orbit — solar arrays must support normal vehicle power requirements, in addition to fully recharging the batteries prior to entering the next eclipse. Though estimating future battery performance is difficult, recent studies conclude an expected battery life of up to 18.5 years for IIR and 12 years for IIR-M.

The IIR robust lifetime comes from following military standards, employing tight limits on parts selection, and executing a thorough testing program.

IIR-M Lifetime

All eight Block IIR-M SVs have been launched. To date, no IIR-M SVs have been disposed due to final failure. The oldest is SVN-53 at just over five years of age; the youngest is the recently launched SVN-50 at just over one year. SVN-49, on orbit, awaits being set healthy to users. Optimism remains that it will eventually have a long successful life serving the user community.

IIR-M MMD, design life, and expendables requirements are the same as for IIR SVs. However, the life longevity is expected to be shorter than IIR due to the higher transmitter power requirements on IIR-M for the new modernized signals and the associated higher electrical power demands and thermal profile. Analysis (summarized in the next section) suggests that the GPS Block IIR-M SVs will exceed all MMD and lifetime requirements. The IIR-M expected life (MLE) exceeds nine years when analyzed for a 10-year lifetime.

IIR Special Study Results

Three recent studies have shown increased lifetime prediction for Block IIR: the Limited Life Components Analysis (LLCA) study, conducted with the Aerospace Corporation, the Power Consumption study, and the updated IIR Reliability analysis.

The 2007–2008 LLCA sought to determine possible areas that might limit the maximum life of the vehicle. It analyzed solar array degradation, battery charging capacity degradation, orbital environment degradation of certain transistors in the RAFS units, and the general reliability analysis of the IIR and IIR-M as expressed in the MLE. Table 3 summarizes study results.

There was no issue with environmental radiation due to the shielding on select transistors within the RAFS. The solar-array degradation model tracks well, with the trend showing adequate power supply for 15–20 years, and battery capacity still exceeds the expected SV reliability.

Enhanced Low-Dose Radiation Sensitivity (ELDRS) is a concern for the degradation of certain types of transistors when held in an unpowered state on-orbit. This situation has been suspected for GPS Block IIA AFS units when they are not powered on for many years in the severe radiation of the MEO environment. Redundant AFS (2–3 per GPS SV) are kept in an unpowered condition until required to replace the primary unit. The ELDRS analysis performed in this study showed no vulnerability of the IIR RAFS to this degradation due to the presence
of adequate radiation shielding in the unit.

Another limiting factor examined during the LLCA study focused on battery degradation. The study developed a degradation model showing adequate battery performance margin for the SV life. But it is acknowledged that the IIR low-level trickle charge rate employed during the non-eclipse portion of the year may heat the battery cells somewhat more than optimal. It would be preferred to cut the trickle charge rate in half. The battery degradation model, developed by the Aerospace Corporation, suggests that this reduction in charge rate would add two years of life to each IIR and IIR-M SV, except the few oldest. A study is currently underway to demonstrate the feasibility of this change.

The updated solar array degradation model developed during the study suggests that the power production will be more than adequate over the predicted lifetime of both the IIR and IIR-M SVs. On-orbit solar array capability tests on several SVs has begun, with results confirming the predictive analysis. It is expected that this on-orbit capability test will eventually be expanded to all IIR SVs as part of normal on-orbit monitoring. See Figure 2 for a plot of the solar array power capacity trend for SVN-43 over 13 years. The power capacity degradation per year decreases as the arrays age.

Finally, the on-board fuel budget shows more than adequate margin to fully meet mission needs for all SVs, including station-keeping maintenance and disposal operations. Thus, component failure — failure of a final redundant box — is still the primary concern for IIR and IIR-M final failure. Random component failures represent the most likely cause of IIR and IIR-M SV loss.

IIF Lifetime Requirement

The first IIF SV was launched in May 2010. Eleven others will be launched in the next four years. The Block IIF will primarily replace well-used and over-age IIA SVs. For each new IIF launched, a PRN must be taken away from an on-orbit asset. The old SV may be disposed due to final failure, or it may be maintained in its GPS orbit as a spare, should it have capability remaining.

The IIF SV has MMD and design life requirements of 9.9 and 12 years, respectively. This is several years beyond that required of all earlier GPS SVs. Obviously, the new IIF SV has no track record yet, but analysis by the contractor and USAF suggests that the GPS Block IIF SVs will exceed all MMD and lifetime requirements.

IIIA Lifetime Requirement

The GPS IIIA contract was awarded in May 2008, and the Critical Design Review was completed in August 2010, two months ahead of schedule. Long lead part acquisition and subsystem build have started. The first launch is still targeted for May 2014. Analysis presented at the GPS IIIA SV CDR currently predicts that the GPS IIIA SVs will exceed all MMD and design life requirements of 12 and 15 years.

The GPS IIIA System Design Review occurred in March 2007, just prior to the expected release of the final RFP. The delay of the final RFP release until July and contract award decision postponement until May 2008 were two final delays which directly affect the tight schedule for first launch. The IIIA schedule suffered from these delays on top of the extended proposal activity from 2002–2008.

Despite these delays, IIIA benefits now from the numerous risk reduction and systems engineering efforts performed in the interim. Also, the IIIA design leverages significant design maturity from the A2100 satellite bus, the IIR-M SV heritage, and the fact that Lockheed Martin’s navigation payload subcontractor, ITT, has provided navigation payload components on every GPS SV to date.

Since the GPS III production looks to be on schedule, the worst thing that could happen would be an acquisition delay or reduction of the SVs necessary to keep the constellation robust. This could well bring the GAO report’s worst-case predictions to pass in a few years.

Another primary GAO conclusion was that “[the GPS IIIA development] schedule is optimistic, given the program’s late start, past trends in space acquisitions, and challenges facing the new contractor.” But Lockheed Martin and ITT built 21 IIR and IIR-M SVs and bring significant GPS experience to the GPS III design and development — a major benefit to keeping the program on schedule.

Constellation Sustainment

The 20 IIR SVs will form the backbone of the constellation for many years to come. But GPS constellation sustainment will depend on all GPS SV types operating together. The 12 IIF SVs will generally replace the older IIA SVs, and the new GPS IIIA SVs will begin launching in 2014 to initially replace older IIR SVs and eventually supplement the constellation beyond 32 SVs. GPS IIIA SVs will be able to broadcast on PRNs as high as 63, though there may be some delay before the Control Segment (CS) can monitor these modernized capabilities and before users are equipped to use them.

Figure 3 shows a projection of GPS constellation size over the next decade as Block IIR provides the foundation, while IIF and IIIA replace older SVs or add to the size. This figure gives a prediction of constellation health over the next 10 years, considering IIA failures, IIF life, IIR failures, and III life. It suggests a busy operations tempo of disposing of at least one old SV to free up a PRN in time for the launch of a new SV, to maintain constellation strength while reducing the number of extremely old SVs. Moving an SV to spare status slightly relaxes this tempo. Should GPS III SVs be unavailable or significantly delayed (for example, due to boosters), the constellation health will definitely suffer.

In addition to the general long-life predictions, on-orbit SVs can have their operational life extended through employment of various options. Power management is available to extend SV useful life for the navigation and timing community. On Block IIA and Block IIR SVs, this is limited to turning off non-navigation boxes. This is always an option if the available solar array power or battery capacity threatens limiting the legacy signal capabilities. This has been employed on Block IIA SVs with the benefit of extending the SV life by several years. It is expected that this technique will be used periodically on all SV versions in the future.

On Block IIR-M SVs, reducing the L-band broadcast power (that is, turning off the modernized signals) is an option. Analysis in a recent MMD report shows that this would add several years (2–4) to IIR-M SV life. This would probably be the first step of several available to extended IIR-M life.

Current Operations

Regular IIR and IIR-M operati
ons start with the normal daily navigation data uploads, routine telemetry collection, and memory dumps as for all GPS SVs. Other on-orbit support for IIR and IIR-M SVs consists of a variety of periodic operations from orbital repositioning and minor hardware reconfiguring, to data and computer program updates of the on-board processors. When necessary, anomaly investigation support is provided for any issue or event with causes or could potentially cause an SV outage.

To maintain proper constellation coverage and proper relative spacing of the SVs, orbital repositioning maneuvers are performed regularly on almost all SVs to counteract the effects of the normal orbital perturbations and natural in-plane acceleration. Occasionally, rephasing maneuvers are performed to move an SV to a new orbital location. Approximately 15 orbital maneuvers are performed per year for the 20-SV IIR/IIR-M subconstellation.

The SV communication mode for command and telemetry is occasionally modified temporarily to avoid communication conflicts with nearby SVs. Also, certain heaters must be enabled during a portion of the year to avoid excessive cooling.

The bus and the navigation processors on the IIR/IIR-M SVs are both reprogrammable on-orbit. This includes program updates and data changes. Flight computer maintenance has required an update every year or so. The bus computer has seen eight sets of patch updates to date. The navigation computer has been reprogrammed approximately every two years (patches are not used here). These updates have provided adjustments to current capability, including accommodating degraded hardware component performance, allowing them to perform nominally. Other updates have enabled enhanced capabilities on the SVs.

The navigation computer program was updated for a number of items including time-keeping system (TKS) loop stability and data collection for offline performance analysis. This has avoided numerous outages due to clock jumps. RAFS frequency drift adjustments must be performed occasionally. All clocks are monitored and uploaded as required.

Data parameter updates to the bus computer occur occasionally to accommodate Earth/lunar eclipse pair issues and other purposes. Backup ephemeris data uploads are performed on every IIR/IIR-M SV every 10 months. Occasional events caused by the space weather environment must be tracked and addressed using data provided by on-board data monitors. Memory dumps and buffer dumps are performed daily on every SV.

The bus computer processing was enhanced by adding a rolling buffer for telemetry data collection when out of contact with the CS. This high-fidelity data collection recently has been used to collect battery performance information during an investigation into battery performance degradation.

The IIR-M SV provides legacy signals just like a IIR SV, and many of the operations are similar, but modernized signals require unique operations for
IIR-M. To date, these capabilities have been accomplished on the non-modernized CS by using work-arounds. Full modernized capability and signal monitoring will come online with the GPS Advanced Control Segment (OCX).

The new M-code signal has only been used to date for MUE development and test, but L2C-capable civilian receivers have been sold on the market since before the first IIR-M SV launch in 2005. Users equipped with such recievers now have seven IIR-M and one IIF SV to provide half of the ionospheric correction from tracking the new signal. The remainder of the correction may not be available until the OCX deployment, when regular inter-signal correction (ISC) data gets modulated on the L2C signal.

Users generally do not think much about GPS SV operations unless it affects the performance they experience. Block IIR and IIR-M SVs have shown significant performance improvement to users in accuracy and availability over the years, indicating that longer IIR life will benefit users by providing good-performing SVs which will last a long time.

Figure 4 shows GPS accuracy over 13 years, tracking the daily peak estimated range deviation (ERD) trend. The trend has improved partly due to system improvements (both CS and Space Segment), partly due to more IIR RAFS and fewer older AFS, and partly due to RAFS maturation (the guess is that this is due to physics package stabilization within the RAFS). The full constellation accuracy has also improved from using additional National Geospatial-Intelligence Agency (NGA) monitor stations, and other Accuracy Improvement Initiative (AII) improvements to the CS.

Concerning SV availability, General Kehler, commander, AFSPC, stated at the congressional hearing on the GAO report, “[S]ince we declared Full Operational Capability in 1995, the Air Force has maintained the constellation above the required 24 GPS satellites on orbit at 95 percent.” Figure 5, a plot of the number of SVs from 1995 FOC to present day, shows this claim is accurate.

There have been no occasions when the constellation size dipped below 24 SVs, and there were only a few times in the mid-1990s with a few SVs briefly set unhealthy due to maintenance or anomalies when there were fewer than 24 available SVs. Very rarely has it been as low as 25 SVs. Only once since late 2006 has the number of available SVs dropped as low as 27. This doesn’t take into account the spare SVs that may still have some life left, if required.

Future Operations

Consideration of options for future operations include assistance for aging IIR SVs and any CS changes that could help the older SVs. Ideas have been explored, such as crosslinking clock timing data from other SVs if all clocks fail on a particular SV.

It is expected that the past flight software update pace will need to continue into the future, both for the bus computer and for the navigation computer. This will likely be necessary to address SV hardware issues, CS updates (Architecture Evolution Plan [AEP] and the OCX), as well as compatibility with other future SVs (IIF and III). The OCX will bring to the IIR-M SVs command of the full modernized capabilities. This includes modulation of modernized data on the new signals, full employment of the new signal structure, and signal monitoring of the new signals at the USAF monitor stations. It is expected that most IIR-M SVs will be around for this.

As has been seen with earlier SV blocks, future IIR and IIR-M availability may degrade somewhat as the SVs age, but the quality support from the Second Space Operations Squadron (2SOPS) and the flexibility of the SVs should minimize any significant outage periods.

Having Block IIR SVs last longer will potentially allow for more SVs on-orbit providing greater coverage. More SVs will also allow for additional lower elevation SVs to be masked by the user equipment and thus avoid local obstructions.

Conclusion

The data and analysis presented here show no single point of vulnerability for the existing IIR and IIR-M on-orbit SVs. Lessons learned from older SVs have been applied to make later
blocks more robust. IIR SVs have been studied thoroughly with no obvious life-limiting mode identified at this point. Robust and flexible SV design suggests long life for these SVs.

Based on this analysis and performance, it is expected that IIR and IIR-M SVs will meet and exceed MMD and design life requirements, with some SVs lasting more than 20 years. This will form the backbone of the constellation well into the next decade and mesh well with GPS III.

While the dire forecast of the GAO report will not come to pass, it is important to follow the guidance of the new National Space Policy of June 2010 to maintain U.S. preeminence in space: “The United States must maintain its leadership in the service, provision, and use of global navigation satellite systems (GNSS).” This can be accomplished by maintaining the steady course which has proven so fruitful to date. If more SVs are wanted, then there might be the option to build the simplified GPS III, the “IIIS,” as recommended by Brad Parkinson.

Acknowledgments

The authors thank Pete Barrell, Jim Martens, Joe Trench, Don Edsall, Kim Kruis, Amanda Keith, Wayne Rasmussen, Mark Merwin, Sam Bryant, Jeff Holt, and Chris Krier all of Lockheed Martin, Jeff Harvey of ITT, and Mike O’Brine of Aerospace for their contributions and comments on this work. A longer version of this article was presented at the ION-GNSS 2010 conference.

WILLARD MARQUIS is a senior staff systems engineer with Lockheed Martin’s GPS IIR and GPS III Flight Operations Group. He has a masters degree in aeronautics and astronautics from the Massachusetts Institute of Technology.

J. DAVID RIGGS is a staff systems engineer with Lockheed Martin Space Systems GPS IIR Flight Operations Group. He has an M. S. in electrical engineering from Colorado Technical University.