Instability of Self-Driving Satellite Mega-Constellation: From Theory to Practical Impacts on Network Lifetime and Capacity

Computer Science > Networking and Internet Architecture

[Submitted on 10 Jun 2024]

Yimei Chen, Yuanjie Li, Hewu Li, Lixin Liu, Li Ouyang, Jiabo Yang, Junyi Li, Jianping Wu, Qian Wu, Jun Liu, Zeqi Lai

Low Earth Orbit (LEO) satellite mega-constellations aim to enable high-speed Internet for numerous users anywhere on Earth. To safeguard their network infrastructure in congested outer space, they perform automatic orbital maneuvers to avoid collisions with external debris and satellites.

However, our control-theoretic analysis and empirical validation using Starlink's space situational awareness datasets discover that, these safety-oriented maneuvers themselves can threaten safety and networking via cascaded collision avoidance inside the mega-constellation. This domino effect forces a dilemma between long-term LEO network lifetime and short-term LEO network capacity. Its root cause is that, the decades-old local pairwise maneuver paradigm for standalone satellites is inherently unstable if scaled out to recent mega-constellation networks.

We thus propose an alternative bilateral maneuver control that stabilizes self-driving mega-constellations for concurrent network lifetime and capacity boosts. Our operational trace-driven emulation shows a 8× network lifetime extension in Starlink without limiting its network capacity.

Subjects:	Networking and Internet Architecture (cs.NI)
Cite as:	arXiv:2406.06068 [cs.NI]
	(or arXiv:2406.06068v1 [cs.NI] for this version)
	https://doi.org/10.48550/arXiv.2406.06068

Submission history

From: Yimei Chen [view email]
[v1] Mon, 10 Jun 2024 07:23:20 UTC (22,050 KB)

 Summary

The paper studies the instability of self-driving satellite mega-constellations and its impacts on the network lifetime and capacity of Low Earth Orbit (LEO) satellite internet networks. The key findings are:

1. Current automatic collision avoidance systems in self-driving mega-constellations, while excellent at avoiding collisions with external debris/satellites, can amplify internal collision risks via cascaded maneuvers between the constellation's own satellites. This causes a dilemma between the LEO network's long-term lifetime and short-term capacity.
2. The root cause is that the decades-old local pairwise maneuver paradigm, where each satellite only responds to its most imminent collision risk, is inherently unstable when scaled to mega-constellations. A small maneuver by one satellite propagates and amplifies hop-by-hop through the constellation.
3. The authors provide a control-theoretic analysis of this instability and empirically validate it using Starlink's space situational awareness data. Starlink's maneuver policy is shown to be unstable, causing explosive growth of maneuvers that exhaust satellites' limited fuel and shorten the network lifetime.
4. To stabilize maneuvers, inter-satellite spacing needs to be increased, fundamentally limiting the constellation's size and network capacity.
5. The authors propose bilateral maneuver control that allows stable mega-constellation self-driving without limiting network capacity. By coordinating each satellite's response to both its leading and trailing satellites, cascading can be suppressed.

In summary, the paper reveals an inherent architectural limitation of current collision avoidance approaches in self-driving mega-constellations, analyzes it theoretically and empirically, and proposes a new algorithm to enable stable and scalable satellite networks. The findings have important implications for the design of the growing number of planned LEO internet mega-constellations.

arxiv.org

Instability of Self-Driving Satellite Mega-Constellation

Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing 100084, China

132–168 minutes

---

From Theory to Practical Impacts on Network Lifetime and Capacity

Yimei Chen, Yuanjie Li, Hewu Li, Lixin Liu, Li Ouyang, Jiabo Yang, Junyi Li,
Jianping Wu, Qian Wu, Jun Liu, Zeqi Lai

Abstract.

Low Earth Orbit (LEO) satellite mega-constellations aim to enable high-speed Internet for numerous users anywhere on Earth. To safeguard their network infrastructure in congested outer space, they perform automatic orbital maneuvers to avoid collisions with external debris and satellites. However, our control-theoretic analysis and empirical validation using Starlink’s space situational awareness datasets discover that, these safety-oriented maneuvers themselves can threaten safety and networking via cascaded collision avoidance inside the mega-constellation. This domino effect forces a dilemma between long-term LEO network lifetime and short-term LEO network capacity. Its root cause is that, the decades-old local pairwise maneuver paradigm for standalone satellites is inherently unstable if scaled out to recent mega-constellation networks. We thus propose an alternative bilateral maneuver control that stabilizes self-driving mega-constellations for concurrent network lifetime and capacity boosts. Our operational trace-driven emulation shows a 8$\times$ network lifetime extension in Starlink without limiting its network capacity.

1. Introduction

(a) Space congestion

(b) Maneuvers’ impacts on satellite networks

(c) Starlink’s constellation scale and maneuver growth over time

Figure 1. Unstable automatic orbital maneuvers and their impacts on satellite mega-constellation networks.

Low Earth Orbit (LEO) satellite mega-constellation networks are revolutionizing the future Internet. Powered by 1,000–10,000s satellites with ultrahigh-capacity wireless links, they aim to enable broadband Internet access to the remaining 2.6 billion “unconnected” users (underserved-user, ) anywhere on Earth. Thanks to recent technological advances in satellite miniaturization and rocket reusability, this vision has gained traction from considerable industrial efforts like Starlink (starlink, ), OneWeb (oneweb, ), Amazon Kuiper (kuiper, ), Iridium (iridium-constellation, ), Inmarsat (inmarsat-leo, ), and more.

In this work, we ask a simple question: Can LEO mega-constellations retain sustainable high-speed Internet access to numerous users at scale? Our study is motivated by the rule of thumb that, while a large system like the mega-constellation network can expand its capacity by adding more satellites, such a scale-out expansion is often associated with inherent system complexity hurdles for its scalability and robustness. It is open to question whether mega-constellations can always sustain their rapid network capacity expansions today to serve more and more users for revenues and social goods.

This paper studies the question from a unique perspective of LEO mega-constellation networks: autonomous driving. Compared to terrestrial networks, LEO satellites operate in the harsh, congested outer space. As shown in Figure 1a, they are surrounded by countless space debris and third-party satellites (debris-number, ). This leads to unprecedented satellite collision risks for the LEO network infrastructure. To this end, the latest LEO mega-constellations have installed self-driving systems for their satellites to sense space collision risks and avoid them via maneuvers (starlink-maneuver, ; starlink-maneuver-2, ). So far, these systems have successfully safeguarded mega-constellations via 10,000s of maneuvers every half year (starlink-semi-annual-2021-7, ; starlink-semi-annual-2021-12, ; starlink-semi-annual-2022-7, ; starlink-semi-annual-2022-12, ; starlink-semi-annual-2023-6, ; starlink-semi-annual-2023-12, ) (Figure 1c), thus seeming to facilitate reliable and performant network infrastructure.

Unfortunately, we find that these self-driving systems can be a double-edged sword for safety and networking. While excellent in avoiding collisions with external debris/satellites, they can also amplify internal satellite collision risks inside a mega-constellation. This phenomenon has been evidenced in Starlink’s official semi-annual reports (starlink-semi-annual-2021-7, ; starlink-semi-annual-2021-12, ; starlink-semi-annual-2022-7, ; starlink-semi-annual-2022-12, ; starlink-semi-annual-2023-6, ; starlink-semi-annual-2023-12, ) and our empirical results in Figure 1c (detailed in $\mathrm{\S }$3). They unveil an explosive growth of Starlink’s maneuvers that significantly surpasses its satellite growth. This explosive maneuver growth can magnify satellite network connectivity/service interruptions (mobicom23li, ; peiro2000galileo, ; esa-gsl-disruption-in-maneuver, ; starlink-degraded-service-congestion, ) and distortion of nominal satellite distributions in the mega-constellation (fan2017ground, ; aorpimai2007repeat, ; kim2021maintaining, ), both being well-known threats to satellite missions. Surprisingly, most maneuvers occur among Starlink’s own satellites, contrasting with its claim in (starlink-maneuver-2, ) that its careful mega-constellation design has deconflicted most internal satellite collisions.

To understand this counter-intuitive phenomenon, we propose a control-theoretic framework to characterize the structural properties of automatic orbital maneuvers in mega-constellations and their impacts on networking. We formally prove that this phenomenon is rooted in the endogenous instability of self-driving mega-constellations (rather than specific to Starlink only). To scale space collision avoidance to numerous satellites, most operators follow the decades-old local pairwise maneuver paradigm (krage2020nasa, ; operator-handbook, ; alfano2005numerical, ; probe2022prototype, ; brown2014simulated, ): Each satellite will only maneuver in response to its most risky upcoming conjunction with another satellite/debris each time. While reasonable and cost-effective for each satellite, this local maneuver’s overall global effect is the undesirable cascaded collision avoidance: A maneuver for external collision avoidance will move a satellite closer to its neighboring satellites inside the mega-constellation, which increases its internal collision risk and forces its neighboring satellite to maneuver further. This domino effect amplifies hop-by-hop inside the mega-constellation, leading to the explosive maneuver growth in Figure 1c. Our control-theoretic analysis in $\mathrm{\S }$4 and empirical validation using Starlink’s large-scale space situational awareness datasets in $\mathrm{\S }$5 show that, this instability threatens LEO networks in at least two aspects (Figure 1b):

1. (1)
2. (2)

   Network capacity: To save the LEO network lifetime, one could configure its local pairwise maneuver policy for stabilization. However, we prove this effort will unavoidably increase collision risks and force larger inter-satellite safe distance, thus throttling the satellite network scale and capacity to serve more users.

(a) LEO satellite constellation

(b) The need for mega-constellation.

Figure 2. LEO satellite mega-constellation network.

Our study further sheds light on how to avoid unstable maneuvers and bypass the above dilemma between LEO network lifetime and capacity. The key is to depart from local pairwise maneuvers to global maneuver coordination among satellites. Its challenge, however, is the coordination complexity when scaled out to the mega-constellation. To this end, we simplify the global maneuver coordination to the distributed, network-friendly bilateral maneuver control ($\mathrm{\S }$6). By incrementally adding a local backward control to the existing pairwise maneuvers, this method can provably decouple local collision avoidance (which limits LEO network capacity) from global maneuver stability (which impacts LEO network lifetime) for their concurrent satisfaction. Our operational trace-driven emulation shows that it can expand Starlink’s lifetime by 8$\times$ without limiting its total capacity.

Ethics: This work does not raise any ethical issues.

2. Self-Driving Mega-Constellation

We introduce the LEO mega-constellation networks ($\mathrm{\S }$2.1), their congested operation environment in outer space ($\mathrm{\S }$2.2), and how they enforce safety via automatic maneuvers ($\mathrm{\S }$2.3).

2.1. The LEO Mega-Constellation Network

LEO networks complement terrestrial networks to enable broadband Internet access in under-served areas. As shown in Figure 2, each LEO satellite runs at an altitude of 340–2,000 km. It equips ultrahigh-capacity radio links (e.g., 240 MHz Ku-band OFDM link (humphreys2023signal, ) with 15–60 Gbps capacity (starlink-capacity-official, ; satellite-capacity-2, ; satellite-capacity, ) per Starlink satellite) to serve a vast amount of users. Since each LEO satellite only has a finite coverage, a constellation of satellites is necessary to form a global Internet coverage.

To offer ubiquitous network services, a small constellation with 10s of LEO satellites suffices for global coverage (e.g., 66 satellites in Iridium (iridium-constellation, )). But a small constellation does not have sufficient capacity to meet vast global users’ demands for high-speed Internet. To this end, mega-constellations with 1,000s–10,000s of satellites have been under rapid deployments to expand the LEO network capacity: With around 5,200 active LEO satellites, Starlink has provisioned a 165 Tbps total network capacity (spacex-total-capacity, ) for 2.3 million users in 70 countries (starlink-subscribers, ) to offer 25–220 Mbps data speed per user (starlink-performance-spec, ).

Of course, the LEO network capacity does not always grow with the mega-constellation scale. For example, due to radio link interference among satellites, the LEO network capacity would start to saturate or even decrease if scaled to around 30,000 satellites (jia2021uplink, ), which is luckily still far beyond operational mega-constellations’ sizes today. Instead, we reveal a more critical limiting factor of the LEO network capacity that today’s mega-constellations are already experiencing.

2.2. The Congested Low Earth Orbits

The recent rocket-fast deployment of mega-constellations has congested low Earth orbits and jeopardized space safety. To date, there have been around 32,680 pieces of space debris and 14,450 satellites (debris-number, ) at about 27,000 km/h in LEOs. Every fast-moving satellite is at high risk of physical collisions with debris or other satellites. Once collided, the satellite can break up into 10s–1,000s more pieces of debris to worsen orbit congestions and stimulate more collisions. This phenomenon, called Kessler syndrome (kessler2010kessler, ), has occurred in the past decade (collision-example-yunhai, ; collision-example-Fengyun, ) and severely threatened Starlink’s satellite safety (starlink-semi-annual-2021-7, ; starlink-semi-annual-2021-12, ; starlink-semi-annual-2022-7, ; starlink-semi-annual-2022-12, ; starlink-semi-annual-2023-6, ; starlink-semi-annual-2023-12, ) and network service quality (starlink-degraded-service-congestion, ).

2.3. The Automatic Collision Avoidance

To strive for LEO network infrastructure safety in congested orbits, satellite operators should forecast collision risks and instruct their satellites to maneuver for collision avoidance. They track their satellites’ orbital motions using onboard GPS or terrestrial radars (sharma2000space, ; utzmann2014space, ; SBSS, ; maskell2008sapphire, ), publicize them to the U.S. Space Surveillance Network (SSN) as fine-grained ephemeris or coarse-grained two-line elements (TLEs) (tle, ) in Figure 3, and pull other debris and satellites’ orbital traces from SSN. With these data, they follow the method in Appendix A to assess the pairwise collision risk between their satellite and every other space object (measured in the miss distance or collision probability $P_c$). This forms pairwise conjunction reports (ccsds-cdm, ; krage2020nasa, ) in Figure 3 exchanged between operators.

If a satellite’s most risky upcoming conjunction with another object exceeds its predefined safety threshold ($P_c\ge {10}^{-4}$ in NASA (krage2020nasa, ) and more stringent $P_c\ge {10}^{-5}$ in Starlink (starlink-maneuver, )), it should maneuver for collision avoidance. The common method is to slightly adjust its velocity using its propulsion system to avoid concurrent arrivals at the orbit intersection with the other object (analogous to acceleration/deceleration in terrestrial driving). This method is energy-efficient and keeps this satellite in its legacy orbit for mission integrity (sanchez2006collision, ). In rare cases when this conjunction will happen soon, the satellite may run emergency maneuvers by quickly raising/lowering its orbit for collision avoidance (analogous to lane change in terrestrial driving), which is uncommon due to its more fuel costs and mission interruptions (mobicom23li, ; leonet23zhao, ).

Before LEO mega-constellations emerged, most satellite operators manually planned maneuvers at the remote control center. This method is not scalable or responsive to mega-constellations with many fast-moving LEO satellites. Instead, recent constellations like Starlink (starlink-maneuver, ; starlink-maneuver-2, ) and NASA Starling (nasa-starling, ; probe2022prototype, ; brown2014simulated, ) have installed automatic maneuver systems in their satellites (Figure 3). These systems have been proven successful in scaling to mega-constellations: As officially reported in (starlink-semi-annual-2021-7, ; starlink-semi-annual-2021-12, ; starlink-semi-annual-2022-7, ; starlink-semi-annual-2022-12, ; starlink-semi-annual-2023-6, ; starlink-semi-annual-2023-12, ) and plotted in Figure 1c, Starlink has performed 10,000s of maneuvers every half year.

3. Cascaded Collision Avoidance

While self-driving mega-constellations excel in avoiding collisions with external satellites/debris, we find their current maneuver paradigm can also amplify collision risks via internal cascaded maneuvers. This forces a dilemma between the LEO network’s long-term lifetime and short-term capacity. We introduce this phenomenon ($\mathrm{\S }$3.1), analyze its root cause ($\mathrm{\S }$3.2), and validate its existence/popularity in Starlink ($\mathrm{\S }$3.3).

Figure 3. Starlink’s automatic collision avoidance (starlink-maneuver, ; starlink-maneuver-2, ).

3.1. An Illustrative Example

Figure 4. An example of cascaded collision avoidance in a self-driving mega-constellation (online video at (cascaded-maneuver-annimation, )).

Figure 4 exemplifies the cascaded collision avoidance in a self-driving satellite mega-constellation’s orbital shell. LEO satellites in this orbital shell move at a homogeneous velocity (measured in the angular mean motion (mean-motion, )) due to their identical orbital parameters. To avoid collisions, they have been separated by an appropriate safe distance (measured in their relative phase differences $\mathrm{\Delta }{\theta }_i$ in the orbital shell) during the mega-constellation design phase (starlink-maneuver-2, ). Therefore, despite their fast mobility, LEO satellites inside the mega-constellation are not supposed to collide ideally.

Now, consider the situation when one of these satellites (marked red in Figure 4) is approached by a 3rd-party satellite or external debris, which is common in congested LEOs ($\mathrm{\S }$2.2). To avoid collisions, this satellite often accelerates/decelerates in orbit to prevent concurrent arrivals at the intersection with the external object ($\mathrm{\S }$2.3). In reality, most of these maneuvers have minimized their velocity and altitude change (typically 0.2–1 km (fernandez2021impact, )) to save satellites’ energy (probe2022prototype, ; brown2014simulated, ; sanchez2006collision, ), thus seemingly harmless to the mega-constellation and network.

However, this maneuver for external collision avoidance can trigger cascaded internal collision risks. During the above acceleration/deceleration, the red satellite in Figure 4 also incurs relative motions to its neighboring satellites inside the mega-constellation. This relative motion shortens its intra-constellation safe distance $\mathrm{\Delta }{\theta }_1$ and raises collision risks with its neighbor. To this end, the neighboring satellite may also locally maneuver to enlarge its safe distance $\mathrm{\Delta }{\theta }_1$, which, however, incurs further relative motions to later satellites and shortens their safe distance $\mathrm{\Delta }{\theta }_2$. This effect will propagate across satellites hop by hop inside the mega-constellation and cause cascaded maneuvers in Figure 4. Since most satellites tend to adopt aggressive collision avoidance criteria for their own safety ($\mathrm{\S }$2.3), a small change of intra-constellation safe distance $\mathrm{\Delta }{\theta }_i$ can easily satisfy these criteria and trigger cascaded maneuvers. The denser satellites a mega-constellation comprises, the shorter the safe distance and the more maneuver propagation hops these satellites will have. So, the more frequent and exhaustive these cascaded maneuvers will be.

Cascaded maneuvers are undesirable to the LEO mega-constellation network in various aspects:

(1) Given limited fuels, each satellite can only perform finite collision avoidance maneuvers (e.g., 350 times in Starlink (starlink-maneuver-lifetime, )). Afterward, it will be permanently deorbited for space safety (starlink-maneuver, ; starlink-maneuver-2, ). Cascaded maneuvers exhaust all satellites’ maneuver budgets and shorten the LEO network lifetime.

(2) Most satellites cannot provide network services during maneuvers. A maneuvering satellite’s orientation change causes its antennas to temporarily lose alignment with the ground stations or terminals (kepler-gsl-disruption-in-maneuver, ). Similarly, maneuvers can also disrupt optical inter-satellite links via out-of-alignments (mobicom23li, ). In reality, each maneuver-induced satellite connectivity disruption can last for hours (peiro2000galileo, ; esa-gsl-disruption-in-maneuver, ). Cascaded maneuvers amplify this connectivity disruption’s frequency.

3.2. The Root Cause

The root cause of cascaded maneuvers lies in each satellite’s local pairwise collision avoidance. As a decades-old paradigm starting from NASA (krage2020nasa, ; operator-handbook, ; alfano2005numerical, ; probe2022prototype, ; brown2014simulated, ), each satellite only assesses its own upcoming collision risks and maneuvers locally. As shown in $\mathrm{\S }$3.1, while this local action is reasonable and cost-effective for each satellite, its overall effects become undesirable for the global mega-constellation and network.

Figure 5. The LEO network lifetime-capacity dilemma due to cascaded internal collision avoidance.

From the control system perspective, this phenomenon can be viewed as an unstable cascaded control. As shown in Figure 5, each satellite’s local maneuver is a function that outputs its orbital motion deceleration (hence velocity/altitude change) in response to its safe distance and relative velocity to its closest neighboring satellite. Its deceleration output will update all neighboring satellites’ safe distances (i.e., the input of their local maneuver policies), thus forming a cascaded transfer. If each transfer slightly amplifies the next satellite’s safe distance (Figure 5b), then any small maneuver by external debris/satellite will be propagated and amplified hop by hop. As we will empirically show in $\mathrm{\S }$3.3 and $\mathrm{\S }$5, this is common in reality because most satellites tend to enlarge their safe distances to prioritize their own safety.

To stop this undesirable amplification effect, an obvious fix seems to force each satellite’s local maneuver to output a smaller deceleration compared to its inputs. But as shown in Figure 5c, this fix raises internal collision risks since the inter-satellite spacing decreases hop by hop. To avoid collisions, the inter-satellite spacing inside the mega-constellation must be large enough to tolerate safe distance reductions. This mandates sparser satellite distributions, thus limiting the mega-constellation scale and its LEO network capacity ($\mathrm{\S }$2.1).

Another possible solution is to shift to global maneuver coordination among all satellites using a central controller. While seemingly effective, this option has two issues: (1) Scalability: Coordinating all satellites’ maneuvers in a mega-constellation has been proven computationally intractable (brown2014simulated, ), which motivated distributed collision avoidance systems in the last decade (starlink-maneuver, ; starlink-maneuver-2, ; nasa-starling, ; probe2022prototype, ); (2) Responsiveness: The central controller at ground stations may not always be able to reach every fast-moving satellite for timely coordination.

3.3. Real-World Instances in Starlink

(a) By NASA’s TROPICS satellite (amplification factor=22)

(b) By COSMOS 1408 debris (amplification factor=27)

Figure 6. Starlink’s internal cascaded maneuvers in reality triggered by external 3rd-party satellites and debris.

We find that cascaded collision avoidance indeed occurs at an alarming frequency in Starlink, the largest operational LEO satellite mega-constellation network. This section showcases it using our space situational awareness datasets in $\mathrm{\S }$5.1. We leave more systematic empirical validations in $\mathrm{\S }$5.

Existence of cascaded maneuvers: Figure 6 showcases two real categories of cascaded collision avoidance in Starlink:

$\circ$ Triggered by 3rd-party satellites: In May 2023, NASA launched its TROPICS satellites (nasa-tropics, ) that operate at the same altitude as Starlink’s satellites (i.e., 550 km). As shown in Figure 6a, the TROPICS-07 satellite approached the Starlink-2068 satellite at a collision probability $P_c=1.64\times {10}^{-5}>{10}^{-5}$ (i.e., Starlink’s threshold (starlink-maneuver, )) on 2023/06, thus forcing Starlink-2068 to maneuver for collision avoidance, shorten Starlink-2068’s safe distance $\mathrm{\Delta }\theta$ to its neighbor Starlink-2418, and stimulate cascaded maneuvers. It lasts 22 hops until the cumulative altitude difference between the last-hop Starlink-1578 and the Starlink-1305 satellite is large enough to separate them safely. This phenomenon partially explains NASA’s report that Starlink experienced a surge of internal conjunction events after launching TROPICS satellites (nasa-unique-conjunction-reports, ).

We further find that among these cascaded maneuvers, 97% of them occur between Starlink satellites from different orbits when approaching these orbits’ intersections (exemplified in Figure 8a). Intra-orbit collision avoidance is infrequent due to more homogeneous satellite motions in the same orbit.

(b) The minimum inter-satellite safe distance under different $F$

Figure 7. Starlink has optimized inter-satellite spacing to mitigate collision risks inside its mega-constellation.

Figure 8. Theoretical model of cascaded orbital collision avoidance in self-driving LEO satellite mega-constellations.

Aren’t they from satellite growth or constellation design defects? No. Figure 1c shows Starlink’s first-generation constellation’s internal maneuvers continue growing even when its number of satellites in orbit remains almost unchanged from 2023/06 to 2023/12¹¹1During this period, Starlink is preparing its launches of second-generation mega-constellation and stops launching first-generation satellites (starlink-launches, ).. We also empirically confirm Starlink’s claim (starlink-maneuver-2, ) that its constellation layout has been optimized to mitigate internal collisions. As shown in Figure 7, Starlink has chosen its spacing parameter $F$ in adjacent orbits (walker-constellation, ) to enlarge the minimum safe distance between satellites. Despite this great effort, Figure 1 shows that internal collision avoidance maneuvers are still common.

4. Self-Driving Stability Theory

We next build a formal control-theoretic model for cascaded collision avoidance inside the self-driving mega-constellation ($\mathrm{\S }$4.1), derive its stability condition ($\mathrm{\S }$4.2), and characterize its fundamental dilemma between satellite network lifetime ($\mathrm{\S }$4.3) and capacity ($\mathrm{\S }$4.4).

4.1. Modeling Cascaded Collision Avoidance

We consider a single orbital shell with $m$ identical orbits and $n$ identical satellites in the LEO mega-constellation, as shown in Figure 8. This model represents the most basic setting in operational mega-constellations today. In reality, satellites in the same orbital shell are manufactured and launched in batches, thus being homogeneous regarding their hardware, software, and maneuver policies. For LEO mega-constellations with multiple orbital shells at different altitudes and inclinations (e.g., Starlink (mobicom23li, )), this basic model applies independently to each shell. We next take four steps to model cascaded collision avoidance inside an orbital shell:

(1) Collision risk from external debris/satellites: Each satellite in this orbital shell is surrounded by third-party satellites and external debris. To avoid collisions with them, it may conduct orbital maneuvers to deviate from its ideal position in the orbital shell, thus changing its relative positions to its neighboring satellites in the same orbital shell.

(2) Each satellite’s internal collision avoidance: The relative position change may raise the collision risk between neighboring satellites in the orbital shell, thus triggering internal collision avoidance maneuvers. The state-of-the-art local pairwise collision avoidance paradigm in $\mathrm{\S }$2–3 finds each satellite’s most threatening space object and instructs it to maneuver. In the internal collision context, the most threatening object to each satellite inside the orbital shell is its closest neighboring satellite. We thus model the $i$-th satellite’s internal collision avoidance decision policy $F(\cdot )$ as

(1)

$${\dot{\omega }}_i(t)=F(\mathrm{\Delta }{\theta }_i(t),{\dot{\mathrm{\Delta }\theta }}_i(t),{\omega }_i(t))$$

where $\mathrm{\Delta }{\theta }_i(t)={\theta }_{i-1}(t)-{\theta }_i(t)$ is this satellite’s angular safe distance to its closest neighboring satellite at time $t$, ${\dot{\mathrm{\Delta }\theta }}_i(t)$ is the change of this angular safe distance, ${\omega }_i(t)$ is this satellite’s orbital velocity (angular mean motion (mean-motion, )), and ${\dot{\omega }}_i(t)$ is its angular acceleration for conducting internal collision avoidance maneuvers. We assume all satellites in the same orbital shell use the same internal collision avoidance policy $F(\cdot )$ due to their homogeneity. Our model allows for any general form of $F(\cdot )$ that satisfies two realistic assumptions:

1. (a)

   For safety, each satellite’s deceleration by its internal collision avoidance maneuver ${\dot{\omega }}_i(t)$ increases when its inter-satellite safe distance $\mathrm{\Delta }{\theta }_i(t)$ decreases;

2. (b)

   For safety, each satellite’s deceleration by its internal collision avoidance maneuver ${\dot{\omega }}_i(t)$ increases when its preceding satellite’s velocity ${\omega }_{i-1}(t)$ decreases.

(3) Cascaded collision avoidance chain: The above $(i-1)$-th satellite’s maneuver changes its angular velocity ${\omega }_{i-1}(t)$ and relative distance to its closest succeeding neighboring satellite $i$ in the orbital shell, thus forcing this $i$-th satellite to conduct orbital maneuvers further using the policy $F(\cdot )$ in Equation 1. In the circular orbital shell, this results in a ringed cascaded collision avoidance chain in Figure 8(b). To determine this chain, we start from the first satellite that maneuvers for external collision avoidance, find the second satellite in this chain as its closest successor regarding $\mathrm{\Delta }{\theta }_1(t)$ inside this orbital shell, iteratively repeat this process to find the $i$-th satellite as the $(i-1)$-th satellite’s closest successor regarding $\mathrm{\Delta }{\theta }_{i-1}(t)$, and stops after enumerating all satellites in this orbital shell or returning to the first satellite.

(4) Equilibrium state: To prevent wasting each satellite’s lifetime, the cascaded maneuvers should eventually stop, i.e., ${lim}_{t\to \mathrm{\infty }}{\dot{\omega }}_i(t)=0$ and ${lim}_{t\to \mathrm{\infty }}{\dot{\mathrm{\Delta }\theta }}_i(t)=0$ for all satellites $i$. At this equilibrium state, each satellite’s orbital velocity ${\omega }^{\ast }$ and inter-satellite distance $\mathrm{\Delta }{\theta }^{\ast }$ satisfy the following equation

(2)

$$F(\mathrm{\Delta }{\theta }^{\ast },0,{\omega }^{\ast })=0$$

Obviously, this equilibrium $x_e=(\mathrm{\Delta }{\theta }^{\ast },{\omega }^{\ast })$ corresponds to the ideal satellite distribution in the constellation design. We aim to understand conditions of always converging to this equilibrium state and their impacts on satellite networking.

4.2. Basic Lyapunov Stability Condition

To derive the conditions of converging to the original LEO constellation despite maneuvers, we leverage the Lyapunov stability analysis (Lyapunov-stability, ) from the control theory. We note that the convergence to the equilibrium in Equation 2 is equivalent to ensuring the asymptotic Lyapunov stability as follows:

Definition 0 (Lyapunov asymptotic stability (Lyapunov-stability, )).

The self-driving mega-constellation’s equilibrium state $x_e=(\mathrm{\Delta }{\theta }^{\ast },{\omega }^{\ast })$ in Equation 2 is saided to be asymptotically stable if for each $ϵ>0,\exists \delta =\delta (ϵ)>0$ so that if $\Vert x(0)-x_e\Vert <\delta$, then

(3)		$\Vert x(t)-x_e\Vert <ϵ,\forall t\ge 0$
(4)		$\underset{t\to \mathrm{\infty }}{lim}\Vert x(t)-x_e\Vert =0$

Intuitively, the Lyapunov asymptotic stability implies that all satellites will eventually return to the equilibrium state (i.e., the original constellation) despite any small perturbations due to external collision avoidance maneuvers. We follow this formal definition to study the stability under small orbital perturbations by external maneuvers. Consider a small perturbation of the $i$-th satellite from the equilibrium:

$${\widetilde{\mathrm{\Delta }\theta }}_i(t)=\mathrm{\Delta }{\theta }_i(t)-\mathrm{\Delta }{\theta }^{\ast },{\tilde{\omega }}_i(t)={\omega }_i(t)-{\omega }^{\ast }$$

Then we can apply the first-order Taylor series expansion to linearize this satellite’s collision avoidance policy in Equation 1 at the equilibrium state $x_e=(\mathrm{\Delta }{\theta }^{\ast },{\omega }^{\ast })$ as

(5)		${\dot{\widetilde{\mathrm{\Delta }\theta }}}_i(t)$	$=$	${\omega }_{i-1}(t)-{\omega }_i(t)={\tilde{\omega }}_{i-1}(t)-{\tilde{\omega }}_i(t)$
(6)		${\dot{\tilde{\omega }}}_i(t)$	$=$	${\alpha }_1{\widetilde{\mathrm{\Delta }\theta }}_i(t)-{\alpha }_2{\tilde{\omega }}_i(t)+{\alpha }_3{\tilde{\omega }}_{i-1}(t)$

where

(7)

$${\alpha }_1={\frac{\partial F}{\partial \mathrm{\Delta }\theta }|}_{x_e},{\alpha }_2={\left(\frac{\partial F}{\partial \dot{\mathrm{\Delta }\theta }}-\frac{\partial F}{\partial \omega }\right)|}_{x_e},{\alpha }_3={\frac{\partial F}{\partial \dot{\mathrm{\Delta }\theta }}|}_{x_e}$$

i.e., ${\alpha }_1$, ${\alpha }_2$, and ${\alpha }_3$ reflect each satellite’s maneuver policy’s sensitivity to the inter-satellite safe distance $\mathrm{\Delta }\theta$, its own orbital motion velocity $\omega$, and inter-satellite relative velocity $\dot{\mathrm{\Delta }\theta }$, respectively. The assumptions (a) and (b) of the collision avoidance policy $F(\cdot )$ in $\mathrm{\S }$4.1 implies ${\alpha }_1>0,{\alpha }_2>{\alpha }_3>0$.

Considering all $n$ satellites in each cascaded maneuver ring, we can rewrite Equation 5–6 in a matrix form. Consider all satellites’ small perturbations as a vector

$$y(t)={[{\widetilde{\mathrm{\Delta }\theta }}_1(t),{\tilde{\omega }}_1(t),{\widetilde{\mathrm{\Delta }\theta }}_2(t),{\tilde{\omega }}_2(t),\mathrm{\cdots },{\widetilde{\mathrm{\Delta }\theta }}_n(t),{\tilde{\omega }}_n(t)]}^T$$

Applying this perturbation vector to Equation 5–6 yields the global self-driving mega-constellation’s system function

(8)

$$\dot{y}(t)=Ay(t)$$

where $A$ is the $n\times n$ system matrix in Figure 8c. As a linear time-invariant system, this mega-constellation’s self-driving system is asymptotically stable if and only if all of $A$’s complex-valued eigenvalues have negative real parts (Lyapunov-stability, ). The following proposition reveals the general necessary and sufficient condition to achieve so (proved in Appendix B):

Proposition 1 (Stability condition).

The mega-constellation’s maneuver policy in Equation 8 is asymptotically stable for any size $n$ of the self-driving mega-constellation if and only if

(9)

${\alpha }_2^2-{\alpha }_3^2-2{\alpha }_1\ge 0,{\alpha }_1>0,{\alpha }_2>{\alpha }_3>0$

4.3. Instability’s Cost: Network Lifetime

If a self-driving mega-constellation violates Proposition 1, its cascaded collision avoidance will exhaust each satellite’s maneuver budgets and shorten the overall LEO network lifetime. We next quantify this from two perspectives: the microscopic maneuver transfer between satellites, and the macroscopic maneuver growth trend in the mega-constellation.

4.3.1. Microscopic View: Local Maneuver Amplification

We first derive how a satellite’s local maneuver is amplified hop by hop inside the mega-constellation. Consider the $i$-th satellite’s deviation from the equilibrium state in Equation 5–6 due to its maneuver. Since its system matrix $A$ is linear, this deviation can be always expressed as a linear combination of $A$’s exponential eigenfunctions (Lyapunov-stability, )²²2For a linear time-invariant system, its linear combination is equivalent to the discrete Fourier series (oppenheim1999discrete, ) of each satellite’s any small perturbation.. So, consider the $i$-the satellite’s velocity deviation eigenfunction

(10)

$${\tilde{\omega }}_i(t)=c_i{e}^{\lambda t}$$

where $\lambda$ is $A$’s eigenvalue and $e^{\lambda t}$ is its eigenfunction. By substituting it into Equation 5–6, we get

(11)

$${\tilde{\omega }}_i(t)=H(\lambda ){\tilde{\omega }}_{i-1}(t)$$

where

(12)

$$H(\lambda )=\frac{{\alpha }_1+{\alpha }_3\lambda }{{\alpha }_1+{\alpha }_2\lambda +{\lambda }^2}$$

is the collision transfer function that propagates the leading satellite’s motion (${\tilde{\omega }}_{i-1}$) to its follower’s (${\tilde{\omega }}_i$). As shown in Figure 5b, if $|H(\lambda )|\ge 1$, each satellite’s velocity and spacing deviation from the equilibrium state will be larger than its preceding satellite’s, thus amplifying cascaded maneuvers. In Appendix B, we prove that $|H(\lambda )|\ge 1$ is equivalent to the violation of the stability condition in Proposition 1.

4.3.2. Macroscopic View: Global Maneuver Growth Trend

Figure 9. Stability of self-driving mega-constellations under different orbital maneuver policies $H(\lambda )$.

We next switch to the global view to prove the explosive growth of orbital maneuvers when the mega-constellation’s self-driving policy violates Proposition 1. From Equation 12, the $i$-th satellite moves $|H(\lambda )|$ times faster than the $(i-1)$-th satellite due to its amplification effect in cascaded maneuvers. Assume the uniformly distributed satellites in the mega-constellation. If the first satellite takes time $t_0$ to approach the second satellite to trigger the first maneuver, then the $i$-th satellite would take $t_0/{|H(\lambda )|}^{i-1}$ time to approach the $(i+1)$-th satellite to trigger the $i$-th maneuver. Summing them together, we get the time to trigger the $N$-th maneuver:

(13)

$$t(N)=t_0\left(1-\frac{1}{{|H(\lambda )|}^n}\right)/\left(1-\frac{1}{|H(\lambda )|}\right)$$

Therefore, given a limited maneuver budget $N$, the mega-constellation’s lifetime $t$ decreases with a higher collision transfer function $|H(\lambda )|$. The total number of maneuvers $N(t)$ triggered by time $t$ can be derived from Equation 13 as

(14)

$$N(t)=\ln \left[\frac{t_0}{t_0-t(1-{|H(\lambda )|}^{-1})}\right]/\ln |H(\lambda )|$$

As shown in Figure 9, the total number of maneuvers $N(t)$ grows explosively over time when the constellation’s self-driving policy is unstable (i.e., $|H(\lambda )|\ge 1$). This trend is consistent with the observations from real space situational awareness datasets in Figure 1 and Starlink’s official reports (starlink-semi-annual-2021-7, ; starlink-semi-annual-2021-12, ; starlink-semi-annual-2022-7, ; starlink-semi-annual-2022-12, ; starlink-semi-annual-2023-6, ; starlink-semi-annual-2023-12, ). Unlike the common belief, this explosive maneuver growth can occur without adding more satellites in the mega-constellation. It exhausts all satellite’s finite maneuver budgets and dramatically shortens the entire LEO network’s lifetime, as we will empirically quantify in $\mathrm{\S }$5.3.

4.4. Stability’s Cost: Network Capacity

We next consider the scenario that the self-driving mega-constellation satisfies Proposition 1 for stability. In this case, it will not suffer from cascaded maneuvers in $\mathrm{\S }$4.3 since $|H(\lambda )|<1$, thus saving the LEO network’s lifetime. The cost, however, is the potential collision: To avoid maneuver amplifications, a satellite’s maneuver’s amplitude will be smaller than its preceding satellite’s, thus reducing the safe distance between them (Figure 5c). For collision avoidance, their safe distance before maneuvers should be sufficiently large to tolerate such damped maneuvers. This limits the available satellites and total LEO network capacity ($\mathrm{\S }$2.1).

We now derive the upper bound of the mega-constellation size and LEO network capacity under the stable self-driving policy ($|H(\lambda )|<1$). In this case, Equation 12 implies that the $(i-1)$-th satellite’s acceleration amplitude is larger than the $i$-th satellite’s due to cascaded maneuver, thus reducing their safe distance. As visualized in Figure 5c, to avoid collision between them, the $i$-th satellite’s safe distance $\mathrm{\Delta }{\theta }_i$ to the $(i-1)$-th satellite be no smaller than its accumulative reduction:

$$\mathrm{\Delta }{\theta }_i\ge {\int }_0^{\mathrm{\infty }}{\dot{\widetilde{\mathrm{\Delta }\theta }}}_i(t)𝑑t=c_{i-1}\cdot \left[-\frac{1-H(\lambda )}{\lambda }\right],\forall i=1,2,\mathrm{\cdots },n$$

according to Equation 5, 10 and 12. Note that since the system matrix $A$ is stable, its $\lambda <0$ and collision transfer function $H(\lambda )<1$. Considering all satellites along the cascaded ring and the worst-case maneuver amplitude $c_{max}$ to avoid external collisions, the minimum safe distance between any two satellites, denoted as $\mathrm{\Delta }{\theta }_{safe}$, can be derived as

(15)

$$\mathrm{\Delta }{\theta }_{safe}>\underset{i}{\max }\mathrm{\Delta }{\theta }_i=c_{max}\cdot \underset{\lambda }{\max }\left[-\frac{1-H(\lambda )}{\lambda }\right]$$

To avoid internal collisions, this inter-satellite safe distance threshold directly limits the number of satellites in each mega-constellation. Consider the Walker constellation in Figure 7a used by operational LEO networks. Given its inter-satellite spacing parameter in adjacent orbits $F$, a self-driving constellation’s maximum number of satellites $n$ (i.e., its total LEO network capacity according to $\mathrm{\S }$2.1) is limited by

(16)

$$n<2\pi \cdot F/\mathrm{\Delta }{\theta }_{safe}$$

This network capacity bound decreases monotonically with a stabler self-driving policy. As we will empirically validate in $\mathrm{\S }$5.4, it is more stringent than the RF interference-induced LEO network capacity limit in $\mathrm{\S }$2.1 (jia2021uplink, ), thus becoming the bottleneck to offer high-speed Internet access for more users.

Satellite network lifetime-capacity dilemma: Our analysis has revealed a fundamental dilemma between the satellite network lifetime and capacity in state-of-the-art self-driving mega-constellations. From Equation 11 and Equation 15, it is clear that a larger collision transfer function $|H(\lambda )|$ helps expand the satellite network capacity at the cost of more maneuvers and thus shorter network lifetime, and vice versa. When the self-driving policy $|H(\lambda )|\to 1$, the satellite network capacity is almost unleashed, but maneuvers will also be propagated hop by hop without convergence to shorten the satellite network lifetime. No local pairwise maneuver parameters in Equation 7 exist to work around this dilemma.

5. Experimental Validation

We validate our theory with Starlink’s large-scale space situational awareness datasets. We infer its proprietary maneuver policy from real data ($\mathrm{\S }$5.1), cross-check its stability using our theory and actual cascaded maneuvers ($\mathrm{\S }$5.2), and assess its impacts on network lifetime ($\mathrm{\S }$5.3) and capacity ($\mathrm{\S }$5.4).

5.1. Experimental Setup

Our verification experiments over Starlink takes four steps:

(I) Datasets: Table 1 summarizes three categories of large-scale space situational awareness datasets in our study:

$\circ$ Fine-grained ephemeris: To date, Starlink is the only satellite network operator that volunteers to publicize its satellites’ massive fine-grained orbital motion traces (starlink-maneuver, ; starlink-maneuver-2, ). As exemplified in Figure 4 and summarized in Table 1, its unique ephemeris dataset records each satellite’s runtime position, velocity, and their covariance from its onboard GPS on a minute basis. This offers sufficient granularity for us to reverse-engineer Starlink’s self-driving maneuver policy.

$\circ$ Coarse-grained ephemeris (TLEs): Except for Starlink, other satellites and debris’ fine-grained positions are not publicly available. Instead, their coarse-grained orbital parameters are publicized by the U.S. SSN on an hourly basis in the TLE format in Figure 3 (tle, ). With TLEs, we can estimate each debris/satellite’s location using the classic SGP4 orbit propagator (hoots1980models, ) with a cumulative error of 1–3 km per day, which suffices in this study to detect external collision risks as initial triggers for cascaded maneuvers.

$\circ$ Pairwise conjunction reports: They are standardized data (ccsds-cdm, ; krage2020nasa, ) to guide collision avoidance today. Given any two space objects’ position and velocity, they follow procedures in Appendix A to estimate and report their collision probability to satellite operators for maneuver planning. We use conjunction reports to detect and correlate maneuvers.

Table 1. Space situational awareness datasets.

(II) Inferring “black-box” maneuver policies: Starlink generally follows the local pairwise maneuver paradigm (starlink-maneuver, ; starlink-maneuver-2, ), but its detailed form of maneuver decision policy $F(\cdot )$ in Equation 1 is proprietary. Previous work (mobicom23li, ) takes the first step in detecting its maneuvers by comparing a satellite’s actual location with its sparse TLE-based prediction. But this heuristic maneuver detector cannot unveil sufficient information about $F(\cdot )$ from the coarse-grained TLEs to help evaluate its stability and impacts on satellite networking.

To this end, we develop a rigorous approach to unveil Starlink’s maneuver policy from its fine-grained ephemeris. Our key insight is that, while the exact closed-form expression of the maneuver policy $F(\cdot )$ is unknown, its sensitivities to each satellite’s runtime velocity and inter-satellite spacing (both being observable from our ephemeris data) can be directly derived by applying the differential Equation 7. Therefore, we extract Starlink’s constellation design parameters from its public FCC fillings (starlink-constellation-layout-gen1, ), deduce its equilibrium state $x_e$ from them, track each satellite’s runtime angular velocity $\omega$, inter-satellite spacing $\mathrm{\Delta }\theta$, and maneuver acceleration $\dot{\omega }$ from its ephemeris, calculate these parameters’ deviations from $x_e$, and derive the maneuver policy’s sensitivity parameters $({\alpha }_1,{\alpha }_2,{\alpha }_3)$ using Equation 7. These parameters $({\alpha }_1,{\alpha }_2,{\alpha }_3)$ suffice to characterize Starlink’s maneuver stability and impacts on networking via Proposition 1 and Equation 12–16.

(III) Extracting real cascaded collision avoidance: To validate our theory in $\mathrm{\S }$4, we extract Starlink’s cascaded maneuvers from our datasets as the ground truth as follows:

(1) Detect the triggering maneuver by external collision risks: Since the external debris/satellites’ fine-grained ephemeris is not publicly available, we follow (mobicom23li, ) to detect Starlink-on-others maneuvers based on their conjunction reports: A Starlink-on-others maneuver is detected if its collision probability $P_c\ge {10}^{-5}$ (starlink-maneuver, ; starlink-maneuver-2, ) and the Starlink satellite’s real semi-major axis deviates from its prediction by $\ge$1 km.

(2) Search subsequent internal maneuvers: For each Starlink-on-others maneuver, we examine if it stimulates cascaded Starlink-on-Starlink maneuvers. We leverage Starlink’s fine-grained ephemeris to accurately check if the maneuvering satellite’s safe distance $\mathrm{\Delta }\theta$ to its internal neighbors decreases (indicating an increased collision risk). If so, we further check if its neighbor later decelerates to increase this $\mathrm{\Delta }\theta$ for collision avoidance, as exemplified in Figure 6. If true, we mark it as a cascaded maneuver and iterate this process on this neighbor to extract the cascaded collision avoidance chain.

(IV) Assessing maneuvers’ impacts on networking: For the LEO network lifetime, We follow Starlink’s report (starlink-maneuver-lifetime, ) to assume a 350-maneuver budget per satellite, count cascaded maneuvers, compare them with the total maneuvers, and estimate LEO network lifetime reductions. For the LEO network capacity, we follow Starlink’s official report (satellite-capacity, ) to assume a 20 Gbps capacity per satellite, evaluate its total network capacity upper bound in Equation 15–16, and assess how close Starlink’s network capacity is to this bound.

5.2. Instability of Real Maneuver Policies

(a) Maneuver policy over time

(b) Distribution of parameters

Figure 10. Starlink’s local pairwise maneuver policy.

(a) Stability violation (Proposition 1)

(b) Cascaded maneuver frequency

Figure 11. Instability of Starlink’s self-driving policy.

We first characterize Starlink’s internal collision avoidance policy, assess its stability using Proposition 1, and compare this theoretical result with experimental validations.

Characteristics of Starlink’s maneuver policy: Figure 10 demonstrates Starlink’s maneuver policy’s sensitivity to inter-satellite spacing (${\alpha }_1$), satellite velocity (${\alpha }_2$), and inter-satellite relative velocity (${\alpha }_3$) in Equation 7 extracted from our datasets using our method in $\mathrm{\S }$5.1. We make two observations:

First, Starlink’s maneuver decision is more sensitive to inter-satellite spacing than velocity: ${\alpha }_1$ is two orders larger than ${\alpha }_2^2$ and ${\alpha }_3^2$ in Proposition 1 most time. This is consistent with most satellite operators’ collision avoidance procedure in Appendix A (krage2020nasa, ; operator-handbook, ; alfano2005numerical, ), in which the inter-satellite spacing (miss distance) dominates their collision probability calculation and maneuver decision. The relative velocity between satellites only fine-tunes the collision probability calculation.

Second, Starlink’s dominating maneuver parameter, inter-satellite distance sensitivity ${\alpha }_1$, remains generally stable except for an apparent adjustment in 2023.06–2023.09. We gauge that this update may be attributed to Starlink’s joint collision avoidance system test with NASA’s experimental Starling satellites (Starling-test, ; nasa-starling, ; probe2022prototype, ) in 2023.07. Other maneuver parameters about satellite velocity also conform to common assumptions of maneuver policies ${\alpha }_2>{\alpha }_3>0$ in $\mathrm{\S }$4.1–4.2 most of the time. Rare exceptions exist due to fluctuations of elliptical orbital parameters but are tolerable in our theory.

Theoretical vs. experimental stability analysis: As shown in Figure 11a, Starlink’s maneuver policy in Figure 10 has consistently violated the stability condition in Proposition 1. This theoretical violation conforms to our empirical results in Figure 11b that on average, 81.4% of Starlink-on-Starlink maneuvers belong to the cascaded collision avoidance chain inferred using our method in $\mathrm{\S }$5.1. It explains the explosive growth of maneuvers in Figure 1c and $\mathrm{\S }$3.3 despite Starlink’s excellent mega-constellation design. As shown in Figure 10, this stability violation mainly stems from Starlink’s maneuver policy’s high sensitivity to inter-satellite spacing ${\alpha }_1$.

5.3. Impacts on LEO Network Lifetime

(a) Remaining network lifetime

(b) Decayed satellites

(c) Maneuver amplification factor in orbital shell 1 and 2

Figure 12. Starlink’s network lifetime reduction.

In theory, an unstable policy would lead to unstoppable cascaded maneuvers (Equation 14). In practice, cascaded maneuvers will eventually stop since the motion amplification in Equation 11–12 will lower the satellite altitude based on Kepler’s third law. After sufficient hops of amplification, a satellite will eventually greatly deviate from its original altitude to avoid collisions with its neighbors and stop maneuver propagations. The exact number of hops to stop cascaded maneuvers depends on various factors, such as the satellite size, altitude, and initial maneuver magnitude. We define the maneuver amplification factor as the number of additional maneuvers triggered by an external collision avoidance. Figure 12c shows Starlink’s maneuver amplification factor fluctuates from 1 to 41 over time. It even grows when its number of satellites remains stable due to the co-orbit TROPICS satellite deployment in Figure 6a and $\mathrm{\S }$3.3.

5.4. Impacts on LEO Network Capacity

We last assess the potential reduction of network capacity if Starlink stabilized its maneuver policy in $\mathrm{\S }$5.2. Since its maneuver policy is dominated by the inter-satellite spacing and relative motion ($\mathrm{\S }$5.2), we consider the feasibility of fine-tuning its sensitivity to both factors (i.e., ${\alpha }_1$ and ${\alpha }_3$) to satisfy Proposition 1 while maximizing the LEO network capacity in Equation 15–16. We compare this theoretical LEO network capacity bound with Starlink’s current capacity and characterize its tradeoff with the LEO network lifetime.

Figure 13 projects the LEO network capacity in different combinations of $({\alpha }_1,{\alpha }_3)$ by fixing ${\alpha }_2$ as the most common value in Figure 10. It confirms the feasibility of fine-tuning Starlink’s maneuver parameters for stabilization. However, the maximal LEO network capacity after the stabilization would be highly constrained. This tradeoff between the LEO network capacity and lifetime is quantified in Figure 13b. It hints that Starlink may prioritize the short-term network capacity over the long-term network lifetime. This strategy may help accommodate more customers but also increase satellite replacement costs to offset Starlink’s net income.

(a) The size of mega-constellation

(b) Network capacity vs lifetime

Figure 13. Network capacity limit after stabilization.

6. Mitigation: Bilateral Control

In this section, we explore how to renovate the self-driving mega-constellations to simultaneously boost LEO network lifetime and capacity. As shown in $\mathrm{\S }$4–5, this goal is hard to achieve in the state-of-the-art local pairwise maneuver paradigm due to its tight coupling of two different tasks:

1. (1)

   Global stability: The inter-satellite motion transfer and amplification should be sufficiently small to avoid cascaded maneuvers for a longer network lifetime ($\mathrm{\S }$4.3);

2. (2)

   Local collision avoidance: The inter-satellite spacing should be sufficiently large to tolerate each satellite’s catchup to its preceding maneuvering satellite, which can limit the LEO network capacity ($\mathrm{\S }$4.4).

The local pairwise maneuver uses the same control law in Equation 11–12 for both tasks, thus suffering from their conflicting satisfication conditions between LEO network lifetime (preferring $|H(\lambda )|<1$) and capacity ($|H(\lambda )|\ge 1$).

Instead, these two tasks can be independent, decoupled, and governed by different control laws. Although stability requires a small forward transfer function in Equation 11–12 from the leading to the following satellite, collision avoidance does not mandate so. As an alternative, collision avoidance can also be achieved backward by accelerating the leading satellite to prevent its successor’s catchup. This backward control is orthogonal and additive to the forward control in Equation 11–12, thus offering a chance of bypassing the LEO network lifetime-capacity dilemma for concurrent boosts.

To this end, we decouple LEO network lifetime extension from network capacity expansion via bilateral maneuver control, as shown in Figure 14. This method is inspired by the recent bilateral brake control in terrestrial autonomous driving (horn2013suppressing, ; horn2017wave, ) but customized to be satellite-specific. Unlike the legacy local pairwise policy in Figure 8, each satellite’s internal collision avoidance decision depends on its relative distance and velocity to not only its predecessor but also its successor. This method incrementally adds a backward control to the existing forward control in local pairwise maneuvers. It uses the combined backward/forward control for collision avoidance while still retaining stability using the forward control. We next detail its control-theoretic model to prove its benefits for networking ($\mathrm{\S }$6.1), discuss its practical deployment ($\mathrm{\S }$6.2), and assess its viability in Starlink ($\mathrm{\S }$6.3).

6.1. Control-Theoretic Model

Figure 14. Bilateral maneuver control (video at (bilateral-control-annimation, )).

Figure 14 overviews our bilateral maneuver control in the self-driving mega-constellation networks. It follows the same modeling of cascaded collision avoidance in $\mathrm{\S }$4.1-4.2, except that the $i$-th satellite’s internal collision avoidance policy is renovated as

(17)		${\dot{\omega }}_i(t)$	$=$	$F(\mathrm{\Delta }{\theta }_i(t),{\dot{\mathrm{\Delta }\theta }}_i(t),{\omega }_i(t))$
			$-$	$F(\mathrm{\Delta }{\theta }_{i+1}(t),{\dot{\mathrm{\Delta }\theta }}_{i+1}(t),{\omega }_i(t))$

Clearly, this bilateral control policy reuses and combines the existing local pairwise maneuver policy in Equation 1 in a backward plus forward manner. By replacing Equation 1 with this new policy and repeating the analytics procedures in $\mathrm{\S }$4.2–4.3, we get its bilateral transfer function as

(18)

$${\tilde{\omega }}_i(t)=\widehat{H}(\lambda ){\tilde{\omega }}_{i-1}(t)+\widehat{H}(\lambda ){\tilde{\omega }}_{i+1}(t)$$

where

(19)

$$\widehat{H}(\lambda )=\frac{{\alpha }_1+{\alpha }_3\lambda }{2{\alpha }_1+2{\alpha }_3\lambda +{\lambda }^2}$$

is the collision transfer function in this bilateral control, and ${\tilde{\omega }}_i(t)$, ${\alpha }_1$, and ${\alpha }_3$ are identical to those in $\mathrm{\S }$4.2–4.3. Unlike pairwise maneuvers in Equation 11–12, a maneuvering satellite’s motion ${\tilde{\omega }}_i(t)$ in bilateral control depends on not only its leading satellite’s motion ${\tilde{\omega }}_{i-1}(t)$ but also its following satellite’s motion ${\tilde{\omega }}_{i+1}(t)$. Intuitively, this offers an additional flexibility to avoid collisions and stabilize maneuvers³³3An informal physical analogy from (horn2013suppressing, ; horn2017wave, ) to this bilateral control is a chain of satellites in Figure 14 inter-connected by “springs and dampers.” Any satellite’s deviation from the equilibrium for collision avoidance will propagate both forward and backward, thus being attenuated and dissipated by the hop-by-hop dampers over time. This contrasts with amplifications in local pairwise maneuvers in Figure 8, which have no such physical analogy. :

1. (1)

   Global stability: To avoid cascaded maneuvers, the $i$-th satellite’s motion should not be amplified when propagated to its following $(i+1)$-th satellite, i.e., $|\widehat{H}(\lambda )|<1$.

2. (2)

   Local collision avoidance: To avoid the $(i+1)$-th satellite from catching up with the maneuvering $i$-th satellite to cause internal collisions, the $i$-th satellite’s overall gain in Equation 18 should be large enough as $2|\widehat{H}(\lambda )|\ge 1$.

Obviously, both conditions can be satisfied simultaneously if $0.5\le |\widehat{H}(\lambda )|<1$, thus bypassing the LEO network lifetime-capacity dilemma in $\mathrm{\S }$4.4 as follows:

Proposition 2 (Bilateral maneuver control).

For any ${\alpha }_1>0,{\alpha }_3>0$, the bilateral control in Equation 17 always ensures the following properties simultaneously in the satellite ring

• •

  Network lifetime: The maneuvers in Equation 17 are always stable, thus suppressing cascaded maneuvers for longer satellite network lifetime; and

• •

  Network capacity: Any positive inter-satellite spacing $\mathrm{\Delta }{\theta }_{safe}>0$ suffices to avoid internal collisions, posing no constraints on the satellite network capacity.

Proposition 2 is proved in Appendix C. Different from Proposition 1 and Equation 15 in the local pairwise maneuver paradigm, Proposition 2 ensures stability for all maneuver policies without limiting the mega-constellation scale. This concurrently boots LEO network lifetime and capacity.

6.2. Practical Deployment

(a) Local pairwise maneuver

(b) Bilateral maneuver control

Figure 15. A showcase of different maneuvers’ stability.

Our bilateral control in Figure 14 is naturally backward compatible and incrementally deployable to existing self-driving mega-constellations. Note that bilateral control is a simple linear combination of two legacy local pairwise maneuver policies. To adopt it, each satellite can directly reuse its legacy maneuver system in Figure 3 to dry-run its legacy pairwise maneuver decision separately for its leading and following neighboring satellite inside the mega-constellation. Then, it follows Equation 17 to combine both dry-runs’ outputs as its final maneuver decision. No modifications of the legacy pairwise maneuver policy in Equation 1, satellite’s hardware, standard pairwise conjunction reports, or ephemeris formats in Figure 3 are needed for incremental deployment.

Moreover, bilateral control can be readily realized as a distributed solution. Similar to local pairwise maneuvers in Figure 3, each satellite only needs its neighboring satellites’ information for local bilateral control without centralized scheduling, thus scalable to self-driving mega-constellations.

6.3. Operational Trace-Driven Evaluation

(a) Local pairwise maneuver

(b) Bilateral maneuver control

Figure 16. Satellite spacing limiting network capacity.

We assess the viability of bilateral control using operational trace-driven emulations. Since bilateral control is a linear combination of local pairwise maneuvers, we emulate it by reusing Starlink’s maneuvers in $\mathrm{\S }$5.2 and composing them via Equation 17. This allows for a fair comparison between bilateral control and existing maneuvers in the same setting.

We first analyze how bilateral control mitigates cascaded collision avoidance to extend the network lifetime. Figure 15 showcases three neighboring satellites’ deviation from the ideal constellation layout over time when the middle satellite (marked red) maneuvers for external collision avoidance. If using Starlink’s unstable local pairwise maneuvers in $\mathrm{\S }$5.2, this maneuvering satellite will reduce its inter-satellite safe distance to its following neighbor only, which in turn has to amplify maneuvers for its own safety. Instead, bilateral control distributes the maneuvering satellite’s inter-satellite spacing changes across its leading and following neighbors. This way, both neighboring satellites only need minor maneuvers for safety, thus suppressing hop-by-hop amplifications to save maneuver budgets for a longer network lifetime.

We next assess bilateral control’s impacts on the LEO network capacity. Figure 16 compares the temporal evolution of inter-satellite spacing in the holistic mega-constellation using different maneuver policies. It confirms that bilateral control retains stable inter-satellite spacing by spreading and dissipating an external collision avoidance maneuver’s significant safe distance changes hop by hop, as exemplified in Figure 15. This implies that a small inter-satellite spacing is sufficient for bilateral control to avoid internal collisions inside the mega-constellation, thus removing the legacy maneuver’s LEO network capacity bottleneck in Equation 16.

(a) Maneuver amplification factor

(b) Lifetime extension

Figure 17. Network lifetime in different maneuvers.

With both merits, bilateral control can simultaneously benefit the LEO network’s lifetime and capacity. Figure 17a replays Starlink’s external collision risk events from 2022/12 to 2023/12 and counts cascaded maneuvers induced by the legacy local pairwise maneuver in $\mathrm{\S }$5.2 and bilateral control atop it. In Starlink’s orbital shell 1 (at the 550 km altitude with 53° orbit inclination) and 2 (540 km altitude and 53.2° inclination), bilateral control reduces local pairwise maneuvers’ amplification factor by 80.41% on average, leading to an 8$\times$ network lifetime extension without reducing the capacity.

7. Related Work

Recent mega-constellation deployment has spurred academic and industrial enthusiasm for satellite networks in diverse aspects, including radio optimization (jia2021uplink, ; jia2022analytic, ; singhspectrumize, ; pan2023pmsat, ), topology (bhattacherjee2019network, ; li2021cyber, ), routing (mobicom24li, ; uyeda2022loon, ; barritt2018loon, ; handley2019using, ; handley2018delay, ; lai2023achieving, ), function split (li2022spacecore, ; nsdi24liu, ), scheduling (vasisht2021l2d2, ; tao2023transmitting, ), transport control (hu2023leo, ; cao2023satcp, ; barbosa2023comparative, ), orbital computing (kassas2020navigation, ; bhattacherjee2020orbit, ; denby2020orbital, ; mobicom24xing, ), positioning (narayana2020hummingbird, ; iannucci2022fused, ; neinavaie2021acquisition, ; neinavaie2021exploiting, ), and security (smailes2023watch, ; willbold2023space, ; koisser2024don, ; sp24liu, ). Instead, the underlying orbital maneuvers gained less attention as they were outside the traditional networking research scope. It is not until recently that (mobicom23li, ; leonet23zhao, ) noticed maneuvers’ impacts on topology. We take one step forward to reveal their inherent instability and impacts on network lifetime and capacity.

LEO mega-constellations are well known to congest orbits and raise collision risks (kessler2010kessler, ), which motivated self-driving systems for collision avoidance (starlink-maneuver, ; starlink-maneuver-2, ; nasa-starling, ; probe2022prototype, ; brown2014simulated, ). Instead, we show that such systems themselves can threaten space safety. This phenomenon is analogous to “phantom traffic jams” in terrestrial driving (sugiyama2008traffic, ; wu2018stabilizing, ; zheng2015stability, ) but more detrimental due to its additional impacts on network lifetime and capacity. Hence, we customize bilateral control (horn2013suppressing, ; horn2017wave, ) for mega-constellations to strive for sustainable and performant satellite networking.

8. Conclusion

This paper studies how a self-driving mega-constellation’s endogenous instability hinders its sustainable high-speed Internet services to numerous users. We formally prove and empirically validate that, while initially designed for safety, its self-driving system itself can threaten safety and networking with cascaded collision avoidance. This domino effect is rooted in the decades-old local pairwise maneuver paradigm, which is reasonable for standalone satellites but unstable when scaled out to recent mega-constellation networks. We devise bilateral maneuver control to mitigate it for concurrent satellite network lifetime and capacity boosts. More refinements of network-friendly maneuvers can be explored in the future, such as enhancing its stability in more complex settings, cross-layer optimizations for network functions, and cooperative maneuvers between networked satellites. We hope these lessons can help satellite operators strive for a safer and faster planet-scale high-speed Internet from space.

Acknowledgment: This work is funded by the National Key Research and Development Plan of China (2022YFB3105201) and the National Natural Science Foundation of China (62202261). Yuanjie Li and Hewu Li are the corresponding authors.

References

• [1] ITU. Measuring Digital Development: Facts and Figures 2023. https://www.itu.int/hub/publication/d-ind-ict_mdd-2023-1/, 2023.
• [2] SpaceX Starlink. https://www.starlink.com/, 2024.
• [3] OneWeb constellation. https://www.oneweb.world/, 2024.
• [4] Amazon Project Kuiper. https://www.aboutamazon.com/what-we-do/devices-services/project-kuiper, 2023.
• [5] Iridium Satellite Communications. https://www.iridium.com/, 2023.
• [6] Inmarsat ORCHESTRA LEO satellite constellation. https://www.inmarsat.com/en/about/technology/orchestra.html, 2022.
• [7] ESA. Space Debris by the Numbers. https://www.esa.int/Safety_Security/Space_Debris/Space_debris_by_the_numbers, Nov. 2022.
• [8] SpaceX’s Approach to Space Sustainability and Safety. https://www.spacex.com/updates/index.html, Feb 2022.
• [9] SpaceX. Starlink Orbital Space Safety. https://forum.nasaspaceflight.com/index.php?PHPSESSID=tu14od0adpt8lrslne9nr33tug&action=dlattach;topic=48297.0;attach=2054365;sess=0, Aug 2021.
• [10] SpaceX Constellation Status Report: December 1, 2020–May 31, 2021. https://licensing.fcc.gov/myibfs/download.do?attachment_key=10375428, Jul. 2021.
• [11] SpaceX Constellation Status Report: June 1, 2021–November 30, 2021. https://licensing.fcc.gov/myibfs/download.do?attachment_key=14325486, Dec. 2021.
• [12] SpaceX Constellation Status Report: December 1, 2021–May 31, 2022. https://licensing.fcc.gov/myibfs/download.do?attachment_key=16644318, Jul. 2022.
• [13] SpaceX Constellation Status Report: June 1, 2022–November 30, 2022. https://licensing.fcc.gov/myibfs/download.do?attachment_key=19127252, Dec. 2022.
• [14] SpaceX Constellation Status Report: December 1, 2022–May 31, 2023. https://licensing.fcc.gov/myibfs/download.do?attachment_key=23204338, Jun. 2023.
• [15] SpaceX Constellation Status Report: June 1, 2023–November 30, 2023. https://licensing.fcc.gov/myibfs/download.do?attachment_key=25957549, Dec. 2023.
• [16] Yuanjie Li, Hewu Li, Wei Liu, Lixin Liu, Wei Zhao, Yimei Chen, Jianping Wu, Qian Wu, Jun Liu, Zeqi Lai, and Han Qiu. A Networking Perspective on Starlink’s Self-Driving LEO Mega-Constellation. In The 29th International Conference on Mobile Computing and Networking (MobiCom). ACM, 2023.
• [17] A Peiro, Theresa W Beech, Alvaro Mozo Garcia, and Miguel M Romay Merino. Galileo In-orbit Control Strategy. In Proceedings of the IAIN World Congress and the 56th Annual Meeting of The Institute of Navigation, pages 469–480, 2000.
• [18] European Space Agency. Frequently Asked Questions on Space Debris. https://www.esa.int/Space_Safety/Space_Debris/FAQ_Frequently_asked_questions, 2021.
• [19] Starlink Degraded Service: How to Troubleshoot and Improve Your Connection. https://starlinkhow.com/starlink-degraded-service/, 2023.
• [20] Li Fan, Chao Jiang, and Min Hu. Ground Track Maintenance for BeiDou IGSO Satellites Subject to Tesseral Resonances and the Luni-solar Perturbations. Advances in Space Research, 59(3):753–761, 2017.
• [21] M Aorpimai and PL Palmer. Repeat-Groundtrack Orbit Acquisition and Maintenance for Earth-Observation Satellites. Journal of guidance, control, and dynamics, 30(3):654–659, 2007.
• [22] Junmo Kim, Yoola Hwang, and Byoung-Sun Lee. Maintaining Repeat Ground Track of Low Earth Orbit Satellite. In Asia-Pacific International Symposium on Aerospace Technology, pages 685–692. Springer, 2021.
• [23] Frederic Joshua Krage. NASA Spacecraft Conjunction Assessment and Collision Avoidance Best Practices Handbook. Technical report, https://ntrs.nasa.gov/citations/20230002470, Feb. 2023.
• [24] 18th Space Control Squadron. USSPACECOM Spaceflight Safety Handbook for Satellite Operator. Technical report, https://www.space-track.org/documents/Spaceflight_Safety_Handbook_for_Operators.pdf, 2020.
• [25] Salvatore Alfano. A Numerical Implementation of Spherical Object Collision Probability. The Journal of the Astronautical Sciences, 53(1):103–109, 2005.
• [26] Probe, Austin and Bryan, Graham and Woodbury, Tim and Novak, Evan and Iyer, Shiva and Karra, Apoorva and Jah, Moriba. Prototype Infrastructure for Autonomous On-board Conjunction Assessment and Collision Avoidance. 2022.
• [27] Allen G Brown, M Ruschmann, Brenton Duffy, Lucas Ward, Sun Hur-Diaz, Eric Ferguson, and S Stewart. Simulated annealing maneuver planner for cluster flight. In 24th International Symposium on Space Flight Dynamics, Laurel, MD, 2014.
• [28] Re: IBFS File Nos. SAT-LOA-20200526-00055 and SAT-AMD-20210818-00105. EXHIBIT B. SATELLITE DIMENSIONS AND DAS OUTPUTS. https://licensing.fcc.gov/myibfs/download.do?attachment_key=17429628, Oct. 2022.
• [29] Reddit. Lifetime of Starlink Satellites. https://www.reddit.com/r/SpaceXLounge/comments/13wn0jg/lifetime_of_starlink_satellites/, 2023.
• [30] Todd E Humphreys, Peter A Iannucci, Zacharias M Komodromos, and Andrew M Graff. Signal Structure of the Starlink Ku-Band Downlink. IEEE Transactions on Aerospace and Electronic Systems, 2023.
• [31] SpaceX. Starlink Services, LLC’s Supplemental Responses to the Montana Public Service Commision’s Data Requests PSC-001 Through PSC-013. http://www.apscservices.info/pdf/21/21-002-U_14_8.pdf, 2021.
• [32] Sergei Pekhterev. SpaceX Starlink Orbital Capacity and Usable Capacity. https://www.nextbigfuture.com/2023/12/spacex-starlink-orbital-capacity-and-usable-capacity.html, 2023.
• [33] Mike Puchol. Modeling Starlink Capacity. https://mikepuchol.com/modeling-starlink-capacity-843b2387f501, 2022.
• [34] SpaceX. All Hands Meeting on the Company Update. https://twitter.com/SpaceX/status/1745941814165815717, 2024.
• [35] Starlink’s global availability and subscription. https://stories.starlink.com/, 2024.
• [36] Starlink Service Performance. https://www.starlink.com/legal/documents/DOC-1400-28829-70, 2024.
• [37] Haoge Jia, Zuyao Ni, Chunxiao Jiang, Linling Kuang, and Jianhua Lu. Uplink Interference and Performance Analysis for Megasatellite Constellation. IEEE Internet of Things Journal, 9(6):4318–4329, 2021.
• [38] Donald J Kessler, Nicholas L Johnson, JC Liou, and Mark Matney. The Kessler Syndrome: Implications to Future Space Operations. Advances in the Astronautical Sciences, 137(8):2010, 2010.
• [39] Chinese Satellite Got Whacked by Hunk of Russian Rocket in March. https://www.space.com/space-junk-collision-chinese-satellite-yunhai-1-02, 2021.
• [40] Russian Satellite Hit by Debris from Chinese Anti-Satellite Test. https://www.space.com/20138-russian-satellite-chinese-space-junk.html, 2013.
• [41] Jayant Sharma. Space-based visible space surveillance performance. Journal of Guidance, Control, and Dynamics, 23(1):153–158, 2000.
• [42] J Utzmann, A Wagner, Jiri Silha, Thomas Schildknecht, P Willemsen, F Teston, and T Flohrer. Space-based space surveillance and tracking demonstrator: mission and system design. 2014.
• [43] Space-Based Surveillance System. https://eoportal.org/web/eoportal/satellite-missions/content/-/article/sbss.
• [44] Paul Maskell and Lorne Oram. Sapphire: Canada’s answer to space-based surveillance of orbital objects. In Advanced Maui Optical and Space Surveillance Conference, 2008.
• [45] Two-Line Element (TLE) Set. https://en.wikipedia.org/wiki/Two-line_element_set, 2023.
• [46] CCSDS Recommendation for Space Data System Standards (508.0-B-1): Conjunction Data Messages. https://public.ccsds.org/Pubs/508x0b1e2c2.pdf, 2013.
• [47] Noelia Sánchez-Ortiz, Miguel Belló-Mora, and Heiner Klinkrad. Collision Avoidance Manoeuvres during Spacecraft Mission lifetime: Risk Reduction and Required $\delta$v. Advances in Space Research, 38(9):2107–2116, 2006.
• [48] Wei Zhao, Yuanjie Li, Hewu Li, and Yimei Chen. A First Look at Networking-Aware LEO Maneuvers. In ACM Workshop on LEO Networking and Communication (LEO-NET). ACM, 2023.
• [49] NASA’s Starling mission. https://www.nasa.gov/mission/starling/, 2023.
• [50] Anonymous Authors. An Illustrative Example of Cascaded Collision Avoidance Maneuvers in a Self-Driving Mega-Constellation. https://youtu.be/eIqSUmjoTdo, 2024.
• [51] Mean Motion in Astrodynamics. https://en.wikipedia.org/wiki/Mean_motion, 2023.
• [52] Lucía Ayala Fernández, Jonas Radtke, and Enrico Stoll. Impact of Collision Avoidance Manoeuvres on Large Satellite Constellations. In European Conference on Space Debris, page 65, 2021.
• [53] Kepler Communications. Application of Space Exploration Holdings, LLC, For Modification of Authorization for the SpaceX NGSO Satellite System. https://licensing.fcc.gov/myibfs/download.do?attachment_key=2638397, 2020.
• [54] NASA’s TROPICS satellite constellation. https://weather.ndc.nasa.gov/tropics/, 2023.
• [55] NASA. Unique Conjunction Event Growth Over Time: Jan 2016–Dec 2023.
• [56] BBC. Russian anti-satellite missile test draws condemnation. https://www.bbc.com/news/science-environment-59299101, 2021.
• [57] Walker Satellite Constellation. https://en.wikipedia.org/wiki/Satellite_constellation#Walker_Constellation, 2023.
• [58] List of Starlink and Starshield launches. https://en.wikipedia.org/wiki/List_of_Starlink_and_Starshield_launches, 2024.
• [59] Lyapunov Stability for Linear State Space Models. https://en.wikipedia.org/wiki/Lyapunov_stability#Stability_for_linear_state_space_models, 2023.
• [60] Alan V Oppenheim. Discrete-Time Signal Processing. Pearson Education India, 1999.
• [61] Hoots, Felix R and Roehrich, Ronald L. Models for Propagation of NORAD Element Sets. Technical report, Aerospace Defense Command Peterson AFB CO Office of Astrodynamics, 1980.
• [62] SpaceX. Application for Fixed Satellite Service by Space Exploration Holdings. https://fcc.report/IBFS/SAT-MOD-20200417-00037/2274315.pdf, 2020.
• [63] Debra Werner. NASA, SpaceX to test satellite crash-prevention strategies. https://spacenews.com/nasa-spacex-to-test-satellite-crash-prevention-strategies/, June 2022.
• [64] Berthold KP Horn. Suppressing Traffic Flow Instabilities. In 16th International IEEE Conference on Intelligent Transportation Systems (ITSC 2013), pages 13–20. IEEE, 2013.
• [65] Berthold KP Horn and Liang Wang. Wave Equation of Suppressed Traffic Flow Instabilities. IEEE Transactions on Intelligent Transportation Systems, 19(9):2955–2964, 2017.
• [66] Anonymous Authors. An Illustrative Example of Bilateral Maneuver Control for the Self-Driving Mega-Constellation. https://youtu.be/3zbcdL_13gk, 2024.
• [67] Haoge Jia, Chunxiao Jiang, Linling Kuang, and Jianhua Lu. An Analytic Approach for Modeling Uplink Performance of Mega Constellations. IEEE Transactions on Vehicular Technology, 72(2):2258–2268, 2022.
• [68] Vaibhav Singh, Tusher Chakraborty, Suraj Jog, Om Chabra, Deepak Vasisht, and Ranveer Chandra. Spectrumize: Spectrum-efficient Satellite Networks for the Internet of Things. In 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI), 2024.
• [69] Hao Pan, Lili Qiu, Bei Ouyang, Shicheng Zheng, Yongzhao Zhang, Yi-Chao Chen, and Guangtao Xue. PMSat: Optimizing Passive Metasurface for Low Earth Orbit Satellite Communication. In Proceedings of the 29th Annual International Conference on Mobile Computing and Networking (MobiCom), pages 1–15, 2023.
• [70] Debopam Bhattacherjee and Ankit Singla. Network Topology Design at 27,000 km/hour. In ACM CoNEXT, 2019.
• [71] Yuanjie Li and Hewu Li and Lixin Liu and Wei Liu and Jiayi Liu and Jianping Wu and Qian Wu and Jun Liu and Zeqi Lai. “Internet in Space” for Terrestrial Users via Cyber-Physical Convergence. In Twentieth Workshop on Hot Topics in Networks (HotNets). ACM, 2021.
• [72] Yuanjie Li, Lixin Liu, Hewu Li, Wei Liu, Yimei Chen, Wei Zhao, Jianping Wu, Qian Wu, Jun Liu, and Zeqi Lai. Stable Hierarchical Routing for Operational LEO Networks. In The 30th Annual International Conference On Mobile Computing And Networking (MobiCom). ACM, 2024.
• [73] Frank Uyeda, Marc Alvidrez, Erik Kline, Bryce Petrini, Brian Barritt, David Mandle, and Chandy Aswin Alexander. SDN in the Stratosphere: Loon’s Aerospace Mesh Network. In Proceedings of the ACM Special Interest Group on Data Communication (SIGCOMM). ACM, 2022.
• [74] Brian Barritt and Vint Cerf. Loon SDN: Applicability to NASA’s next-generation space communications architecture. In 2018 IEEE Aerospace Conference, pages 1–9. IEEE, 2018.
• [75] Mark Handley. Using Ground Relays for Low-Latency Wide-Area Routing in Megaconstellations. In Proceedings of the 18th ACM Workshop on Hot Topics in Networks (HotNets), pages 125–132, 2019.
• [76] Mark Handley. Delay is Not an Option: Low Latency Routing in Space. In Proceedings of the 17th ACM Workshop on Hot Topics in Networks (HotNets), pages 85–91, 2018.
• [77] Zeqi Lai, Hewu Li, Yikun Wang, Qian Wu, Yangtao Deng, Jun Liu, Yuanjie Li, and Jianping Wu. Achieving Resilient and Performance-Guaranteed Routing in Space-Terrestrial Integrated Networks. In IEEE Conference on Computer Communications (INFOCOM), pages 1–10. IEEE, 2023.
• [78] Yuanjie Li, Hewu Li, Wei Liu, Lixin Liu, Yimei Chen, Jianping Wu, Qian Wu, Jun Liu, and Zeqi Lai. A Case for Stateless Mobile Core Network Functions in Space. In Proceedings of the ACM Special Interest Group on Data Communication (SIGCOMM). ACM, 2022.
• [79] Lixin Liu, Yuanjie Li, Hewu Li, Jiabo Yang, Wei Liu, Jingyi Lan, Yufeng Wang, Jiarui Li, Jianping Wu, Qian Wu, Jun Liu, and Zeqi Lai. Democratizing Direct-to-Cell Low Earth Orbit Satellite Networks. In 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI). USENIX, 2024.
• [80] Deepak Vasisht, Jayanth Shenoy, and Ranveer Chandra. L2D2: Low Latency Distributed Downlink for LEO Satellites. In Proceedings of the 2021 ACM SIGCOMM 2021 Conference, pages 151–164, 2021.
• [81] Bill Tao, Maleeha Masood, Indranil Gupta, and Deepak Vasisht. Transmitting, Fast and Slow: Scheduling Satellite Traffic Through Space and Time. In Proceedings of the 29th Annual International Conference on Mobile Computing and Networking, pages 1–15, 2023.
• [82] Bin Hu, Xumiao Zhang, Qixin Zhang, Nitin Varyani, Z Morley Mao, Feng Qian, and Zhi-Li Zhang. LEO Satellite vs. Cellular Networks: Exploring the Potential for Synergistic Integration. In Companion of the 19th International Conference on emerging Networking EXperiments and Technologies (CoNEXT), pages 45–51, 2023.
• [83] Xuyang Cao and Xinyu Zhang. SaTCP: Link-Layer Informed TCP Adaptation for Highly Dynamic LEO Satellite Networks. In IEEE Conference on Computer Communications (INFOCOM), pages 1–10, 2023.
• [84] George Barbosa, Sirapop Theeranantachai, Beichuan Zhang, and Lixia Zhang. A Comparative Evaluation of TCP Congestion Control Schemes over Low-Earth-Orbit (LEO) Satellite Networks. In Proceedings of the 18th Asian Internet Engineering Conference, pages 105–112, 2023.
• [85] Zaher Zak M Kassas. Navigation from Low-Earth Orbit–Part 2: Models, Implementation, and Performance. Position, Navigation, and Timing Technologies in the 21st Century: Integrated Satellite Navigation, Sensor Systems, and Civil Applications, 2020.
• [86] Bhattacherjee, Debopam and Kassing, Simon and Licciardello, Melissa and Singla, Ankit. In-orbit Computing: An Outlandish thought Experiment? In Proceedings of the 19th ACM Workshop on Hot Topics in Networks (HotNets), 2020.
• [87] Bradley Denby and Brandon Lucia. Orbital Edge Computing: Nanosatellite Constellations as a New Class of Computer System. In Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), pages 939–954, 2020.
• [88] Ruoling Xing, Mengwei Xu, Ao Zhou, Qing Li, Yiran Zhang, Feng Qian, and Shangguang Wang. Deciphering the Enigma of Satellite Computing with COTS Devices: Measurement and Analysis. In The 30th Annual International Conference on Mobile Computing and Networking (MobiCom). ACM, 2024.
• [89] Narayana, Sujay and Prasad, R Venkatesha and Rao, Vijay and Mottola, Luca and Prabhakar, T Venkata. Hummingbird: Energy Efficient GPS Receiver for Small Satellites. In Proceedings of the 26th Annual International Conference on Mobile Computing and Networking (MobiCom), pages 1–13, 2020.
• [90] Peter Anthony Iannucci and Todd E Humphreys. Fused Low-Earth-Orbit GNSS. IEEE Transactions on Aerospace and Electronic Systems, 2022.
• [91] Mohammad Neinavaie, Joe Khalife, and Zaher M Kassas. Acquisition, Doppler Tracking, and Positioning with Starlink LEO satellites: First Results. IEEE Transactions on Aerospace and Electronic Systems, 58(3):2606–2610, 2021.
• [92] Mohammad Neinavaie, Joe Khalife, and Zaher M Kassas. Exploiting Starlink Signals for Navigation: First Results. In Proceedings of the 34th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+), pages 2766–2773, 2021.
• [93] Joshua Smailes, Sebastian Köhler, Simon Birnbach, Martin Strohmeier, and Ivan Martinovic. Watch this Space: Securing Satellite Communication Through Resilient Transmitter Fingerprinting. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 608–621, 2023.
• [94] Johannes Willbold, Moritz Schloegel, Manuel Vögele, Maximilian Gerhardt, Thorsten Holz, and Ali Abbasi. Space Odyssey: An Experimental Software Security Analysis of Satellites. In The 44th IEEE Symposium on Security and Privacy (S&P). IEEE, 2023.
• [95] David Koisser, Richard Mitev, Marco Chilese, and Ahmad-Reza Sadeghi. Don’t Shoot the Messenger: Localization Prevention of Satellite Internet Users. In The 45th IEEE Symposium on Security and Privacy (S&P). IEEE, 2024.
• [96] Wei Liu, Yuanjie Li, Hewu Li, Yimei Chen, Yufeng Wang, Jingyi Lan, Jianping Wu, Qian Wu, Jun Liu, and Zeqi Lai. The Dark Side of Scale: Insecurity of Direct-to-Cell Satellite Mega-Constellations. In The 45th IEEE Symposium on Security and Privacy (S&P). IEEE, 2024.
• [97] Yuki Sugiyama, Minoru Fukui, Macoto Kikuchi, Katsuya Hasebe, Akihiro Nakayama, Katsuhiro Nishinari, Shin-ichi Tadaki, and Satoshi Yukawa. Traffic Jams Without Bottlenecks: Experimental Evidence for the Physical Mechanism of the Formation of a Jam. New Journal of Physics, 10(3):033001, 2008.
• [98] Cathy Wu, Alexandre M Bayen, and Ankur Mehta. Stabilizing Traffic with Autonomous Vehicles. In International Conference on Robotics and Automation (ICRA), pages 6012–6018. IEEE, 2018.
• [99] Yang Zheng, Shengbo Eben Li, Jianqiang Wang, Dongpu Cao, and Keqiang Li. Stability and Scalability of Homogeneous Vehicular Platoon: Study on the Influence of Information Flow Topologies. IEEE Transactions on intelligent transportation systems, 17(1):14–26, 2015.
• [100] Joshua A Marshall, Mireille E Broucke, and Bruce A Francis. Formations of Vehicles in Cyclic Pursuit. IEEE Transactions on automatic control, 49(11):1963–1974, 2004.
• [101] Brian J Olson, Steven W Shaw, Chengzhi Shi, Christophe Pierre, and Robert G Parker. Circulant Matrices and Their Application to Vibration Analysis. Applied Mechanics Reviews, 66(4):040803, 2014.
• [102] Robert B Burckel. An Introduction to Classical Complex Analysis: Vol. 1, volume 64. Birkhäuser, 2012.

Appendix A Pairwise Space Collision Risk Assessment

Figure 18. The calculation of collision probability $P_c$ between two space objects on the conjunction plane.

We follow [23, 24, 25] to introduce the standard calculation of miss distance and collision probability between two space objects (satellites or debris). Consider a pair of independent space objects $A$ and $B$ that may collide, as shown in Figure 18. To plan orbital maneuvers, satellite operators should estimate their miss distance and collision probability $P_c$ at the time of closest approach (TCA). To compute it, we need to know both objects’ size $R_k$, velocity ${𝐯}_k$, and position ${𝐩}_k(k=A,B)$. Note that, due to the inaccurate observations by radars/telescopes, both objects’ velocity and position observations can be inaccurate. This inaccuracy can cause random uncertainties about these objects’ potential collision. The deviations of objects’ velocity and position are normally distributed with a covariance matrix ${𝐂}_k(k=A,B)$. Since the observation errors on the two objects are independent, we can shift all the errors into one imagined “object” of combined radius $R_A+R_B$ that passes through an “error ellipsoid” with a joint covariance matrix ${𝐂}_A+{𝐂}_B$. As visualized in Figure 18, this method reduces the 3D collision probability calculation into an equivalent 2D calculation on the conjunction plane perpendicular to the relative velocity vector. The collision probability $P_c$ equals the probability that the miss-distance vector “tube” will cross this collision “error ellipsoid”.

1:Space object information ${\{{𝐯}_k,{𝐂}_k,{𝐩}_k,R_k\}}_{k\in \{A,B\}}$

2:Collision probability $P_c$ between space objects $A$ and $B$

3:${𝐯}_r\leftarrow {𝐯}_B-{𝐯}_A$ $▷$ Relative velocity between $A$ and $B$

4:${\widehat{𝐞}}_{\mathrm{𝟏}}\leftarrow \frac{{𝐯}_r}{\left|{𝐯}_r\right|}$, ${\widehat{𝐞}}_{\mathrm{𝟐}}\leftarrow \frac{{𝐯}_B\times {𝐯}_A}{\left|{𝐯}_B\times {𝐯}_A\right|}$, ${\widehat{𝐞}}_{\mathrm{𝟑}}\leftarrow {\widehat{𝐞}}_{\mathrm{𝟏}}\times {\widehat{𝐞}}_{\mathrm{𝟐}}$, $𝐐\leftarrow \left[{\widehat{𝐞}}_{\mathrm{𝟐}}{\widehat{𝐞}}_{\mathrm{𝟑}}\right]$ $▷$ Unit velocity vectors

5:$𝐂\leftarrow {𝐐}^T\left({𝐂}_A+{𝐂}_B\right)𝐐$ $▷$ Covariance (uncertainty) of space objects’ trajectories

6:$(𝐮,𝐯)\leftarrow \text{Eigenvectors}\left(𝐂\right)$, $({\sigma }_{𝐱}^{\mathrm{𝟐}},{\sigma }_{𝐲}^{\mathrm{𝟐}})\leftarrow \text{Eigenvalues}\left(𝐂\right)$

7:$𝐮\leftarrow \frac{𝐮}{\left|𝐮\right|}$, $𝐯\leftarrow \frac{𝐯}{\left|𝐯\right|}$, $𝐔\leftarrow \left[𝐮𝐯\right]$

8:$\left[\begin{array}{c}{x}_m\\ y_m\end{array}\right]\leftarrow {𝐔}^T{𝐐}^T\left({𝐩}_B-{𝐩}_A\right)$ $▷$ Mean value of miss distance between $A$ and $B$

9:$R\leftarrow R_A+R_B$ $▷$ Combined radius/size of space objects $A$ and $B$

10:Compute the pairwise collision probability $P_c$ between $A$ and $B$ as

$$P_c=\frac{1}{2\pi {\sigma }_x{\sigma }_y}{\iint }_{x^2+y^2\le R^2}f(x,y)𝑑x𝑑y$$

where

$$f(x,y)=\exp \left\{-\frac{1}{2}\left[{\left(\frac{x-x_m}{{\sigma }_x}\right)}^2+{\left(\frac{y-y_m}{{\sigma }_y}\right)}^2\right]\right\}$$

11:return $P_c$

Algorithm 1 Collision probability between space objects.

Algorithm 1 describes the standard collision probability calculation using the classic Alfano’s numerical method [25]. We first project the miss distance vector and the joint covariance to the 2D conjunction plane, as shown in Figure 18. The $P_c$ is the probability that the miss-distance vector will cross the “error ellipsoid.” This is the portion of the combined error ellipsoid that falls within that circle. Therefore, the final collision probability is the integral of the Gaussian distribution probability density function in the circular domain (step 8).

For our focus on internal collision avoidance inside each mega-constellation, both satellites’ velocity and position are measured and gathered by the same satellite operator with high accuracy (e.g., using each Starlink satellite’s onboard GPS in Figure 3 [8, 9, 89]). So, their uncertainties (i.e., covariance matrices ${𝐂}_A$ and ${𝐂}_B$ in Algorithm 1) are small or even negligible. In this case, their collision probability calculation and the subsequent maneuver decision are dominated by these two satellites’ miss distance (Line 6–7 in Algorithm 1). To this end, our control-theoretic model in $\mathrm{\S }$3–6 focuses on inter-satellite spacing $\mathrm{\Delta }\theta$ inside the mega-constellation.

Appendix B Proof of Proposition 1

Proof.

To asymptotically stabilize the linear self-driving system in Equation 8, the Lyapunov stability theorem states that it should let all real parts of the complex-valued eigenvalues of the system matrix $A$ in Equation 8 be negative [59]. To compute the system matrix $A$’s eigenvalues, note that $A$ is a block circulant matrix, so it can be decomposed as follows according to [100, 101]:

$$A=(F_n\otimes I_2)\cdot \text{diag}(D_1,D_2,\mathrm{\dots },D_n)\cdot (F_n^{\ast }\otimes I_2)$$

where “$\otimes$” denotes the Kronecker product on two matrices, “*” denotes the conjugate transpose matrix, $F_n$ is the $n\times n$ Fourier matrix defined as

$$F_n=\frac{1}{\sqrt{n}}\left[\begin{array}{ccccc}1& 1& 1& \mathrm{\cdots }& 1\\ 1& z& z^2& \mathrm{\cdots }& z^{n-1}\\ 1& z^2& z^4& \mathrm{\cdots }& z^{2(n-1)}\\ \mathrm{⋮}& \mathrm{⋮}& \mathrm{⋮}& \mathrm{⋮}& \mathrm{⋮}\\ 1& z^{(n-1)}& z^{2(n-1)}& \mathrm{\cdots }& z^{(n-1)(n-1)}\end{array}\right]$$

with $z=e^{\frac{2\pi j}{n}}$ and $j=\sqrt{-1}$, and

$$D_i=A_1+A_2{z}^{(n-1)(i-1)}=\left[\begin{array}{cc}0& z^{(n-1)(i-1)}-1\\ {\alpha }_1& {\alpha }_3{z}^{(n-1)(i-1)}-{\alpha }_2\end{array}\right]$$

for $i=1,2,\mathrm{\cdots },n$. Then $A$’s eigenvalues can be calculated by

	$\text{det}(\lambda I-A)$	$=$	$\text{det}(\lambda I-\text{diag}(D_1,D_2,\mathrm{\dots },D_n))$
		$=$	${\displaystyle \prod _{i=1}^n}\text{det}(\lambda I-D_i)$
		$=$	${\displaystyle \prod _{i=1}^n}\left|\begin{array}{cc}\lambda & 1-z^{(n-1)(i-1)}\\ -{\alpha }_1& \lambda +{\alpha }_2-{\alpha }_3{z}^{(n-1)(i-1)}\end{array}\right|$
		$=$	${\displaystyle \prod _{i=1}^n}[{\lambda }^2+({\alpha }_2-{\alpha }_3{z}^{(n-1)(i-1)})\lambda$
			$+{\alpha }_1(1-z^{(n-1)(i-1)})]$
		$=$	$0$

which implies that for $i=1,2,\mathrm{\cdots },n$

$${\lambda }^2+\left({\alpha }_2-{\alpha }_3{z}^{(n-1)(i-1)}\right)\lambda +{\alpha }_1\left(1-z^{(n-1)(i-1)}\right)=0$$

By substituting $z=e^{\frac{2\pi j}{n}}$ into this equation, we have

(20)

$$e^{\frac{i-1}{n}2\pi j}=\frac{{\alpha }_1+{\alpha }_3\lambda }{{\alpha }_1+{\alpha }_2\lambda +{\lambda }^2}=H(\lambda )$$

where $H(\lambda )$ is exactly the collision transfer function derived in Equation 12. This means that the eigenvalues of $A$ are also the solutions of Equation 20. Note that $e^{\frac{i-1}{n}2\pi j}$ is the $i$-th complex root of $z^n=1$. Therefore, Equation 12 indicates that for each eigenvalue $\lambda$ of $A$, its value of $H(\lambda )$ corresponds to a unit root. Therefore, if all the roots of $|H(\lambda )|=1$ have negative real parts, then the solutions of Equation 20 (i.e., all eigenvalues of $A$) have negative real parts. This guarantees all eigenvalues of $A$ have negative real parts (i.e., $\text{Re}(\lambda )<0$) for the asymptotical stability according to the Lyapunov theory. Note that this condition becomes sufficient and necessary for the case where the system is stable for any $n$, because now that $H(\lambda )$ can be any unit root $e^{\theta j},\theta \in [0,2\pi )$ given all possible $n$ values.

To this end, we next derive the condition that all the roots of $|H(\lambda )|=1$ have negative real parts (i.e., $\text{Re}(\lambda )<0$). To do so, we leverage the maximum modulus principle in complex analysis [102]. Since the ${\alpha }_1$ and ${\alpha }_2$ are positive real numbers, the poles of $H(\lambda )$ are in the left half complex plane, indicating that $H(\lambda )$ is holomorphic in the right half complex plane. Also, according to the definition of $H(\lambda )$ in Equation 12, $|H(\lambda )|\to 0$ when $\text{Re}(\lambda )\to \mathrm{\infty }$. So according to the maximum modulus principle, the maximum of $|H(\lambda )|$ in the right half complex plane can only be achieved on the imaginary axis. To avoid eigenvalues with positive real parts, $|H(\lambda )|$ should be no more than 1 on the imaginary axis, i.e.,

$$|H(j\mu )|\le 1,\forall \mu \in ℝ$$

The necessary and sufficient condition to achieve this is

${|H(j\mu )|}^2={\displaystyle \frac{{\alpha }_1+j{\alpha }_3\mu }{{\alpha }_1+j{\alpha }_2\mu -{\mu }^2}}\cdot {\displaystyle \frac{{\alpha }_1-j{\alpha }_3\mu }{{\alpha }_1-j{\alpha }_2\mu -{\mu }^2}}\le 1,\forall \mu \in ℝ$

Then we have

$${\alpha }_2^2-{\alpha }_3^2-2{\alpha }_1+{\mu }^2\ge 0,\forall \mu \in ℝ$$

Since ${\mu }^2\ge 0,\forall \mu \in ℝ$, we conclude that to guarantee all eigenvalues of $A$ have negative real parts, it is necessary and sufficient to have

$${\alpha }_2^2-{\alpha }_3^2-2{\alpha }_1\ge 0$$

thus concluding our proof. ∎

Appendix C Proof of Proposition 2

Proof.

We first derive the bilateral transfer function in Equation 18–19. Consider a small perturbation of the $i$-th satellite from the equilibrium:

$${\widetilde{\mathrm{\Delta }\theta }}_i(t)=\mathrm{\Delta }{\theta }_i(t)-\mathrm{\Delta }{\theta }^{\ast },{\tilde{\omega }}_i(t)={\omega }_i(t)-{\omega }^{\ast }$$

Then we can apply the first-order Taylor expansion to linearize this satellite’s collision avoidance policy in Equation 1 at the equilibrium state $x_e=(\mathrm{\Delta }{\theta }^{\ast },{\omega }^{\ast })$ as

	${\dot{\widetilde{\mathrm{\Delta }\theta }}}_i(t)$	$=$	${\omega }_{i-1}(t)-{\omega }_i(t)={\tilde{\omega }}_i(t-1)-{\tilde{\omega }}_i(t)$
	${\dot{\tilde{\omega }}}_i(t)$	$=$	${\alpha }_1\left({\widetilde{\mathrm{\Delta }\theta }}_i(t)-{\widetilde{\mathrm{\Delta }\theta }}_{i+1}(t)\right)$
		$+$	${\alpha }_3\left(\left({\tilde{\omega }}_{i-1}(t)-{\tilde{\omega }}_i(t)\right)-\left({\tilde{\omega }}_i(t)-{\tilde{\omega }}_{i+1}(t)\right)\right)$

where ${\alpha }_1={\frac{\partial F}{\partial \mathrm{\Delta }\theta }|}_{x_e}$ and ${\alpha }_3={\frac{\partial F}{\partial \dot{\mathrm{\Delta }\theta }}|}_{x_e}$ are identical to those in $\mathrm{\S }$4.2. To derive this linear system’s collision transfer function, we repeat the procedures in $\mathrm{\S }$4.3 to consider the $i$-the satellite’s motion deviation ${\tilde{\omega }}_i(t)=c_i{e}^{\lambda t}$. By substituting it into above Equations, we get the collision transfer function:

$${\tilde{\omega }}_i(t)=\widehat{H}(\lambda ){\tilde{\omega }}_{i-1}(t)+\widehat{H}(\lambda ){\tilde{\omega }}_{i+1}(t)$$

$$\widehat{H}(\lambda )=\frac{{\alpha }_1+{\alpha }_3\lambda }{2{\alpha }_1+2{\alpha }_3\lambda +{\lambda }^2}$$

Next, consider a ring of $n$ satellites in Figure 14. Applying the above collision function to each hop yields:

	${\tilde{\omega }}_1(t)$	$=$	$\widehat{H}(\lambda ){\tilde{\omega }}_n(t)+\widehat{H}(\lambda ){\tilde{\omega }}_2(t)$
	${\tilde{\omega }}_2(t)$	$=$	$\widehat{H}(\lambda ){\tilde{\omega }}_1(t)+\widehat{H}(\lambda ){\tilde{\omega }}_3(t)$
		$\mathrm{\cdots }$
	${\tilde{\omega }}_{n-1}(t)$	$=$	$\widehat{H}(\lambda ){\tilde{\omega }}_{n-2}(t)+\widehat{H}(\lambda ){\tilde{\omega }}_n(t)$
	${\tilde{\omega }}_n(t)$	$=$	$\widehat{H}(\lambda ){\tilde{\omega }}_{n-1}(t)+\widehat{H}(\lambda ){\tilde{\omega }}_1(t)$

By summing them up, we get ${\sum }_{i=1}^n{\tilde{\omega }}_i(t)=2\widehat{H}(\lambda )\cdot {\sum }_{i=1}^n{\tilde{\omega }}_i(t)$ and thus

$$\widehat{H}(\lambda )\equiv 1/2$$

By substituting Equation 19 into it, we get

$$\lambda \equiv 0,\forall {\alpha }_1>0,{\alpha }_3>0$$

According to Equation 18–19, this implies

$${\tilde{\omega }}_i(t)\equiv \frac{1}{2}({\tilde{\omega }}_{i-1}(t)+{\tilde{\omega }}_{i+1}(t)),\forall i=1,2,\mathrm{\cdots },n$$

Suppose ${\tilde{\omega }}_{i-1}(t)\ge {\tilde{\omega }}_i(t)$, then this equation immediately impies that

$${\tilde{\omega }}_{i-1}(t)\ge {\tilde{\omega }}_i(t)=\frac{1}{2}({\tilde{\omega }}_{i-1}(t)+{\tilde{\omega }}_{i+1}(t))$$

which further implies ${\tilde{\omega }}_{i-1}(t)\ge {\tilde{\omega }}_{i+1}(t)$. Then we have

$${\tilde{\omega }}_i(t)=\frac{1}{2}({\tilde{\omega }}_{i-1}(t)+{\tilde{\omega }}_{i+1}(t))\ge \frac{1}{2}({\tilde{\omega }}_{i+1}(t)+{\tilde{\omega }}_{i+1}(t))={\tilde{\omega }}_{i+1}(t)$$

So by recursion on each hop, we get

$${\tilde{\omega }}_1(t)\ge {\tilde{\omega }}_2(t)\mathrm{\cdots }\ge {\tilde{\omega }}_n(t)\ge {\tilde{\omega }}_1(t)$$

which implies

(21)

$${\tilde{\omega }}_1(t)={\tilde{\omega }}_2(t)\mathrm{\cdots }={\tilde{\omega }}_n(t)={\tilde{\omega }}_1(t),{\dot{\omega }}_i(t)=0,\forall i$$

i.e., under any self-driving policy parameters ${\alpha }_1>0,{\alpha }_3>0$, all satellites’ motions remain homogeneous despite any small perturbations by external collision avoidance. This implies the stability and elimination of cascaded maneuvers in $\mathrm{\S }$4.3.

We next analyze the bilateral control’s satellite network capacity. By repeating the analysis procedures in $\mathrm{\S }$4.4, we get

(22)

$${\dot{\widetilde{\mathrm{\Delta }\theta }}}_i(t)={\tilde{\omega }}_i(t-1)-{\tilde{\omega }}_i(t)\equiv 0$$

So the minimum safe distance required by the LEO satellite mega-constellation to avoid internal collisions is

(23)

$$\mathrm{\Delta }{\theta }_{safe}>\underset{i}{\max }\mathrm{\Delta }{\theta }_i=\underset{i}{\max }{\int }_0^{\mathrm{\infty }}{\dot{\widetilde{\mathrm{\Delta }\theta }}}_i(t)𝑑t\equiv 0$$

i.e., while being stable, the bilateral control’s minimum safe distance $\mathrm{\Delta }{\theta }_{safe}$ can still be arbitrarily small, thus posing no limits on the satellite network capacity. This contrasts with the existing local pairwise policy in Equation 15 and bypasses its fundamental dilemma between the satellite network lifetime and capacity, thus concluding our proof. ∎