How Collision Avoidance Works

What changed

It was the first accidental collision between two intact satellites. The orbital planes met at nearly a right angle, and neither object was being screened against the other. Afterward the U.S. military began screening every active satellite, not only its own, and sending warnings to their operators.

The screening pipeline moved from classified systems onto Space-Track.org, the public site that publishes the catalog and delivers those warnings, and conjunction messages were standardized.¹ Warnings became routine. Coordination did not.

Warnings that can’t be reconciled

Each service screens with its own catalog, its own propagator, its own covariance model, its own thresholds and its own probability method. Most of those are not fully open. When their warnings disagree, an operator cannot tell which one is right, because the inputs and algorithms behind them can’t be compared.

Every launch makes it harder

Every object has to be screened against every other. The number of pairs is N(N−1)/2, so it grows with the square of the catalog. Ten times the objects means a hundred times the pairs, and a hundred times the warnings that have to be triaged.

Governments that operate military and intelligence satellites

At least sixteen governments operate reconnaissance or other military satellites. Their orbits, and especially their maneuvers, are not all published. Every one of them shares the same orbits with everyone else.

Every close approach needs both orbits

To screen two objects against each other, something has to compare where both will be at the same moment. For most pairs, the public catalog is enough. For a pair that includes a classified satellite or a planned maneuver, one of the two orbits belongs to someone who will not hand it over.

Each government screens its own hidden satellites against what it can see. Each operator screens its own plans against the public catalog. Nobody can screen one government’s hidden satellite against another’s, or a company’s planned burn against a classified orbit, because nobody holds both.

A maneuver opens a blind window

An operator plans a burn hours or days ahead. Screening looks days ahead too, so from the moment the plan exists, everyone else’s prediction for that satellite is wrong. After the burn, radars and telescopes have to notice the change, gather enough new tracking, and solve for the new orbit before any catalog shows it. That takes hours to days more.

For that whole window, every other operator plans around a trajectory that is no longer true, and a close approach inside it is screened against the wrong orbit. Large constellations now maneuver every day, so a window like this is always open somewhere.

Three ways to close the gap, and their limits

Each of the obvious answers asks someone to give up the thing they cannot give up, or to wait until it is too late to matter.

Computing on data nobody else can read

Homomorphic encryption lets a computer do arithmetic on locked numbers. It adds and multiplies them without unlocking them, and the answer comes out locked too.

Screening needs one narrow calculation: how close do these two objects get? One operator locks its trajectory with its own key and sends it. The other works out, on the locked values, how close its own object comes at each moment, and sends the locked answer back. Only the first operator can open it, and it learns only whether the two come too close. Each operator runs it to protect its own satellite. No third party takes part.

Private screening is specified and measured. It is not yet available on the network.

The screening software is open, so both sides can check exactly what was computed, even though neither can see the other’s data.