Business models for new launch vehicle and launch base operators place aggressive requirements of cost, launch rate and campaign agility. In this scenario, the reduction of ground infrastructure and operations becomes a necessity in the roadmaps of New Space players.
A flight safety system has the responsibility to neutralise the launch vehicle i.e. terminates the mission, based on the launcher and mission diagnostics, to prevent undue risks. To ensure the safety of orbital launch operations and mitigate risks to third parties in the event of a non-nominal and critical flight conditions, the implementation of a robust Flight Termination System (FTS) is required for all orbital launch vehicles. Conventional FSS rely on launcher telemetry data, ground-based radar tracking systems distributed around the globe, and an uplink to the on-board FTS for the termination command. The radar and telemetry data are processed by ground systems and displayed to the FSOs, who are responsible for issuing the termination command based on the violation of a set of flight safety rules defined by the spaceport flight safety regulatory authority. The termination command is then sent to the on-board FTS using the spaceport telecommand system. Such approach is obsolete when seeking to contribute to match New Space requirements of cost, flexibility and launch rate. First of all because FTS systems impose limitations on the range of trajectories available at a spaceport, due to the necessity for tracking and telecommand systems to be in line-of-sight of the launch vehicle. But mainly and above all, the reusable stage strategy, which contributes to campaign agility and recurrent costs, requires the mission safety assessment of multiple objects in real-time, while the current telecommand systems are limited to the transmission of a single signal, making an absolute necessity the autonomous safety assessment and neutralisation of each flying stage to enable the reusable launch vehicle concept.
The on-board Autonomous Flight Safety System (AFSS) strategy has a major contribution to New Space objectives:
- ground infrastructures reduction and compactness: radars become unnecessary, ground TM processing IT systems become simpler and less critical and systems for operators training become obsolete,
- ground operations: more agile and responsive campaigns preparation and operators in the base reduced
- mission constraints: the delay in the safety is reduced (current chain from the launcher to the human on the ground and back to the launcher with the neutralisation telecommand). Therefore, the ground safety limits and constraints time-related can be relaxed. The safety mission becomes independent from both the telecommand line-of-sight constraint and the ground means constraint, allowing as a result more flexible and safer missions.
- reusable concepts enabler: current ground-commanded safety systems do not allow multi-object neutralisation since, while more than one object can be tracked in real-time, a strategy with simultaneous telecommands to neutralise more than one stage is not secure and reliable (e.g. more than one telecommand is forbidden at the CSG). That is the scenario facing the reusable concepts: when one stage (or more) are returning and the main stage continues the ascending flight, all of them requiring simultaneously in-flight safety decision-making. On-board AFSS allows independent in-flight safety for each object (one AFSS each), enabling safe reusable concepts

GTD is a systems and critical SW company dedicated to space operations for the past 37 years, with the last 30 particularly being crucial in the context of AFSS: developing, operating, and maintaining safety systems at CSG European Spaceport. The rise of the New Space challenges that scenario, prompting the need to answer the question “what is next” to adapt to the needs of this new paradigm, from both technological and business perspectives.
In addition to our background in safety systems, GTD possesses a high capability in onboard critical SW, giving us a unique understanding of the challenges and opportunities of transitioning towards the AFSS. To anticipate market needs and solidify our position, GTD AFSS is founded on two pillars:
- Everything will be CONSTANTLY changing (regulations, actors, roadmaps, etc.), therefore, we must design FLEXIBLE systems, especially if targeting a multi-launcher multi-spaceport product.
- Linked to first point, we cannot wait for requirements from launchers or spaceports; we must rely, as much as reasonably possible, on ALL our expertise and background and scale up gradually from here, prioritizing time-to-market.
New launch concepts plan to be launched from different Spaceports in order to increase their offer of mission azimuths and increase the launch rate. As a result, in a future scenario on board systems should be prepared to meet not only the interfaces and requirements for different launcher systems, but also interface different ground systems. Therefore, onboard systems interfacing both ground and launcher, as in the case of the future concepts of AFSS, should be configurable and adaptable to fulfil the missionisation needs, allowing operations of multiple launchers from multiple spaceports in multiple missions.
For the last 15 years GTD follows the strategic driver of the AFSS. That line of action leads from the expertise and background on flight safety at the CSG, where GTD develops and maintains the SAUVEGRDE system responsible for the mission safety, to the current maturity on available AFSS components to be tested during the THEMIS campaign at Kiruna. During this roadmap (see picture below) GTD has capitalized the innovation and results of both operational and R&D projects into the MASSIM (Modular Avionics and SW SIMulator), a HW-in-the-loop infrastructure that serves as development, simulation and testing platform, built-up bringing together the technological building-blocks outcome from the activities and experience.

The current version to be validated at Kiruna campaigns includes the navigation diagnosis and processing module (based on hybrid navigation strategies), safety criteria generation based on vehicle status and dynamics assessment; and the autonomous decision-making logic. This system presents state-of-the-art contributions in the following drivers.
- Launcher health monitoring: while the ascending launch vehicles focus only on dynamics diagnosis, this system considers as well the launcher systems health monitoring, since the assessment of the launcher systems diagnosis does become crucial on re-entry trajectories, on the contrary of expendable, and shall therefore be considered for safety decisions. That strategy allows as well to centralize in one system all safety functions that concern launcher status (e.g. separation actuators), some of them currently under responsibility of the onboard computer.
- Decision-making: soft computing strategies such as Bayesian networks and Fuzzy logic have been explored for the decision-making module. However, redundant strategy based on multiple independent chains running different algorithms libraries has been proven the best strategy for requirements on both deterministic of onboard critical applications and the improvement of the RAMS system, shifting the redundancies to SW instead of HW from the sake of mass, cost and configurability.
- Missionisation and configurability: the design and development of the AFSS is been driven by modularity and configurability, to adapt to different evolving missions and regulations (e.g. safety rules and criteria, navigation requirements). The use of libraries and partitions allows to configure and instantiate the SW modules at the operators will. The SW architecture is designed so the invariant part of it can digest and interpret the configurable part autonomously, contributing to reduce validation time and cost of critical code. GTD has done the last years the subsequent survey and analysis on regulations before undertaking any development, and has been surveying recurrently any update in the regulation’s scenario.
The AFSS application is embedded on an on-board processor in a real-time simulation platform for development and testing phases, while the system to be validated at Kiruna is the same SW version embedded in a HW designed specifically for the campaigns with the same processor and real-time OS (RTOS). Besides the HW and SW for the ground AFSS, an operational station is developed to monitor the results in real-time at the operations center. It shall be remarked that the system receives as an input the telemetry from the THEMIS stage, but the AFSS does not command or interfere in the flight in any case, since the safety of the mission is guaranteed by other means already qualified.

The results of the THEMIS campaign are expected to validate GTD’s AFSS application. The modularity of the AFSS makes it easily adaptable to the next step strategy of a fully autonomous onboard equipment. GTD is currently focused on the design of a low-cost prototype that embeds the safety application evolved from the tested one. The ongoing design for the onboard HW follows an scalable approach based on COTS components to prioritize the time to market and the launchers needs.
