Space Debris Tracking and Conjunction Assessment Architecture (2026)

Two satellites will pass within 200 metres of each other tomorrow. Should you spend fuel to move one of them? The honest answer from an operations centre is that nobody knows the miss distance to 200 metres — they know it to plus or minus a few kilometres, and the width of that error bar, not the miss distance itself, decides whether anyone burns propellant. Conjunction assessment is routinely explained as a geometry problem. It is not. The geometry is trivial; a laptop can propagate two orbits and find the closest approach. What is hard — and what quietly determines whether low Earth orbit stays usable — is knowing how wrong your orbits are, and being honest about it when the answer is inconvenient.

This piece walks the full pipeline as an engineer would build it, with real numbers and named standards, and develops the result that trips up almost every popular treatment: degrading your tracking data can lower the computed collision probability.

What this covers: the sensing layer and its cadence limits, observation-to-catalogue data flow, orbit determination and why TLE/SGP4 fails for screening, covariance realism, the all-vs-all screening problem, CCSDS Conjunction Data Messages, the operator decision loop, automation at mega-constellation scale, and the failure modes that actually bite.

Context and Background

The population being tracked is larger than most people assume and much larger than what is trackable. ESA’s Space Environment Report 2025 counted roughly 39,000 catalogued objects in Earth orbit — approximately 14,000 payloads, 2,000 rocket bodies and 23,000 debris fragments. Against that, ESA’s MASTER environment model estimated, as of August 2024, about 54,000 objects larger than 10 cm, roughly 1.2 million between 1 cm and 10 cm, and around 130 million from 1 mm to 1 cm.

Read those two paragraphs together and the architecture problem states itself. The catalogue covers a fraction of the objects that can destroy a spacecraft. A 1 cm aluminium fragment at a 10 km/s closing speed carries kinetic energy comparable to a small car at motorway speed. Most of the lethal population is invisible to the system that is supposed to protect against it. Conjunction assessment therefore manages the known risk while a larger unknown risk is handled by shielding, redundancy and luck.

The operational tempo has also changed. SpaceX’s semi-annual reports to the FCC show Starlink satellites performing 207,152 collision-avoidance manoeuvres between December 2025 and May 2026, up from 148,696 in the prior six-month period — over 355,000 in a year, and more than 40 manoeuvres per satellite per year on average. A process designed in an era of dozens of manoeuvres per year across all of NASA’s fleet is now running at industrial volume.

Institutionally, the United States is mid-transition. The Department of Commerce’s Office of Space Commerce is standing up the Traffic Coordination System for Space (TraCSS) to take over the civil warning role from the military. As of June 2026 it reported 52 pilot users and two national government accounts — the United Kingdom and Australia — covering more than 11,125 satellites, with a formal production release anticipated later in 2026. For background on how constellation economics drive this traffic, see our analysis of Amazon’s Globalstar acquisition and Project Kuiper’s satellite technology. ESA’s own annual environment report is the best public primary source on the population itself.

The Reference Architecture: From Photons to Propellant

A conjunction assessment system is a nine-stage pipeline that converts sensor detections into a binary decision — burn or don’t burn — while carrying an uncertainty estimate end to end. Every stage either preserves or destroys information about that uncertainty, and the stages that destroy it are where operational failures originate.

Figure 1: End-to-end conjunction assessment architecture, from sensor observation through catalogue maintenance, screening, CDM distribution and the operator manoeuvre loop.

The loop closes at the bottom: a manoeuvre changes the protected asset’s trajectory, so the new planned ephemeris must be re-screened against the whole catalogue before it is executed. A surprising fraction of real incidents involve a manoeuvre that resolved one conjunction and created another. The feedback edge from ephemeris upload back to screening is not decoration — it is the difference between a safe system and a system that plays whack-a-mole.

The sensing layer is cadence-limited, not sensitivity-limited

The US Space Surveillance Network combines conventional mechanical radars, phased-array radars and optical telescopes. The Ground-based Electro-Optical Deep Space Surveillance system uses sites each fielding two 40-inch telescopes plus a 15-inch auxiliary, capable of detecting objects roughly 10,000 times fainter than the naked eye can see, with each site tracking on the order of 3,000 objects per night. The S-band Space Fence at Kwajalein Atoll, operational since 2020, is the sensitivity workhorse for low Earth orbit. In aggregate the network’s dedicated and collateral sensors produce up to roughly 80,000 observations per day.

Eighty thousand observations sounds like a lot until you divide it by tens of thousands of objects. That is a handful of tracks per object per day, and they are not evenly distributed: coverage clusters around sensor longitudes and orbital geometries that pass over them. A LEO object might be seen four times in one six-hour window and then not at all for eighteen hours. That gap is the fundamental constraint. It is not that we cannot see the object well enough; it is that we cannot see it often enough for the state estimate to stay tight against unmodelled forces.

Commercial networks exist specifically to attack cadence. LeoLabs operates a distributed set of UHF and S-band phased-array radar sites — with locations including Texas, Alaska, Costa Rica, New Zealand, Australia and the Azores — targeting revisit rates of ten or more passes per day for prioritised objects and, with S-band sites, tracking down towards the 2 cm class. A phased array steers its beam electronically hundreds of times per second, so one aperture can interleave dozens of targets. That is the architectural reason phased arrays displaced dish radars for catalogue maintenance: the scarce resource is beam-time scheduling, not raw aperture.

Orbit determination is where uncertainty is born

Observations are range, angles and sometimes range-rate, each with its own noise. Orbit determination fits a dynamical trajectory through them, usually by batch least squares over a multi-day fit span or by a sequential filter. The output is not a position; it is a state estimate — position and velocity at an epoch — together with a covariance matrix describing the estimator’s uncertainty in each direction and the correlations between them.

That covariance is the product. In an orbital frame the uncertainty ellipsoid is dramatically elongated along-track, typically by an order of magnitude or more relative to radial and cross-track, because an error in semi-major axis integrates into a growing along-track drift. For a LEO object a week out, along-track uncertainty of several kilometres against radial uncertainty of tens to hundreds of metres is unremarkable. That anisotropy is why miss distance alone is a poor risk metric: a 500 m miss in the radial direction is a far more serious event than a 500 m miss along-track.

Figure 2: The orbit determination pipeline. Special-perturbations fits with validated covariance feed screening; general-perturbations element sets are a lossy publication format on a separate branch.

The diagram makes the split explicit. The high-fidelity special-perturbations solution — numerical integration with a detailed force model covering geopotential harmonics, atmospheric drag, solar radiation pressure, third-body gravity and, for precise work, tides and relativistic corrections — is what feeds screening. The general-perturbations element set is generated separately for public distribution and throws away the covariance entirely.

Why TLE and SGP4 cannot support screening

A two-line element set is not a state vector with error bars. It is a set of mean elements fitted specifically so that the SGP4 analytical propagator reproduces the orbit; the elements are meaningless outside that propagator. Published TLEs are typically produced by taking a special-perturbations solution over a fit span of roughly five days, propagating it forward to generate pseudo-observations, and fitting a general-perturbations element set to those. Information is discarded at every step, and no uncertainty is carried at all.

The accuracy consequence is well documented: SGP4 with public TLEs gives position errors on the order of kilometres, with error growth commonly quoted at one to three kilometres per day of propagation. For a LEO conjunction where the interesting miss distances are hundreds of metres, a propagator with kilometre-class error and no covariance is not a marginal tool — it is the wrong instrument entirely. NASA’s guidance is explicit that conjunction screening should not be performed with TLEs and should instead use the special-perturbations catalogue maintained for that purpose.

This matters commercially because a great deal of “space situational awareness” tooling is built on public TLEs, which are free. Such tools can tell you that two objects are in similar orbits. They cannot tell you whether to manoeuvre, and a screening product built on them will generate alerts whose false-positive rate is dominated by propagation error rather than by real geometry.

Screening, Probability, and the Dilution Trap

Direct answer: probability of collision is computed by projecting both objects’ position uncertainties onto the plane perpendicular to the relative velocity at closest approach, combining them into a single joint covariance, and integrating that two-dimensional Gaussian over a circle whose radius is the sum of the two objects’ hard-body radii. The result is a number, typically between 1e-9 and 1e-3, that operators compare against an action threshold.

Making all-vs-all tractable

With tens of thousands of catalogued objects, a naive pairwise screen over a seven-day horizon is computationally absurd — the pair count is in the hundreds of millions, each requiring propagation and a closest-approach search. Production systems use a cascade of increasingly expensive filters, each cheap enough to run on everything that survived the previous one.

The first filter is orbital: if the perigee of one object exceeds the apogee of the other by more than a screening margin, they can never meet, and this alone eliminates the large majority of pairs. The second is geometric, based on the relative orientation of the two orbit planes and the resulting minimum orbit intersection distance — if the orbits themselves never come within the threshold, the objects cannot either. The third is temporal: even where the paths cross, both objects must be near the crossing point at the same time, which is a phasing condition that eliminates most surviving pairs. Only what remains gets full numerical propagation with a fine time step and a root-find on the range-rate zero crossing to locate time of closest approach precisely.

The practical effect is that a screen which is naively O(n²) with an expensive kernel becomes O(n²) with a very cheap kernel plus O(k) with the expensive one, where k is a few thousand rather than a few hundred million. The filters must be conservative — a filter that occasionally discards a real conjunction is a safety defect, so margins are set generously and the cost of that conservatism is a larger k.

The Pc calculation and its assumptions

The standard short-encounter formulation, in the lineage of Foster’s 1992 method and refined by Chan, Patera and Alfano, rests on assumptions that hold well for typical LEO conjunctions and badly for some others. It assumes the relative motion through the encounter is rectilinear, that both covariances are constant over the brief encounter, that position errors are Gaussian, and that the two objects’ errors are uncorrelated. It then reduces to a 2D integral in the encounter plane.

The methods differ mainly in how they evaluate that integral. Chan’s is a series expansion and is by far the fastest; Alfano’s and Patera’s use different numerical strategies and sit in the middle; Foster’s original numerical approach is roughly an order of magnitude or two slower than Alfano or Patera, which are themselves substantially slower than Chan. For a system computing Pc on millions of screened pairs, that constant factor is a real architectural constraint, and most operational systems use a fast method for triage and a slower, more careful one on the survivors.

The assumptions break in identifiable cases. Low relative velocity encounters — common between co-planar satellites in the same constellation, and in geostationary orbit — violate the rectilinear and constant-covariance assumptions, and require long-encounter formulations or Monte Carlo. Highly non-Gaussian uncertainty, which arises for objects with poorly modelled drag propagated over long horizons, breaks the Gaussian assumption; unscented transforms and Gaussian mixture models are the usual remedies. Correlated errors between the two objects — which occur when both were tracked by the same sensors and share atmospheric density mismodelling — inflate the true risk relative to the computed value.

Probability dilution: the counter-intuitive core

Here is the result that should change how you read any Pc number. Hold the miss distance fixed and increase the position uncertainty. Pc first rises, peaks, and then falls. The falling branch is the dilution region, and it exists for a simple reason: the total probability mass is conserved at one, so as the uncertainty ellipsoid grows, the fraction of that mass landing inside the small hard-body circle eventually shrinks, even though the situation is objectively more dangerous.

The operational consequence is stark. An operator with poor tracking data, a stale covariance and a long propagation horizon will compute a lower collision probability than an operator with excellent data on the same physical encounter. Low Pc in the dilution region does not indicate low risk; it indicates ignorance. The literature is unambiguous that when an event falls in the dilution region, the correct response is to obtain better data and recompute, and if that is impossible, to base the decision on the maximum probability — the value Pc would take if the covariance were scaled to the size that maximises it — rather than the nominal value.

This is not an obscure edge case. It is a routine feature of events at five to seven days before closest approach, when covariances are largest and the initial screening alerts are generated. Events frequently appear benign early, become alarming as the covariance tightens with new tracking, and then resolve one way or the other in the final 24 to 36 hours.

The incentive problem should be obvious. If a regulator sets a hard Pc threshold and an operator’s compliance is judged on computed Pc, then investing in better tracking data can move events above the threshold and generate manoeuvre obligations that poorer data would have hidden. Any threshold-based regime that does not simultaneously mandate covariance quality standards is rewarding sloppiness. This is the single strongest argument for regulating the inputs to conjunction assessment — data quality, ephemeris sharing, covariance realism testing — rather than only the output number.

Covariance realism is a measurable property, not a hope

A covariance is “realistic” if the actual errors are distributed the way it claims. The standard test is to compute Mahalanobis distances between predicted states and subsequently determined states, normalised by the combined covariance. Under Gaussian assumptions those squared distances should follow a chi-square distribution with the appropriate degrees of freedom, and the empirical distribution can be compared against it with a Kolmogorov-Smirnov test.

In practice raw formal covariances from orbit determination fail this test badly, and they fail in the dangerous direction — they are optimistic. The reason is structural: a standard OD process propagates only measurement noise into the covariance, while the dominant real error sources are mismodelled dynamics. Atmospheric density is the worst offender in LEO, where empirical density models carry substantial errors that spike during geomagnetic storms, and drag error maps directly into along-track position error.

The remedy in current practice is consider-parameter theory: treat the uncertain model parameters — drag coefficient, density scale, solar radiation pressure coefficient — as consider parameters whose variances are inferred from the observed distribution of Mahalanobis distances across the catalogue, then fold them into the reported covariance. The output is a covariance that is larger but honest. Crucially, that honesty can push events into the dilution region, which is exactly why the maximum-Pc backstop must be part of the decision logic rather than an academic footnote.

This is the same discipline that shows up in any high-stakes measurement chain — the instrument’s stated uncertainty has to be validated against reality rather than asserted. The parallel with precision sensing is direct; see our explainers on quantum sensing with SQUID magnetometers and how atomic clocks achieve their stability, where calibration against a physical standard is what separates a real measurement from a plausible number.

The Conjunction Data Message and the Operator Loop

Screening output has to reach operators in a form they can act on, and since 2013 that form has been standardised. The CCSDS Conjunction Data Message, recommended standard CCSDS 508.0-B-1, defines a machine-readable message describing a single predicted close approach between two objects. It exists in keyword-value notation and XML forms and is the interchange format used by the US warning system, ESA, and commercial providers.

What a CDM actually carries

A CDM has a header, a relative-metadata section and two per-object sections. The relative section carries time of closest approach, the miss distance, the relative speed and the relative position and velocity resolved into the radial, in-track and cross-track frame — that resolution matters, because a purely radial miss is far more dangerous than the same magnitude in-track.

Each object section carries identification, the orbit determination metadata, the state vector at TCA, and the covariance. The covariance is specified in lower-triangular form covering the 6×6 position-velocity submatrix and extending to a 9×9 form that can include drag and radiation-pressure consider terms. Alongside it sits the metadata that determines whether the covariance is usable at all: the OD method, the observation span, the number of observations, the weighted RMS of the fit, and the COVARIANCE_METHOD field, which states whether the matrix was actually calculated or is a default value substituted because a real one was unavailable.

That last field deserves attention from anyone building automated triage. The standard itself warns against using default covariance values to compute collision probability. A CDM with a default covariance produces a Pc that is a statement about a convention, not about the encounter. Any automated pipeline must branch on COVARIANCE_METHOD, and treating a default-covariance CDM as equivalent to a calculated one is a genuine safety bug that is easy to ship and hard to notice.

The US Office of Space Commerce has published TraCSS-specific CDM field specifications, updated in January 2026, that constrain and extend the CCSDS baseline for the civil service — a useful signal that the trend is towards tighter field-level requirements rather than looser ones.

The decision loop in time

Conjunction assessment is not a single evaluation; it is a converging sequence of them.

Figure 3: The conjunction event lifecycle. Successive CDMs refine the estimate as new tracking arrives, with the operator’s decision point typically 24 to 36 hours before closest approach.

Events typically surface five to seven days out with a large covariance and an uninformative Pc. Fresh tracking arrives, the covariance shrinks, and updated CDMs are issued — daily at first, then more frequently as TCA approaches. The operator’s job in that window is triage: which events warrant requesting additional tracking, which warrant preparing a manoeuvre, and which can be watched.

The decision point sits roughly 24 to 36 hours before closest approach, driven by operational lead times rather than by physics. A manoeuvre must be planned, verified against the rest of the catalogue, uplinked during a ground station pass, and executed with enough margin that the resulting orbit is observable and confirmable before TCA. Waiting longer gets you a better covariance but leaves no time to act on it. This tension — the estimate is best exactly when it is too late to use — is the defining operational characteristic of the whole discipline.

Thresholds and what they encode

NASA’s Conjunction Assessment Risk Analysis programme uses a red threshold of 1e-4: under NASA Procedural Requirements 8079.1, a conjunction with Pc above 1e-4 requires a risk mitigation manoeuvre unless a documented exception applies. NASA’s own account of that choice describes it as a deliberate balance between safety and mission enablement rather than a value derived from first principles, which is the honest framing — a threshold is a risk-appetite statement encoded as a number.

SpaceX operates Starlink at a far more conservative 1e-5, and public reporting has described action at levels as low as 3e-7 for some cases, orders of magnitude below the 1e-4 convention. The reason is structural, not virtue: Starlink satellites have electric propulsion, high manoeuvre cadence, low per-manoeuvre cost in mission terms, and an automated system that does not consume analyst hours. When the marginal cost of a manoeuvre approaches zero, the optimal threshold drops. A science mission with limited hydrazine, a rigid observation schedule and a fixed end-of-life fuel budget faces the opposite economics and rationally sets a looser threshold.

The uncomfortable implication is that there is no single correct threshold, which makes uniform regulation difficult. A regulator imposing 1e-5 on everyone would force fuel-limited missions into premature retirement; imposing 1e-4 on everyone would let cheap-manoeuvre constellations take risks they do not need to take.

Trade-offs, Gotchas, and What Goes Wrong

The failure modes cluster into four groups, and none of them are exotic.

Stale and default covariance. A covariance computed from tracking that is three days old, propagated forward, and reported without a realism correction produces a Pc that is confidently wrong. Combined with a default-covariance CDM, this is the most common way an automated pipeline produces a false clearance. The mitigation is architectural: branch on COVARIANCE_METHOD, track the observation span and weighted RMS as first-class inputs, and compute maximum Pc alongside nominal Pc on every event.

Figure 4: Decision logic for a low computed Pc. The branch that distinguishes genuine low risk from probability dilution is the one most often missing from automated triage.

Cross-operator coordination gaps. When both objects in a conjunction are active satellites, both operators may manoeuvre, and there is no universal protocol guaranteeing they do not manoeuvre into each other. Coordination happens through bilateral contacts, shared ephemeris exchanges and, increasingly, TraCSS-mediated channels — but it depends on operators being reachable, responsive, and willing to share planned manoeuvres. Contact information goes stale, time zones intervene, and geopolitical relationships mean some operator pairs do not talk at all. This is a governance failure with an engineering consequence.

Uncatalogued lethal debris. With roughly 1.2 million objects above 1 cm and only about 39,000 catalogued, conjunction assessment addresses a small share of the lethal population. No screening architecture protects against what is not tracked. This is why the discipline of debris mitigation — passivation, deorbit compliance, avoiding intentional fragmentation — matters more than any improvement in screening. Better tracking of the 1–10 cm regime, which is what commercial S-band radar networks are pushing towards, expands the catalogue but also expands the alert volume proportionally.

Alert fatigue. With thresholds set conservatively and covariances honest, the number of alerts an operator receives vastly exceeds the number that lead to manoeuvres — the ratio is commonly hundreds to one. Human analysts habituate. Automated systems that suppress alerts to control volume can suppress the one that mattered. The only sustainable answer is automation that is trustworthy enough to close the loop without a human in it, which requires the covariance quality that many operators do not have.

Kessler syndrome, stated accurately. The scenario proposed by Donald Kessler and Burton Cour-Palais in 1978 describes collisional cascading: above a critical spatial density, collisions generate fragments faster than atmospheric drag removes them, so the debris population grows through self-collision even if all launches stop. It is a description of a regime, not an event. There is no moment when the sky closes. It is also not a prediction that orbit becomes impassable — the realistic outcome is a gradual increase in operating cost, manoeuvre frequency and insurance premiums in the most congested shells. Treating it as an apocalypse makes the real problem — a slow economic tax on a shared resource — easier to ignore.

Practical Recommendations

If you are building or buying conjunction assessment capability, the decisions that matter are about data quality and decision logic, not about the Pc algorithm. Every credible implementation of Foster, Chan, Alfano or Patera gives essentially the same answer from the same inputs; the inputs are where systems differ.

Start by refusing to build screening on public TLEs. If your provider cannot tell you the observation span, the number of observations, the weighted RMS and whether the covariance was calculated or defaulted, they are selling you a propagation, not an assessment. Then make maximum Pc a standing output rather than a special-case analysis, so that dilution is caught by the pipeline instead of by an alert analyst on a good day.

Share your own ephemerides. Operator-supplied planning ephemerides with realistic covariance are the single highest-leverage improvement available, because they replace an external estimate of your spacecraft with your own, which is always better. Onboarding to TraCSS or an equivalent service is the cheap way to do this.

• Screen against a special-perturbations catalogue; never against TLE/SGP4.
• Branch automated triage on COVARIANCE_METHOD; never treat a defaulted covariance as calculated.
• Compute nominal Pc and maximum Pc on every event; escalate on the dilution gap between them.
• Validate covariance realism periodically with Mahalanobis-distance chi-square testing, not just at acceptance.
• Re-screen every planned manoeuvre against the full catalogue before uplink.
• Maintain current 24/7 operator contact data and publish planned manoeuvres to your neighbours.
• Set your Pc threshold from your own manoeuvre economics and document the reasoning.
• Track your alert-to-manoeuvre ratio as a health metric; a sudden change means an input changed.

Frequently Asked Questions

What is conjunction assessment in space operations?

Conjunction assessment is the process of predicting close approaches between orbiting objects and quantifying the collision risk of each one. It combines sensor tracking, orbit determination with uncertainty estimation, catalogue-wide screening for close approaches, and computation of a probability of collision from the combined position covariance. The output is distributed to satellite operators as Conjunction Data Messages, which they use to decide whether to perform an avoidance manoeuvre.

Why can’t two-line element sets be used for collision avoidance?

TLEs carry mean elements fitted to the SGP4 analytical propagator and carry no covariance at all. Position errors are typically kilometre-class, growing roughly one to three kilometres per day of propagation, while the miss distances that matter in a conjunction are hundreds of metres. NASA explicitly recommends against TLE-based screening, directing users to the special-perturbations catalogue instead. Without covariance, a probability of collision cannot be computed in any meaningful sense.

What is probability dilution?

Probability dilution is the regime where a larger position uncertainty produces a smaller computed probability of collision. Because total probability mass is fixed, spreading it over a wider ellipsoid reduces the fraction falling inside the small hard-body circle. A low probability from a large, stale covariance therefore signals ignorance, not safety. The recommended response is to obtain better tracking data and recompute, or to decide based on the maximum probability rather than the nominal value.

What collision probability threshold do operators use?

NASA uses 1e-4 as its red threshold, above which a risk mitigation manoeuvre is required under NPR 8079.1. SpaceX operates Starlink at 1e-5, roughly an order of magnitude more conservative, with reported action at even lower levels in some cases. The difference reflects manoeuvre economics: electric propulsion and full automation make Starlink manoeuvres nearly free, while a fuel-limited science mission rationally accepts more risk per event.

What is a Conjunction Data Message?

The Conjunction Data Message is the CCSDS 508.0-B-1 recommended standard for exchanging predicted close-approach information. It carries time of closest approach, miss distance, relative velocity, and per-object state vectors with covariance in lower-triangular form, plus orbit determination metadata including observation span, weighted RMS and the covariance method. It is available in keyword-value and XML forms and is used by US, European and commercial conjunction warning services.

How many objects are actually tracked versus estimated to exist?

ESA’s Space Environment Report 2025 put the catalogue at roughly 39,000 objects — about 14,000 payloads, 2,000 rocket bodies and 23,000 fragments. ESA’s MASTER model estimated, as of August 2024, roughly 54,000 objects above 10 cm, 1.2 million between 1 cm and 10 cm, and about 130 million from 1 mm to 1 cm. Since a 1 cm fragment can destroy a spacecraft, the catalogue covers only a small share of the genuinely lethal population.

Further Reading

• Amazon’s Globalstar acquisition and what it means for Project Kuiper satellite technology — the constellation economics driving orbital congestion.
• Quantum sensing explained: SQUID magnetometers and MRI — why calibrated uncertainty is what makes a measurement usable.
• How atomic clocks work: quantum resonance and GPS — the timing backbone underneath all orbit determination.
• ESA Space Environment Report 2025 — the primary source for population figures.
• CCSDS 508.0-B-1 Conjunction Data Message — the recommended standard itself.
• NASA Conjunction Assessment Risk Analysis — thresholds, procedures and the CARA handbook.

By Riju — about