5. Space Insurance

Home , INVAP, TDF 2, Telstar 4, Telstar 401, Telstar 402, Yamal 101

Mémoire présenté devant le Centre d’Etudes Actuarielles pour l’obtention du diplôme du Centre d’Etudes Actuarielles et l’admission à l’Institut des Actuaires le : 27 Janvier 2012

Par : Jean-François GAUCHE Titre : SPACE RISKS ______

Confidentialité : NON OUI (Durée : 1an 2 ans) Les signataires s’engagent à respecter la confidentialité indiquée ci-dessus

Membre présent du jury de signature Entreprise : l’Institut des Actuaires : Nom : ______Signature : Membres présents du jury du Directeur de mémoire en entreprise : Centre d’Etudes Actuarielles :

Thomas BEHAR Nom : ______Signature : Vincent DAMAS Invité : Gérard CROSET

Arnaud COHEN Nom : ______Signature : Jean-Pierre DIAZ

Brigitte DUBUS

Paul ESMEIN Autorisation de publication et de Michel FROMENTEAU mise en ligne sur un site de Stéphane MENART diffusion de documents actuariels (après expiration de l’éventuel délai de Christophe IZART confidentialité)

Pierre PETAUTON Signature du responsable entreprise Florence PICARD

Olivier LOPEZ

Secrétariat : Signature du candidat

Bibliothèque :

4 rue Chauveau Lagarde 75008 Paris Tél. : 01 44 51 72 72 / Fax : 01 44 51 72 73

MMéémmooiirree AAccttuuaarriiaatt

SSppaaccee RRiisskkss

Jean-François Gauché Centre d’Etude Décembre 2011 Actuarielle

Forewords

The present paper is the final work to validate the graduation of actuary studies in the “Centre d’Etude Actuarielle”. The purpose of this work is to analyze the space business environment with an actuary angle in order to find solutions to manage efficiently the underlying space risks. This is an attempt to formalize the business practices with statistics and mathematical models. The main outcome is to calculate the “cost of risk” in the space sector.

One of the benefits of this paper is to provide a synthesis of a wide set of data gathered from different origins and analyzed in detail to derive claim and pricing models. The high quality data is inherited from different sources and a strong experience of the space environment.

The space insurance market practice is generally relying on an empirical approach and is strongly driven by the offer and demand equilibrium. This paper proposes to analyse this market with a mathematical viewpoint and using an actuarial methodology which is also used by many insurers, and see how both approaches can be conciliated.

Finally, the interest of this work is to measure the risk exposure for all the actors of the space business using a common model. The optimization of the risk coverage is analyzed in detail. The main contribution of this work is to propose a panel of solutions to manage those risks and measure their efficiency with mathematical models.

I would like to address special thanks to Philippe Cotelle for his expertise in the frame of the space risk management and insurance. He has been challenging the content of this work and has given me the opportunity to implement the methodology developed in this paper on concrete cases.

I am also very thankful towards my Astrium colleagues, especially Mrs Jallade, Mr Gajewski and Mr Maurel, who have actively participated in the development of risk models within the company from which were inspired some models presented in this paper.

Finally I want also to thank all the teachers of CEA for the high quality of the courses which are thought in the frame of the actuary master. The highly valuable methodologies and tools that I have been taught were a key element in my daily work as risk manager. Among them, I want to address a special thank to Mr Robert and Mr Lopez for their valuable advises on my work and their availability to discuss the problematic of my paper.

Table of Contents

1. INTRODUCTION ...... 11

2. EXECUTIVE SUMMARY...... 13

2.1 INTRODUCTION ...... 13 2.2 SPACE BUSINESS...... 14 2.3 SPACE RISKS...... 15 2.4 SPACE INSURANCE...... 19 2.5 CASE STUDY: SPACE ACTORS ...... 20 2.6 CONCLUSION ...... 22

3. SPACE ENVIRONMENT...... 39

3.1 SPACE BUSINESS...... 40 3.1.1 Satellite Markets ...... 40 3.1.2 Commercial Market Organization...... 42 3.2 SATELLITES ...... 47 3.2.1 Telecom Satellites ...... 48 3.2.2 Earth Observation Satellites ...... 50 3.3 LAUNCHERS...... 52 3.3.1 Principle ...... 52 3.3.2 Main Launchers ...... 53

4. SPACE RISKS ...... 57

4.1 INTRODUCTION: SPACE RISKS OVERVIEW ...... 58 4.2 LAUNCH RISK MODEL...... 62 4.2.1 Overview...... 62 4.2.2 Launch Failure History...... 64 4.2.3 Model definition...... 66 4.3 IN ORBIT TEST RISK MODEL ...... 75 4.3.1 Overview...... 75 4.3.2 IOT Failure History...... 78 4.3.3 Model Definition...... 80 4.3.4 IOT Failure Frequency Model...... 82 4.3.5 IOT Failure Severity Model...... 85 4.4 IN ORBIT LIFE RISK MODEL ...... 90 4.4.1 Overview...... 90 4.4.2 IOL Failure History...... 92 4.4.3 Model Definition...... 94 4.4.4 IOL Failure Frequency Model ...... 95 4.4.5 IOL Failure Severity Model ...... 104 4.5 CONCLUSION ...... 105

5. SPACE INSURANCE...... 107

5.1 MARKET OVERVIEW ...... 108 5.1.1 Space Insurance Coverage ...... 108 5.1.2 Market Metrics ...... 109 5.2 INSURER LOSS MODEL ...... 112 5.3 SPACE RISK PRICING ...... 115 5.3.1 Pure Premium...... 116 5.3.2 Commercial Premium ...... 119 5.4 MARKET VOLATILITY ...... 120 5.4.1 Impact of offer and demand...... 120 5.4.2 Impact of market profitability...... 121 5.4.3 Other factors ...... 122 5.4.4 Rates forecast and volatility...... 122 5.5 CONCLUSION ...... 123

6. CASE STUDY: SPACE ACTORS...... 125

6.1 INTRODUCTION ...... 126 6.2 SATELLITE MANUFACTURER ...... 127 6.2.1 Risks Overview...... 127 6.2.2 Manufacturer Risk Model...... 129 6.2.3 Manufacturer Gross Exposure...... 131 6.2.4 Coverage Optimization ...... 133 6.2.5 Synthesis ...... 138 6.3 SATELLITE OPERATOR ...... 139 6.3.1 Operators Overview...... 139 6.3.2 Business Model ...... 141 6.3.3 Risk Management Strategies ...... 144 6.3.4 Conclusion...... 149

7. CONCLUSION...... 151

8. BIBLIOGRAPHY ...... 153

9. ACRONYMS...... 155

10. ANNEXES ...... 157

10.1 CREDIBILITY THEORY ...... 157 10.2 CONFIDENCE INTERVAL ESTIMATION...... 159 10.3 CHI2 ESTIMATE METHOD...... 160 10.4 KERNEL DENSITY ESTIMATOR...... 161 10.5 LEAST SQUARES ESTIMATE ...... 163 10.6 MAXIMUM LIKELIHOOD ESTIMATE...... 165 10.7 CHI SQUARE TEST ...... 167 10.8 KOLMOGOROV SMIRNOV TEST...... 168

List of Figures

Figure 1: Spacecraft Launched 1960-2010 by Satellite Type ...... 40

Figure 2: Spacecraft Launched 1990-2010 – Satellite Mission...... 41

Figure 3: Commercial Market Actors...... 42

Figure 4: telecom satellites in orbit by manufacturers (source XL insurance 2009) ...... 46

Figure 5: Earth Observation Satellites built or ordered by manufacturers (source Euroconsult 2009). 46

Figure 6: Ariane 5 Structure ...... 52

Figure 7: Ariane 5 Flight Profile...... 52

Figure 8: GTO Launchers...... 55

Figure 9: LEO Launchers ...... 56

Figure 10: failure origin...... 60

Figure 11: Ariane 5 (June 1996)...... 62

Figure 12: Zenit 3 (Jan 2008) ...... 62

Figure 13: Proton JCSAT11 ...... 62

Figure 14: GSLV (Dec 2010)...... 62

Figure 15: Launch Failures History (source spacetrack)...... 64

Figure 16: Early Launch Status (source spacetrack with amendments)...... 65

Figure 17: Design Failure Rate Trend ...... 67

Figure 18: Early Launch Failure Rate...... 69

Figure 19: Design Failure Rate - Maturity Phase ...... 69

Figure 20: GTO Launchers Reliability ...... 74

Figure 21: LEO Launchers Reliability...... 74

Figure 22: IOT Failure Modes...... 79

Figure 23: Satellites Reliability ...... 83

Figure 24: IOT historical severity histogram...... 85

Figure 25: IOT historical severity histogram...... 87

Figure 26: IOT severity smooth distribution...... 87

Figure 27: IOT severity adjustment ...... 88

Figure 28: Q-Q Diagram...... 88

Figure 29: KS fit test illustration...... 89

Figure 30: IOL failure severity ...... 93

Figure 31: IOL reliability shape (bathtub) ...... 95

Figure 32: Satellite architecture...... 99

Figure 33: Satellite Survival Curve ...... 102

Figure 34: IOL severity distribution...... 104

Figure 35: IOL severity adjustment ...... 104

Figure 36: IOL Severity QQ Plot...... 104

Figure 37: Launch Capacity (Source Aon / ISB) ...... 109

Figure 38: In Orbit Capacity (Source Aon / ISB) ...... 109

Figure 39: Market Capacity Evolution (1986-2010) (Source Aon / ISB) ...... 109

Figure 40: Insurers L+1y portfolio evolution (source XL insurance)...... 110

Figure 41: Insurers IOL portfolio evolution (source XL insurance)...... 110

Figure 42: Insurers P&L evolution (based on market data by Marsh and Willis) ...... 111

Figure 43: Typical insurer portfolio loss distribution ...... 116

Figure 44: Impact of risk correlation on insurers’ loss distributions...... 117

Figure 45: Comparison of P-C distribution vs portfolio size ...... 118

Figure 46: Rates vs capacity ...... 120

Figure 47: Rates vs capacity cloud ...... 120

Figure 48: Rates vs aggregate profit ...... 121

Figure 49: Commercial Rates vs aggregate profit cloud ...... 121

Figure 50: Rates vs aggregate profit ...... 121

Figure 51: Commercial Rates vs aggregate profit cloud ...... 121

Figure 52: Incentive Satellite Portfolio...... 130

Figure 53: Incentives Portfolio Loss Distribution ...... 131

Figure 54: Incentives Loss Distribution Adjustment ...... 131

Figure 55: QQ Plot MC Result vs Weibull ...... 131

Figure 56: IOT Losses ...... 132

Figure 57: IOL losses ...... 132

Figure 58: Incentives Loss Distribution Adjustment ...... 132

Figure 59: QQ Plot MC Result vs Adjustment...... 132

Figure 60: Provision level vs exposure...... 133

Figure 61: Provision with reserves ...... 135

Figure 62: Provision with no reserve ...... 135

Figure 63: XS coverage...... 135

Figure 64: finite facility description ...... 137

Figure 65: Single Satellite Project ...... 139

Figure 66: Multi Satellite Project...... 140

Figure 67: Operator Nominal Fleet...... 141

Figure 68: Operator Nominal Cash Flows ...... 141

Figure 69: Project NPV without insurance...... 144

Figure 70: Project NPV vs insurance strategy...... 145

Figure 71: RoE distribution vs insurance strategy...... 147

Figure 72: EBIT No insurance ...... 147

Figure 73: EBIT Full Insurance...... 147

Figure 74: RoE vs insurance strategy ...... 148

List of Tables

Tableau 1: Telecom Operators...... 44

Tableau 2: Space agencies...... 45

Tableau 3: Main Telecom GEO platforms ...... 49

Tableau 4: Main Earth Observation Satellites by Manufacturer...... 51

Tableau 5: GEO / GTO Launchers...... 53

Tableau 6: LEO/SSO Launchers...... 54

Tableau 7: GTO Launchers Manufacturing Failure Rates ...... 70

Tableau 8: LEO Launchers Manufacturing Failure Rates ...... 71

Tableau 9: Launch Failure Rate Regression Results...... 71

Tableau 10: Launchers Reliability ...... 74

Tableau 11: IOT Failure History (Data from Spacetrack database)...... 78

Tableau 12: Telecom Platform Loss Rate...... 83

Tableau 13: IOL Failure History (Data from Spacetrack database) ...... 92

Tableau 14: IOL Historical Loss Ratios ...... 96

Tableau 15: XS premium calculation...... 136

111... IIInnntttrrroooddduuuccctttiiiooonnn

The management of space risks is a key element in the space business. Indeed, the high technological complexity of spacecrafts and launchers together with the obvious physical challenge to position satellites in the earth orbit and operate it during many years with no direct access or repair possibility, have made space risks a predominant problematic in this industry.

For satellite operators, the high probability of occurrence of satellite and launch failures joint with a high severity of associated financial losses, puts space risk management at the forefront in the setup of business plans as well as companies financial management. Managing space risks properly is indeed a prerequisite to collect the necessary funds to address this business.

This has led all the major satellite operators and manufacturers to setup dedicated teams to manage these particular risks. Astrium, notably, has setup a dedicated team to handle the company risks and to optimize their coverage. His role is to measure accurately and transfer risks faced by the company in an efficient manner, in most cases relying on space insurers, and whenever possible using in-house tools to achieve more financially efficient solutions. This paper will position itself from an “insured” viewpoint willing to properly manage space risks.

Despite the relatively small amount of statistics in this field, the past 30 years return on experience is giving enough information to envisage these risks with an analytical approach. The modelling of risks has become a powerful tool to understand and manage these risks efficiently. This has led Astrium to develop a strong know how and to develop tools in this area to support Astrium Risk Management.

The present paper will analyse Hedging Solutions in the space business. In other words, we will seek how the space business actors can optimize the coverage of space risks predominant in this field of activity.

This paper proposes to solve the following questions:

• How to quantify the company exposure to space risks and model the impact of space risks on its business model: estimate the cost of space risk as a random variable

• How to optimize the cost of risk: evaluate retention of risks and hedging of risks to achieve the best possible financial efficiency in line with the risk appetite of the company

The first part of this work will give an overview of the space environment to provide to the reader a snapshot of this sector with its main actors and give an idea of the risks they are subject to.

The second part gives an overview of the main phases of a satellite life. For each phase, we will then analyse the claim history and try to derive frequency and severity models which are representative of the risk. Different approaches will be implemented and cross checked to optimize the modelling. Additional filters on data will be used as well to eliminate bias. We will also study the segmentation for the various risks studied and implement credibility methods to improve the data analysis where the historic information is too limited.

In a third step, we have studied the space insurance market which provides insurance coverage for space risks. The objective is to present the practice of the market, and analyse the exposure of insurers for a typical portfolio of risk to determine their capital requirements and pricing methodology. Based on that, the volatility of the market will be analysed.

In part 4, we will then analyse the typical exposure of a manufacturer and an operator and see how they can optimize their management of space risks based on the outcome of the first 3 parts. The main questions which will be studied are the analysis of the cost of risk distribution and the optimized mix of risk retention, mitigation and transfer.

222... EEExxxeeecccuuutttiiivvveee SSSuuummmmmmaaarrryyy

This chapter summarizes the main topics and outcomes of this paper. It is aimed at providing to the reader an overview of the analysis developed in this work and its principal conclusions.

2.1 Introduction

The purpose of this work is to analyse the risks faced by actors of the space industry, principally launcher / satellite failures or underperformances, and to evaluate the possible risk management and transfer solutions which can be implemented to run a prudent and efficient business.

The main questions which are dealt with are the following:

• Understand the main characteristics of space risks and propose a representative modelling for it with a quantitative approach.

• Measure the exposure of the space business actors with loss distributions

• Describe the space insurance practice and propose a pricing model which is representative of this specialized branch of insurance.

• Compare the hedging solutions available for manufacturer and operators and the trade off between risk retention and transfer.

Different models are proposed to simulate the occurrence and severity of space risks. The model parameters are adjusted on historical data to match the track records of the various launchers and satellite families. Monte Carlo simulations are run to compute the exposure distributions of space actors and to analyse the efficiency of risk management strategies.

2.2 Space Business

The space industry was initially created to respond to the defence and sovereignty missions of developed nations. In the last decades a commercial sector has emerged to respond to the telecommunications demand and has then evolved to other types of businesses.

■ The principal actors of this industry are Launch Service Satellite Space Agencies organized as detailed in the following diagram. Provider Manufacturer Operators invest in a satellite infrastructure and launch contract satellite contract exploit it for the provision of telecom or imaging Investor services to generate revenues. Their business Equity Owners equity Satellite Insurance Company is relying on the proper deployment (launch) Operator Bank bank loan and performance of their satellites, therefore Dept Owners they are exposed to important assets and service contract revenue losses in case of launch vehicles or End Users satellite failures. Banks and equity providers would generally request insurance coverage to protect their investment. Insurance companies are able to mutualise space risks and propose insurance coverage for all phases of the satellite life from launch to de-orbitation. The space insurance market fluctuates with the occurrence of risks. Manufacturers are also exposed to the performance of their delivered product through penalty schemes imposed by operators and have developed risk management solutions to manage the corresponding exposure.

■ Spacecrafts are autonomous machines able to maintain a position in the earth orbit and to provide a given mission. The two principal missions achieved by satellites are telecommunications and earth imaging. The characteristics of this two types of satellites are described below:

- Telecom satellites are generally located in the geostationary orbit at 36 000 km from the earth in a movement synchronized with the earth rotation which provides them a fixed position over the same point in the globe. They need high power platforms with a stabilized pointing and run amplification channels and antennas to relay information on the earth footprint. They serve all types of communications for defence or commercial purposes and TV broadcasting. There is about 300 GEO telecom satellites in orbit, with a majority operated on a commercial basis.

- Earth Observation satellites are evolving in a much lower orbit between 600 and 1000 km from the earth which incurs a cyclic rotation over the earth surface. They are used to capture optical or radar images from the earth over wide areas to observe the climate, map the globe or detect areas of interest. The platforms or instruments can generally be oriented to provide agile scene captures and download information to the ground stations. Among the 90-100 imaging satellites presently in orbit a majority is dedicated to defence or institutional bodies.

■ Launch vehicles are made of several motor stages burning liquid or solid ergols and controlled with an automated guidance system. They are used to propulse satellite payloads in the correct orbit. Such vehicles are subject to very high mechanical constraints and forces. Launchers able to attain geostationary transfer orbits necessitate an even more powerful thrust and involve more complex technologies. There are 60-120 satellites launched every year.

2.3 Space Risks

Satellites are exposed to a high risk of partial or total failure during their deployment and operational life. Each satellite can generate financial losses. The possible losses associated to each satellite will be determined by a random variable called Loss Ratio (LR). “LR” will be modelled with (i) a failure occurrence model “OCC” and (ii) a failure severity model “SV”.

The methodology implemented in this paper is to analyse the historical losses to extract the main risk drivers for each phase. The risk drivers are then translated into a statistical model which is tuned with historical data sets. The risk nature being different along the satellite lifecycle, a specific model will be determined for each phase: Launch, In Orbit Test, and In Orbit Life.

Launch Phase

The launch phase is very critical due to the extreme constraints which are put on a launch vehicle and the transported satellites to reach the earth orbit. The very intense acceleration and vibration which are at stakes makes each launch a physical challenge. Typical launch failures are the explosion of the launch vehicle due to uncontrolled forces at stake, or a wrong injection of the satellite in space due to an insufficient thrust generally linked to an accidental propulsion abort or a malfunction of the vehicle control and guidance system. Launchers success rates vary between 2% to 10% for design proven vehicles, while much higher failure rates are common for new launchers.

Occurrence Model

All launch events are considered as fully independent and can result either in a success or a loss, which is simply determined by a Bernoulli distribution with a parameter P_LF representing the probability of failure of a given launch. P_LF will be specific to each launch depending on the launch vehicle technical maturity and track record. An important objective of this study is also to analyse the launch vehicles differentiation.

The design of a launch vehicle necessitates important investments and experience before reaching a mature concept. When the design is proven, the quality of the manufacturing and control process will be determinant on the launcher reliability. Therefore, the main drivers in the proposed occurrence model will be (a) the design maturity and (b) the quality of the manufacturing process. This leads us to split the model parameter into 2 components (a) the probability of failure linked to the design (P_DLF) and (b) the probability of failure linked to the manufacturing process (P_MLF) so that P_LF = P_DLF + (1-P_DLF)*P_MLF.

P_DLF depends on the technical maturity of the launcher design, it is determined with the historical failure rate of launchers at given stage of development. P_MLF will be estimated with the average failure rate of LV corrected with a credibility method and using a confidence interval estimator.

Severity Model

Launch failures generally lead to complete satellite losses, therefore partial losses are very rare, so the launch severity is considered as 1 in all cases.

In Orbit Test Phase

The LEOP and In Orbit Test Phase are supposed to put the satellite in its final orbit, to deploy all elements and to test every components of the satellite. There are many possible causes of malfunctions since satellites are exceedingly complex systems of electronic, electrical, pyrotechnical, chemical, and mechanical elements. The failure of a single component in the positioning phase may prevent the satellite from reaching its final position or attaining its operating configuration. Some component failure can also lead to a partial mission accomplishment.

Occurrence Model

The most important criteria for risk assessment in this phase are (i) the manufacturer’s experience and (ii) the technical criticality of the spacecraft based on the complexity of the design and the flight heritage of the satellites equipments. Therefore the failure probability will be derived from these 2 factors and set as P_IOTF = P_MIOTF * TC_Factor. TC_Factor will be used to tune the expected satellite reliability based on a technical analysis of its components and mission.

The differentiation of rates estimates between satellites has been studied. P_MIOT will be specific to each manufacturer and based on their track record, with P_MIOTF = E[LossRate(Manufacturer)] / E[Severity]. The obtained failure rate is then corrected with a credibility method. Due to the relatively small size of the data sample, a confidence interval method is also used to improve the model confidence level.

Finally, in order to represent the risk correlation between satellites, the failure probability is split into an idiosyncratic part and a systemic part which is shared by satellites of the same group. The share of systemic risk with the overall IOT failure risk is estimated either with a statistical approach or with an analytical approach based on the satellites technical understanding.

Severity Model

The loss of very critical components of the spacecraft (solar arrays, propulsion, antennas) will generally lead to Total Failure. Historically an occurrence in the IOT phase leads to total loss in a third of cases for telecom. However, satellites generally incorporate redundancies for every subsystem or design margins, therefore some equipments failure might incur underperformances without completely destroying the satellite mission.

The severity of IOT failures must be modelled as to be representative of the main failure modes. The loss severity distribution is obtained based on the observed sample of satellite failures which is translated into a continuous density function using a kernel density estimator. It is then adjusted with a mix of Normal and Weibull distributions using a least squares estimation method and a Kolmogorov Smirnov test to validate the fitness. Due to the existence of 3 modes in the severity distribution, the adjusted distribution is a mix of 3 distributions representative of the 3 modes.

In Orbit Life

After the first year in space, the risk of a satellite failure is drastically reduced, nevertheless satellites are exposed to a very stringent environment and subject to wear out with no repair possibility during long periods of time (5 to 15 years) and therefore are subject to failures as well.

Occurrence Model

The satellite In Orbit Life is generally between 5 and 15 years (sometimes more) and therefore necessitates failure estimation over time. This is achieved by modelling the satellite survival curve, in other words the cumulative distribution function of the random variable Time To Failure (TTF). It can then be translated in a periodic failure probability (yearly generally).

Two approaches are proposed to model the satellite TTF distribution.

The first method is to adjust the satellite empirical survival curve with a Weibull or lognormal distribution (chosen for its particular shape), and to estimate the distributions parameters with a Maximum Likelihood Estimator. The benefit of this method is to match properly the observed satellite lifetime however on the down side, the adjustment must be performed on the data of all satellites of a given category and therefore we lose the specific reliability of each manufacturer.

The second method is to consider the satellite functional architecture and to model the TTF of the satellites equipments with an exponential distribution. The equipments reliability is computed with a chi square estimate determining the exponential law parameter. Finally the satellite overall TTF is recomposed based on the aggregation of elementary equipments TTF incorporating the redundancy schemes between them. This method is very powerful since it allows a detailed modelling matching both the specific experience of the manufacturer, the actual health status of all equipments and the intrinsic reliability of the satellite. However, this necessitates a very detailed data set.

The failures origin can be classified in 3 categories (i) “random” failures due to the occurrence of unexpected events or excessive stress over-passing the satellite possibilities despite the absence of a design of manufacturing fault, (ii) “defect” failures linked to an undetected design or manufacturing defect incurring weaknesses within the satellite subsystems or an accelerated degradation of performances, this type of failure cause can be shared by several satellite with a similar design or commonalities which incurs the possibility of serial losses and therefore risk correlations, (iii) excessive environmental stress due to extreme solar activity or excessive debris which can damage the satellite, this cause can also be shared between satellites located in the same position and incur serial losses. The failure occurrence is thus decomposed between an idiosyncratic part and a systemic part (itself split into a group design specific part and a part related to the external events which can affect several satellites at a time)

Severity Model

The main risk in the operating phase is the occurrence of partial loss since there are numerous components on board which do not function reliably enough to guarantee absolutely faultless operations throughout the satellite’s design service life. Even redundancy may not always be sufficient to eliminate the risk of breakdown completely and there is still a relatively high risk of total failure. Partial losses severity is obtained from the data sample of observed satellite partial failures in orbit.

The associated density is computed first with a kernel density estimator and then adjusted with a mix of normal and weibull distributions using least squares estimate and matching the main modes of the density.

Risk Portfolio Model

A loss model is defined for each phase of the satellite life and adapted to the specific reliability of each spacecraft. This determines the law of the random variable Loss Ratio LR(S,L) for each satellite S and each launcher L. The defined loss models can be used to simulate the loss distribution of a given portfolio of satellites with a Monte Carlo methodology.

The principle of the Monte Carlo model is to define a portfolio of risks and define a random variable for each risk of the portfolio, tuned with its specific characteristics. A financial indicator is determined (loss amount, profitability, RoE) which is relying on these random variables. We generate a sample by simulating a large number of scenarios for all the considered risks and collecting the resulting financial indicator of each scenario. This sample can be used to derive statistics and distributions.

These models will be the basis to compute the exposure of space actors and determine (a) the risk pricing and capital requirements of space insurers, and (b) the risk management solutions available to the insured namely satellite manufacturers and operators to protect their bottom line.

2.4 Space Insurance

The space insurance allows the mutualisation of a majority of space risks in a single market, where high peaks of risks are manageable using a coinsurance scheme on every risk.

Space insurance policies cover all risks of loss to satellites and launch vehicles with complex technologies, and including loss of satellite performance. Insured clients are mainly satellite operators and manufacturers willing to protect their assets or their financial health, leading to very high amounts insured with peaks up to 500 M€ on a single launch. Overall it translates into a high probability of risk occurrence, very high amounts at stake and a quite limited number of risks covered, which incurs a strong volatility of underwriting results. A coinsurance scheme with an open competition of the complete market is the standard practice on every risk. The yearly premium volume is 750 M$ in average, but claims can fluctuate between 100 M$ and 1800 M$. Consequently market rates fluctuate over time depending on the market capacity versus demand and with the profit and loss history.

The premium charged by insurers will be made of (i) a pure premium based on the technical risk faced by insurers but including possible risk correlations and (ii) a commercial premium made to cover underwriting fees incurred by the activity and to remunerate the risk and ensure a minimum return on capital for its shareholders. The allocated capital imposed by the legislation to ensure the solvency of the insurance company in high loss scenarios, is quite high due to the risk nature and it will require a quite important remuneration included in the commercial premium.

This paper proposes a method to compute the premium and capital requirement. Monte Carlo models have been implemented to evaluate the loss distribution of insurers and tested with various sensitivities. This is used to derive the level of pure premium expected by insurers and the necessary level of allocated capital which then impacts the commercial premium levels. It is used to demonstrate that the size of the portfolio, and the risk correlation within the portfolio are influencing the loss distribution shape and consequently the necessary commercial premium to maintain acceptable safety margins.

The premium rates volatility is analysed and compared to the evolution of the possible explanatory variables in order to derive a correlation model. It appears that the premium evolution is strongly correlated with (1) market capacity and (2) loss history. A simplified model is proposed to illustrate this correlation. However, due to the high dispersion of the underlying risks, the prediction of rates evolution is almost impossible beyond a 1 year time horizon.

2.5 Case Study: Space Actors

At first sight, it appears difficult for a single risk owner (operating company or manufacturer) to assume space risks on its own (due to a limited mutualisation effect and high peaks of risk) therefore risk owners will generally transfer risks on the space insurance market. However, in some circumstances, risk owners can have a sufficiently large fleet to be able to mutualise their own risks, and enough financial reserves to absorb important financial losses.

Case 1: Satellite manufacturer

The Business model of a satellite manufacturer is to sell satellite to operators. In a majority of cases, satellites are delivered on ground, and therefore the final customer bears space risks. Sometimes satellite are sold with an in orbit delivery putting the space risks on the manufacturer side. Isolated risks with a very high value are impossible to assume on a standalone basis and are generally insured on the space market. Nevertheless, in almost all contracts, the manufacturer is penalised in case of underperformance of its product after launch which regularly incurs a space risk in IOT and IOL phases wrt to the performance of its spacecrafts creating a quite important portfolio of risks.

This portfolio is characterized by a quite important number of risks (10-15 IOTs in backlog + 20-40 satellites in orbit) and homogeneous amounts. Performance penalties relative to each satellite is in general significant (5-25 M€) but still manageable considering the typical financial reserves of large companies. Another important element of the portfolio is to be composed of satellites sharing the same design, quality process, and equipments batches leading to an important risk correlation and a significant exposure to serial losses.

A Monte Carlo model is implemented and tuned with the in orbit return on experience, to compute the loss distribution of the portfolio. Possible serial losses incur a fat tail. The problematic faced by the manufacturer is two fold: (i) provision enough capital to absorb overall losses (ii) manage the impact of instant failures on the company results with reserves.

Mainly three solutions have been studied and compared:

• Insurance: with a large fleet, externalisation appears very expensive and not optimized but remains the only prudent solution below a certain portfolio size or for risk adverse companies

• Self insurance is very powerful above a critical portfolio size and returns to the manufacturer the complete benefits of highly performing products. It is not appropriate below a certain portfolio size and for poorly performing fleets

• Stop loss solution: the purpose is to hedge extreme cases and can be considered as a satisfactory compromise for companies with a more reduced risk appetite or medium fleets where absorbing instant financial shocks can be problematic

Actuarial approach provides an accurate tool to determine the appropriate provision level for risk retention, and to support strategic decisions on retention vs transfer of the risks with financial indicators encapsulating all the possible loss scenarios.

Case 2: Satellite Operator

The Business model of satellite operators is to procure and operate satellites to sell services, generally telecommunications pipes or earth images. In general, operators accept satellites deliveries on ground and assume all risks of loss during launch and in orbit This leads to important amounts at risk in case of satellite failure due either to loss of business / revenues or unforeseen cost of satellite replacement.

The operating satellite fleet and future deployments constitute a portfolio of risk measured in terms of loss of company EBIT or loss of Return on Equity (RoE). The main question faced by operators is their capacity to absorb losses and their EBIT objectives.

A Monte Carlo model has been developed to estimate the EBIT / RoE impact of satellite failures, The model outcome is the distribution of probability of RoE of the company. Various risk hedging solutions are then envisaged and implemented in the model to modify the resulting RoE distribution. A critical analysis is performed on their financial efficiency and on their purpose.

• Full risk retention leads to an important probability of very low or negative RoE. This is especially true for small operators where one or two satellite losses can lead to business termination. This strategy looks impossible for prudent operators who need to comply with sponsors and lenders requirements. Even large operators with a high mutualisation power generally don’t accept entirely such a high risk.

• Full insurance: is the safest strategy leading to a fixed cost of risk and no uncertainty on the company RoE (regarding space risks). This is however very expensive and dependant on the market status, but the only solution for very small operators with no internal mutualisation possibilities.

• IOL losses risk retention: due to the more reduced probability of satellites failures in orbit and considering important fleets of satellites, this strategy seems acceptable for large operators. Insuring all launches removes the major peaks of risk and incurs a RoE distribution with a much thinner tail and a very limited probability of negative RoE.

• Partial insurance: (a) Stop Loss strategy aims at maintaining a target RoE for the company by insuring all events or series of events which might put the RoE below a given threshold. This strategy allows to tune the level of risk transfer to match the company RoE objectives and best fit the company risk appetite. (b) Insurance with a transverse franchise aims at reducing the insurance costs with retention (for example the loss of 1 satellite) but still having an important insurance level.

This paper demonstrates that an actuarial approach is a powerful tool for decision making based on a quantified measure of the risk and of the impact of hedging solutions on the company key financial indicators.

2.6 Conclusion

The space sector is by nature and due to high complexity of spacecrafts a risky business where operators, investors and manufacturers are exposed to high financial losses.

A quantitative approach on space risks has been pursued in the present paper by defining a model for the random losses that can be incurred by a satellite. The satellite lifecycle has been decomposed in 3 phases for which a loss model was determined based on the identified risk drivers. This loss risk model is the main building block to create portfolio risk models. The main added value of the present paper in the modelling of failure events is:

• To use a systematic methodology starting from the analysis of observed events in order to match as much as possible the underlying risks with the models. This has been achieved thanks to a solid experience of the space products and manufacturers, and through a detailed review of the claim history and high quality data.

• To use actuarial methods (credibility, confidence intervals) to estimate the reliability of all launch vehicles and satellite types and compensate the reduced data sets available

• To analyse in detail the loss severity of satellite failures allowing a precise modelling of partial losses with standard distributions using kernel density estimator, adjustment and fit test

• To propose a functional in orbit life model incorporating the design specificities and available redundancies as well as the flight heritage per component

• To analyse the correlation between losses in order to properly address the risk of serial losses in a satellite portfolio

A complete analysis of the space insurance sector is presented in the paper. The space insurance market offers an attractive hedging solution for high value risks by a mutualisation of the launch and in orbit risks. A pricing method based on an actuarial approach is presented. The principal benefits of the study are:

• To propose a simple pricing model based on mathematical data, which can be used as a complement or cross check to a qualitative risk analysis approach, or to determine a fair insurance price for complex schemes with multiple satellites, partial loss cases or with new technologies

• To implement a tool capable of determining the necessary capital allocation to perform the space insurance activity while meeting the solvency requirements imposed by the legislation

• To compute the pure premium of a portfolio as well as the required level of commercial premium necessary to meet profitability objectives with a given confidence level.

• Propose a mathematical explanation about the mechanics of market volatility demonstrating the challenge of rate evolution anticipation

The main purpose of the paper is to adopt an insured position and optimize the management of space risks for a manufacturer or an operator. The analysis is mainly based on Monte Carlo models

simulating the impact of random satellite failures on the company financial indicators. The satellite loss model has been used to simulate the loss distribution of complete satellite portfolios and measure the impact of various risk management strategies on the loss distribution. Thanks to the developed models, the risk exposure can be accurately measured and besides the benefits of the different possible risk management strategies can be clearly quantified. The main benefits of the approach are:

• To evaluate the interest and feasibility of a captive risk retention and to propose a fair pricing of XS or stop loss coverage in order to optimize the risk management budgets while maintaining an acceptable level of risks within a company

• To support the dimensioning of risk provisions

• To support decision making on risk retention and transfer trade offs considering the risk appetite of the space actors

• To quantify the influence of risk management strategies on the company financial indicators

All in all, I consider that this paper demonstrates the interest of actuarial science to put light on the risks of this industry and proposes operational mathematical tools to manage efficiently those risks.

Traduction Française

1) Introduction

La gestion des risques est un élément clé dans le domaine spatial. En effet, la grande complexité technologique des engins spatiaux et des lanceurs ainsi que le défi physique que constitue le positionnement des satellites sur orbite et leur exploitation pendant de nombreuses années sans accès direct ou possibilité de réparation, ont fait de la gestion des risques une problématique prédominante dans cette industrie.

Pour les opérateurs de satellite, étant donné la probabilité d'occurrence élevée d’une défaillance (satellite ou lanceur) associée à une exposition significative en termes de pertes financières, la gestion des risques spatiaux constitue une activité déterminante dans le montage d’affaire et dans la gestion financière de la société. Une gestion de risques appropriée est en effet un pré requis pour recueillir les fonds nécessaires pour développer ce type d’activité.

Cela a conduit tous les grands opérateurs et fabricants de satellites à instaurer des équipes dédiées pour gérer ces risques particuliers. C’est le cas notamment d’Astrium. Le rôle de cette équipe est de mesurer avec précision les risques encourus par l'entreprise et de les transférer efficacement, dans la plupart des cas, en s'appuyant sur une assurance spatiale, et si possible en utilisant des outils internes pour parvenir à des solutions financièrement plus optimales. Le présent travail se positionne du point de vue d'un «assuré» cherchant à maîtriser au mieux ses risques spatiaux.

Malgré la quantité relativement faible de statistiques dans ce domaine, ces 30 dernières années nous ont fourni un retour d’expérience suffisant pour envisager ces risques avec une approche analytique. La modélisation est devenue un outil puissant pour comprendre et gérer ces risques efficacement. Cela a conduit à Astrium à acquérir un savoir-faire important en la matière et à développer des outils de modélisation pour améliorer la gestion des risques d'Astrium.

Le présent document analysera diverses solutions de couverture. En d'autres termes, nous chercherons comment les acteurs du secteur spatial peuvent optimiser leur couverture de risques spatiaux qui sont prédominant dans ce domaine d'activité.

On se propose de résoudre les questions suivantes:

• Comment quantifier l'exposition de la société à des risques spatiaux et modéliser l'impact de ces risques sur son modèle économique: estimation du coût du risque spatial comme une variable aléatoire

• Comment optimiser le coût du risque: évaluer le bon arbitrage entre rétention des risques et couverture des risques pour atteindre le meilleur rendement financier possible selon l'appétit au risque de l'entreprise

La première partie de ce travail donne un aperçu de l'environnement spatial et de ses principaux acteurs afin d’offrir au lecteur une idée des risques auxquels ils sont soumis.

La deuxième partie passe en revue toutes les phases de la vie des satellites. Pour chaque phase, on se propose d’analyser l'historique des sinistres pour tenter de dégager des modèles de fréquence et de gravité des sinistres aussi représentatifs que possible. Différentes approches seront mises en œuvre et recoupées afin d'optimiser la modélisation. Les paramètres du modèle sont ajustés sur des données historiques et adaptés à la performance observée des différentes familles de lanceurs et de satellites. Des filtres supplémentaires sur les données seront utilisés afin d’éliminer les biais éventuels. Nous étudierons également la segmentation des différents risques entre les différents types d’engins spatiaux et nous appliquerons la méthode de la crédibilité afin d’améliorer la qualité de l’estimation pour les engins disposant d’un historique limité.

Dans une troisième étape, nous avons étudié le marché de l'assurance spatiale, qui fournit une couverture d'assurance pour les risques spatiaux. L'objectif est de présenter la pratique du marché, et d'analyser l'exposition des assureurs pour un portefeuille typique de risques afin de déterminer leurs besoins en capitaux et déterminer une méthodologie de tarification. Sur cette base, la volatilité du marché sera analysée.

Dans la partie 4, nous étudierons finalement le profil d'exposition typique d'un fabricant et d’un opérateur afin de déterminer comment ces deux acteurs peuvent optimiser leur gestion des risques spatiaux. Des simulations de Monte Carlo sont exécutées pour calculer les distributions de probabilité caractérisant l'exposition des acteurs spatiaux pour ensuite analyser l'efficacité de diverses stratégies de gestion des risques. Nous analyserons principalement la distribution du coût du risque pour chaque type d’acteur, puis à partir de là nous tâcherons d’analyser quel est le compromis adéquate en terme de rétention, de mitigation et de transfert de risque.

2) L’industrie Spatiale

L'industrie spatiale a été initialement créée pour répondre aux missions de défense et de souveraineté des nations développées. Dans les dernières décennies un secteur commercial a émergé pour répondre à la demande en télécommunications et a ensuite évolué vers d'autres types d'activités.

■ Les principaux acteurs de cette industrie sont organisés de la manière suivante. Les opérateurs investissent dans une infrastructure satellitaire et l’exploitent dans le but de fournir un service de télécommunications ou d'imagerie pour générer des revenus. Leur activité dépend du succès des lancements et du bon fonctionnement de leurs satellites, ils sont donc exposés à des pertes d’actifs importantes ou à des pertes de revenus significatives en cas de d’échec au lancement ou en cas de défaillances de leurs satellites. Les banques et les investisseurs qui mettent à disposition les capitaux nécessaires à leur activité demandent par conséquent une couverture d'assurance pour protéger leurs investissements. Les compagnies d'assurance sont en mesure de mutualiser les risques spatiaux et de proposer une couverture d'assurance pour toutes les phases de la vie des satellites depuis leur lancement jusqu’à leur désorbitation. Les fabricants de satellite et de lanceurs sont également exposés à la performance de leurs produits par le biais de régimes de pénalité imposés par leurs clients opérateurs et ont par conséquent développé des solutions de gestion du risque.

■ Les satellites sont des machines spatiales autonomes, capables de maintenir une position dans l'orbite terrestre et de fournir une mission donnée. Les deux principales missions remplies par les satellites sont les télécommunications et l'imagerie de la Terre. Les caractéristiques de ces deux types de satellites sont décrites ci-dessous:

- Les satellites de télécommunications sont généralement situés dans l'orbite géostationnaire à 36 000 km de la terre dans un mouvement synchronisé avec la rotation de la terre qui leur fournit une position fixe sur un point donné du globe. Ils ont besoin de plates-formes de haute puissance avec un pointage stabilisé pour alimenter des canaux d'amplification et des antennes qui relaient l'information sur une empreinte terrestre. Ils servent tous les types de communications pour la défense ou à des fins commerciales et de télévision. Il y a environ 300 satellites de télécommunications géostationnaires en orbite, dont la majorité est exploitée de manière commerciale.

- Les satellites d'observation de la terre évoluent sur une orbite beaucoup plus basse entre 600 et 1000 km de la Terre, ce qui induit leur rotation cyclique autour de la Terre. Ils sont utilisés pour capturer des images optiques ou radar sur de vastes zones d'observation pour répondre aux besoins de prévision météorologique, de cartographie ou d’espionnage. Les plates-formes ou les instruments peuvent généralement être orientés avec agilité pour capturer différents points d’intérêt et télécharger les informations vers les stations au sol. Parmi les 90 à 100 satellites d’observation actuellement en orbite autour de la terre, la majorité est dédiée à la défense ou à des besoins institutionnels.

■ Les lanceurs sont des engins à plusieurs étages motorisés qui se propulsent par la combustion d’ergols liquides ou solides et qui sont contrôlés avec un système de guidage automatisé. Ils sont utilisés pour positionner sur orbite des satellites. Ces véhicules sont soumis à de très fortes contraintes mécaniques et des forces importantes qui rendent leur mission très critique. Les lanceurs capable d'atteindre l’orbite de transfert géostationnaire nécessitent une poussée encore plus importante et impliquent des technologies plus complexes. Il y a environ 60 à 120 satellites lancés chaque année.

3) Les Risques Spatiaux

Les satellites sont exposés à un risque relativement élevé de défaillance partielle ou totale au cours de leur déploiement et durant leur vie opérationnelle. Chaque satellite peut générer des pertes financières importantes en cas de défaillance. Les pertes éventuelles liées à chaque satellite seront déterminées par une variable aléatoire appelée Ratio de Perte (RP). "RP" sera modélisé avec (i) un modèle d’occurrence de défaillance "OCC" et (ii) un modèle de sévérité associé à la défaillance "SV".

La méthodologie mise en œuvre dans ce papier est d'analyser les pertes historiques pour extraire les facteurs de risque principaux pour chaque phase de vie du satellite. Les facteurs de risque sont ensuite traduits en un modèle statistique qui est ajusté avec les ensembles de données historiques. La nature des risques étant différente le long du cycle de vie des satellites, un modèle spécifique sera déterminé pour chaque phase: lancement, mise à poste / recette et vie en orbite.

3.1 – La Phase de Lancement

La phase de lancement est très critique en raison des contraintes extrêmes auxquelles sont soumis lanceurs et satellites durant le transport jusqu’à l'orbite souhaitée. L'accélération et les vibrations très intenses font de chaque tir un véritable défi technique et physique. Les cas d’échecs au lancement typiques sont l'explosion du véhicule (lorsque les forces en jeu deviennent incontrôlables), ou une mauvaise injection du satellite dans l'espace en raison d'une poussée insuffisante généralement liée à une interruption accidentelle de propulsion ou d'un dysfonctionnement du contrôle du véhicule ou du système de guidage. Le taux d’échec des lancements varie entre 2% et 10% pour les véhicules de conception éprouvée, tandis que les nouveaux lanceurs présentent un taux d'échec beaucoup plus élevé.

A. Modèle d’Occurrence

Tous les événements « lancement » sont considérés comme totalement indépendant et peuvent se traduire soit par un succès soit par une perte, ce qui peut être déterminé simplement par une loi de Bernoulli avec un paramètre P_LF représentant la probabilité de défaillance d'un lancement donné. P_LF sera spécifique à chaque lancement selon la maturité du design du lanceur et son expérience en termes de tirs passés. Un objectif important de cette étude sera d'analyser la différenciation des lanceurs et l’évolution de la probabilité d’échec au cours du temps.

La conception d'un véhicule de lancement nécessite des investissements importants et de nombreux essais avant d'atteindre un concept mature. Lorsque la conception est éprouvée, la qualité du processus de fabrication et de contrôle sera déterminante sur la fiabilité du lanceur. Par conséquent, les principaux facteurs caractéristiques dans le modèle d’occurrence proposé seront (a) la maturité de la conception et (b) la qualité du processus de fabrication. Cela nous conduit à diviser le paramètre du modèle en 2 composantes (a) la probabilité de défaillance liés à la conception (P_DLF) et (b) la probabilité de défaillance liée au processus de fabrication (P_MLF) avec la relation P_LF = P_DLF + (1 - P_DLF) * P_MLF.

P_DLF dépend de la maturité technique de la conception du lanceur, elle est déterminée par le taux d'échec historique de lanceurs à un stade de développement donné. P_MLF sera estimée par le taux d'échec moyen du lanceur corrigé avec une méthode de crédibilité et en utilisant un estimateur par intervalle de confiance.

B. Modèle de gravité

Les échecs au lancement conduisent généralement à des pertes totales des satellites embarqués, les pertes partielles sont très rares, donc la variable aléatoire « gravité » pour la phase lancement est considérée comme une constante égale à 100% dans tous les cas.

3.2 - Phase de mise à poste et recette en orbite

Le LEOP et la phase de recette en orbite sont destinés à mettre le satellite sur son orbite définitive, veiller au déploiement tous les systèmes et tester tous les composants du satellite. Il y a beaucoup de causes possibles de dysfonctionnements autant donné que les satellites sont des systèmes extrêmement complexes faits de composants électroniques, électriques, pyrotechniques, chimiques, et mécaniques. La défaillance d'un seul composant (point de panne unique) dans la phase de positionnement peut empêcher le satellite d'atteindre sa position finale ou d’atteindre une configuration exploitable. Certaines défaillances peuvent aussi conduire à un accomplissement partiel de la mission.

A. Modèle d’Occurrence

Les critères les plus importants pour l'évaluation des risques dans cette phase sont: (i) le fabricant et sont expérience / niveau de qualité et (ii) la criticité techniques de l'engin reposant sur la complexité de la conception et l’expérience en vol des équipements satellites. Par conséquent, la probabilité de défaillance sera issue de ces deux facteurs et définie comme P_IOTF = TC_Factor * P_MIOTF.

TC_Factor sera utilisé pour ajuster la fiabilité attendue par satellite sur la base d’une analyse technique de ses composants et sa mission. Le paramètre P_MIOTF sera spécifique à chaque fabricant et fonction de son palmarès, avec P_MIOTF = E[LossRate (Fabricant)] / E [gravité]. Le taux d'échec obtenu est ensuite corrigé par une méthode de crédibilité. En raison de la taille relativement petite de l'échantillon de données, une méthode d’estimation par intervalle de confiance est également utilisée pour améliorer le niveau de confiance du modèle.

Enfin, afin de représenter la corrélation des risques entre les satellites, la probabilité de défaillance sera décomposée en une partie idiosyncratique (spécifique au satellite) et une partie systémique qui sera partagée par les satellites du même groupe. La part du risque systémique dans le risque d'échec global est estimée pour cette phase IOT soit avec une approche statistique soit avec une approche analytique basée sur une analyse technique des satellites.

B. Modèle de gravité

La perte d'éléments très critiques de l'engin (panneaux solaires, propulsion, antennes) conduit généralement à un échec total. Historiquement, une occurrence dans la phase IOT mène à la perte totale dans un tiers des cas pour les télécommunications. Cependant, les satellites incorporent généralement des redondances pour chaque sous-système et des marges de performances, donc il arrive souvent que la défaillance d’un équipement induise une sous performance sans anéantir complètement la mission du satellite.

La gravité des défaillances IOT doit être modélisée de façon à représenter aussi justement que possible les principaux modes de défaillance observés. La distribution de la loi de probabilité « gravité » de la panne est obtenue à partir de l'échantillon observé des défaillances de satellites qui se traduit par une fonction de densité continu en utilisant un « Kernel Density Estimator » (estimateur

par noyau). Il est ensuite ajusté avec un mélange de distributions normales et Weibull en utilisant une méthode d’estimation des moindres carrés et un test de Kolmogorov Smirnov pour valider l'adéquation. En raison de l'existence de trois modes dans la distribution observée, nous obtenons une distribution ajustée qui est un mélange de trois distributions représentatives de chaque mode.

3.3 La Phase de Vie en orbite

Après la première année d’opération dans l'espace, on observe un risque de défaillance du satellite considérablement réduit, néanmoins les satellites sont toujours exposés à un environnement très hostile et soumis à un phénomène d’usure sans aucune possibilité de réparation durant de longues périodes de temps (5 à 15 ans) et sont donc toujours sujets à des pannes diverses.

A. Modèle d’Occurrence

La durée de vie en orbite des satellites est généralement comprise entre 5 et 15 ans (parfois plus) de fait une estimation de la probabilité d’occurrence de panne au cours du temps est nécessaire. Ceci peut être obtenu en caractérisant la courbe de survie du satellite, en d'autres termes la fonction de distribution cumulative de la variable aléatoire « Time To Failure » (TTF). Celle-ci peut ensuite être traduite en une probabilité de défaillance périodique (annuelle par exemple) (cf tables de mortalités utilisées en assurance vie).

Deux approches sont proposées pour modéliser la loi de survie.

La première méthode consiste à ajuster la courbe de survie empirique d’un type de satellite avec une distribution de Weibull ou log-normale (choisi pour sa forme particulière), et à estimer les paramètres des distributions avec un estimateur du maximum de vraisemblance. L'avantage de cette méthode est de faire correspondre correctement la durée de vie estimée et celle observée. En revanche, l'ajustement doit être effectué sur les données de tous les satellites d'une catégorie donnée et donc cette méthode ne permet pas de prendre en compte la fiabilité spécifique de chaque fabricant.

La seconde méthode consiste à considérer l'architecture fonctionnelle du satellite pour modéliser le TTF des équipements le constituant avec une distribution exponentielle. La fiabilité (espérance de vie sans panne) des équipements est calculée avec un estimateur du chi2 qui détermine le paramètre de la loi exponentielle. Enfin, la loi de survie globale du satellite est recomposée en agrégeant les lois de survie élémentaires de chaque équipement en intégrant au passage les schémas de redondance entre eux. Cette méthode est très puissance, car elle permet une modélisation détaillée reflétant à la fois l'expérience spécifique du fabricant, l'état de santé réel de tous les équipements et la fiabilité intrinsèque du satellite. Cependant, cela nécessite un ensemble de données très détaillées.

L'origine des défaillances peuvent être classées en trois catégories: (i) «aléatoire» pannes liées à la survenance d'événements imprévus ou un stress excessif surpassant la robustesse spécifiée du satellite même en l'absence de défaut de conception ou de fabrication, (ii) « défaut » pannes liées à un défaut de conception ou à un défaut de fabrication non détectés qui induisent une faiblesse au niveau du satellite ou une dégradation accélérée des performances, ce type de défaut peut être partagé par plusieurs satellites ayant un design similaire, ce qui induit une corrélation entre plusieurs risques et la possible survenance de pertes en série (iii) « stress environnemental » panne due à une activité solaire extrême ou un excès de débris qui peuvent endommager les satellites, cette cause peut également être partagé entre les satellites situés dans la même position et créer des pertes en

série. La probabilité de perte sera donc décomposée en une partie idiosyncratique et une partie systémique (elle-même divisée entre probabilité de défaut et probabilité de stress environnemental)

B. Modèle de gravité

Le risque principal dans la phase d'exploitation est la survenance d'une perte partielle car il existe de nombreux composants à bord qui ne fonctionnent pas de manière suffisamment fiable pour garantir les performances nominales durant toute la vie opérationnelle d’un satellite. Les redondances à bord évitent généralement que les pertes d’équipement se traduisent par une perte totale mais cela n'est pas toujours suffisant pour éliminer le risque de perte total qui reste non négligeable. La distribution de gravité des pertes est obtenue à partir de l'échantillon des pertes partielles observées en orbite. La densité associée est calculée d'abord avec un estimateur de densité par noyau, puis ajusté avec un mélange de distributions normales et Weibull correspondant aux principaux modes de la densité.

3.4 - Modèle de portefeuille de risque

Un modèle de panne a été défini pour chaque phase de la vie d’un satellite et adapté à la fiabilité spécifique de chaque produit. Ceci détermine la loi de la variable aléatoire Ratio de Perte RP (S, L) pour chaque satellite S et chaque lanceur L. Les modèles de perte ainsi définis peuvent être utilisés pour simuler la distribution des pertes sur un portefeuille de risques donné avec une méthode de Monte Carlo.

Le principe du modèle Monte Carlo est de définir des variables aléatoires pour chaque risque du portefeuille, calibrées avec ses caractéristiques propres. On choisit ensuite un indicateur financier (montant des pertes, rentabilité, RoE) qui dépend des valeurs prises par ces variables aléatoires. On génère un échantillon de cet indicateur en simulant un grand nombre de scénarios pour tous les risques considérés en collectant l'indicateur financier qui résulte de chaque scénario. Cet échantillon peut être utilisé pour dériver des statistiques et construire des distributions.

Ces modèles seront la base pour calculer l'exposition des acteurs de l’industrie spatiale et pour déterminer (a) la tarification des risques et des besoins en capitaux des assureurs spatiaux, et (b) les solutions de gestion du risque à la disposition des constructeurs et des opérateurs de satellites souhaitant garantir leur solidité financière.

4) L'assurance spatiale

L'assurance spatiale permet de mutualiser la majorité des risques spatiaux dans un unique marché, en utilisant un schéma de coassurance, et d’absorber des pics de risque élevés.

Les polices d'assurance couvrent tous les risques de perte de satellites et de lanceurs malgré leurs technologies complexes, et notamment la perte de performance. Les assurés sont essentiellement des opérateurs de satellites ou des fabricants désireux de protéger leurs actifs ou leur santé financière. Les montants assurés sont généralement très élevés avec des pointes allant jusqu'à 500M€ sur un seul lancement. Globalement, le risque spatial assuré est caractérisé par une forte probabilité d’occurrence du risque, des montants assurés importants et un nombre assez limité de risques couverts, ce qui entraîne une forte volatilité des résultats de souscription. Un système de coassurance et de compétition de l’ensemble des acteurs du marché est la pratique standard pour chaque risque. Le volume des primes annuelles s’élève à 750 M$ en moyenne, mais les règlements cumulés de sinistres peuvent fluctuer entre 100 M$ et 1 800 M$. En conséquence les taux du marché fluctuent au fil du temps en fonction de l’équilibre entre la capacité disponible sur le marché et la demande, et selon les pertes et profits réalisés par le marché.

On considère dans ce travail que la prime facturée par les assureurs se compose de (i) une prime pure qui dépend du risque technique assumé par l’assureur, y compris les possibles corrélations entre différents assurés (ii) une prime commerciale destinée à couvrir les frais de souscription de l'activité et à rémunérer le risque pris par l’assureur pour assurer un rendement minimum du capital pour ses actionnaires. Le capital exigé par la législation pour garantir la solvabilité de la compagnie d'assurance, est assez élevé en raison de la nature du risque et cela induit de fait un besoin de rémunération important qui est inclus dans la prime commerciale.

Ce document propose une méthode pour calculer le niveau de prime que doit facturer l’assureur en fonction de ses objectifs de rentabilité et pour estimer les exigences de fonds propres. Un modèle Monte Carlo est mis en œuvre pour évaluer la distribution des pertes des assureurs et testé avec des sensitivités différentes. Ceci est utilisé pour calculer la prime pure et le besoin en capital associés à un portefeuille de risque donné, puis le niveau des primes commerciales. Les sensitivités réalisées permettent de démontrer que la taille du portefeuille, et la corrélation des risques au sein du portefeuille influent sur la forme de la distribution caractérisant le résultat de l’assureur et par conséquent la prime commerciale nécessaire pour maintenir des marges de sécurité acceptables.

Enfin, la volatilité des taux de prime est analysée et comparée à l'évolution de variables supposées explicatives pour dégager un modèle de corrélation. Il apparaît que l'évolution des primes est fortement corrélée avec la capacité du marché (1) et l'historique des pertes (2). Un modèle simplifié est proposé pour illustrer cette corrélation. Toutefois, en raison de la forte dispersion des risques sous-jacents, la prédiction de l'évolution des taux est presque impossible au-delà du très court terme.

5) Étude de cas: les acteurs spatiaux

A première vue, il semble difficile pour les acteurs du spatial (société d'exploitation ou fabricant) d’assumer seuls sur fond propre les risques spatiaux auxquels ils sont sujets étant donné la mutualisation relativement limitée dont ils bénéficient en interne et l’existence de pics de risque élevés. Par conséquent, ces acteurs optent généralement pour un transfert de risques sur le marché de l'assurance spatiale. Toutefois, dans certaines circonstances, les sociétés du secteur peuvent disposer d’une flotte de satellites suffisamment importante pour être en mesure de mutualiser leurs risques et périls, mais aussi de réserves financières suffisantes pour absorber des pertes importantes.

Cas 1: Le constructeur de Satellites

L’activité d'un fabricant de satellites consiste à vendre des satellites à des opérateurs. Dans la majorité des cas, les satellites sont livrés au sol, et donc c’est le client final qui supporte les risques spatiaux associés. Parfois cependant, des satellites sont vendus livrés en orbite ce qui replace les risques spatiaux du côté du fabricant. Ces risques isolés, pouvant représenter une perte potentielle de plusieurs dizaines de million d’euros, ne peuvent être assumés intégralement par le constructeur et sont généralement assurés sur le marché spatial.

Cependant, dans presque tous les contrats, le constructeur est soumis à un schéma de pénalité en cas de sous-performance des produits livrés après le lancement. Le constructeur encourt de fait régulièrement un risque spatial durant la phase de recette et de vie en orbite de ses satellites. Il détient donc un portefeuille de risques lié à la performance de ses engins spatiaux dont le volume global peut être très significatif.

Ce portefeuille est caractérisé par un nombre assez important de risques (10-15 satellites à livrer dans le carnet de commandes + 20-40 satellites déjà livrés en orbite) et des montants homogènes. La pénalité de performance liée à chaque satellite est en général significative (5-25 M€), mais encore gérable compte tenu des réserves financières dont disposent les grands fabricants. Une autre caractéristique importante du portefeuille est qu’il est composé de satellites partageant le même design, un processus qualité commun, et des équipements issus d’un même lot. Cela conduit à une forte corrélation des risques et de fait un risque important de pertes en série.

Un modèle Monte Carlo a été développé pour calculer la distribution des pertes associées au portefeuille du constructeur et calibré sur la base du retour d'expérience des satellites en orbite. Le risque de perte série se retrouve dans la queue de distribution ainsi obtenue. Les problématiques rencontrées par le fabricant sont de deux ordres: (i) il doit disposer d’un capital suffisant pour absorber les pertes globales du portefeuille qui peuvent s’étaler sur plusieurs années (ii) il doit être en mesure d’absorber l'impact instantané des défaillances de satellites sur les résultats de l’entreprise et donc disposer de réserves suffisantes à cet égard.

Principalement trois solutions ont été étudiées et comparées:

• L’Assurance: considérant une grande flotte de satellite, l'externalisation complète du risque apparaît très coûteuse et peu optimisée, ceci dit elle reste la seule solution prudente en dessous d'une certaine taille de portefeuille, ou pour des fabricants ayant une forte aversion au risque

• L'auto assurance ou rétention complète du risque est très efficace au-dessus d'une taille critique de portefeuille. Elle présente l’avantage de retourner intégralement au fabricant les bénéfices découlant de la bonne performance de ses produits. En revanche, une telle stratégie pourra difficilement être adoptée en dessous d’une certaine taille de portefeuille (faible mutualisation du risque) ou lorsque la fiabilité des produits est mauvaise

• L’assurance « Stop Loss »: le but est de couvrir les cas de perte extrêmes ce qui constitue un compromis satisfaisant pour les entreprises ayant un appétit au risque relativement réduit ou disposant de flottes de moyenne taille pour lesquelles absorber des pertes financières instantanées peut être problématique

L’approche actuarielle développée dans ce travail fournit un outil précis pour déterminer le niveau de provision approprié pour gérer la rétention des risques, ou pour appuyer une décision stratégique lorsqu’il s’agit d’arbitrer entre transfert et rétention des risques à l’aide d’indicateurs financiers encapsulant tous les scénarios de perte possible.

Cas 2: L'opérateur de Satellite

L’activité des opérateurs de satellites consiste à acheter et à exploiter des satellites pour vendre un service, en général des canaux de télécommunications ou des images de la Terre. Dans la majorité des cas, les opérateurs réceptionnent les satellites achetés au sol avant leur lancement et assume donc ensuite tous les risques de perte lors du lancement et la vie en orbite. Ils sont de fait exposés financièrement en cas de destruction ou de défaillance d'un satellite en terme de perte d’exploitation ou de coûts de remplacement non prévus.

La flotte de satellites déjà en exploitation ou restant à lancer constitue un portefeuille de risque qui se mesure en termes de perte d'EBIT ou de perte de rendement des capitaux propres (RoE) de l’entreprise. La question principale que se posent les opérateurs, est leur capacité à absorber des pertes et la tenue de leurs objectifs d'EBIT.

Un modèle de Monte Carlo a été développé pour estimer l'impact d'EBIT / RoE causé par des défaillances de satellites, le résultat du modèle est la distribution de probabilité de RoE de l'entreprise. Diverses solutions de couverture de risque sont alors envisagées et mises en œuvre dans le modèle afin de mesurer leur impact sur la distribution de RoE qui en résulte. Chaque solution est ensuite analysée en termes d’efficacité financière et de couverture.

• La rétention complète des risques conduit à une probabilité importante de RoE très faible ou négative. Cela est particulièrement vrai pour les petits opérateurs, pour lesquels une ou deux pertes de satellites peuvent conduire à la cessation d’activité. Une telle stratégie semble impossible pour les opérateurs prudents qui ont besoin de se conformer aux exigences de leurs actionnaires et des prêteurs. Même les grands opérateurs qui disposent d’un fort pouvoir de mutualisation ne supportent généralement pas un risque si élevé.

• L’assurance intégrale : c'est la stratégie la plus sûre menant à un coût du risque fixe et aucune incertitude sur le RoE de l’entreprise (concernant les risques spatiaux). Celle-ci est néanmoins très coûteuse et dépendante de la situation du marché de l’assurance qui est soumis à de fortes

fluctuations. C’est en revanche la seule solution envisageable pour de très petits exploitants sans possibilités de mutualisation interne du risque.

• Rétention des pertes en orbite: en raison de la probabilité plus réduite d'échecs des satellites en orbite et en tenant compte des flottes importantes de satellites, cette stratégie semble acceptable pour les grands opérateurs. Assurer tous les lancements supprime en effet les pics majeurs de risque et génère une distribution de RoE avec une queue beaucoup plus mince ainsi qu’une probabilité très limitée de se retrouver avec un RoE négatif.

• L’assurance partielle: (a) une assurance « stop loss » permet de maintenir le RoE de l’entreprise au dessus d’un certain seuil quoi qu’il arrive en assurant tous les événements ou série d'événements qui pourraient conduire à une RoE sous un seuil donné. Cette stratégie permet d’adapter le niveau de transfert de risque aux objectifs de RoE de l’entreprise et à son appétit au risque.

(b) Une assurance avec une franchise transversale vise à réduire les coûts d'assurance grâce à une franchise (par exemple la perte d’un satellite), tout en maintenant une couverture d'assurance importante.

Ce document démontre que l'approche actuarielle offre un outil puissant pour une prise de décision efficace et éclairée basée sur une mesure quantifiée du risque et de l'impact des solutions de couverture sur les indicateurs financiers clés de l’entreprise.

6) Conclusion

Le secteur spatial est par nature un domaine d’activité risqué en raison de la complexité élevé des engins spatiaux, où les opérateurs, les investisseurs et les fabricants sont exposés à des pertes financières importantes.

Une approche quantitative sur les risques spatiaux a été menée dans le présent document en définissant un modèle pour les pertes aléatoires qui peuvent être encourus par un satellite. Le cycle de vie d’un satellite est décomposé en 3 phases pour lesquelles un modèle de perte a été déterminé sur la base des facteurs de risque identifiés. Ce modèle de risque constitue la brique de base permettant de créer des modèles de risque de portefeuille. La principale valeur ajoutée de ce travail de modélisation est:

• d’utiliser une méthodologie de modélisation systématique à partir de l'analyse des observations afin de faire correspondre autant que possible les risques sous-jacents aux modèles. Ceci est rendu possible par la connaissance détaillée des produits spatiaux et des constructeurs, et à travers un examen approfondi de l'historique des sinistres et de données de haute qualité.

• de mettre en œuvre diverses méthodes actuarielles (crédibilité, intervalles de confiance) pour estimer la fiabilité de tous les types de véhicules de lancement ou de satellites et pour compenser la taille réduite des données d’entrée disponibles.

• d’analyser en détail la gravité des pertes (estimations par noyau ou paramétriques assorties de tests d’ajustements) ce qui permet une modélisation précise des pertes partielles à l’aide de distributions standards

• de proposer un modèle de survie des satellites avec une approche fonctionnelle intégrant les spécificités de conception, les redondances disponibles et l’héritage en vol des équipements

• d’analyser la corrélation des risques en vue de traiter correctement les potentielles pertes en série dans un portefeuille de satellites

Le document propose une analyse complète du secteur de l'assurance spatiale. Le marché de l'assurance spatiale offre une solution de couverture attrayante pour les expositions élevées grâce à une mutualisation des risques lancement et vie en orbite. Une méthode de tarification fondée sur une approche actuarielle est proposée. Les principaux avantages de l'étude sont:

• de proposer un modèle de tarification simple basée sur des données mathématiques, qui peut être utilisé comme un complément ou en vérification d’une approche analytique qualitative des risques, ou pour déterminer un prix équitable pour des couvertures d'assurance complexes (multiples satellites, cas des perte partielle, nouvelles technologies)

• de déterminer les besoins en capitaux nécessaires à l'activité d'assurance spatiale, tout en répondant aux exigences de solvabilité imposées par la législation

• d’estimer la prime pure d'un portefeuille et le niveau de prime commerciale requis pour répondre aux objectifs de rentabilité de l’assureur avec un seuil de confiance donné.

• de proposer une explication mathématique au mécanisme de volatilité du marché démontrant au passage la difficulté d’anticiper l’évolution des taux

Enfin, l’objectif principal de ce papier est de proposer des solutions pour optimiser la gestion des risques spatiaux pour un fabricant ou un opérateur. L'analyse s’appuie sur des modèles de Monte Carlo simulant l'impact des défaillances aléatoires de satellite sur les indicateurs financiers des entreprises. Le modèle génère la distribution des pertes potentielles associées à un portefeuille de satellite et permet de mesurer l'impact de différentes stratégies de gestion des risques sur cette distribution. Grâce à ces modèles, on est en mesure de quantifier avec précision l'exposition au risque des acteurs du spatial ainsi que les avantages que présentent les différentes stratégies de gestion du risque possibles. Les principaux avantages de l'approche sont les suivants:

• évaluer l'intérêt et la faisabilité d'une rétention de risques dans une captive d’assurance

• de proposer une tarification équitable de couverture en excess ou en stop loss afin d'optimiser les budgets de gestion de risques tout en maintenant un niveau d’exposition acceptable pour l’entreprise

• supporter le dimensionnement des provisions pour risques

• aider la prise de décision sur la rétention de risque et le transfert compte tenu de l’appétit au risque des acteurs spatiaux

• quantifier l'influence des stratégies de gestion des risques sur les indicateurs financiers des entreprises

Dans l'ensemble, on peut considérer que ce document démontre l'intérêt de la science actuarielle pour mettre en lumière les risques de cette industrie et proposer des outils mathématiques opérationnels pour gérer efficacement les risques de ce secteur.

333... SSSpppaaaccceee EEEnnnvvviiirrrooonnnmmmeeennnttt

This chapter will provide to the reader an overview of the space business actors and their relation. We will first recall the main missions accomplished by satellites and their usage. We will also describe the satellites and launchers principle and recall the main products which are presently used in the world. Finally, the space business will be explained in numbers.

3.1 Space Business

The Space sector is quite young compared to other industries but has significantly developed over the last 50 years. This section will provide to the reader an overview of the sector through the different satellite markets and satellite missions.

3.1.1 Satellite Markets

Broadly speaking, the market can be divided into three segments, namely commercial, public / institutional and military. Within each market segment the use of all orbit types is a possibility, although some are more likely than others. The demand for launch services and satellite construction within the civil market segment has remained relatively constant since the initial growth of the 1960s. The military market segment saw spectacular growth in the 1960s, but has been in decline since the collapse of the Soviet Union. The commercial market has experienced a higher volatility, with an important growth in the 1990s, and decline in the first part of the twenty-first century. In the recent years, we have seen the civil / military frontier disappear with the development of civilian or military satellite operations, especially communications, provided by nongovernment agencies on a commercial basis (notably through Public Private Partnerships like the Skynet5 military telecom infrastructure for the UK MoD).

The diagram below illustrates the satellite launches over the last 50 years.

1 – Space development Nombre de SATELLITE 200 Almost exclusively based

180 1 2 3 4 on public investment

160 2 – Telecom Boom 140 Rapid development of the 120 commercial sector in the 100 Telecom area 80 3 – Telecom Crash 60 Collapse of the telecom 40 development 20

0 4 – Recent Years 1960 1965 1970 1975 1980 1985 1990 1995 2000 2005 2010

Type Stable and balanced COMMERCIAL MILITARY PUBLIC Year period despite the crisis

Figure 1: Spacecraft Launched 1960-2010 by Satellite Type

Public / Institutional

The civil market is directly funded by governments and provides satellite operations that are deemed of interest or are important to that specific nation. The Public sector relies on national or international space agencies (French CNES who strongly supported the Ariane story, US NASA strongly involved in manned spacecrafts). Their role is to support technological development with multinational funding. International collaboration is very developed to reduce individual costs and avoid duplication of effort. Major satellite operations within the civil market are for technology demonstration missions, space

science, meteorology and other Earth observation, interplanetary missions and manned spaceflight. Over time, manned spaceflight missions have covered the range of operations conducted by unmanned satellites, as well as serving national prestige and propaganda purposes.

Military

Like its civilian counterpart, the military market is funded exclusively by national governments. In addition to many of the missions conducted by civilian agencies further military specific missions are conducted including, early warning, intelligence gathering and global positioning. Although funded by military agencies, global positioning satellites have seen significant use by civilian and commercial interests. Most military missions are exclusive to one nation for security reasons and launch services are normally sought within the country in question.

Commercial

A commercial satellite is one that is launched with the definite purpose of providing a commercial service (~25% of the launched satellites in the last decade). Although many commercial schemes have been proposed that utilise satellite operations, there are only two long-standing demonstrated market areas, these are the use of communications satellites and Earth observation satellites. Commercial operators aim for a significant return on investment and seek funding from many sources. The latter may include private equity and debt, as well as public offerings and customer financing. The relatively recent deregulation in the telecommunications industry results in a highly competitive environment for communications satellite operators.

The diagram below shows the different satellite missions launched in the last 20 years. The importance of telecommunications is obvious.

Nombre de SATELLITE 160

140

120

100

0 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010

MISSIONGROUP Communications Earth Observation Intelligence Navigation Science Year

Figure 2: Spacecraft Launched 1990-2010 – Satellite Mission

3.1.2 Commercial Market Organization

The present paper will focus on the commercial market where the management of risks is performed with financial objectives. The commercial market involves several actors from the service and manufacturing industry as well as the financial sector. The chart below gives an overview of the main actors and their relations.

Launch Service Satellite Space Agencies Provider Manufacturer

launch contract satellite contract

Investor Equity Owners equity Satellite Insurance Company Operator

Bank bank loan Dept Owners

service contract

End Users

Figure 3: Commercial Market Actors

Satellite Operators

The satellite operator is at the center of the space business. His role is to provide satellite based services to end users. The operators will contract with satellite manufacturers to purchase a fleet of satellites and with launch service providers to launch them into space. They need the support of banks and investors to gather the necessary funds to purchase their expensive infrastructure, and the support of space insurers to protect their book value or earnings in case of failure or underperformance of their assets. Operators are exposed to loss of revenues in case of satellite failures, their objective is to protect their profitability and their financial health towards investors.

Satellite manufacturers

Manufacturers deliver satellites and associated services to operators. They are often financially exposed to penalties in case of underperformance of their products.

Launcher Manufacturers

Launch manufacturers are building rockets sold to the launch service providers. Generally the exposure of launcher manufacturers wrt the quality of their products and the success rate is very limited. Due to high cost of entry, this industry is often subsidized by public funds at least for the early developments.

Launch Service Providers

Launch service providers are in charge to put satellites into orbit by purchasing batches of launchers and sell launch operations to their customers. The risk of launch failure is generally insured directly by the end customer but some launch service providers generally offer (and charge) a launch reflight guarantee providing a replacement launch in case of failure.

Space Agencies

Space agencies are supporting the development of space by providing institutional budgets to help new technology developments or to finance institutional programs in the field of science, meteorology, disaster monitoring or public sector attributions. The funding of agencies relies on national budgets and therefore agencies would generally self insure all their satellites.

Investors

Banks and Private Equity Funds are providing the necessary funds which allow the important Capital investments necessary to build and launch satellites. The funding of space programs can be achieved with different layers where the risks taken and the cost of capital are different. Investors are driving the company financial objectives and also influence the company risk management objectives. In general, the level of risk acceptable by banks is very limited for both commercial and technical risks. Therefore, the outstanding debt should always be backed by insurance in case of satellite failure. The level of risk acceptable for other investors is generally larger (against a more important return expectation), notably the commercial risks can be partially retained by equity providers and part of the expected return might be lost in case of satellite failure.

Insurers

Insurers are a key actor in the setup of space business since they allow a transfer of the majority of space risks which are unacceptable to the investors. Insurers can mutualise this risk by constituting a sufficiently large portfolio of space risks and can afford to provide coverage against a remuneration of the risk.

End users

End users are purchasing satellite capacities to provide services out of it.

3.1.2.1 Operators

Commercial Telecom Operators

Typical example is a telecom operator which sells communication capacity over the globe for TV broadcast and internet. The telecommunication market is strongly consolidated with only 5 actors controlling 50% of the worldwide fleet and controlling the majority of the business. The leading Telecom commercial operators have a large fleet of GEO satellites covering the earth surface. The size of the fleets and the high amounts at stake will allow an optimized management of space risks.

Operator Turnover # Satellites Intelsat 2 500 M$ 52 SES 2 500 M$ 44 Eutelsat 1 400 M$ 26 Telesat 750 M$ 12 JSAT 360 M$ 13

Tableau 1: Telecom Operators

Smaller operators are also present on niche markets or on regional coverage. They generally operate smaller fleets in the range of 5 satellites.

Telecom constellation operators

The 90s have also seen the development of telecom constellation operators managing fleets of 30-50 satellites rotating around the earth. However, the commercial development of this particular business was disappointing and these commercial operators have faced significant financial difficulties.

Commercial Earth Observation Operators

Earth Observation operators control and program a set of satellites to capture images (optical or radar) and sell their content to serve various business like agriculture, mapping, survey, monitoring. They generally provide added value services based on imaging.

The earth observation market is more segmented and more institutional. Operators would also manage very smaller fleets of satellites. The development of commercial earth observation is strongly accelerating but is still in the initial steps.

There are only 3 commercial earth observation operators today, the Americans DigitalGlobe and GeoEye and the European Astrium Global Earth Observation Services. Each company managing fleets of approximately 3 to 6 satellites. The indicative turnover volume is around 100-200 M€ per year which indicate that this activity is still far more reduced that the telecom business.

The operators sellable capacity is measured in operational transponders / sellable images over time. This capacity is proportional to the satellites performances over their lifetime. In case of a satellite anomaly or failure, a reduction of the sellable capacity will incur loss of revenues. The objective is to maintain enough sellable capacity and revenues to make a profitable business.

Institutional Operators

There are also a number of non commercial operators either institutional or military bodies serving defence, national security or earth monitoring purposes. Due to the specific public nature of these operators, they are not subject to the same financial requirements as private operators and will not be part of the present work.

3.1.2.2 Space agencies

The role of space agencies is to sponsor and develop the space industry for a country or a group of country. They are a source of funding for the development of space products, services and technologies serving the interest of the nations. For example, the European access to space with the Ariane program was almost entirely possible thanks to the engineering and funding provided by the French space agency CNES. Another example is the American NASA who has the largest budget in the world to develop the American space industry and supported the shuttle program. The main agencies and their respective indicative budgets are given in the table below.

Country Agency Budget (USD)

United States NASA (National Aeronautics and Space Administration) $19,000 million ESA Europe ESA (European Space Agency) $5,430 million

Russia ROSCOSMOS (Russian Federal Space Agency) $3,800 million

France CNES (French Space Agency) $2,822 million

Japan JAXA (Japan Aerospace Exploration Agency) $2,460 million

Germany DLR (German Aerospace Center) $2,000 million

China CNSA (China National Space Administration) $1,300 million

India ISRO (Indian Space Research Organization) $1,268 million

Italy ASI (Italian Space Agency) $1,000 million Tableau 2: Space agencies

Generally space agencies are not involved in the commercial sector like the telecommunications. However, it happens that they provide funding to develop new business under a Public Private Partnership scheme in areas that the industry would not be able to develop without an institutional support.

3.1.2.3 Manufacturers

Commercial Telecommunications

The telecommunication market is split between a couple of actors which have a quite balanced share of the overall market.

All manufacturers have their own satellite bus with large satellite series based on the same design. The design of TC satellites between manufacturers is also very similar. Figure 4: telecom satellites in orbit by manufacturers (source XL insurance 2009)

Earth Observation

JAXA INVAP Ball The earth observation market is very segmented KARI ASTB CAST for manufacturers with also many institutional IAI OHB ISRO agencies and generally a less commercial INPE SSTL approach. U. of Stellenbosh MDA NASA There are also much smaller series and therefore SSC satellites are more specific. Others (1 units) The variety of payloads, altitudes and missions Non also incurs more variety in the design of earth EADS contracted Astrium observation satellites. Thales A.S.

Figure 5: Earth Observation Satellites built or ordered by manufacturers (source Euroconsult 2009)

Overview of risks

At the moment of delivery and after delivery, in case of anomaly or loss of the satellite, the manufacturer will suffer penalties from its customer and cost of investigation and retrofit to solve the problem. The objective is to manage the exposure related to the underperformance of the contracted satellite fleet.

3.2 Satellites

There are three principal orbits commonly used by the various market segments outlined in the previous subsection. The three main orbits are Low Earth Orbit (LEO), Medium Earth Orbit (MEO) and Geostationary/geosynchronous Earth Orbit (GEO).

Low Earth Orbit (LEO)

Low Earth orbits are defined to be orbits with an average altitude that is less than 2,000 km. An important subset of LEO is the sun-synchronous orbit (SSO). These are circular orbits with an altitude between 500 km and 1200 km that provide an orbital period that result in passes over a point on the Earth’s surface at the same time of day, a fixed number of days apart. This is ideal for Earth observation missions. LEO has predominantly been used by civil and military agencies for Earth observation, scientific missions, manned missions and intelligence or spy satellites.

Medium Earth Orbit (MEO)

Medium Earth orbits are defined to be orbits with an average altitude in the range of 5,000 to 20,000 km. The U.S. military were the first to exploit this orbit with the Global Positioning Satellites (GPS). The numerous satellites in the constellation appear to move slowly across the sky of an observer and several satellites are always visible at any point on the Earth’s surface. A similar orbit is used by the Russia’s equivalent Glonass system and the European Galileo.

Geostationary Earth Orbit (GEO)

The GEO type orbit features an altitude of approximately 36,000 km. The matched orbital period means that the satellite will appear to be nearly stationary in the sky of an observer, allowing for simplified earth communications and a global coverage. The main use of this type of orbit has been for the telecommunications industry, point-to-point, mobile and direct broadcast. A significant secondary user has been for Earth observation, especially meteorological but also military missile launch and nuclear explosion detection satellites.. Commercial use of space satellites has tended to concentrate on the GEO orbit with the market predominantly developing in the late 1970s and throughout the 1980s and 1990s. Total demand for launches to GEO again increased to 1997, mainly due to commercial interests, before a sharp decline in demand into the early 2000s.

3.2.1 Telecom Satellites

A telecommunication satellite is made of 2 parts:

- the Bus or Service Module, which is used to power the satellite, communicate with the ground and maintain the satellite in the correct orbital position and with the correct orientation. Generally the Bus design is made for a satellite serie (e.g Eurostar or Spacebus) with some adaptations for the misison

- the Payload or Communications Module, which is in charge of hosting the mission, is made of tubes (amplifiers) reception and emission antennas to relay communications. The payload is generally specific to the mission and can use different frequency bands (X, C, Ku, Ka) and propose different coverages of the earth.

The Bus is made of the following main subsystems

- The Electrical Power System (EPS), is used to generate power with large Solar Arrays, to manage the available power with Batteries and distribute the power to the other subsystems (PSR). Solar Arrays are permanently oriented in front of the sun with a rotative mechanism called Solar Array Drive Mecanism.

- The Attitude Dynamic Control System (ADCS) is used to maintain the satellite in the correct orientation to ensure the mission continuity. It is made of Sensors (Erath or sun sensors) and gyroscopes which are used to determine the satellite position and orientation. The satellite position is maintain with actuators (reaction wheels and thrusters). The attitude control is automated and managed by electronics (ADE).

- The Chemical / Electrical Propulsion System (CPS/EPS) is used to manoeuvre the satellite in its orbital slot with a set of thrusters. Thrusters are fed with ergol located in the satellite tanks and brought by pipes.

- The Data Handling System (DHS) manages all the information flows within the satellite notably through the Spacecraft Central Unit (SCU). It also contains the Telemetry and Control functions (TM/TC) which establishes a link with the ground control stations.

Main Platforms

The following table provides an overview of the main modern satellite bus and their characteristics.

Picture Name / Manufacturer Mass Power # Launched / Cumulated years of operations

BSS 601 / 702 3-4t 4-10 kW 88 satellites (Boeing Space Systems) 5-6t 13-18 kW 993 years US

LS1300 3.6t 4-8 kW 79 satellites (Satellite Systems Loral) 710 years US

SpaceBus 6t 13 kW 56 satellites (Thales Alenia Space) 470 years EU

Eurostar 4-6t 9-12 kW 46 satellites (Astrium) 370 years EU

A2100 2-5t 6-15 kW 37 satellites (Lockeed Martin) 330 years US

Star 1.5t 2-2.5 kW 21 satellites (Orbital Science) 105 years US

Tableau 3: Main Telecom GEO platforms

3.2.2 Earth Observation Satellites

Principle

Earth Observation satellites are made of 2 parts:

- the Bus or Service Module, which is used to power the satellite, communicate with the ground and maintain the satellite in the correct orbital position. It is also used to manoeuvre the satellite to capture different parts of the earth and provide the acquisition agility. The satellite series are quite reduced but still each manufacturer use a similar design or concept. The principle is also the same between manufacturers.

- the Payload or Instrument, which is in charge of hosting the mission, is made of a sensor to acquire images or radiations from the earth and a video chain for on board data treatment. EO satellites can be mainly divided in 2 categories:

- Optical satellites: the instrument is made of one or more cameras which incorporate mirrors and sensors which will translate images in a digital signal over a given spectrum.

- Radar satellites: the instrument is generally a single aperture radar (SAR) which captures images by listening the echo of the emitted signals.

The Bus is made of the following main subsystems

- The Electrical Power System (EPS), is used to generate power with Solar Arrays, which are either fixed or mobile and oriented in front of the sun. Batteries are used to manage the capture cycles of the spacecraft.

- The Attitude Orbital Control System (AOCS) is used manoeuvre the satellite. It is made of Sensors (Earth or sun sensors and star trackers) and gyroscopes which are used to determine the satellite position and orientation. This type of satellite requires a strong agility to optimize the image capture, the movement of the satellite are managed by strong reaction wheels or momentum gyros.

- The Chemical / Electrical Propulsion System (CPS/EPS) is used to maintain the satellite on the correct orbit with a set of thrusters. Thrusters are fed with ergol located in the satellite tanks and brought by pipes.

- The Data Handling System (DHS) manages all the information flows within the satellite notably through the Spacecraft Computer Unit (SCU). It also contains the Telemetry and Control functions (TM/TC) which establishes a link with the ground control stations and includes all data memorization and downlink systems.

Main Modern Platforms

The following table provides an overview of the main modern satellite bus and their characteristics which are generally used for the optical earth observation.

Picture Manufacturer # Launched Main Sat Famillies

Astrium – EU 21

(Spot / Astrosat)

SSTL – EU 11

(DMC)

Lockeed Martin – US 4

(GeoEye / IKONOS)

BALL / Raytheon - US 5 (Worldview / QuickBird)

Orbital Science Corp – US 3

(Orbview – LEO Star)

ISRO - India 17

(IRS / Cartosat)

Tableau 4: Main Earth Observation Satellites by Manufacturer

3.3 Launchers

3.3.1 Principle

In its simplest form a rocket can be envisioned as a vessel containing a ‘working fluid’, usually gas, under pressure. A small opening, or nozzle, will allow the gas to escape producing an accelerating thrust. The simplest form of rocket is a balloon that is allowed to deflate. The rubber walls of the balloon compress air inside. Releasing the nozzle allows the air to escape and the balloon is propelled in the opposite direction in accordance with Newton’s third law.

Modern rockets are complex machines that are generally based on either solid or liquid-propellants. ‘Propellants’ refers to both the fuel and oxidisers, which are pre-mixed in solid-based rockets, and are stored separately in liquid rockets. However, rockets are generally referred to as either solid-fuelled or liquid-fuelled. There is also a hybrid solid liquid version of the rocket that usually contains a solid fuel and a liquid oxidiser.

Launchers also necessitate guidance and control system in order to manage the flight mission evolution and maintain the correct orientation of the launch vehicle. This can be either analogic (old generation) or completely digital systems (modern launchers)

The launcher flight is made of different steps where the launcher stages are progressively released after their combustible has been fully used.

Example: Ariane 5

Payload

ESC-A Cryogenic Upper Stage, model A, with HM-7 engine EPC (Etage Cryogenic Supérieur) Main Cryogenic Stage (Etage Principal Cryotechnique)

EAP Solid Booster Stage (Etage d’Acceleration à Poudre)

MSP Solid Rocket Motor (Moteur à Propulsion Solide) Vulcain Vulcain propulsion System (Moteur Principal Vulcain)

Figure 6: Ariane 5 Structure Figure 7: Ariane 5 Flight Profile

Launch vehicles are subject to very high constraints in terms of thrust, vibration, temperature.

3.3.2 Main Launchers

GEO / GTO Launchers

Picture Name Payload Stages # Launch

Ariane5 ESCA 2 boosters (Solid) Astrium ST Dual payload to Main stage (Liquid) A5 : 60 Upper stage (Cryogenic) Arianespace GTO 9,5t

4 stages (Liquid) Proton M-Breeze M Stages1-3 in version K or M Proton K 308 Krunitchev Single Payload 4th Stage = Breeze M or Proton M 54 ILS 6,3t to GTO Block DM

AtlasV Main stage (CCB) (Liquid) V: 27 Launches Lockeed Payload to GTO 2nd Stage (Centaur) (Liquid) 5-8,7t Martin Opt. boosters (4-5) (solid) ULA

LongMarch 2E/3ABC single 3 stages (Liquid) LM3: CGWI payload to GTO 3rd stage cryogenic 57 Launches 2,5-4,8t CGWI

Zenit3 Payload to GTO 3 stages Liquid NPO 71 Launches 3,5 – 6 t 3rd stage = block DM Sea Launch

Payload to GTO DeltaIV 4,2-5,4 t for 2 stages (Liquid) Boeing 17 Launches Medium Solid Boosters ULA 13t for Heavy

Falcon9 F9 4,5t to GTO SpaceX 2 stages (Liquid) 2 Launches (LEO) F9H 15t to GTO SpaceX

Tableau 5: GEO / GTO Launchers

LEO / MEO Launchers

Picture Name Payload Mass Stages Launch #

Soyuz U / ST / FG 4,9 tons to SSO 4 stages liquid Sz U 926

Krunitchev 3,1 tons to GTO 4th stage = Fregat Sz 2/ST/FG 47

Arianespace / Starsem / RSCC

Cosmos3M 1,4 ton to SSO 2 stages liquid 449 (TBC)

Delta II 2,1 ton to GTO 3 stages (Liquid) 242

Boeing

PSLV 1,2 tons to SSO 4 stages:1 solid fuel 20 + boosters+- 3 liquid ISRO

Antrix

Dnepr 3,7 tons to LEO 3 stages liquid 17

Roscomos

Rockot 2 tons to LEO 3 stages liquid 16

1 ton to SSO 3rd stage Breeze KM

Tableau 6: LEO/SSO Launchers

Historical and Future Launches

GTO Launchers: The GTO market is dominated by Ariane 5 primarily and Proton. The Ariane 5 launcher has demonstrated 5 / 6 launches per year since its qualification in 2000. The launch rate of Ariane5 is expected to remain stable in the coming years with a possibility to slightly increase to 7 launches per year.

The Proton launcher has performed several launches in the last years with 5 to 10 launches per year. Due to the number of failures experienced by the Proton, the number of launches strongly varies from one year to the other, notably due to investigation periods before returning to flight (eg year 2007). The launch rate of the Proton is expected to remain stable in the future with a probable slow decrease due to the vehicle ageing around 7 flights per year in the next 5 years.

The Zenith Launcher operated by Sea launch has taken an important market share in the last decade. However, due to the launch failure in 2008 which damaged the off shore launch pad and the chapter 11 period experienced by Sea launch, the zenith launcher has lost market shares. In 2011 it is performing its return to flight. Based on that, the Zenith launcher is expected to have a slow launch rate around 2/3 launches per year in the future.

US launchers are rarely used for commercial mission and therefore remain quite marginal on the commercial market and for space insurers. We have considered that this situation will remain in the future with an average of 2 AtlasV and 1 deltaIV launches per year in the coming years.

In the next years, we should see the Chinese Long March and more importantly the American Falcon9 get a bigger share in the market. The long march is limited by the US ITAR military constraint which limits its access to the commercial launches; however, it is expected to take a significant market share in the coming years.

The Falcon9 launch vehicle is a new comer in the launch services business but with high objectives. It is expected to progressively develop in the next 5 years with a step by step qualification for SSO and GTO flights. We plan 2 to 3 launches per year in GTO at the horizon 2015.

30 2 33 4 2 1 25 2 3 8 3 66666 3 1 2 4 4 1 8 5 20 2 6 4 3 5 3 3 33333 2 2 1 0 6 4 1 1 5 1 11111 10 2 4 3 33 3 15 2 22222 5 3 5 1 8 2 4 1 5 1 1 1 1 88 2 2 1 2 1 1 1 5 10 10 66 57 5 1 5 777 10 4 4 7 6 9 5 6 6 6 1 5 8 3 5 10 99 1 9 8 8 888 7 7 777 6 66 6 6 5 5 55 4 4 3 0 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015

proton ariane 4 ariane 5 atlas delta4 zenit LM Falcon 9

Figure 8: GTO Launchers

LEO/SSO Launchers: The LEO market is less developed commercially than the GTO market since there is less demand for such launches, mainly dedicated to earth observation and navigation satellites. However, in the near future, we can anticipate a slow increase trend in this area, steered by the development of the commercial earth observation and LEO/MEO missions.

In the last years, the American Delta II has performed several flights, notably to deploy the American GPS, but also commercial earth observation missions. This launcher is now retired since 2010.

On the Russian side, the Cosmos 3M which has shown an important track record as well, is progressively retiring with the last available vehicle launches. It might perform very limited number of launches in the coming years until its complete retirement. Similarly, the Russian Dnepr is not produced any more, former ballistic missiles converted to launch vehicles will still be launched in the next 5 years until the complete retirement of this launcher.

The Soyuz launch vehicle has been qualified for launches from the European space port in French Guyana by Arianespace, it is therefore expected to take progressively a large market share in the coming years. Arianespace is also planning to operate a new European launcher, the Vega. Its development and qualification shall take place in the next 5 years.

The LEO launchers landscape will also be mainly occupied by new comers or young launchers in the coming years. The Indian PSLV has demonstrated several successful launches in SSO in the recent past, and will certainly continue to increase launch rate in the future. The rockot launch vehicle is also expected to take a small market share in the future.

The diagram below illustrates the launch rates and is based on launchers track records for the past and based on launchers manifest and the above hypothesis for the future projections.

16 3 2

2 22 5 12

0 2 1 1 10 44 1 1 2 2 2 5 3 8 2 2 5 1 2 0 2 0 5 1 1 3 33 6 6 0 1 1 3 3 3 3 10 2 11 11 3 11 4 2 2 4 2 1 5 1 1 1 1 6 2 2 2 2 5 3 1 1 13 1 1 2 4 2 2 2 4 2 44 1 3 1 1 1 3 2 2 222 2 11 11 1 1 1111 1 0 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015

soyuz cosmos delta2 rockot pslv Dnepr Vega

Figure 9: LEO Launchers

444... SSSpppaaaccceee RRRiiissskkksss

4.1 Introduction: Space risks overview

Below are presented the main phases of risk during a satellite life.

Launch Phase

In this phase, the satellite is transported into its designated orbit by the launch vehicle. Although the reliability of launch vehicles has steadily improved over the years and although the launch phase only lasts for a relatively short time – less than half an hour – it continues to be a phase that is exposed to major hazards and a particularly high risk of total losses (launch represent ~50% of satellite losses)

LEOP and In Orbit Testing

The IOT risk is assimilated in this study to the risk of a satellite failure (or anomaly leading to a subsequent failure) during the first year of operations of the satellite after separation from the launcher. It includes the LEOP and In Orbit Test phase of the satellite which is very critical. After separating from their launch vehicle, the satellites must use their own power and ergols to reach their final orbit. There it will be put into an operational configuration and tested, a process that usually takes 1 to 3 months.

When the satellite has achieved its final configuration, its payload and housekeeping systems have to be examined to ascertain whether the satellite has survived the hostile launch environments, is free of design errors and manufacturing faults, and will attain its nominal performance. Anomalies and failures usually become evident in the early stage of a satellite’s life (35% of failures occur in the IOT phase)

In Orbit Life Phase

The positioning phase is followed by the operating phase, in which the spacecraft provides its intended services as, for example, a communication satellite, a weather satellite, or an earth observation satellite. At the present state of the art, the design service life of geostationary satellites is generally 15 years and about 5-10 years for EO satellites. However it is not at all unusual for the actual service life to be longer than planned. The risk of failure of a satellite after the first year is related to the wear out of the equipments due to a defect which was not detected before or due to an excessive stress of the environment. The probability of a loss occurring in the operating phase used to be relatively small once a satellite had come through in-orbit testing successfully and represent about 15% of failure cases. Total Losses and large partial losses are also more rare after IOT since all critical elements being redunded, the malfunctions in one of the subsystems do not usually trigger a complete failure but only lead to a reduction in payload capacity or service life.

Data Sources

The modelling of space risks and the adjustment of the risk models are strongly relying on the quality of data sources. This is all the more true as the subset of information available on satellites and launchers is relatively reduced considering the youth of space activity compared to other sectors.

The data sources used in this paper are coming from different origins which have been cross checked together in order to increase the reliability and credibility of the figures. A majority of data are either commercial and cannot be divulgated in detail in this paper, either proprietary data which are confidential for Astrium and therefore cannot be displayed either.

The main source of information is the on line data base spacetrack, which is recognized by the space insurance community and considered as a reference in many studies about statistics and reliability for satellites and launchers. This database raw data has been used to generate a majority of statistics and plots in this paper. The space track data is quite detailed and reliable especially for telecom satellites and commercial satellites. It is less detailed for earth observation satellites and non insured mission.

The second source of information is Astrium proprietary data with respect to its own satellites. It provides a very detailed source of information on the satellite itself but also about components and equipments. This data is very detailed and reliable however it is limited to the Astrium satellites only.

This set of data which is mainly focused on technical aspects is also completed with market reports made by space brokers (Marsh, Aon/ISB, Willis) and by insurers (notably XL). It provides aggregated market data which gives an overview of premium and claims paid over the years together with the market capacity. It is generally impossible to get figures risk by risk but market average and extremes are available with a strong confidence level. This is the main source of data to measure the financial losses associated to the reported claims.

Last but not least, there is a large amount of public information in specialized papers and reviews and on the net, which provides additional data on the space business. Space passionate websites are also useful to complete the data sets. This piece of information is generally less reliable but still an important part of the data sources.

Type of Losses

The claims observed in the satellite industry are generally based on the loss of mission that a satellite has suffered. For telecom satellites, the loss of mission is measured in transponder.years, ie the number of lost telecommunication capacity (through transponders) over a given period of time. In the earth observation world a similar concept exists with the loss imaging capability over time. In this case, the qualitative aspect of images (noise, colours, width) can be also measured in the performance loss with an appropriate loss formula.

Generally, a difference is made between partial losses and total losses with the following definitions:

• Total Loss / Constructive Total Loss:

o Total Loss means physical destruction of the spacecraft, no separation from the launch vehicle or injection in a useless orbit, loss of control of the spacecraft

o Constructive Total Loss means a partial loss where the loss ratio is equal or above 75%, assimilated to a Total Loss

• Partial Loss: loss of performance impacting the spacecraft intended mission, reduction of useful lifetime, permanently intermittent mission based on a predetermined loss formula.

In case of Total Loss or Constructive Total Loss, the loss ratio will be considered to be 100%. In case of partial loss the loss ratio will be based on the mission loss which is generally determined by a loss formula in the satellite insurance contracts.

The main failure contributors can be analysed in a simplified way by considering the subsystem at the origin of the root cause for a failure. The main subsystems considered are:

- Power system (including solar arrays, battery and power OTHER; 0,27% POWER; PL; 9,65% distribution) which cause almost half of the failure cases 42,29% DHS; 13,53% - Propulsion with the tank and tubes assembly and the thrusters

- AOCS: all sensors, actuators and electronics used to maintain the satellite position and orientation AOCS; 16,94% - Data handling system containing the central computer and all the tm/tc functions PROP; 17,32% - Payload which can host different types of mission

(specific analysis based on space track and other data) Figure 10: failure origin

The typical failure cases for power is a lost wing which incurs incapacity of the satellite to generate enough power to sustain a sufficient part of the intended mission or can lead to a total loss if the residual power is insufficient to maintain the platform minimal needs. Propulsion and AOCS failures are generally a fuel leak which can lead to reduced mission life or a total loss in case of an open valve.

Risk Modelling Methodology

Each satellite can lead to a financial loss depending on its proper launch and its performance. This financial loss will be represented by a random variable called Loss Ratio (LR) characterizing the level of mission loss of the satellite and multiplied by the financial value of the satellite. This chapter will try to determine a model for the random variable LR for each phase of the satellite life.

As a direct consequence of the different phases witnessed by a satellite in its lifecycle, we will derive 3 different models for each phase: Launch, In Orbit Test (up to 1st year in Orbit), In Orbit Life after the first year. This differentiation is driven by the different type of failure causes for each phase, notably, the launch phase relies essentially on the launcher performance whereas the post separation phases are driven by the satellite performance. The In orbit Test phase and the first year of In Orbit life generally shows failure linked to a satellite defect or design issue, whereas the In Orbit Life after the 1st year will see failure cases which are linked to the stress of the environment and the wear out of systems, there is thus a justification to separate these 2 phases. Each of these 3 models is detailed in the next chapters.

For each phase, an in depth analysis of the historical failures will be performed in order to identify the risk driving factors and to determine a representative model. A driving factor can be for example the design maturity of a satellite or a launch vehicle. Besides, the correlation between different risks shall be considered in the model, notably if a common factor can influence the risk relative to different satellites. A risk model will then be proposed to match the driving factors. If different alternatives can be used to model the Loss Ratio, we will explain the motivation to adopt the proposed model.

In general, the Loss Ratio random variable will be equal to OCC * SV

• Where OCC is the frequency element to determine the probability of occurrence of a failure

• Where SV is the severity element to determine the probable amount of losses related to each failure occurrence

The proposed model parameters will then be tuned with observed data set. The frequency and severity distributions will be computed based on historical data, using different methods.

A segmentation of the risks will be considered to tune the model parameters for each segment. The credibility theory will be used to complete the holes in a data set or to compensate the reduced amount of data available in each segment.

4.2 Launch Risk Model 4.2.1 Overview

The launch phase is very critical due to the extreme constraints which are put on a launch vehicle and the transported satellites to reach the earth orbit. The very intense acceleration and vibration which are at stakes makes each launch a physical challenge. A strong illustration of this challenge is the extensive amount of time and spending which have been necessary to governments to develop reliable launchers (more than 15 years in average for Europe and US). Even today, newcomers in the launch vehicle industry are showing similar difficulties to develop a new launcher from scratch (see SpaceX Falcon 9 and ISRO GSLV).

The first driver in the launcher performance is the maturity of a launch vehicle design. A quick outlook at the launch success rate for new launchers shows that unforeseen design issues are generally detected during the early flights of a launch vehicle leading to a very low success rate in the youth of a launcher. The design risk is generally decreasing rapidly in the first 10 flights to attain a very level when the launch is considered as mature. Despite the maturity of the launcher, its constant evolution over makes the design risk still present after several launches and shall still be considered. The launch vehicle design is generally very robust with many systems redundancies. However, the launchers motors, stage separation and guidance control can suffer from design defects.

The second driver in the launcher performance is the quality of the manufacturing. The possible decline of quality standards as a result of competition adding pressure to reduce costs means that attention must be paid not only to the design of the launch vehicle but also to the degree of quality of control exercised by the manufacturers and their suppliers. In the maturity phase of a launcher, launch failure can still happen and are generally due to a manufacturing defect which was not detected during the manufacturing process. The intrinsic robustness of the launcher based on its design is also an influencing factor.

Consequently in the launch phase risk model, we should consider a distinction between design related and manufacturing related failures.

Figure 12: Zenit 3 (Jan 2008)

Figure 11: Ariane 5 (June 1996) Figure 13: Proton JCSAT11 Figure 14: GSLV (Dec 2010)

Typical Loss Scenarios

Total losses are mainly due to:

- The satellite being destroyed during the launch or explodes on the launch pad * GSLV launch failure dec 2010: destruction of the rocket in flight * Sea Launch NSS8 ( 30/01/2007): US$256 million. Disruption in the first stage main engine oxidiser (liquid oxygen) pump caused by a stray metal particle entering it due to a manufacturing fault led to an explosion of the rocket on the launch pad.

- the control of the launcher is lost and has to be destroyed Ariane 5 maiden flight Total Loss: 40 seconds after lift-off, the rocket veered off course, broke up and exploded. An investigation revealed that the failure was caused by the complete loss of guidance and attitude information .The loss of information was due to specification and design errors (inertial guidance system calibrated for Ariane 4 and not the more powerful Ariane 5).

- The attained orbit deviating so far from the envisaged orbit that correction cannot be achieved using the apogee motor or the satellite’s on-board propulsion system. Proton M LAUNCH UNDERSHOOT on 14/03/2008 - INSURANCE LOSS (95%). US$182 million - ( Breeze M (Briz M) engine shut down two minutes and 13 seconds earlier than planned in second burn with a GTO apogee some 8,000km short of planned. the most probable cause of the failure as a rupture of a gas conduct

Proton JCSAT 11 -. TOTAL LOSS US$180 million. The vehicle had reached an altitude of 76 km when the second stage engine apparently suffered a shutdown shortly at the point of separation from the first stage. Damage/burnthrough to a pyro firing control cable on the inter stage truss structure. Debris from the launch reportedly landed in the Kazakhstan countryside creating an impact crater 40 metres wide and 20 metres deep

Partial losses are less common. They occur, for example, when

- the intended transfer orbit is not attained exactly but the deviation is within a certain range of tolerance and therefore be corrected by making appropriate orbital adjustments. In such a case the necessary corrective manoeuvres require an unscheduled use of propellant, shortening the satellite’s service life. Long March – Palapa D – 31/08/2009. Failure of third stage - second burn. One of the YF-75 cryogenic upper-stage engines failed to deliver the necessary thrust..

- Other causes of failure that may lead to partial or even total loss are the stresses resulting from the acceleration, pressure, vibration, noise, and heat to which the satellite is exposed during launching. Apstar2 – Long March 2E 1995: An explosion of APSTAR 2 occurred 51 seconds after liftoff destroying the rocket. A. Video evidence indicated that the payload exploded within the payload shroud/fairing after the shroud collapsed.

Early Losses:

In the failed maiden flight of Delta 3, which resulted in a total loss of the communications satellite Galaxy 10 insured for USD 250 millions, it was also impossible to correct the deviations that occurred during ascent. Three solid-rocket boosters fired after lift-off made the launch vehicle vibrate more and more.

It appears that the average loss ratio for launch failures is close to 99%, therefore Partial Losses are quite rare. No random severity model is necessary for the launch phase and will be considered as a 100% constant.

4.2.2 Launch Failure History

The diagram below provides an overview of the launch status for the main launchers. For each presented launch vehicle, all versions have been gathered under the same category. Launch Success is shown in green whereas Launch Failures are shown in orange and red.

This is the result of a detailed analysis of all the failure reports to extract the root cause and the nature of the loss, which represent an extensive work of treatment of the data. A distinction has been introduced between launch failures related to a design defect and launch failures due to a manufacturing defect. It appears that Design Failures are generally concentrated in the youth phase of the vehicle while the maturity phase sees almost exclusively manufacturing related failure.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50

Ariane 4 SSSSD S D SSSSSSSSSSSSSSSSSMSSSSSSSSSSSSSSSSSSSSSSSSS SMSSSSSSMSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS

Ariane 5 G/GS/G+ DDSSSSSSSMSSSSSSSSSSSSSSS

Ariane 5 ECA/ES DSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS

Proton K SDMDSDSSSDMDDDSSDDDMSSSSSMSSSSSMSSSSSSSSSSSSSSSSMS SSSSSSSMSSSMSMSSMMSSSSSSSSSSSSSSSSSSSSSSMSSSSMSSSS SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSMMSSMSSSSSS SSSMMSSSSSSSSSSSSSSSSSSSSSSSSSSSMSSSSSSSSSSSSSSSSS SSSSSSSMSSSSSSSSSSSSSSSSSSSSSSSSMSSSSSMSSSSSSSSMSS SSSSSSSSSSMSSMSSSSSSSSSSSSSSSSSSSSSSSSSMSSSSSSSSSS SSSSSSSS Proton M SSSSSSSSSSMSSSSSMSSSSSMSSSSSSSSSSSSSSSSSSSSSSSSSSM SSSMS Atlas I/II/III SDSSSSSDMSSSSMSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS SSSSSSSSSSSSSSSSSSSSSSSSSSSSSS Atlas V SSSSSSSSSDSSSSSSSSSSS

Delta III DDD Delta IV SSSDSSSSSSSSSSSSS Falcon 9 S Zenit 2/3 DDSDSSSSSSSSSSMMMSSSSSSSSSSMSSMSSSSMSSSSSSSSSSSSSM SSSSSSSSSMSSSSSSSSSSS LM3 DSSSSSSMSSSSMSMSSSSSSSSSSSSSSSSSSSSSSSSSSSSMSSSSSS SSSSSSS

LM4 SSSSSSSSSSSSSSSSSSSS

LM2 DSSSSSSSSSSSDSSSSDMSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS SSSSSSSSSSSM

Dnepr SSSSSSMSSSSSSSSSS

Rockot SSSSSSSMSSSSSSSM

PSLV DSSMSSSSSSSSSSSSSS

Start SDSSSSS

Falcon 1 DDDS

Soyuz U SSSSSSMSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSMSSSSSSSSSSSS MSSSSSSSSSSSSSSSSSSSMSSSSSSSSSSSSSSSSSSSSSSSSSSSSS SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSMSSSSSSSSSSSSSSS SSSSSSSSSSSSSSSSSSSSSMSSSSSSSSSSSSSSSSSSSSSSSSSSSS SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSMSSSSSSSSSSSSSSSSS SSSSSSSSSSSSSSSSSSSSSSSSSMSSSSSSSMSSSSSSSSSSSSSSSS SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSMSSSSSS SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSMSSSSS SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSMSSSSSS SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSMSMSSSSSSSS SSSSMSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS SSSSSMSSSSSSSSMSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSMSSSSSSSSSSSSSS SSSSSSSSSSSSSSSSSSSSSSSSSSSMMSSSSSSSSSSSSSSSSSSSSS SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSMSSSSSSSSSSSS SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSM

Soyuz 2/ST/FG SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSMSSSSSSSSSSSSSSS

Delta II SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSMSSS SSSSSSSSSSSMSSSSSSSMSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS

Cosmos 3M SDDSSSSSDSSSSSSSSMSSSMSSSSSSSMSSSSSSSSSMSSSSSSSSSS SSSSSSSSSMSSSSSSSMSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS SSSSSMSSSSSSSSSSMSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS SSSSSSSSSSSSSSSSSSSMSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS SMSSSSSSSSSMSSSSMSSSMSSSMSSSSSSSSSSSSSSSSSSSSSSSSS SSSSSSSSSSSSSSSSSSSSSSMSSSSSSSSSSSSSSSSSSSSSSSSSSS SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSMSSSSSSSSSSSS

Figure 15: Launch Failures History (source spacetrack)

The table below provides a focus on the qualification phase of the main launchers, with a detailed view on the different versions of each launcher, which represent either a completely new design, a major evolution of an existing launcher or a converted ballistic missile (CBM).

12 3 45

Ariane 5G New DD S SS Ariane 5ECA New DSSSS Ariane 5G Plus Evolution SS S Ariane 5 ES Evolution S Ariane 3 New SSSSD Athena 1 New DS Athena 2 Evolution SD S

Atlas 1 New SD S DD Atlas 2/2A/2AS Evolution SSSSS Atlas 3B Evolution SS S Atlas 5 Evolution SSSSS Atlas 3A New SS Brazilian VLS New DD Conestoga New D Delta III New DD S Delta IV New SSSSS Delta II (LEO) Evolution SSSSS Delta IV Heavy Evolution DS S

Falcon 1 New DD D SS Falcon 9 New S H2 New SSSSS H2A Evolution SSSSS H2S Evolution D

KSLV-1 New DD GSLV New DS S DD GSLV 2 Evolution D PSLV New DS S MS Long March 3A New SSSSS Long March 2E New DSSSS Long March 3B/3C New DSSSS Long March 2D Evolution SSSSS Long March 2F Evolution SSSSS

M-V New SS D SS Safir New DS Pegasus New SD S SD Pegasus Evolution DD S SS

Proton K New SD M DS Proton K/Breeze M Evolution DSSSS Proton M/Breeze M Evolution SSSSS

Shavit 2 Evolution S Soyuz FG Evolution SSSSS Soyuz FG-FREGAT Evolution SSSSS Soyuz U-FREGAT Evolution SSSSS Soyuz-IKAR Evolution SSSSS Soyuz 2-1 Evolution SSSSM

Taurus (Castor 120) Evolution SD S Taurus (ARPA) Evolution SS S Taurus XL Evolution SD

Zenit 2 New DD S DS Zenit 3-SL Evolution SS D SS Zenit 2-SLB Evolution S

Dnepr CBM SSSSS Kaituozhe CBM DD Minotaur CBM SSSSS Rockot/Breeze K CBM S Rockot/Breeze KM CBM SSSSS Shtil CBM SS Start CBM D Start 1 CBM SSSSS Strela CBM S Unha 2 CBM D Volna CBM D Figure 16: Early Launch Status (source spacetrack with amendments)

4.2.3 Model definition

Driving Factors

The driving factors identified for the reliability of each launch vehicle are:

• The design maturity

• The manufacturing process quality and the intrinsic robustness of the design

The failure frequency model will be tuned based on the launchers historical data. The design failure rate characterizing maiden and early launches on the one hand and the manufacturing failure rate (for mature launchers) on the other hand will then be estimated separately with a different method.

All launch events will be considered as mutually independent considering that each launch vehicle and the associated conditions of its launch are unique and cannot be influenced by common elements.

The main challenges of the modelling are first the reliability estimation for new launchers or launchers in the development/qualification phase considering the high technical uncertainty related to the design quality. This will be solved by a detailed analysis of failure rates for each stage of qualification of the launcher and with a confidence interval method where the tested event is the existence of a design failure within the launcher after a given number of successful launches.

The second difficulty is to extract reliable statistics from the relatively small amount of data available for a majority of launchers. This has been answered with a credibility method. Two different methods have been used to assess the launchers reliability in order to check the results of both methods and reinforce the modelling accuracy.

Proposed Model

As a consequence the proposed risk model for the launch phase is the following:

• Severity = Constant = 100%

• Frequency = Bernoulli Distribution B(P)

o P = P_DLF + (1-P_DLF) * P_MLF

P_DLF is the probability to have an undetected design defect in the launcher leading to a launch failure

P_MLF is the probability to have a manufacturing defect leading to a launch failure based on the launcher historical reliability excluding design failures

Segmentation

The segmentation for the launch phase will first distinguish the GTO launchers which are subject to higher constraints and necessitates more developments, and the LEO launchers which is a different type of mission.

The performance of the launch vehicles being very specific to each rocket, we will consider a categorization by launch vehicle. However, when considering different rocket designs with a similar manufacturer, the historical data used to evaluate the manufacturing defect rate can be taken for each manufacturer and considering different rockets.

4.2.3.1 Design Failure Model

It is difficult to assess the reliability of launch vehicles that are still in the development stage. Manufacturers’ predictions relate to the frequency of launch failures due to random failures and do not consider the frequent launch failures in early flights due to a faulty design. This is illustrated by the high rate of launch failures involving first and second launches as shown in the present table. The objective of this part is to measure the probability of having a design defect undetected in the launcher especially in the first 5 to 10 flights.

We have developed two methods to answer that question, the first one is graphical and using a linear regression. It is based on the number of launch attempts. The second method is based on the calculation of loss probability after a number of observed successes and using a confidence interval with a Chi2 estimate.

Method 1: Linear Regression of success rate vs launch attempts

The chart below represents the success rate of launch vehicles for each launch number (spacetrack data). Due to the quite reduced size of the data sample, the curve is irregular but still reveals a quite obvious trend. This trend is captured with a linear regression which is represented on the chart.

Early Launch Failure Rate 60%

50%

40%

30%

Failure Rate 20%

10%

0% 123456789 Launch Number

Figure 17: Design Failure Rate Trend

The trend function is Failure Rate = 50% - 0,22 * Ln(Launch #). The fit is not very satisfactory especially on the 3rd launch and it reveals that the first 2 launches look quite particular.

Nevertheless, the benefit of this method, beyond its simplicity, is to smooth the reliability figure for each launch number and thus soften inconsistencies due to the small number of analysed elements, while matching the overall trend of historical events.

The downside of this method is to rely only on the launch number, where the more relevant driver for reliability is the actual design evolutions which were implemented or not and thus the status of the design qualification. Besides, due to the small number of early launches observed, with reasoning for each launch number, the analysis shows probability decrease and increase which are inconsistent with the design improvement logic. This leads to consider an alternative method.

Method 2: Design maturity level analysis

The principle of this method is to compute the loss probability directly from the launch history of early flights and considering the level of design maturity of the launch vehicle. In this method, we consider the number of previous successful flights rather the number of flights.

For a better confidence level, we will assess the loss rate with a simple confidence interval method (detailed in annex 2), so that P[P_LF <= α] < 1- β (where β is the chosen confidence level, we will use a beta = 5%).

No prior successful flight: If we look at the historical probability of failure of maiden flights, we obtain a loss rate close to 50%, considering a completely new launch vehicle. The upper limit of this probability is 66% with 95% confidence interval.

If we now consider launch attempts after the maiden flight but with no prior success, we obtain a loss probability P[Failure / No prior success] = 45% (64% with a confidence interval of 95%). Thus, whatever the number of launch attempts, as long as a launcher has not demonstrated at least one success, we shall consider that its failure probability remains very high.

1 successful flight: From the moment, a launcher has been able to fulfil one mission, the reliability assessment becomes different but there is still a high probability that a defect was not revealed by the prior launches. We have extracted from the launch history the launch attempts with at least one prior successful flight, we obtain the conditional probability: P[Failure / 1 prior successful flight] = ~16% (28% with a confidence interval of 95%).

2 or more prior successes: After 2 successful flights, the logic of calculation is changed. The principle of this alternative method is to consider the probability to detect a design failure after a given number of launch attempts. In order to increase the confidence level associated to the method, we will estimate the probability with a Chi2 estimate with a confidence interval of 90%.

We consider the probability P_Defect(n) to have an undetected design defect on a given launcher after n prior successful launches. If a launcher has performed n prior consecutive successes it belongs to a category of launchers with certain maturity level. We count the number of launchers in history that have performed at least n successful flights in a row and revealed no defect, and consider that these launchers belongs to the same category (in terms of maturity). This is considered as a sample of N launchers that have each performed n flights with no defect. For this category of launcher, P_Defect(n) is estimated with a Chi2 method (detailed in annex 3) and calculated as 2 −1 P _ Defec(n) = χ2*(r+1) (40%) / N / n with r=0

The result of the calculation is given in the graph below.

Early Launch Failure Rate 6%

Defect Occurence Rate Occurence Defect 1%

0% 234567891011 Number of prior successful flights

Figure 18: Early Launch Failure Rate

Significant design evolution: It also happens during the life of the launcher that important design evolutions are implemented. This can be used to extend the launcher capability (increase the launcher payload mass capabilities for example) or to improve its reliability. Notably, it happens that a launcher motors are changed, which can also come with a complete modification of the stage to accommodate the new motors. We can give as an example the Ariane 5 evolution from the standard G version to the ECA which was equipped with a new upper stage with cryogenic motor. The first launch of the delta IV Heavy is also a good example as it represented a major evolution compared to the standard version.

Such significant launcher evolutions increase the probability of having a design defect compared to the previous version (supposed to have a mature design). The resulting historical loss rates for the 1st and 2nd flight of launchers with major evolutions are close to 20%.

Mature Launcher Design: When a launcher has performed 10 to 20 consecutive successful launches, it design can be considered as mature and therefore the probability of having an undetected design defect is very remote. However, minor evolutions or corrections are frequently implemented in a launch vehicle to accommodate each different mission. This maintains a probability of introducing a design defect which is however very low. We will consider that the design loss rate in the maturity phase is below 0,5% and can be tuned depending on the information available on the launcher evolutions.

Early Launch Failure Rate 1,2%

1,0%

0,8%

0,6%

0,4%

Defect Occurence Rate Occurence Defect 0,2%

0,0% 11 13 15 17 19 21 23 25 27 29 31 33 35 37 39 41 43 45 47 49 Number of prior successful flights

Figure 19: Design Failure Rate - Maturity Phase

4.2.3.2 Manufacturing Launch Failure Model

The probability of launch failure during the so-called maturity phase of the launcher is mainly due to manufacturing defects or a reduced robustness of some part of the launcher due to a reduction of the quality process run by the manufacturer or the launch service provider.

The probability of loss will depend upon the launch vehicle used and how reliable it is. The launch vehicle reliability will be estimated based on its historical manufacturing failure rate. Of course the number of launches performed by a launcher shall also be considered and taken into account in the loss rate estimation. We propose 2 methods to estimate the maturity failure rate.

Method 1: Loss ratio of manufacturing failures

The method consists in filtering the manufacturing related failures from the list of failure to compute the corresponding failure ratio. The main benefit of this method lays in the detailed analysis of claims history to extract manufacturing related failures.

The table below summarizes all the recorded launches and launch failures for the main launchers. We have distinguished the failure rate (where all type of launch failures are considered) and the manufacturing failure rate (where only launch failures related to the manufacturing are considered).

Failure Rate = #Launch Failures / # Launch attempts

Manufacturing Failure Rate = # Launch Failures (due to manufacturing) / # Launch attempts

The following table summarizes the obtained results for each launch vehicle.

GTO Launchers

Launcher L F F rate MF MF rate All 807 72 8,9% 51 6,3% Atlas I /II // II / V 107 5 4,7% 3 2,8% Atlas I / II / III 80 4 5,0% 2 2,5% Atlas V 27 1 3,7% 1 3,7% Ariane 4 & 5 193 9 4,7% 4 2,1% Ariane 4 133 5 3,8% 3 2,3% Ariane 5 60 4 6,7% 1 1,7% LongMarch 3 57 5 8,8% 4 7,0% All Proton K & M 363 41 11,3% 31 8,6% Proton K 308 36 11,7% 26 8,4% Proton M Breeze M 54 5 9,3% 5 9,3% Delta IV 17 1 5,9% 1 5,9% Zenit 2/3 71 11 15,5% 8 11,3% Tableau 7: GTO Launchers Manufacturing Failure Rates

LEO / SSO Launchers

Launcher L F F rate MF MF rate All 1813 61 3,7% 52 2,9% Soyuz 973 26 2,7% 24 2,5% Soyuz U 926 25 2,7% 23 2,5% Soyuz 2 47 1 2,1% 1 2,1% PSLV 20 2 10,0% 1 5,0% Dnepr 17 1 5,9% 1 5,9% Rockot 16 2 12,5% 2 12,5% Cosmos3M 449 21 4,7% 18 4,0% Start 7 1 14,3% 1 14,3% LM 2 & 4 89 5 5,6% 2 2,2% LM2 64 5 7,8% 2 3,1% LM4 25 0 0,0% 0 0,0% Delta 2 242 3 1,2% 3 1,2% Tableau 8: LEO Launchers Manufacturing Failure Rates

NB: the average rate for all launchers is very low because of the very important weight of the Soyuz in this average. The quivalent rate without Soyuz is much higher.

Method 2: Rate regression

An alternative method can be used to extract the launch failure rate of the launcher maturity phase. It consists in tracing a plot of the number of failures vs the launch number and to consider the launch failure rate as the curve asymptotic line (or with a regression). Since the majority of design related failures occur at the beginning of the launcher life, such method should extract these failures. The calculation is given in Annex.

Launcher MF rate Reg rate Delta Atlas V 3,7% 4,9% 1,2% Ariane 5 1,7% 3,2% 1,5% Long March 3 7,0% 6,8% 0,2% Proton M 9,3% 7,8% 1,5% Delta IV 5,9% 5,7% 0,2% Zenit 2/3 11,3% 13,8% 2,5% Soyuz 2,5% 2,5% 0% PSLV 5,0% 3,8% 1,2% Dnepr 5,9% 8,1% 2,2% Rockot 12,5% 11,5% 1,0% Cosmos3M 4,0% 3,7% 0,3% Delta II 1,2% 1,4% 0,2% Long March 2 & 4 2,2% 3,4% 1,2% Tableau 9: Launch Failure Rate Regression Results

The “maturity” failure rates obtained with each method appear to be quite similar. Therefore, this is an indicator that our estimates can be considered as reliable. Since the first method is based on a more precise analysis of data, it will be kept as the reference for our estimates.

Examples are given below for the Ariane5, Proton and Atlas V launchers.

Ariane 5

Failures vs Launches 2,5

1,5

1 # Failures #

0,5

0 1591317 # Launches

Araine5 – slope = 4% PSLV – slope = 5,1%

Proton

Failures vs Launches 30

# Failures # 10

0 15139172125293337414549535761656973778185899310197105109113117121125129133137141145149153157161165169173177181185189193197201205209213217221225229233237241245249253257261265269273277281285289293297301305309313317321325329333337341345349353357361365369373377381385389393397401405409413417421425429433437441445449453457461465469473477481485489493497501505509513517521525529533537541545549553557561565569573577581585589593597601605609613617621625629633637641645649653657661665669673677681685689693697701705709713717721725729733737741745749753757761765769773777781785789793797801805809813817821825829833837841845849853857861865869873877881885889893897901905909 # Launches Soyuz – slope = 2,5% Proton family – K & M – slope = 7,1%

Atlas V

Failures vs Launches

1,4

1,2

0,8

0,6 # Failures #

0,4

0,2

1 3 5 7 9 11 13

# Launches

Delta IV – slope = 8,2% Atlas family – slope = 2,2%

Improvement of Statistics with Credibility

Due to the relatively small size of the available data samples (especially for young launchers with a reduced track record), the confidence level of the above mentioned estimates remains quite limited. The idea to solve this issue is to rely on the credibility methodology to compensate the lacking information by extracting it from launchers with a similar design.

The credibility method consists in giving to each launcher a credibility factor which will depend on the importance and the regularity of its loss history. The “credible” loss ratio of the Launcher L is then obtained by weighting the satellite specific loss ratio estimation by its credibility factor and complementing the difference with the reliability of all launchers in the same category.

IOTLR_cred(L) = Cred(L) * IOTLR(L) + (1 – Cred(L)) * IOTLR(All Launchers)

The loss ratios are grouped in series of 5 years and data collected among the last 30 years, which provides 6 periods of observation N = 6. The number of observed launch vehicles is L=6.

The parameters of the credibility method are estimated based on the launchers loss history: 1 Inter Launcher Volatility ~ 2 ~ ~ 2 ~ 2 σ = 2 * ( ∑ na (S)( pS − p) − (S −1)s ) na (L) Launchers na (1− ∑ 2 ) Launchers na

~ 2 1 1 ~ ~ 2 Intra Launcher Volatility s = ∑ ∑ na (S, P)( pS ,P − pS ) L Launchers N −1Periods

IntraLauncherVolatility Cred(L) = For each Launcher the credibility factor is given by: InterLauncherVolatility IntraLauncherVolatility + NbFlight(L)

For the majority of launchers which are used extensively for the launch of commercial satellites, the data sample used to estimate the launcher reliability is quite reduced. Considering the similarities which exist between launchers of the same class, we can use the theory of credibility to improve our estimation of the launch failure rates for each launcher. The credibility factor will give the weight of the statistics specific to the launcher, the remaining weight will be affected the reliability rate of the launcher class. The launchers are split in 2 classes: GTO and LEO/MEO. GTO LEO / SSO Inter launcher volatility 4,78E-02 1,58E-02 Intra launcher volatility 5,81E-04 2,05E-04 Launchers average rate 6,3% 2,9%

Launcher L Rate Credibility Factor Credible Loss Ratio GTO Launchers AtlasV 27 3,7% 53% 4,5% Ariane5 60 2,1% 68% 3,4% Long March 3 57 7,0% 38% 6,6% Proton K & M 353 8,7% 80% 8,1% Delta IV 17 5,7% 16% 6,3% Zenit3 71 11,3% 44% 8,5% LEO Launchers Soyuz 973 2,5% 94% 2,4% PSLV 20 5,0% 51% 4,3%

Dnepr 17 5,9% 47% 4,6% Rockot 16 12,5% 45% 7,5% Cosmos3M 449 4,0% 78% 4,1%

Tableau 10: Launchers Reliability

Final Result

The following table provides the result of the credibility application and the final result.

Red bars represent the failure rate, whereas blue bars represent the credible failure rate.

12%

11%

10%

0% Ariane 5 Atlas V Delta IV Long March 3 Proton M Zenit 2/3 All

Figure 20: GTO Launchers Reliability

14% 13% 12% 11% 10% 9% 8% 7% 6% 5% 4% 3% 2% 1% 0% Soyuz Cosmos3M PSLV Dnepr Rockot All

Figure 21: LEO Launchers Reliability

4.3 In Orbit Test Risk Model 4.3.1 Overview

The LEOP and In Orbit Test Phase are supposed to put the satellite in its final orbit, to deploy all elements and to test every components of the satellite. From an engineering point of view, the positioning phase constitutes a totally new risk, for once a satellite has separated from its launch vehicle, the attainment of its final orbit and the success of its mission will depend solely on the satellite and its on-board systems operating smoothly.

Risk Assessment

The most important criteria for risk assessment in this phase are the manufacturer’s experience, which is reflected in the number of satellites the firm has built to date, and the malfunctions and failures that have affected these satellites.

It is also important to find out whether the satellite in question incorporates any modifications to predecessors and whether it uses any new components that have not yet been tried out in space. The more heritage of the components without failure, the more reliable a satellite will be considered.

Finally, the complexity of the design and the mission should have an importance in the risk assessment. Satellites incorporating complex processors, flexible payloads, security components or extra large antennas might also be considered as more risky than simple bent pipe satellites.

Total Loss cases

There are many possible causes of malfunctions since satellites are exceedingly complex systems of electronic, electrical, pyrotechnical, chemical, and mechanical elements. The failure of a single component in the positioning phase may prevent the satellite from reaching its final position or attaining its operating configuration. Therefore, there is a considerable risk of total loss.

Satellite unable to reach its final orbit.

Superbird 6. Total Loss 204 M$. 15 April 2004. After injection the satellite began losing altitude because the effect of the moon’s gravity had not been considered when planning the mission. The heat generated by the higher air resistance in the lower orbit caused severe damages to the solar arrays, batteries and other components and led to a Total Loss.

No solar array deployment. Before all the satellite’s systems can be put into operation and tested in the intended orbit, the solar arrays and antennae have to be deployed, which incurs a major danger of extensive partial damage or even total loss.

Estrella do Sul, for instance, was successfully launched on 11 January 2004 using a Sea Launch vehicle and reached its geostationary orbit without any problem, but one of the two solar arrays could not be fully deployed. This led to a serious impairment of the satellite’s power supply and resulted in an insured loss of over UDS 200 millions.

Propulsion System Failure

EUTELSAT W3B Total Loss 343 M$ - W3B was lost after an anomaly in the satellites propulsion sub-system. A large leak in its onboard oxidiser tank.

Partial Loss cases

It is also very common that a satellite suffers a major problem without being totally lost. Such cases would result in a loss of mission, a reduced lifetime or an erratic behaviour.

Large PL example

MSAT1 BSS 601 - Burnout of component prevented the use of one of the four main beams (L-band mountain beam) preventing users from communicating using telephone and data transmissions using vehicle mounted terminals - areas affected were parts of central and western Canada including the oil rich Alberta territory. INSURANCE LOSS (50%) US$109.5 million paid after reduction of just under 50% for salvage.

Medium PL example

Intelsat 801 – LM - DAMAGE TO NORTH SOLAR ARRAY AFTER SPIN. During in-orbit testing a wrong command was sent the spacecraft into an uncontrolled spin. The ground controllers regained control but one of the solar arrays was tilted/damaged (North Solar array). The solar arrays now produce less power than planned although within the 18% margin. The problem is now thought likely to reduce the service life by a few years. because the bent solar array will need more fuel to maintain the satellites 3-axis attitude. Commercial operations to begin on May 7. INSURANCE LOSS (Est.27%) US$44.8 million.

Contamination / pollution

AnikF3 – Partial Loss 4 M$. A particle contamination occurred and prevented the Ka (secondary) payload to operate.

Serial Losses

Serial losses can occur in the early stages of the satellite life. This was even more in the telecom boom where satellites with similar characteristics were launched with a high frequency. The introduction of a faulty design or the non detection of a manufacturing defect can cause the satellite to suffer major losses or an accelerated degradation soon after launch.

The costliest serial loss so far involved the BSS 702 series, of which six satellites were launched between December 1999 and May 2001. In the autumn of 2001, the insurers were informed that all the satellites were suffering premature and accelerating solar array degradation. The satellites had been fitted with a new generation of solar arrays, to which additional mirrors called concentrators had been attached. These were designed to direct additional sunlight onto the solar cells of the arrays in order to increase electrical power. The consequence of increased solar array degradation was a substantial reduction in payload capacity. The policyholders filed claims for total losses of the satellites, which were insured for an approximate total of USD 1.7 billions. Although the indemnification of approximately USD 840 millions paid for the satellites Galaxy 11, PAS 1R, Anik F1, Thuraya, XM Rock and XM Roll represented only half the amount insured, even this is an order of magnitude that seriously threatened the survival of the space insurance market.

Another notable endemic failure case was the battery problems encountered by BSS 601 satellites due to an overfilling of electrolyte on several satellites.

Iridium satellites also suffered serial wheel losses which damaged numerous satellites.

Segmentation

The segmentation for the IOT phase will first distinguish the GEO Satellites which are mainly providing telecom services and have a particular platform design adapted to a geostationary space flight, and the LEO/SSO satellites which are more dedicated to the Earth observation and navigation missions and are orbiting around the earth in cycles. The platform design and the mission for these 2 types of satellites are totally different and therefore deserve a distinction.

The next question wrt the modelling of the failure occurrence is whether the model should consider failures coming from a same subsystem. By doing so, in order to extract a credible statistics, we would need to merge the data of all satellite families and consequently losing the specific quality of a given manufacturer. Therefore this classification was not retained. The proposed classification, which is the most representative of the risk drivers identified above, is to generate statistics for a given manufacturer and / or satellite family.

The performance of the satellites being very specific to each platform design, we will consider a categorization by platform. However, in order to analyse the manufacturing failure rate, platforms of a different generation but coming from the same manufacturer and showing a strong heritage, will be considered in a single set of data.

4.3.2 IOT Failure History

The following diagram shows all the IOT failures which occurred over the last 30 years and makes a distinction between Total Losses (red) and Partial Losses (orange).

Manuf Platform SATELLITE 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 ASL EUROSTAR AMAZONAS 1 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 33% 0% 0% 0% 0% 0% AMAZONAS 2 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 2% HISPASAT 1A 0% 0% 10% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% HISPASAT 1B 0% 0% 0% 5% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% HOT BIRD 2 0% 0% 0% 0% 0% 0% 9% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% HOT BIRD 4 0% 0% 0% 0% 0% 0% 0% 0% 6% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% HOT BIRD 5 0% 0% 0% 0% 0% 0% 0% 0% 6% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% ANIK F-3 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 5% 0% 0% 0% BSS BSS 376 ARABSAT 1D (P 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% BSAT 1A 0% 0% 0% 0% 0% 0% 0% 13% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% THOR 2 0% 0% 0% 0% 0% 0% 0% 1% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% WESTAR 4 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% WESTAR 5 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% BSS 601 ASTRA 1G 0% 0% 0% 0% 0% 0% 0% 0% 20% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% GALAXY 8I 0% 0% 0% 0% 0% 0% 0% 0% 18% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% INTELSAT 26 (JC 0% 0% 0% 0% 0% 0% 0% 10% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% INTELSAT 5 (PA 0% 0% 0% 0% 0% 0% 0% 0% 90% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% MSAT 1 0% 0% 0% 0% 0% 0% 50% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% MSAT 2 (AMSC 0% 0% 0% 0% 0% 15% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% PAKSAT 1 0% 0% 0% 0% 0% 0% 16% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% SUPERBIRD 6 (A 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 100% 0% 0% 0% 0% 0% TDRS 8 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 34% 0% 0% 0% 0% 0% 0% 0% 0% 0% UHF 08 0% 0% 0% 0% 0% 0% 0% 0% 10% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% BSS 702 GALAXY 11 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 49% 0% 0% 0% 0% 0% 0% 0% 0% 0% INTELSAT 1R (P 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 34% 0% 0% 0% 0% 0% 0% 0% 0% 0% ANIK F-1 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 67% 0% 0% 0% 0% 0% 0% 0% 0% 0% THURAYA 1A/G 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 63% 0% 0% 0% 0% 0% 0% 0% 0% 0% XM-1 (XM-ROLL 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 46% 0% 0% 0% 0% 0% 0% 0% 0% XM-2 (XM-ROCK 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 46% 0% 0% 0% 0% 0% 0% 0% 0% LM A2100 ACES GARUDA 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 39% 0% 0% 0% 0% 0% 0% 0% 0% 0% ECHOSTAR 4 0% 0% 0% 0% 0% 0% 0% 0% 83% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% TELESAT NIMIQ 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 30% 0% 0% 0% 0% 0% 0% LM-3k5k7k AMOS 5i (ASIAS 0% 0% 0% 0% 0% 0% 25% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% AURORA II 0% 25% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% BS-3A 25% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% INTELSAT 801 0% 0% 0% 0% 0% 0% 0% 27% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% SATCOM C-4 0% 0% 2% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% SPACENET 4 0% 25% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% TELESAT ANIK 0% 5% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% TELSTAR 402 0% 0% 0% 0% 100% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% OSC LEOSTAR EARLY BIRD 1 0% 0% 0% 0% 0% 0% 0% 100% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% MICROSTAR TELEDESIC T1 0% 0% 0% 0% 0% 0% 0% 0% 100% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% STAR CAKRAWARTA 0% 0% 0% 0% 0% 0% 0% 0% 19% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% NSTAR C 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 30% 0% 0% 0% 0% 0% 0% OPTUS D1 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 6% 0% 0% 0% 0% Other dash DASH* 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 100% 0% 0% 0% 0% 0% 0% 0% DFH CHINASAT 6A (S 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 11% DFH-3 0% 0% 0% 0% 100% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% NIGCOMSAT 1 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 100% 0% 0% SINOSAT 2 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 100% 0% 0% 0% 0% ORBCOMM 29 ( 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 89% 0% 0% ORBCOMM 38 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 89% 0% 0% SSTL UOSAT 12 0% 0% 0% 0% 0% 0% 0% 0% 0% 20% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% yamal YAMAL 101 0% 0% 0% 0% 0% 0% 0% 0% 0% 100% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% EYESAT 1 0% 0% 0% 100% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% FAISAT 2V 0% 0% 0% 0% 0% 0% 0% 100% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% LANDSAT 06 0% 0% 0% 100% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% SSL LS1300 DIRECTV 6 0% 0% 0% 0% 0% 0% 0% 15% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% INTELSAT 8 (PA 0% 0% 0% 0% 0% 0% 0% 0% 30% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% INTELSAT 901 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 10% 0% 0% 0% 0% 0% 0% 0% 0% NSS-12 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 2% PANAMSAT 6 0% 0% 0% 0% 0% 0% 0% 13% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% SUPERBIRD A 100% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% TELSTAR 14 (ES 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 82% 0% 0% 0% 0% 0% TAS ASTRA 5A 0% 0% 0% 0% 0% 0% 0% 0% 16% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% EUTELSAT W2A 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 100% 0% EUTELSAT W3B 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 100% EUTELSAT W4 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 5% 0% 0% 0% 0% 0% 0% 0% 0% 0% RASCOM 1 (RAS 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 90% 0% 0% 0% SB300 TDF-2 25% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% ISRO INSAT EUTELSAT W2M 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 100% 0% INSAT 1D 5% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% INSAT 2C 0% 0% 0% 0% 0% 0% 100% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% INSAT 2D 0% 0% 0% 0% 0% 0% 0% 100% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% INSAT 2E 0% 0% 0% 0% 0% 0% 0% 0% 0% 25% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% INSAT 3B 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 18% 0% 0% 0% 0% 0% 0% 0% 0% 0% NPO NPO KUPON 1 0% 0% 0% 0% 0% 0% 0% 0% 100% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% Tableau 11: IOT Failure History (Data from Spacetrack database)

The severity of the various failures is significantly distributed from 1% to 100% depending on the failure origin and on the redundancy scheme of the satellite. It is therefore important to study both the loss ratio for each satellite but also the failure severity distribution. The equivalent loss ratio will be computed specifically for each satellite platform.

On the contrary, the loss severity will be computed based on the data of all satellites in order to have a sufficiently wide sample to make relevant statistics. It implies the assumption that all the telecom satellites have a similar architecture and a similar failure mode, which is a reasonable assumption.

Failure Severity Analysis

In order to interpret the 3 modes, we will try to substantiate it with a detailed analysis of all the failure cases. We have divided the failure root causes in 5 categories: power subsystem, satellite attitude control, propulsion system, data handling system, payload. We have then analysed the distribution of each failure root cause and superposed it to the estimated distribution.

30 PAYLOAD AOCS 25 PROPULSION 20 POWER 1 15 4 10 3 5 2

0 5% 10% 15% 20% 25% 30% 35% 40% 45% 50% 55% 60% 65% 70% 75% 80% 85% 90% 95% 100%

Figure 22: IOT Failure Modes

The analysis of the above bar chart seems to indicate 4 failure modes:

Failure Mode Caracteristics Typical failures

1 – Total Loss / Very concentrated 90-100% loss ratio Mainly due to total power loss Constructive Total Loss (no SA deployement) or propulsion failure leading to useless orbit or complete fuel loss

2 – Large Partial Loss Average of 50% loss ratio with a lot of Wing loss, severe power loss, dispersion power defect, payload or main antenna loss

3 – Medium Partial Loss Average of 25% loss ratio with a Antenna loss or not deployed, reduced dispersion severe gyro / wheel loss, severe fuel leak, SA or battery short circuit or degradation

4 - Small Partial Loss Average of 5% with a peak at 5% and TWTA loss, minor gyro / wheel 10% and a reduced dispersion on the underperformance, recovered right fuel leak, SA minor degradation

A specific modelling of each failure mode will be performed in the severity model part.

4.3.3 Model Definition

Based on the above, risk driving factors have been identified for the modelling of risk occurrence and severity.

Occurrence Model

• First of all, the manufacturing quality of the satellite based on the manufacturer experience and proven reliability of similar satellites as well as the intrinsic robustness of the design. A manufacturing or testing deviation might create a weakness in the satellite which can randomly translate into a failure.

• The possible existence of manufacturing / design defects which can be present in several satellites, creating a correlation of risks between satellites of the same group. It could happen if a poorly manufactured equipment (for a given batch) is mounted on several satellites launched in a short time frame.

• The technical criticality of the satellite which is principally coming from the complexity of the design and the flight heritage of the equipments.

Severity Model

• The loss severity is random and should have a distribution matching the main failure root causes and their consequence (either total or partial loss)

• Total loss cases have been observed in the past, we have considered that it is reached when the mission loss is 75% or more but it is generally mission specific

• Partial loss cases have been observed and should be classified in 3 categories: minor losses, medium losses, large losses.

Modelling

We want to determine the satellite Loss Ratio (LR) considered as a random variable taking values between 0 and 1 which can be decomposed as a product of:

- the occurrence or not of a failure, determined by a random variable OCC which is either 0 or 1 thus following a Bernoulli distribution of parameter P_IOTF (IOT failure occurrence probability) where P_IOTF = E[OCC]

- the severity of the failure, determined by a random variable SV which will have a value between 0 and 1 as it determines the amount of mission loss as thus should be characterized by a continuous distribution

The estimation of the occurrence probability for a given family of satellite could be obtained directly by considering the number of failure occurrences on the number of IOTs performed. However, such a method could lead to wrong risk estimations since for example a given satellite family can have suffered several minor failures and thus have shown overall a good performance.

Consequently, we have chosen, to evaluate the reliability of a given family, to compute it via the Loss Ratio itself. Since OCC and SV are considered independent E[LR] = E[OCC] * E[SV]. We compute LR empirical average for the satellite family which is an estimator of E[LR] and then the severity empirical average for all satellites, which is an estimator of E[SV]. From that we can derive the probability of failure occurrence: P_IOTF = LR / SV

In order to simulate the impact of serial losses, we have to introduce correlation between individual satellite risks. This can be achieved by decomposing P_IOTF in a sum of 2 probabilities (i) the probability P_RIOTF of having an isolated or random failure on a given satellite, (ii) the probability P_DIOTF of having a defect within a group of satellites sharing a same batch of equipment or similar technology. The split between these 2 components will be obtained simply by considering the average proportion of satellite defects in the overall observed satellite failures: P_DIOTF = α * P_IOTF

The severity loss distribution cannot be evaluated based on the sole data of a given satellite family due to very small amount of data which would be available and could not be sufficient to extract a credible statistics. Therefore, the severity distribution will be estimated based on all the observed cases of failures all satellites families together.

As a consequence the proposed risk model for the IOT phase is the following:

• LossRatio = 1_IOTF * Severity

• Severity is a Random Variable and based on a specific probability distribution adjusted to the observed failure cases. The loss severity will be estimated based on the historical distribution obtained from a kernel density estimator and a least squares adjustment.

• The occurrence frequency 1_IOTF is a random variable which takes value either 1 or 0 and which follows a Bernoulli Distribution B(P_IOTF), it can be decomposed in

o 1_DIOTF: the defect failure occurrence which can be shared by several satellite and based on a Bernoulli distribution of parameter P_DIOTF = α * P_IOTF

o 1_RIOTF: the random failure occurrence which is specific to the satellite

o P_IOTF = P_MIOTF * TC_Factor where

P_MIOTF is based on the satellite historical failure probability which is relying on the manufacturing quality process,

TC_Factor represents the technical criticality of the satellite (based on a qualitative assessment of the satellite components heritage and complexity)

The main challenges of the modelling are:

- To extract failure occurrence model where the available loss experience is relatively small for a given family. This is solved by using a credibility method

- To evaluate the severity distribution based on a reduced set of failures. This is addressed by considering at first a kernel density estimator to smooth the historical loss bar diagram into a continuous distribution while extracting the information on the main failures modes; then by using a least squares estimate to decompose it in a mix of standard distributions.

4.3.4 IOT Failure Frequency Model

The IOT failure will be modelled with a random variable 1_IOTF which is following a Bernoulli distribution with a parameter P_IOT_Failure. The IOT Loss Ratio will be modelled with a random variable IOTLR where IOTLR = IOTF * IOT_Severity. We can derive from that E(IOTLR) = E(IOTF) * E(IOT_Severity) and consequently E(IOTF) = P_IOT_Failure = E(IOTLR) / E(IOT_Severity).

In a first step, we will estimate E(IOTLR) for all satellites and derive from that the respective P_Failure for each satellite.

In a second step we will analyse the proportion or failures linked to a satellite defect and extract from that P_IOT_Failure_Random and P_IOT_Failure_Defect, ie the respective probability for a satellite to generate an IOT failure linked to a random event or a defect.

4.3.4.1 Loss Ratio and Failure Rate

Step 1: Loss Ratio estimation with empirical average

The first step in the analysis is to have an overview of the loss ratio for each satellite platform. The loss ratio is computed as the sum of performance loss among all satellites of the same family, divided by the number of satellites launched of this family: Loss Ratio = Loss Amount (%) / # IOT attempts

A distinction has been made in the table between “mature” manufacturers (mainly European, and American) and new entrants in the satellite manufacturing business (China, India) with a much more reduced experience, which are not analyzed due to the reduced statistics available.

The considered segmentation is by satellite platform, because each platform has its own particularities and track record depending on the underlying design and the manufacturing process.

Step 2: Improved estimate with the credibility methodology

Estimations can be further improved with credibility to balance the small size of the data samples. The credibility method is smoothing the LR estimates of each satellite.

The credibility method consists in giving to each satellite estimate a credibility factor which will depend on the importance and the regularity of the loss history of the satellite and which will represent the credibility of the satellite statistic. The “credible” loss ratio of the satellite S is then obtained by weighting the satellite specific loss ratio estimation by its credibility factor and complementing the difference with the loss ratio of all the existing satellites:

IOTLR_cred(S) = Cred(S) * IOTLR(S) + (1 – Cred(S)) * IOTLR(All Satellites)

The loss ratios are grouped in series of 5 years and data collected among the last 30 years, which provides 6 periods of observation per satellite N = 6. The number of observed satellite platforms S=6.

The parameters of the credibility method are estimated based on the satellites loss history:

~ 2 1 ~ ~ 2 ~ 2 Inter Satellite Volatility σ = *( n (S)( p − p) − (S −1)s ) = 2,69E-02 n (S)2 ∑ a S n (1− a ) Satellites a ∑ 2 Satellites na

~ 2 1 1 ~ ~ 2 Intra satellite Volatility s = ∑ ∑na (S, P)( pS ,P − pS ) = 3,35E-04 S Satellites N −1Periods

For each satellite the credibility factor is given by: IntraSatelliteVolatility Cred(S) = InterSatellitteVolatility IntraSatelliteVolatility + NbFlight(S)

Step 3: Computation margin using the confidence interval estimation.

Considering the quite reduced size of the statistics used for each satellite, it is interesting to assess the confidence interval for each satellite IOT Loss Ratio estimate. This is achieved by using the confidence interval method.

P_IOT_Failure is estimated by the empirical average of P_IOT_Failure from a sample of n elements and is called pˆ .The central limit theorem provides the asymptotic law of pˆ :

pˆ n − p pˆ − p n → N(0,1) and we seek a so that P(−a < n n < a) = 95% p * (1− pˆ) p *(1− pˆ)

p *(1− pˆ) Consequently p < pˆ + Φ −1 (95%)* = p with a 95% probability. n max

The results for all satellite platforms are given below.

Nb Loss Credibility Loss Ratio Confidence Platforms Nb Failures Loss Ratio trials Amount Factor Cred Loss Rate* Eurostar 51 9 81% 1,59% 60% 3,00% 3,77% OSC Star 24 4 135% 5,63% 41% 5,33% 6,35% SSL LS1300 84 7 322% 3,83% 71% 4,20% 5,11% LM A2100 41 4 252% 6,15% 55% 5,68% 6,73% Boeing 90 17 667% 7,41% 73% 6,79% 7,93% TAS SB 55 9 311% 5,65% 62% 5,45% 6,48% All 345 50 17,48 5,12% Tableau 12: Telecom Platform Loss Rate

(*) computed for a confidence level of 80%

7% Specific Rate

6% Credibility Rate

0% Eurostar LS1300 OSC SB A2100 BSS 601/702 ALL

Figure 23: Satellites Reliability

Step 4: IOT defect ratio

To determine the IOT defect ratio, we have analysed the past IOT failures and tried to extract the share of failures which where corresponding to serial losses. Based on that we compute a proportion of IOT defects named α.

If we look at the aggregate claims resulting from serial losses compared to the total claim amount over the last 20 years, it appears that the share of serial losses in this total is relatively reduced around 13,5% of the losses. So this represents an average value for telecom satellite. A differentiation between satellite manufacturers might be introduced; however this is difficult to validate it with a statistical approach due to the limited data available in that respect for each manufacturer.

Another method can be envisaged which is more technical and based on the analyses of similarities between satellites. It consists in defining satellite families with similar characteristics. The elements which can be considered are (a) the type of platform, (b) the period at which the satellites where manufactured, (c) the specific design of satellites, (d) the proportion of equipments from the same batch. When families have been defined, each family of satellite will be attributed a common risk of design / manufacturing defect.

Finally, when simulating the loss occurrence associated to a given portfolio of IOT risks made of several groups “g” of satellites “s”, we will consider a portfolio of Random Variables

1_IOTF(s,g) = [1_ID_IOT(s)] OR [1_SYS_IOT(g)] = Max[1_ID_IOT(s), 1_SYS_IOT(g)] where:

• 1_SYS_IOT(g) is the systemic risk associated to the group g and computed as a share alpha of the overall risk with the method described above. The random value of 1_SYS_IOT(g) will be common to all satellites of the group g and will follow a Bernouilli distribution of parameter P_DIOTF = α * P_IOTF

• 1_ID_IOT(s) is the idiosyncratic part of the risk compute as a share 1-alpha of the overall risk for this satellite s. The random value of 1_ID_IOT(s) will be specific to the satellite s

4.3.5 IOT Failure Severity Model

In this part we analyse the amount of mission / financial losses associated to satellites failures. We will in fact consider the random variable SVi for a given satellite i and try to characterize it.

The failure severity SV will follow a continuous distribution taking values between 1% and 100%.

4.3.5.1 Total Losses vs Partial Losses

A first distinction shall be made between

the cases of Total Loss and Constructive Total Loss where the satellite is completely unable to fulfil its mission (with a loss ratio between 75%-100%). Historically, the share of IOT claims that led to a Total Loss or Constructive Total Loss is close to 33%. Constructive Total Losses are partial losses where the residual mission performance is so low (below 25% of the nominal satellite mission) that the satellite cannot be used anymore and is considered as totally lost.

the cases of Partial Loss (66% of historical IOT losses) where the satellite still provides a degraded mission (with a loss ratio between 1%-74%). The share of past claims being Partial Losses is of close to 50 as well.

There is a fundamental distinction between these 2 cases, in terms of probability but also in terms of nature of the loss. This is the reason why Total Loss cases are considered apart.

4.3.5.2 Partial Loss Severity Adjustment

As a second step, the distribution of the Partial Loss cases can be studied, to analyse if it is evenly spread or whether we can extract particular loss scenarios and modes. The histogram below shows the distribution of Partial Loss cases.

Loss Ratio Histogram 25%

20%

15%

10% Probability

0% 1% 11% 21% 31% 41% 51% 61% Loss Ratio

Figure 24: IOT historical severity histogram

The purpose of this part is to model easily the severity distribution to be used in a Monte Carlo model. Therefore we would like to use a parametric estimator based on standard distributions. We propose 2 approaches, the first one is to adjust directly the data sample and the second is to adjust the 3 modes of the severity density with a mix of standard distributions.

Method 1: Direct adjustment

The first method consists in a direct adjustment of the data sample with a lognormal distribution using the maximum likelihood estimate (see definition in annex 6).

The diagrams below show the result of the adjustment. g(,;,;(,)) 0,020 0,500 0,225 0,400 5,0% 90,0% 5,0% 62,7% 27,1% 10,2% 2,9% 90,6% 6,6% 72,0% 17,4% 10,6% 1,0 9

0,8 7

6 0,6 5

4 0,4

2 0,2

0,0 0

The quality of the adjustment is measured with 2 fit tests:

• Chi2 test: This test is based on the calculation of a distance between the empirical cumulative distribution function and the fitted distribution (see detail in annex 7). In this case, the computed distance is D = 23,5 which is very high. The distance is much too important compared to an acceptable limit with a confidence level of 10%, therefore the fit is rejected.

• Kolmogorov Smirnov test: The second test is also based on the calculation of a distance between the empirical cumulative distribution function and the fitted distribution (see detail in annex 8). The computed distance is 0,13 which is below the acceptable limit of 0,169 with an error threshold of 10% so the fit hypothesis is accepted in this case.

Overall, the adjustment is not satisfactory considering the important distance between the 2 distributions. This leads to consider an alternative refined method.

Method 2: Mixture distribution

The main idea is to use a mix of distributions rather than a single one, in order to match with more accuracy the 3 apparent modes of the empirical distribution. The shape suggests that there are 3 modes: low, mid, high, with a decreasing probability and corresponding to the typical loss cases identified previously. The problems with histograms are that they are not smooth, depend on the width of the bins and the end points of the bins. Again, this is due to the reduced size of the studied sample. This is not satisfactory as is since we need to obtain a continuous distribution for SV. We can alleviate these problems by using kernel density estimators to smooth the loss severity density while keeping the information on the main modes and thus extract a representative continuous distribution from our discrete inputs. We expect that matching the kernel density estimator will be more powerful than a direct estimation based on the discrete data sample.

Kernel density estimator (KDE)

KDEs belong to a class of estimators called non-parametric density estimators. In comparison to parametric estimators where the estimator has a fixed functional form (structure) and the parameters of this function are the only information we need to store, Non-parametric estimators have no fixed structure and depend upon all the data points to reach an estimate.

To remove the dependence on the end points of the bins, kernel estimators centre a kernel function at each data point. Data points are the severity values of the studied data sample. And if we use a smooth kernel function for our building block, then we will have a smooth density estimate. This way we have eliminated two of the problems associated with histograms. A more detailed explanation of KDEs is provided in annex 4.

We use a normal distribution as a kernel, with a standard deviation of 5%, which corresponds to the optimized bandwidth of the kernel estimator based on the AMISE method described in annex 4. We obtain the following distribution. The histogram is smoothed in a continuous density where the main modes are still visible.

Loss Ratio Histogram Kernel Density Estimator 25% 200 180 20% 160 140 15% 120 100

10% Density 80 Probability 60 5% 40 20 0 0% 1% 11% 21% 31% 41% 51% 61% 1% 11% 21% 31% 41% 51% 61% Loss Ratio Loss Ratio

Figure 25: IOT historical severity histogram Figure 26: IOT severity smooth distribution

We will try to adjust the 3 modes of the distribution with a mixture probability law which is a weighted sum of 3 distributions which can be guessed from the 3 failure modes:

SV = A * SV_L + B * SV_M + C * SV_S

Large failures (SV_L)

Distribution: the shape of the large failures which is widely spread and symmetric suggests a normal distribution which will be centered on the symmetry axis

Mean: the estimation of the mean μ of the distribution is based on the mode peak 50%

Sigma: the estimation of the standard deviation is computed iteratively to minimize the error between the normal distribution and the kernel density points above 50%.

Weight: the weight of large failures in the overall distribution is obtained by taking the ratio of surface above 50% from the total surface (and multiplied by 2).

Model: this leads to a Normal(50%;9%) with a weight of 11%.

Medium failures (SV_M) are obtained by subtracting the already modelled large failures from the global distribution. This reveals the shape of the right half of the distribution.

Distribution: the shape of the medium failures which is widely spread and symmetric suggests a normal distribution which will be centred on the symmetry axis

Mean: the estimation of the mean μ of the distribution is based on the mode peak 25%

Sigma: the estimation of the standard deviation is computed iteratively to minimize the error between the normal distribution and the kernel density points above 25%.

Weight: the weight of medium failures in the overall distribution is obtained by taking the ratio of surface above 25% from the total surface (and multiplied by 2).

Model: this leads to a Normal(25%;8%) with a weight of 42%.

Small Failures (SV_S): For the modelling of small losses, we compute the delta distribution obtained by the following formula Small Failures = All failures – Large Failures – Medium Failures. The resulting distribution is asymmetric on the right with a peak around 7%.

Shape: the shape suggests a beta distribution. The distribution is adjusted using a least square estimation method.

Model: The resulting adjustment is a Beta(α=1,5561; β=2,9932) for minor losses. The average quadratic error is 0,16 which is very satisfactory.

Weight: The residual weight of this curve is 100% - 42% - 7% = 47%.

The negative values of the 3 distributions represent a very small weight less than 1% and are therefore considered as negligible.

Results

The diagrams below show the quality of the adjustment wrt the original distribution.

4 QQ Plot - Adjustement vs Kernel Density Estimate

100

3,5 Modal 90 Large Loss Mode Medium Loss Mode 3 80 Small Loss Mode Adjustement 70 2,5

2 50

1,5 40

30 1

0,5 10

0 0 0 0,05 0,1 0,15 0,2 0,25 0,3 0,35 0,4 0,45 0,5 0,55 0,6 0,65 0,7 0 102030405060708090100

Figure 27: IOT severity adjustment Figure 28: Q-Q Diagram

Fit Test

The Q-Q diagram of the adjustment is presented in fig 26 and visually shows that the fit is correct overall but less precise on small failures.

1 0,9 0,8 0,7 0,6 0,5 0,4 Sample Fitted Distrib 0,3 0,2 0,1 0

0 % % 4 8% 4% 2% 6 4% 2% 4% 12% 16% 20% 2 28% 3 3 40% 4 48% 5 56% 60% 6 68%

Figure 29: KS fit test illustration

The quality of the adjustment is also measured with the Kolmogorov Smirnov test. The Kolmogorov Distance D is 0,12 where the K/S table gives a value of 0,173 with a coefficient of error of 10%. D is below the value so the fit hypothesis is validated. Besides, the quality of the fit is improved compared to the method 1.

4.4 In Orbit Life Risk Model 4.4.1 Overview

After the first year, the risk of a satellite failure is drastically reduced, nevertheless satellites are exposed to a very stringent environment and subject to wear out with no repair possible during long periods of time (5 to 15 years) and therefore are subject to failures as well.

The main risk in the operating phase, is the occurrence of partial loss. Despite the generally high degree of reliability that has been achieved, there are numerous components on board which do not function reliably enough to guarantee absolutely faultless operations throughout the satellite’s design service life. Even redundancy may not always be sufficient to eliminate the risk of breakdown completely and there has been an increase in the total number of total losses occurring in the operating phase.

In September 2001, for example, there was a short circuit in the power supply of Panamsat 7 after it had been in orbit for almost exactly three years, and the satellite, which was insured for USD 253 millions, had to be written off as a total loss. Telstar 4, which was insured for USD 141 millions, suffered the same fate two years later.

The loss history during In Orbit Life suggests that loss should be split in

(i) random failures specific to a satellite: either Single point failures which will lead to a total loss or the loss of a redundant unit which has no impact on the satellite life but reduces its robustness to future failures.

On 15th January, ASTRA 5A (that was formerly known as SIRIUS 2) failed in orbit. The satellite reportedly fell into a sun acquisition mode (exact cause not revealed) which was shortly followed by sun sensor failure led satellite to fall into a spin. On board fuel nearly ran out as engineers tried to recover satellite and with insufficient solar illumination of solar arrays the batteries were depleted and the craft apparently died drifting out of its 31.5E location.

Eutelsat W1: Major solar array ROTATION fault. MAJOR LOSS. It has been reported that on 10th August 2005, EUTELSAT W1 went off line and client’s signals were cut. The satellite had reportedly lost attitude but was later recovered from safe mode a few days later. INSURANCE LOSS circa US$68.5 million post salvage.

(ii) manufacturing / design defects can remain undetected and this is a major source of failure for satellites since the robustness to stress will be strongly limited. A manufacturing or a design defect can appear during the production of the satellite and can be either isolated on a single satellite or shared by multiple satellites. Satellites with a defect are subject to a much higher failure rates than other satellites. If a defect exists within several satellites in orbit, it creates a risk correlation between these satellites.

A large number of BSS 601 satellites, for example, experienced the failure of their on-board control processor after varying periods of service. The resulting total losses of the communications satellites Galaxy 4, Solidaridad 1, and Galaxy 7 cost the insurers an overall figure of about USD 550 millions. In each case, the loss was caused by a short circuit in the on- board control processor due to the fact that the soldering material used was not suitable for conditions in space and that current-carrying components were not sufficiently insulated.

Space System Loral LS-1300/FS-1300 bus satellites launched 1997-2000 have endemic fault on solar arrays.

The TAS Spacebus satellites EUROPESTAR , Hotbird 6 and ATLANTIC BIRD 3 have suffered a leak from itheir Nickel Hydrogen batteries (built by SAFT) each leading to multi million claim.

(iii) External events which can be shared by many satellites at the same position

Meteoroids are cosmic particles which, with a relative velocity of up to 250 000 km/h, have a very high penetration force and can cause severe damages to satellites especially on power subsystems. Micrometeoroids are also encountered in swarms, called Leonids.

Similar damage to the solar arrays may also be caused by periods of intense cosmic radiation resulting from, for instance, solar flares. About every ten to eleven years, solar activity reaches its peak, with strong outbreaks being observed recurrently over a period of one to two years. The resulting radiation leads to solar array degradation. There are other components besides the solar arrays which may malfunction or even be damaged by intense particle radiation. A very frequent kind of incident is what is called a single event upset (SEU).

During a solar storm in January 1997, the link to the American communications satellite Telstar 401 broke off and could not be restored (133 M$). The cause of loss was a short circuit in the power supply. A connection to elevated solar activity could not be proven, but it could not be ruled out either. Loss of telesat Anik E1 is also attributed to extreme solar activity.

The danger of satellites colliding with orbital debris or other satellites is also increasing. One reason for this is that satellites are being stationed closer and closer together. An added complication is that there are about 100 “retired” satellites drifting in the geostationary ring.

In 2009 the satellites Iridium33 and Cosmos2251 collided in space. The shock spread many debris in the neighbour orbits. In 2010, the OSC satellite Galaxy 15 went out of control after the long interruption of its TM/TC and drifted in the GEO orbit without any possibility to stop it incurring high risks of collision with satellites in the neighbourhood. No collision occurred.

A more serious problem, both in the geostationary ring and in low orbits, is the danger of collisions with orbital debris. Orbital debris refer to retired satellites and jettisoned rocket stages and the debris from collisions and explosions involving such objects. More than ten million objects over 1mm in size are estimated to be circling the earth at this very moment.

Some failures leading to claims have been attributed to collision with particles, however due to the particular nature of this loss, it cannot be fully demonstrated that the actual root cause was due to a debris collision.

==> These events can damage several satellites at the same time, this external event shall be considered in the satellites risk model and creates risk correlation leading to serial losses

(iv) Errors in the control or operation of a satellite by ground control is not to be underestimated.

In March 1997, for instance, the communications satellite Intelsat 801 went completely out of control when the ground station inadvertently sent a wrong command during commissioning. It was possible to recover control of the satellite again, but the insurers had to pay claims amounting to approximately USD 33 millions for the loss of lifetime.

4.4.2 IOL Failure History

Let’s start with an overview of the past failures which occurred during the in orbit life phase of the satellites.

Manuf Platform SATELLITE 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 ASL EUROSTAR EUTELSAT W1 0% 0% 0% 0% 0% 0% 0% 0% 0% 60% 0% 0% 0% 0% 0% HISPASAT 1A 0% 25% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% TELECOM 2B 0%0%0%0%0%10%0%0%0%0%0%0%0%0%0% BSS BSS 601 GALAXY 10R 0% 0% 0% 0% 0% 0% 0% 0% 45% 0% 0% 0% 0% 0% 0% GALAXY 4R 0% 0% 0% 0% 0% 0% 0% 75% 0% 0% 0% 0% 0% 0% 0% GALAXY 7 0% 0% 0% 0% 100% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% GALAXY 8I 0% 0% 0% 1% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% HGS-4 (GALAXY 4) 0%0%100%0%0%0%0%0%0%0%0%0%0%0%0% JCSAT 5 0% 0% 0% 0% 0% 0% 0% 0% 0% 10% 0% 0% 0% 0% 0% PAKSAT 1 (PALAPA C1) 0%0%100%0%0%0%0%0%0%0%0%0%0%0%0% SOLIDARIDAD 1 0% 0% 0% 0% 100% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% SUPERBIRD 4 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 5% 0% 0% 0% LM A2100 ACES GARUDA 1 0% 0% 0% 0% 0% 0% 2% 0% 0% 10% 0% 0% 0% 0% 0% AMC-16 (AMERICOM 16) 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 20% 0% 0% AMC-4 (AMERICOM 4) 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 5% 0% 0% 0% LM-3k5k7k TELESAT ANIK E-1 95% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% TELSTAR 401 0% 100% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% TELSTAR 402R 0% 0% 0% 0% 0% 0% 0% 100% 0% 0% 0% 0% 0% 0% 0% LM4k ASTRA 1A 0%0%0%19%0%0%0%0%0%0%0%0%0%0%0% OSC LEOSTAR ORBVIEW 3 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 100% 0% 0% 0% STAR GALAXY 15 (PANAMSAT LI 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 100% Other EXPRESS EXPRESS A1R (A4) 0% 0% 0% 0% 0% 0% 0% 0% 48% 0% 0% 0% 0% 0% 0% EXPRESS AM-2 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 54% 0% 0% 0% EXPRESS AM-22 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 39% 0% 0% 0% MELCO ADEOS 2 0% 0% 0% 0% 0% 0% 0% 100% 0% 0% 0% 0% 0% 0% 0% SSL LS1300 DIRECTV 6 0%0%0%20%0%0%0%0%0%0%0%0%0%0%0% GALAXY 25 (INTELSAT 3005 0% 0% 0% 0% 2% 2% 3% 0% 0% 0% 0% 0% 0% 0% 0% GALAXY 26 (INTELSAT 3006 0% 0% 0% 0% 0% 3% 0% 0% 0% 0% 0% 0% 0% 0% 0% INTELSAT 7 (PAS 7) 0% 0% 0% 0% 0% 100% 0% 0% 0% 0% 0% 0% 0% 0% 0% TAS SB ARABSAT 2A 0% 0% 0% 0% 0% 0% 100% 0% 0% 0% 0% 0% 0% 0% 0% ARABSAT 3A (BADR 3) 0%0%0%0%0%83%0%0%0%0%0%0%0%0%0% ASTRA 5A 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 100% 0% ATLANTIC BIRD 3 0% 0% 0% 0% 0% 0% 0% 15% 0% 0% 0% 0% 0% 0% 0% EUTELSAT W5 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 100% 0% 0% HOT BIRD 6 0% 0% 0% 0% 0% 0% 0% 0% 10% 0% 0% 0% 0% 0% 0% TDF-1 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% 0% THAICOM 3 0% 0% 0% 0% 0% 0% 0% 67% 0% 0% 33% 0% 0% 0% 0% TURKSAT 2A (EURASIASAT 0% 0% 0% 0% 0% 0% 0% 6% 0% 0% 0% 0% 0% 0% 0% Tableau 13: IOL Failure History (Data from Spacetrack database)

The available data sample is limited to 52 observed failures which is a bit small to make accurate statistics.

The specificity of IOL failures is that the mission (and financial) impact of a failure depends strongly on the date of occurrence of the failure. Indeed, a failure occurring at the very end of the mission will result in a small mission loss compared to the overall mission that the satellite is able to provide (in transponder.years for telecom and in images.years for earth observation). Therefore, it is important to have a model which evaluates the failure probability per year but also the date of occurrence of a failure in the satellite life.

We have envisaged 2 different approaches for the phase:

- a purely statistical approach based on the number and the severity of observed failures in the past

- a functional approach where the reliability of the satellite is estimated based on the reliability of each of its components and on the satellite architecture

The 2 approaches should have similar results.

Analysis of severity distribution

The majority of Partial Losses during In Orbit Life seem to be generally small with a 20% average.

From the available data sample of IOL failures, it appears that in orbit life failures will result in a Total Loss in 35% of cases and in a Partial Loss in 65% of cases.

In order to improve our understanding of the possible failures occurring in orbit and their origin, we have classified the possible failure root cause in 5 categories: Payload related, power related, satellite control, central computer, others.

16 power aocs - prop PL dhs 14 other

10 3 1 8

4 2

0 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

Figure 30: IOL failure severity

Each of the 3 modes can be explained with the following failure cases:

Failure Mode Caracteristics Typical failures

1 – Total Loss / Very concentrated 90-100% solar array failure or bus short circuit, Constructive Total Loss loss ratio severe thruster or gyro or tmtc failure leading to uncontrolled sat, loss of on board computer

2 – Medium Partial Loss Average of 25% loss ratio solar array failure (sadm or severe short), with a reduced dispersion battery issue, thruster leak or severe sensor/gyro failure

3 - Small Partial Loss Average of 10% with a Loss of tubes (amplifiers) or filters, power: peak at 5% and a reduced strings or connectors failures, erratic dispersion on the right behaviour of thrusters / sensors / gyros reducing sat lifetime

4.4.3 Model Definition

Driving Factors: The driving factors identified for the IOL phase are:

• The failure probability for each platform based on the manufacturing quality and the intrinsic robustness of the design

• The possible existence of manufacturing / design defects which can be present in several satellites, creating a correlation of risks between satellites of the same group

• External events which can damage several satellites at the same time incurring risk correlation

• The loss severity is random and should have a distribution matching the failure root cause

Modelling

Considering the important duration of operation of the satellite equipments during the IOL phase, the failure modelling will follow a different approach as IOT failures. The wear out of equipments and their resistance to a long and important stress will be at the basis of the possible failures and will drive the underlying failure modelling. Besides, the redundancies present in the satellite will be an important risk mitigation and shall be valued. For these reasons, we have chosen to study the satellite reliability at the level of equipments and build from that the overall satellite reliability integrating the redundancy scheme existing between equipments. This is however only possible when a detailed information on equipments failure is available, which is not always the case. As a backup solution, a more simple Time To Failure estimate at the satellite or subsystem level can be performed based on a more reduced set of data.

As a consequence the proposed risk model for the IOL phase is the following:

• The satellite failure occurrence probability will be represented for each year n by the satellite survival curve which corresponds to the satellite Time To Failure (TTF) Cumulative Distribution Function.

• For each year n, the failure occurrence 1_IOL_F(n) can be modelled with a Bernoulli distribution and the failure occurrence probability will be P_IOLF(n) = TTF(n) – TTF(n+1)

• In order to value the possible risk correlations and the failure occurrence shared by different satellites, the failure occurrence can be modelled as

o 1_IOLF_Random which represents the random risk specific to a satellite based on a Bernoulli distribution of parameter P_R

o 1_IOLF_Defect which represents the defect risk shared by a group of satellites based on a Bernoulli distribution of parameter P_D

o 1_IOLF_Environment which represents the environmental risk shared by a group of satellites based on a Bernoulli distribution of parameter P_E

Segmentation

The segmentation for the IOL phase will first distinguish the GEO Satellites which are mainly providing telecom services and have a particular platform design adapted to a geostationary space flight, and the LEO/SSO satellites which are more dedicated to the earth observation and navigation missions and are orbiting around the earth in cycles. The platform design, the mission and the environment for these 2 types of satellites are different and therefore deserve a distinction.

4.4.4 IOL Failure Frequency Model

The IOL Failure frequency model necessitates the estimation of the satellite loss probability for each year of the satellite life. This loss probability might evolve over time (e.g higher failure rate during youth phase due to the discovery of defects or at the end of the satellite time due to ageing and wear out of the components). Generally, the failure probability of a given system follows a “bathtub curve” as described below and split in 3 phases: (i) a youth failure phase where the failure probability is important due to existence of defects which can cause rapidly the failure of the system, (ii) a cruise phase where the reliability is quite low and flat and (iii) the wear out phase where the system components are more subject to failures due to ageing phenomenon.

Youth Cruise mode Wear out

time

Figure 31: IOL reliability shape (bathtub)

In the proposed modelling, the youth failures are already widely taken into account in the IOT phase and shall thus be excluded from the present IOL model. Wear out failures are a bit difficult to capture but nevertheless still present for satellites notably for mechanical or propulsion elements where the wear out is affecting the resistance characteristics of these equipments. Electronic parts are generally considered as much less subject to wear out phenomenon and therefore not contributing to the wear out type of failures.

We will analyse the satellite failure rate with different methods. Different modelling methods are proposed and analysed depending on the level of information available. A critical analysis is then given for each method.

4.4.4.1 Method 1: IOL Loss Ratio historical average

The first idea is to proceed as per the modelling of the IOT loss rate, by computing the IOL loss ratio for each satellite platform based on the empirical average as estimator for the loss ratio expectancy.

The following table provides an estimation of the satellites loss ratios and failure rates, which are computed as: Failure Rate = Nb Failures / Cumulated Life

Loss Ratio = Aggregate Loss Amount / Cumulated Life

Nb sat Nb Failure Loss Loss Ratio Loss Ratio Platforms Years of obs. launched Failures rate Amount (per year) (per sat) SSL 660 84 6 0,91% 130% 0,20% 7% Eurostar 338 51 3 0,89% 95% 0,28% 6% LM 852 41 11 1,29% 406% 0,48% 27% Boeing 926 90 10 1,08% 546% 0,59% 11% SB 438 55 10 2,28% 439% 1,00% 18% OSC 93 24 1 1,08% 100% 1,08% 4% All 3325 345 42 1,26% 1816% 0,55% 12%

Tableau 14: IOL Historical Loss Ratios

The above table gives a first idea of the loss rate after the first year of orbit. Overall, a loss ratio of approximately 0,6% per satellite per year can be taken as a reference. The other information to consider is the probability of a failure occurrence in the satellite life leading to a mission loss. The above table indicates an average probable loss of 12% for the telecom satellites.

This method is also interesting to observe the differentiation between satellite manufacturers based on their satellites track records. However, this method is a bit limited to build up a complete IOL failure model due to the relatively small amount of data samples which leaves a low confidence level wrt the above estimates. Besides, the satellite reliability evolution over time is not represented by such model which is based on a flat loss rate whatever the satellite age. The specificity of the satellite design or health status is not taken into account either, which is also a strong limitation to the model.

4.4.4.2 Method 2: Satellite Lifetime Curve Estimate

The second method is to build up a satellite lifetime curve representing the satellite loss probability evolution over time. The lifetime curve will be built as the cumulated distribution function of the random variable Time To Failure (TTF) which represents the random residual lifetime of a given satellite.

‘We will distinguish 2 cases: (a) the case of satellite loss occurrence which has an α probability to occur and (b) the case of satellite life with no mission loss which has a (1- α) probability to occur).

Therefore TTF(i) = α * TTF(i / loss occurrence) + (1- α) * TTF(i / no mission loss)

• TTF(i / loss occurrence) will be estimated based on the sample of failure occurrences and their corresponding moment in the satellite life which corresponds to accidental failures

• TTF(i / no mission loss) will be based on deterministic failures linked to the satellite fuel available on board which is finished at a given moment in time and depends on the overall fuel consumption of the satellite and the ergol necessary to de orbit the satellite

TTF(i / loss occurrence): The modelling principle is to consider an appropriate distribution (with a typical shape matching the lifetime curve we want to estimate) and to compute the relevant probability law parameters which all to fit the historical points. We have translated the TTF sample in terms of proportion of the expected design life in order to avoid that differences in design create a bias in the data analysis. Two distributions have been considered to match the youth phase and the wear out phase shape: A Weibull distribution and a Lognormal distribution. A Maximum Likelihood Estimator method is used to perform this adjustment (see ref annex 6).

Results are presented below, the quality of the adjustment is measured with a Chi2 test and with a Kolmogorov Smirnov test. Quantile ajusté 0,0 0,2 0,4 0,6 0,8 1,0 1,2

Chi2 test = 2,42 ==> Confidence level 93% Chi2 test = 3,12 ==> Confidence level 87%

K/S test = 0,0963 < 0,1696 (10%) ==> OK K/S test = 0,0809 < 0,1696 (10%) ==> OK

TTF(i / no mission loss): The modelling will rely on engineering studies which gives an estimated of the probable ergol consumption due to launch injection corrections and orbital fuel consumptions. Generally, the satellite contains ergol margins which incur a satellite life longer than expected, but sometimes the overconsumption of fuel can lead to a life reduction. We propose as a simplified model a weibull distribution with a 110% expectancy and a 10% standard deviation.

The plot below provides the resulting typical satellite life curve for a telecom satellite.

A similar curve can be built for earth observation satellites based on a different adjustment of the accidental mission loss and the ergol failure parts.

Last but not least, this constitutes a survival law of a given satellite which has just been accepted in orbit. If we want to compute the survival curve of a satellite which has already been operated during x years, we shall compute a conditional probability based on the survival curve. This calculation is based on the same principle as for life insurance with commutation numbers.

The benefit of this method is to propose a particular shape for the loss rate of satellite in their life which is more representative of the failure types with youth failures and ageing.

However, in order to have sufficient data to generate a sensible model over time, all the satellite platform and manufacturers have been merged together, which incurs a lack of differentiation between satellites and is not representative of each specific satellite type or the various quality levels observed between manufacturers.

Besides, this model is not able to capture the distinction between partial and total failure rates and is not precise enough to differentiate failures coming from different subsystems which can have different mission impacts or be treated differently in insurance contracts depending on the applicable loss formula. This particular point has been studied as well and resulted in a similar model for each subsystem. In such case the different categories of satellites is lost.

Finally, this model is not able to incorporate the effect of defects or redundancy losses which are already present on a given satellite. The lifetime curve is applicable only for satellites which are new and which did not suffer major losses.

4.4.4.3 Method3: Satellite functional model

The final approach we have considered is to estimate the survival law of each of the satellite components and to derive from that the satellite survival law. The main benefit of this method is to incorporate the design specificities of each satellite, notably its redundancies. Second, the method allows to value the reliability of each component considering its in orbit heritage and its flight proven reliability, but also the health status of each equipment. This method can also value the specific reliability of a type of component or subsystem and thus reflect the quality process of the manufacturer. This method can be envisaged only when a detailed knowledge and follow up of the equipments performances including loss or degradations which have no direct impact on the satellite mission.

To implement this method, we will consider the architecture of a satellite and the equipments which are combined within the satellite to make the full system. The satellite global reliability R is then obtained by a combination of the elementary reliabilities (Ri) of each subsystem. The spares and redundancies have an influence on the calculation of the elementary reliability (Ri) of each subsystem, itself derived from the reliability of the equipments (Rj).

The satellite can be decomposed in mainly 5 subsystems: (1) the alttitude and orbit control system (AOCS) which ensures the stability and proper orientation of the satellite (2) the propulsion subsystem which is providing positioning and orientation capabilities of the satellite with thrusters (3) a Data handling system managing the main routines of the satellite and the central computer (4) the power subsystem providing the energy of the satellite necessary to run the platform and the payload, 5) the payload which is delivering the satellite mission.

The present diagram gives a representation of this approach.

Satellite Subsystem Equipments

R_AOCS R1

R_PROPU Redundancy scheme

Rj R_DHS R_Satellite

R_POWER

R_Payload Redundancy scheme Rn

Figure 32: Satellite architecture

The reliability of each component can be derived from (a) on ground testing done by the manufacturers who will make accelerated qualification tests to assess the robustness of the equipments over time; (b) in orbit life feedback, which provides an observation of the flying equipments and their robustness along the satellite life

These 2 combined sources of information provide a very accurate data base to assess the satellites reliability than the limited sample of known in orbit failures. However, all these data must be aggregated together to derive a satellite reliability model.

The advantage of the functional method is also to value the specific design of each satellite of the particular equipments on board (new/old technology, critical/simple design, etc…). It is also valuable to differentiate satellite categories (e.g telecom and earth observation satellites)

This model can also be used to estimate specifically the reliability of a satellite which has lost some equipment redundancies or having suffered anomalies on a given equipment. The tuning of the model can thus be done with precisely to stick as much as possible to the satellite specificities and health status.

Reliability Model

The proposed reliability model of each equipment and subsystem is an exponential law.

−λsystem *t RSystem = e

λ Where system is the expectancy of the system Time To Failure (TTF) and t is the time horizon at which the Reliability is calculated. During the mission, parts are assumed to exhibit constant failure rates (λ) and items are assumed to fail independently of one another. The main benefit of this model is its simplicity which allows a much easier aggregation of elementary reliabilities up to the satellite level. Besides, this simple model is sensible when considering electronics or high robustness equipments (during their qualified lifetime) where youth failures have been discarded and where ageing effects or nor preponderant.

Estimation of the exponential law parameters

The estimation of the expected TTF for each component is based on the Chi2 estimate with a 60% confidence interval.

2 Lambda_equipment = χ2*(r+1) (60%) / 2 /T Where r = number of failures, T = observation interval.

2 χk (α) represents the value of a random variable following a Chi square probability law with k degrees of freedom which has the probability α to be exceeded. The parameter α is used to choose the level of confidence of the estimator. The principle of the Chi square estimate is given in annex 3.

The failure statistics for the main equipments is proprietary information and cannot be displayed in this paper. It will be specific to each type of technology or manufacturer. In this paper, we will use dummy examples to illustrate the method.

100

Impact of redundancy schemes

The calculation of the subsystems reliability is based on the equipments redundancy scheme and the following assumptions:

−λON *t ¾ Single Point Failure : RSPF = e

¾ Reliability of components in serie = Lambda1 + Lambda2 (due to the properties of the exponential law)

n−m i −λON *t i −λON *t n−i i n! ¾ Active redundancy : RACTIVE (m / n) = ∑Cn (1− e ) *(e ) with Cn = i=0 i!(n − i)!

n−m (1− e−λOFF *t )i i−1 λ ¾ Passive redundancy : −m*λON *t ON RPASSIVE (m / n) = e [1+ ∑ ∏ ( j + m )] i=1 i! j=0 λOFF

Results

One of the main advantages of this method is to compute the occurrence probability of different failure cases. This is helpful to compute the occurrence probability of different loss triggers and for different satellite configurations.

Nominal satellite

An essential information is first to estimate the probability of occurrence of a mission loss (whether total or partial). For a typical satellite with all redundancies available, the “mission loss” failure rate is approximately between 800 and 1000 Failure In Time (FIT), ie 800-1000 failure for 10^9 hours of operations. This is shown in the table below by considering all failure cases leading to a mission reduction and including the robustness coming from redundancies (example 1). This is equivalent to a yearly failure occurrence probability of 0,7%-1,0%, and thus, assuming a 50% average loss ratio per failure, a 0,35%-0,5% loss rate per year which is comparable to the average result obtained in the first method.

Another interesting information which can be extracted directly from this method, is to calculate the Time to Total Failure of the satellite considering only the loss cases which lead to a total inoperability of the satellite notably a complete loss of control or power (generally requiring an accumulation of failures) or the losses occurring on single point failure (SPF) equipments. The result is presented in the table in the example 2 (green curve). This information is interesting notably when considering a satellite replacement strategy where only a Total Loss triggers a satellite re launch.

On the contrary, it might be also interesting to quantify the rate of equipment failures even if it has no impact on the mission but if it necessitates corrective actions or if it triggers additional costs of engineering or support for example. In such case, the risk reduction coming from the redundancy scheme is not relevant and the time to failure is dependant only on the number of equipments within the satellite and their reliability. This is presented in the table in example 3 (blue curve).

101

Damaged satellite

It is also interesting to analyse the performance of a satellite which has already suffered failures in the past to measure their impact on its overall reliability. In this case, we will do the same exercise but considering that (i) the satellite has a weakness (which will generally trigger a mission loss with a higher probability) and (ii) the reliability of components which have not failed but which have the same design as the lost one will be attributed a lower reliability level. Based on these hypotheses, the example satellite (ex 4, red curve) we have considered as an illustration which has already lost a critical equipment redundancy will see its failure rate increase by ~1000 FIT and consequently the associated loss rate will be multiplied by 2. This is illustrated by the curves purple and red.

1,00

0,90

0,80

0,70

0,60

Survival ProbabilitySurvival 0,50 Survival w /o component Failure Survival w /o Missionl Loss 0,40 Survival w ithout Total Loss Survival w ith a lkost redundancy

0,30 0123456789101112131415 Years after IOT

Figure 33: Satellite Survival Curve

Conclusion

The presented method is the most accurate and the most representative of a satellite configuration and health status. The particular quality level of a given manufacturer is also taken into account. The method is also more complex to implement and must be done specifically for each satellite.

This necessitates very precise information on the satellite architecture and on each equipment reliability (and past experience) which is a strong barrier. However, this type of information can be available to insurers who have a large market share and experience in the market. Besides, this information is generally available for the satellite manufacturers for their own fleet and products.

102

4.4.4.4 Risk correlations between satellites

We have seen in the review of historical failures that the occurrence of serial losses has caused important financial losses in the past. We consider as a serial loss associated to the IOL phase, the accelerated wear out phenomenon leading to a satellite performance loss which can be shared by several satellites with similar characteristics. This can coming either from (i) a shared design or manufacturing or technology (ii) an external space event stressing many satellites at the same moment. This phenomenon incurs risk correlation between satellites and therefore the previsouly computed loss rates of each satellite are not independent but correlated. We will propose a simple approach to incorporate this correlation by introducing a shared failure rate between them.

Manufacturing or design generic defects

The occurrence of manufacturing defects will be obtained from the historical failures of satellites. We will consider the complete fleet of telecom satellites to extract the proportion of IOL failures which are linked to a generic defect. The observation of the loss history shows that the ratio of isolated failures is 66% against 34% for generic failures. This ratio is obtained with the aggregate loss ratio of generic failures vs the total loss ratio of satellite failures over the past 25 years. The failure occurrence probability of generic defect failures will be obtained for a satellite group by P_IOL_GF = 34%*P_IOLF.

The severity of failures of a satellite when it is affected by a generic defect is difficult to assess. However, based on the known examples, we have determined that the average severity of failures of satellite subject to a generic defect is roughly 50%. The average severity of generic defects being quite similar to the overall average severity of failures, we will consider that the severity of generic defects will have the same distribution as any type of failure. When modelling the impact of generic defects, we shall consider the same severity for all failures of the same origin.

External Events

The occurrence of leonids or solar flares is quite rare and their exact impact on satellites is not very well known. However, in case a high magnitude occurs, several satellites could be damages at the same time and therefore incur high losses for satellites owners and insurers. Therefore it shall be modelled by using a very low probability of occurrence but shared at the same time by many satellites located in the same region. We have considered an arbitrary yearly failure rate around 0,05% but shared by all satellites. Concerning the loss severity, we consider that the loss level associated to such event might be very different from one satellite to the other and therefore the associated severity will be specific to each satellite. A more precise model might be worked out based on a fine study of solar cycles and other space environment phenomena. This has not been done in the present paper.

Synthesis

To formalize it, we will consider the yearly loss rate of satellites as:

LR_IOL(i, j, k) = MIN(1; P_IOLF_ID(i) * SV_ID(i) + P_IOL_GF(j) * SV_GF(j) + P_IOL_EE(k) * SV(i)

For a satellite i with a design or manufacturing family j and belonging to a group of satellites k and where P_IOL_ID is the idiosyncratic failure probability, P_IOL_GF is the systemic failure rate of the satellite family j and P_IOL_EE is the systemic failure probability of the group of satellites k.

103

4.4.5 IOL Failure Severity Model

From the available data sample of IOL failures, it appears that in orbit life failures will result in a Total Loss in 35% of cases and in a Partial Loss in 65% of cases.

Kernel Density Estimator

The distribution of the Partial Loss ratio (lost performance level of a satellite after a failure) is given by the following curve, which was obtained with a kernel density estimator using a Normal distribution as kernel, with a bandwidth (standard deviation) of 7%.

Kernel Density Estimator 120

100

80 y 60 Densit

0 1% 11% 21% 31% 41% 51% 61% Loss Ratio

Figure 34: IOL severity distribution

Modelling of Partial Failures

We will try to adjust the 2 modal distributions with a mixed probability law which is a weighted sum of 2 distributions representing the 2 failure modes:

Weibull(1,39; 0,13)+ for minor losses with a weight of 65%

Normal(47%;15%) for large losses with a weight of 35%

The diagrams below show the quality of the adjustment wrt the original distribution.

4 QQ Plot - Adjustement vs Kernel Density Estimate

100

3,5 Modal 90 Large Loss Mode 3 Small Loss Mode 80 Adjustement 70 2,5

2 50

1,5 40

30 1 20

0,5 10

0 0 0,01 0,06 0,11 0,16 0,21 0,26 0,31 0,36 0,41 0,46 0,51 0,56 0,61 0,66 0,71 0 102030405060708090100

Figure 35: IOL severity adjustment Figure 36: IOL Severity QQ Plot

104

4.5 Conclusion

3 different models have been proposed to represent space risks for all phases of a satellite life:

1) Launch Failures

■ Occurrence model based on a Bernoulli distribution with parameter P_LF

P_LF = P_DLF + (1 – P_DLF) * P_MLF

• P_DLF estimated with Early launch statistics based on conditional probability and chi square confidence interval estimates

• P_MLF is estimated with each Launch Vehicle Manufacturing Defect statistics and complemented with a credibility method

2) In Orbit Test Failures

■ Severity model based on Weibull distribution or a weighted sum of Weibull and Normal distributions

• The severity distribution adjustment is made with a least square method based on a kernel density estimator of the historical failure severity for all satellites of the same category

■ Occurrence model based on a Bernoulli distribution with parameter P_IOTF

P_IOTF = E[Loss Ratio] / E[Severity]

• E[Loss Ratio] is computed for each satellite based on its historical failure rate corrected with the credibility method

3) In Orbit Life Failures

■ Severity model based on a weighted sum of Weibull and Normal distributions

• The severity distribution adjustment is made with a least square method based on a kernel density estimator of the historical failure severity for all satellites of the same category

■ Occurrence model derived from the satellite survival curve represented by the satellite Time To Failure random variable which is fitted either with a weibull or an exponential law

• The parameter of the exponential law is based on each component failure rate and incorporates the equipments redundancy schemes within the satellite

Segmentation considers different type of satellite missions and associated orbits. It also provides specific rates for each launch vehicle and satellite manufacturer.

The models will be used to estimate and measure the exposure of space actors. It will be the starting point for the definition of optimized risk management for insurers, manufacturers and operators.

105

• To use actuarial methods (credibility, confidence intervals) to estimate the reliability of all launch vehicles and satellite types and compensate the reduced data sets available

• To analyse in detail the loss severity of satellite failures allowing a precise modelling of partial losses with standard distributions using kernel density estimator and estimation methods

• To propose a functional in orbit life model incorporating the design specificities and available redundancies as well as the flight heritage per component

• To analyse the correlation between losses in order to properly address the risk of serial losses in a satellite portfolio

106

555... SSSpppaaaccceee IIInnnsssuuurrraaannnccceee

Space insurance is a specialized branch of insurance which provides coverage for the financial damages caused by the occurrence of space risks. It is made of about 30 companies insuring the risk coverage demand on a quota share basis.

The objectives of this chapter are the following:

• Understand the insurers’ portfolio of risks and the subsequent loss exposure faced by insurers.

• Propose a method to price space insurance policies based on a pure premium and a commercial premium adapted to the specificity of the risk.

• Analyse the volatility of the market which comes from the small number of risks covered and the high variations of losses from one year to the other.

107

5.1 Market Overview

This first part will provide to the reader an overview of the space insurance market practice and an idea of the insurance volumes at stake.

5.1.1 Space Insurance Coverage

Space insurance policies cover ALL risk including loss of performance. Loss due to the failure of, or physical damage to, satellites, launch vehicles and other space payloads are generally insured. The policy is triggered by physical damage (including hardware failure) or satellite mission reduction.

Insurance covers losses related to all the launch vehicles (with at least a couple of flight experience) and all types of satellites and technology including new payloads or hardware. Telecommunications remain however the main type of covered satellites. Overall it translates into a high probability of risk occurrence.

Insured clients are mainly satellite operators (communications & imaging), launch service providers, and satellite & launch vehicle manufacturers. Occasionally scientific payloads or commercial aspects of civil & defense programs might be insured for institutional bodies but remains quite rare and the majority of science missions are generally not covered. Overall the number of risks covered every year is quite limited.

Typical insurance coverage is for satellite and launch vehicle asset values when a customer wishes to replace a lost or non working asset. Loss of revenues or penalties insurance is also envisaged to limit the financial impact of a satellite loss. This translates into very high amounts at risk with peaks up to 500 M€ on a single launch (the limit is attained on Ariane 5 dual telecom launches)

The typical insurance policy is for Launch of a satellite plus one year in orbit, and then separately In orbit life insurance policies which are renewed every year for 12 months. Launch vehicle flight (LVF) covers launch vehicle flight phase, from the launcher lift off up to the separation of the satellite in orbit. Post-separation (P/S) covers LEOP and In Orbit Test phases and in-orbit life up to one year from launch. After the first year, In Orbit life insurance is applied for 12 months. The market has offered multi year coverage (more than 1 year and up to 5 years after launch) in the 90s’ but this has led some insurers to be unable to reconsider their price even after a severe defect discovery and consequently important losses. Today multi year policies are quite rare. However, the risk of serial losses happening on a series of satellites with similar technology is still present.

Typical exclusions are War, terrorism, nuclear, etc., Space third party liability is written through a separate facility, Liability for property damage and bodily injury to third parties. Terms and conditions are otherwise stable.

A coinsurance scheme is the standard practice on every risk; therefore each insurer takes a share of the overall risk exposure and is responsible for its own line. This incurs a strong competition of the complete insurance market on every risk and therefore influences the attainable price.

108

5.1.2 Market Metrics

Globally there are approximately 30 insurance companies which are currently offering coverage for launch and in-orbit operations of commercial and governmental satellites. Companies that provide satellite coverage are typically either large insurers (or reinsurers) with a department dedicated to space that carry the risk on their own books, or managing general agencies that underwrite the risk on behalf of their insurers or reinsurers.

Each company has a maximum dollar amount of insurance (i.e. capacity) it can offer for an individual satellite or launch risk. Most insurers report a maximum theoretical capacity they can provide for an individual risk. However, many underwriters only allocate a fraction of their theoretical capacity to any specific launch or in-orbit risk. Typically there is more capacity available for launch risks than in-orbit risks due to the fact that some insurers find launch risk more attractive than in-orbit risk.

The actual capacity is believed to be the most useful measure of total space insurance global market capacity. Currently, the maximum actual capacity available in the global market for a single launch and in-orbit risk is shown in the charts below.

Figure 37: Launch Capacity (Source Aon / ISB) Figure 38: In Orbit Capacity (Source Aon / ISB)

Capacity has been fluctuating over time together with market rates. This diagram illustrates the volatility of the market rates.

Figure 39: Market Capacity Evolution (1986-2010) (Source Aon / ISB)

109

The market capacity evolution can be divided in different periods characteristic of the underwriting cycle with increase and decrease trend depending on the claims development:

• Period1: 86 – 96: Development of space insurance with the increase trend of telecom satellites. Reduced capacity and high rates. Progressive increase of capacity with the development of the sector and consequently slow decrease of rates.

• Period2: 96-99: Telecom bubble with several satellite launches and a rapid increase of insurance capacity with the arrival of new actors and increase of lines. This period is characterized by a strong competition between insurers and very low rates.

• Period3: 99-04: Severe claims and serial losses lead to negative years and very high losses for the market leading to a rapid increase of rates and capacity decrease. Very hard market with a limited flexibility on policy terms.

• Period4: 04-10: Slow softening of markets with an increasing capacity and a reduction of rates. A large majority of profitable years and no high losses faced by insurers has led to a strong softening of conditions.

Insurance Volume

Typical insurer exercise

30-40 insured launches per year

Carrying 20-25 GEO satellites and 15-30 LEO satellites

Insured values range up to $400 million (up to $700 million for Ariane dual launches), typically $100 million to $250 million

Figure 40: Insurers L+1y portfolio evolution (source XL insurance)

164 insured GEO satellites and 17 insured LEO satellites in orbit

Total insured value of $18.5 billion

• $17 billion in GEO, $1.5 billion in LEO

Figure 41: Insurers IOL portfolio evolution (source XL insurance)

110

Premium and Claims

Annual premium ranges from $300 million to $1150 million, average of 750 M$ in the last decade

Annual claims range from $100 million to $1.8 billion, average of 600 M$

Annual Profit ranges from -800 M$ to 700 M$ and an average yearly profit of 150 M$

2500

2000 Premium Claims Profit 1500 Cumul. Result 5y

1000

500

0 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 Market Profit & Loss (M US$) -500

-1000

-1500

Figure 42: Insurers P&L evolution (based on market data by Marsh and Willis)

The space insurance market is very volatile and therefore insurance rates are almost impossible to predict in the medium term. Market rates are strongly influenced by the insurers profitability objectives, insurers competition, available capacity, and claims suffered / past results

Conclusions

Based on the above, we can conclude that the space insurance market has some specificities:

• A high failure rate combined with high losses on each failure due to the nature of the risk and a relatively small number of risks insured, will incur a strong volatility of underwriting results and premium evolution.

• The loss distribution will necessitate important reserves to ensure solvency.

• The impossible access to launched satellites and the risk of serial failures will result in a fat tail loss distribution

• The risks covered are unique and relying on a complex technology, which makes the risk difficult to assess

• Competition between insurers on every risk will influence the premium price especially when capacity available is at high levels

111

5.2 Insurer Loss Model

A model has been implemented to simulate the loss associated with a typical insurer portfolio.

The expected output of the model is the loss distribution of a given portfolio in the form of a density of probability.

The model inputs are the made of the structure of the portfolio, the risk profile for each risk in the portfolio and the set of parameters defining each individual risk in term of loss occurrence and of loss severity.

Risk Portfolio

Risk Profile Loss History- indemnity

Reliability Costing model Modelling € Reliability Prediction Loss

Outputs

Probability

Claims amount Expectancy ==> 95%ile ==> capital pure premium reuirement

Portfolio Structure

The structure of the portfolio is a set of launch risks, IOT risks and IOL risks. A typical portfolio accounts for 20 to 30 launches, 25-40 satellites IOTs, and between 100 and 150 satellites at risk in orbit. The number of IOT risks depends also on the number of successfully launched satellites. Therefore if a launch failure occurs, the number of satellites IOTs will be reduced by the number of satellites lost at launch. Within each phase, the portfolio of risks is structured with different launchers and different satellites with a particular loss profile. Our typical portfolio will be composed of the following risk in each phase, which is representative for the next 5 years.

112

Risk Profile

The risk profile gives a correspondence between the satellite loss ratio and the claims paid by the insurer. It is generally reflecting a detailed loss formula, however in this simplified simulation, the risk profile is considered as identical for each satellite with a linear slope between 0% and 75% loss ratios and a step at 75% loss ratio where the full sum insured is paid.

The risk profile also defines the maximum financial loss associated to each risk, which is depending on the requested sum insured by the insured. The sum insured related to each risk of the portfolio is based on the average sum insured for a given satellite category, knowing that the sum insured is generally linked to a satellite replacement value, the estimated rebuild and relaunch cost is a relmiable estimate of the sum insured.

financial losses 8

7 100% 6 75 % 5

75% 2

1 Satellite technical losses 0

0 0 4 60 80 00 40 60 1 120 140 160 180 20 220 2 2 280 300 320 340

Risk parameters

The risk parameters are used to tune the risk relative to each element composing the portfolio in terms of risk occurrence and in terms of severity of a claim. The parameters used in the model are the one defined in the chapter 3 of this paper. It can be tuned specifically for a given risk if specific information is available.

Model Calculation

Two methods of calculation have been implemented. The model calculates the resulting loss distribution either with the Monte Carlo principle by generating a sample of random failure scenarios; or with a direct computation of loss distributions for each individual risk and merging the distributions.

Monte Carlo Method

The Monte Carlo method consists in the simulation of the portfolio with random variables to generate random loss scenarios. The simulation is run several times (generally between 1000 and 10 000 times) to generate a large sample of loss scenarios. Each scenario is characterized by the occurrence of failures in the portfolio leading to a certain amount of claim. The sample generated by the monte carlo method is 10 000 values of total claims generated by the portfolio of risks. This sample can then be analysed to extract the main characteristics of the resulting loss distribution: loss expectancy, loss percentiles, loss variance, etc… An adjustment method can also be used to match the resulting empirical sample with a standard loss distribution (weibull, normal, etc…)

113

The loss value for each scenario is computed by making the sum of the losses for each phase. For each phase the loss is the product of the failure occurrence, the failure severity and exposure at stake. These 3 components are all random and are following a given distribution given in input. The diagram below illustrates the calculation on the loss associated to a given scenario.

Occurence Severity Exposure Model Model Model LAUNCH 1i Si ei 20-30 Launches Σ x x + IN ORBIT TEST 1j x Sj x ej 25-40 IOTs Σ IN ORBIT LIFE + ~100-150 1k x Sk x ek Satellites In Orbit Σ

The occurrence model for each satellite or launcher is based on a Bernoulli distribution with the parameters defined in chapter 3.

The Severity model is used only for satellites and is based on a multimodal distribution defined in chapter 3.

The exposure model is base don a normal distribution matching the historical sums insured seen in the last 20 years for each type of satellite and launch vehicle.

114

5.3 Space Risk Pricing

The premium charged by insurers will be made of a pure premium and a commercial premium.

The pure premium is based solely on the technical risk faced by insurers, itself relying on the historical reliability of the insured risk and the risk assessment of underwriters. The pure premium shall also value the possible correlation between risks.

The Commercial premium is made to cover underwriting fees incurred by the activity and to provide a minimum level of profit to remunerate the risk and ensure a minimum return on equity for its shareholders in a majority of scenarios.

The allocated capital is imposed by the legislation in order to ensure the solvency of the insurance company in high loss scenarios with a very high confidence level. The level of allocated capital is fixed by the 99,5 percentile of the insurer loss distribution. The capital put at risk by shareholder will require certain remuneration by the insurance activity. The high volatility of results will necessitate high return.

VaR 99,5% Capital Allocated Loss Target RoE

Profit Premium Commercial Risk Exposure Loss Expectancy Pure Premium

Claim example 1 Claim example 2 P – C > 0 P – C < 0

115

5.3.1 Pure Premium

The insurance pure premium is based on the insurer’s loss expectancy for a given portfolio of risks. We propose to evaluate the loss expectancy of a standard insurer portfolio with a Monte Carlo model. The purpose of this chapter is to analyse the exposure of an insurer to the payment of claims. The loss distribution of an insurer will be computed considering a standard portfolio of risks in a one year exercise. The portfolio of risk is made of Launch, IOT and IOL risks.

The Monte Carlo method consists in the simulation of the risk portfolio with random variables to generate random loss scenarios. The simulation is run several times (generally between 1000 and 10 000 times) to generate a large sample of loss scenarios. Each scenario is characterized by the occurrence of failures in the portfolio leading to a certain amount of claim. The sample generated by the monte carlo method is 10 000 values of total claims generated by the portfolio of risks. This sample can then be analysed to extract the main characteristics of the resulting loss distribution: loss expectancy, loss percentiles, loss variance. A detailed description of the loss model is given in annex.

The model result is provided below as an example for a typical insurer’s portfolio of risk. We extract from the obtained loss distribution:

• the loss expectancy: which gives the theoretical pure premium of the portfolio

• the 99,5 percentile: which will be the basis for estimating the capital allocation necessary to comply with the solvency legislation.

0,9

P 0,8 r 0,7 o b 0,6 a b 0,5 Loss Expectancy Loss 99,5 %ile i = 625 M€ = 2100 M€ 0,4 l = 1,6% loss ratio = 5,4% loss ratio i 0,3 t y 0,2

0,1

Loss

Figure 43: Typical insurer portfolio loss distribution

The nature of the risks within the portfolio will influence the shape and the amplitude of the distribution. This will therefore have an impact on the pure premium to be charged to the insured and on the capital requirements of the company. This will also influence the expected and probable profitability of the insurance activity for a given level of premium.

116

Sensitivity to the risks correlation

The loss distribution for a set of 150 satellites has been simulated to evaluate the impact of risk correlation on the distribution. The losses related to the portfolio were computed using 2 different models: (i) a loss model with no correlation (independent risks) and (ii) a loss model with correlated risks for satellites from the same family. In case (i) the loss occurrence for IOT and IOL is a Bernoulli with a constant parameter specific to each satellite P_Sat. In the case (ii) the loss occurrence for IOT and IOL is a Bernouli with a parameter P = P_Sat + P_familly where P_familly is random and shared by satellites of the same design.

The result of the simulation is given by the curves below. It shows the aggregate loss distribution function of the portfolio in green for the case (i) without correlation and in red for the case (ii) with correlation.

No correlation 99,5% Correlation Average Probability

+30%

Loss Figure 44: Impact of risk correlation on insurers’ loss distributions

The simulation highlights 2 elements:

• Logically the loss expectancy of the portfolio is the same in both cases since the loss expectancy for each individual satellite is the same in both simulations

• The 99,5th percentile of the 2 distributions is significantly different because it is influenced by the correlation between risks

Indeed, the introduction of risk correlation led to loss scenarios with many satellites losses when a severe generic failure appears. This is impacting the tail of the distribution by making it fatter. The result is a 99,5th percentile which is 30% higher in the correlated case. Concretely, it demonstrates that the necessary provisioning for a prudent insurer willing to cover the complete risk portfolio, would be significantly increased.

The higher risk correlation in the portfolio, the higher capital allocation will be. Consequently with more capital necessary to perform insurance, the commercial fees charged on the insured will need to be increases to maintain the expected ratio of return on capital.

117

Sensitivity to the portfolio size

Due to the quite reduced size of the risk portfolio, the mutualisation of risks is still limited in the space insurance. This incurs an important volatility of underwriting results. We want to highlight the importance of the mutualisation effect for insurers and measure why results are so random in the space industry. In this example, we study the Claim on Premium ratio in 3 cases:

- Standard portfolio representative of the current typical market

- Very large portfolio corresponding to a significantly larger number of satellites deployed (factor 5) in order to analyse what would be the positive impact on the sector of reaching a critical portfolio size

Figure 45: Comparison of P-C distribution vs portfolio size

It demonstrates that for given level of premium, the profit and loss distribution is more favourable with a larger portfolio of risks. The simulation based on the standard portfolio shows a large enough probability to generate profits against a sufficiently low probability to reach extreme loss cases. However, the residual is still significant which explains why market reactions should still be expected to compensate the occurrence of high losses. This phenomenon is even more aggravated in the case of smaller portfolios where the mutualisation effect is less efficient.

Finally, the very large portfolio case gives an illustration of a market with a significantly higher number of risks and mutualisation effect. We have also considered more variety of manufacturers and satellites designs leading a reduced risk correlation proportionally. The impact on the P-C distribution is significant with a residual exposure of negative years which is significantly reduced. Under such conditions, we would expect less dispersion in the market results and therefore less volatility of the corresponding rates.

118

5.3.2 Commercial Premium

The purpose of the commercial premium is to provide an acceptable level of profitability to insurers and absorb underwriting costs. The commercial premium represents the expected profit made by the insurer to remunerate the capital put at risk in the activity.

Considering that the necessary reserves (ie premium + capital) are roughly 3 times the pure premium, it comes: Result = X% * capital = pure premium + commercial premium – claims

By considering the expectancy on both sides, it comes that:

E[Result] = Capital * E[X%] = Commercial Premium and then

Commercial Premium = X% / (1+X%) * 2 * PP

With an expected return of e.g X = 15% on the allocated capital it would give a minimum Commercial Premium level of about 25% on top of the pure premium. The rate history seems to indicate that the commercial mark-up on technical rates is much higher and in the order of 50% in average.

Overall, the technical risks associated to the insurers portfolio is quite stable over the years considering that the risks composing the portfolio are quite similar from one year to the other, which leads to a quite stable pure premium every year. However, we observe strong variations of the insurance rates over the past 25 years, which indicates that the commercial premium charged by insurers is significantly evolving over time and driven by certain factors depending on the market context. The main driving factors in the space market are:

• The competition between insurers which depends on the available market insurance capacity vs the insurance demand from the insureds. The balance between offer and demand will fix the level of commercial markup that can be obtained by the insurers and therefore the remuneration of the capital put at risk.

• The profit objectives from the insurers can also vary over time depending on the global situation of the financial markets but primarily depending on the past performance of the space market which is linked to the insurer’s profit and loss in previous years. In a situation where insurers reserves have been destroyed by important claims, the reconstitution of the capital will necessitates compensation in the future premiums charged.

• Finally, it appears that major events like serial losses or the arrival of new launchers or technologies can change the perception of risk of the insurers and therefore influence their pricing strategy.

We will start with a few observations of the market rates together with the above driving factors in order to check a possible correlation between them. The second step is to derive conclusions from the observation and define the explanatory variable that can be used to explain the premium evolutions.

119

5.4 Market volatility

The market rates evolution described in the previous chapters will be analysed in more detail with the objective to quantify the influence of the underlying factors incurring market volatility. The purpose is to measure the correlations between explanatory variables (capacity, profit objectives) and the evolution of commercial rates.

5.4.1 Impact of offer and demand

The rule of offer and demand is fundamental in the determination of insurance prices. In principle, the more competition between space insurers, the lower the available price, up to a certain limit linked to technical rates and a minimum risk remuneration. We propose to compare the evolution of market rates with the variations of space insurance capacity over time. It appears that insurance rates and market capacity are strongly negatively correlated.

25% 900 L+1 Rate vs Market Capacity

800 25%

20% 700

a 20% 600 15% 500 15%

400 10% 10% 300 Launch+1year Rate Launch+1year

200 Market Capacity (MUSD) 5% Rates Delt Commercial L+1 Insurance Rates 5% Market Capacity 100 0% 0 0% 200 300 400 500 600 700 800 900 2 6 7 1 5 9 91 95 00 04 08 9 99 993 9 99 99 998 0 00 002 0 00 006 0 00 010 1 1 1 1994 1 1 1 1 1999 2 2 2 2003 2 2 2 2007 2 2 2 Aggregate market result (5 years) Years

Figure 46: Rates vs capacity Figure 47: Rates vs capacity cloud

Historical data seems to confirm the initial intuition that the available market capacity has an influence on the space insurance rates. Apart from a couple of isolated points, we observe that the capacity and rates of each exercise are aligned on a straight line. We can note 2 years which are disconnected from the cloud: 2003 which has seen the highest historical rate despite a still important capacity, we suggest as explanation that it was due to the high amounts of claims at the same moment; and 2007 which has seen very low rates compared to the available capacity. This discrepancy is more difficult to explain. Anyway, capacity does not contain all the necessary information to estimate rate variations.

Capacity allocation is decided in insurance companies on a yearly basis based on a number of economical and performance factors and therefore cannot be evaluated in the long run. Entries and exit of actors in the market are also unknown beyond a one year perspective. All in all, we can conclude that it is difficult to predict the evolution of market capacity in the medium term and therefore this explanatory variable is not so useful for rate predictions since it is itself difficult to assess.

120

5.4.2 Impact of market profitability

We have seen that insurers were exposed to significant losses when several claims occur on a short period of time. Insurers’ reaction in such cases is logically to try to compensate losses on the upcoming placements leading to rate increases after important losses. In order to illustrate this phenomenon, we have compared the evolution of premium rates versus (i) the aggregate market profit along the last 5 years, (ii) the market P&L at the N-1 exercise.

(i) It appears that rates and past profitability (5 years aggregate) look quite obviously correlated.

25% 2500 16% 2000 20% 14% 1500 12% 1000 15% 10% 500 8% 10% 0 6% 2001 2008 Launch+1year Rate

-500 Commercial Rates 4% 5% L+1 Insurance Rates Market years Profit 5 (MUSD) -1000 2% 1999 Market 5y profit 1998 2000 0% -1500 0%

7 8 0 0 -1500 -1000 -500 0 500 1000 1500 2000 2500 91 93 9 9 99 0 01 02 03 04 05 06 07 09 1 9 0 0 0 19 1992 1 1994 1995 1996 19 19 19 20 20 20 20 20 2 2 20 2008 2 20 Years Aggregate Market Result (5years)

Figure 48: Rates vs aggregate profit Figure 49: Commercial Rates vs aggregate profit cloud

The period 1999, 2000 and 2001 shows 3 points which are far from the main cloud of points, it seems that the average rates offered in these years were abnormally low. This could be explained by the very high amount of capacity at the time leading to an important competition and pressure to offer low prices despite important losses at the same moment.

(ii) On the contrary, the correlation between yearly P&L and rate evolution is not so obvious. We observe rates increases after the occurrence of very negative years, but this phenomenon tends to be soften by the competition pressure. Similarly profitable years tend to lower prices but this is not systematic especially if the market capacity is reducing or when a prior important shock is not yet fully absorbed.

1000 25% 6% 800 Profit & Loss Rates evolution 2002 4% 600 20% 2003 a 400 2%

200 15% 1999 0% 0 -1000 -800 -600 -400 -200 0 200 400 600 800 1000 1 2 3 5 6 7 8 0 1 2 3 4 5 6 7 9 0

9 9 0 0 0 0 rates L+1y -200 99 99 00 00 01 10% 19 1 199 1994 19 1 199 199 1999 20 2 200 200 20 20 2 200 2008 20 2 -2%

-400 Delt Rates Commercial Market Loss & Profit (M US$) -4% -600 5% 1998

-800 -6% M arket Result N-1 -1000 0%

Figure 50: Rates vs aggregate profit Figure 51: Commercial Rates vs aggregate profit cloud

It highlights the facts that a multi year approach on market profitability is more suitable to explain rate evolutions. Historical figures also reveal that the market profit and loss is not explaining alone the rate variations and a lot of uncertainty remains.

121

5.4.3 Other factors

On top of the driving factors we have just presented, some other elements can also influence the determination of rates.

The failure of major launch vehicles on which strongly the space industry relies (and consequently on which depends a large share of the premium that can be made by space insurers), is also of great importance. Indeed, beyond the immediate loss that those launchers represent if they fail, the uncertainty on their return to flight after the failure puts some concerns on a large part of the expected premium income by the market. This double pain can incur a strong reaction from the market in case of premium shortage.

The overall technical risk that is faced every year by insurers is also influencing the rates. We might consider that overall the technical risk level is quite stable over the years but this might not always be true. Notably, when considering the deployment on new generation satellites or launchers the risk level is increased which of course influences the corresponding rating. Analysis the technical risk of insurers portfolio is feasible, so this component can be partially taken into account in rates estimates. However, the perception of the risk can also fluctuate in periods of low and high claims which is reflected in rates. This phenomenon is almost impossible to capture.

5.4.4 Rates forecast and volatility

Based on the analyses run in previous chapters, linear regressions have been performed on several explanatory variables among which previous rates, aggregate results, last year result, occurrence of major launch vehicle losses, occurrence of serial losses, technical risk level. It was possible to obtain satisfactory regressions putting lights on the past evolution of rates but it was never able to fully explain all the variations in a single model. Besides this is not possible to encapsulate all the complexity of this market in a model so there will always be by essence a residual random component preventing a more accurate anticipation of market reactions.

We have seen as well in previous parts that explanatory variables were also difficult to predict in the future (like market capacity) and therefore were of limited interest for rate predictions. On the other hand, the loss ratios of insurers’ portfolio and the associated profitability is extremely volatile itself and therefore given the high dispersion of the explanatory variables which tend to explain rates evolution, the prediction of rates in the future is logically reaching a high dispersion very rapidly.

It is also important to notice that the above analysis is limited to the estimation of average rates over one year and therefore the actual appreciation of a particular risk by the market might be above or below this average value which adds an other difficulty (and source of error) when trying to appreciate the expected rate obtainable for a given satellite.

The general conclusion of this exercise is to confirm that:

- rates evolution can be explained a posteriori by market forces (competition, P&L, profit objectives) in a satisfactory manner, but

- rates predictions are impossible a priori in the medium term due to the high volatility of explanatory variables incurring a quick dispersion of rate estimates but also considering the high complexity of the rate determination by the market

122

5.5 Conclusion

A complete premium pricing model has been evaluated based on

¾ the calculation of the risk portfolio loss expectancy for the pure premium

¾ the understanding of the allocated capital necessary for the activity

¾ an analysis of explanatory variables for the level of the commercial premium

Important capital allocation intrinsically linked to the nature of the activity and the spread of the loss distribution necessitates high return and thus important commercial mark-ups.

Nevertheless, considering the quite limited number of risks insured, the mitigation effect is still reduced and incurs a high volatility of underwriting results which translates into strong market reactions to compensate incurred losses.

Under such conditions, the market rate evolution is almost impossible to predict beyond a certain time horizon and can translate into important cost increase of risk management for the insured.

However, the insurance market allows risk transfer for very high amounts at an acceptable price for the insured and is therefore an important tool of risk management for the space business actors.

123

124

666... CCCaaassseee SSStttuuudddyyy::: SSSpppaaaccceee AAAccctttooorrrsss

125

6.1 Introduction

This chapter will now focus on the satellites manufacturers and operators which are in direct relationship to build and operate satellites.

Both types of companies are exposed financially to the loss of satellites. Consequently, the management of space risk is of key importance for these companies. The first step in the management of space risks is to compute and measure accurately the impact of satellite losses on their business in order to appreciate properly the risks. The second step is to define a risk management strategy that is optimized and financially efficient. Notably, trade offs between risk retention, mitigation and transfer have to be dealt with precisely. This analysis will also contribute to the definition of satellites to be insured on the space market and to dimension properly the sums insured.

We will first analyse the case of a satellite manufacturer who is exposed to the underperformance of the satellites products sold to operators. It is facing risks linked to satellites of a same family with an important risk of serial defect. The penalty schemes associated to satellites underperformances are generally sensitive to minor underperformances and can therefore be triggered rapidly. However, the total amount of penalties per satellite remains sufficiently low and homogeneous to allow risk retention strategies.

We will then analyse the case of satellite operators notably focusing on the one hand on new operators developing new business areas and on the other hand on large leading companies owning a very important satellite fleet (generally in the telecommunication field). Operators have more heterogeneous fleets procured from different manufacturers which limit somehow their exposure to serial losses. However they are still exposed to that risk having several satellites of the same platform and generation. Exposure to losses is related to financial objectives of the company and therefore the risk appetite of the operator will drive its risk management strategy. Overall, amounts at risk are the full satellite replacement value which incurs high severity losses, for which a retention strategy requires high reserves and margins.

126

6.2 Satellite Manufacturer

Through its contracts (commercial, institutional, military), satellite manufacturers accept a certain financial risk for the performance of their products after delivery. This can be through an incentive scheme (partial payments deferred throughout the product lifetime) or warranty paybacks (ongoing obligation to reimburse client in case of failures). In both cases, such In Orbit Incentive scheme failures or underperformances on a satellite will lead to financial losses. Modelling the exposure related to such penalty scheme is important to measure the probable loss scenarios and support decision on the most appropriate strategy to cover that risk in a financially efficient manner.

6.2.1 Risks Overview

The In Orbit Incentives schemes are made to penalize the manufacturer for the poor performance of its products and have therefore some specificity linked to that purpose.

Penalty Risk Profile

The exposure profile is decreasing over time and Nominal Lifetime generally in 2 steps: IOA exposure (i) In Orbit Acceptance exposure which is linked to the proper spacecraft deployment and test, IOI exposure with a significant risk reduction step if the satellite is deployed correctly, and

(ii) (ii) the In Orbit Life where the risk is slowly decreasing with time. It happens that some contracts have no IOL risks. The launch phase is excluded since unrelated to the satellite performance.

One should note that after delivery of the product to its customers, the manufacturers are liable for a long period of about 15 years per satellite since it should cover the complete satellite design life without any possibility to escape. Such a long term risk in the manufacturer portfolio requires a model of events not only during a year period but during the complete satellite lifetime.

Moreover, the abnormal behaviour of the satellite can occur if a system is partially damaged or underperforming, consequently specific models have to be developed to match the observed satellites underperformances. Finally at some point in time, the manufacturer should be able to model the loss probability of an underperforming or damaged “sick” satellite.

Loss Formula

Each satellite contract has a specific “incentive” scheme (penalty scheme) that is detailing the relation between satellite technical underperformances (or mission losses) versus the associated penalties charged on the manufacturer. The sensitivity of the financial losses in the risk model must be adapted to the contracts specificities which can vary from one contract to the other. An in depth contract review is necessary to match the liability imposed by the customer.

127

However, many In Orbit Incentives schemes are based on the following principles:

Performance Losses above 25% will 100% generally lead to a complete loss of incentives

Such a scheme is very stringent compared to the actual mission loss of a satellite (which is the insurance standard) 25% Satellite technical Loss of lifetime will incur a proportional loss losses of incentives.

Mission outages can also be penalized under some contracts which necessitate modeling also outages and their financial impacts (due to payload interruption or platform orientation reconfiguration)

Overall IOI schemes show very stringent triggers which are different from the insurance policy standards.

Amounts at risk

The typical penalty for a given satellite is 10%-20% of the satellite price. This corresponds to approximately a maximum exposure between 5 M€ and 50 M€.

Within a given satellite category, amounts at risk are:

Homogeneous and incurring no peaks of risk which would unbalance the portfolio

Sufficiently high to degrade severely the company result in case of failure occurrence

Sufficiently low so that a single satellite loss can be sustained without terminating the company

Risk Nature

The particularity of the risk is that:

- all the satellites have a similar design (bus family)

- are manufactured in the same factory with a certain level of quality

- are using components from the same manufacturer or same batch

There is a low diversification of the risks and therefore the main threat is the occurrence of serial losses. The modelling of defect failures potentially affecting several satellites at the same time is particularly important. Potential serial losses create a risk correlation between satellites which must be taken into account in the risk management strategy. The detailed knowledge of its satellites series allows the manufacturer to define properly satellites families with a close design or made of same equipments batches where serial losses can occur.

128

6.2.2 Manufacturer Risk Model

The model is using the Monte Carlo principle: it generates random loss scenarios for a given satellite portfolio and collects several outputs for each scenario. The set of collected outputs gives a data sample which is used to make statistics.

6.2.2.1 Model Architecture Overview

A complete model has been implemented to simulate the financial risks related to the manufacturer satellite portfolio. The model is composed of:

- the exposure profile for each satellite of the portfolio based on the contractual incentive scheme in place and the mission profile over time

- reliability predictions incorporating the in orbit feedback of each satellite component

- a simulation of failure events being Total Losses, Partial Losses or Outages during each phase of a satellite life

A simulation core will generate random failure scenarios based on the above elements and generate statistics using the Monte Carlo method.

The model outcome will be the distribution of financial losses related to the satellites incentives schemes. Different scenarios of coverage can be simulated which have an impact on the residual exposure to this risk.

FleetMission Profile Incentivesprofile In-orbit Feedback Reliability Costing Modelling

Reliability Prediction Feedback Feedback Lifetime

Outputs

Probability

Risk

Cost Provision

129

6.2.2.2 Simulation

A typical portfolio of satellites will be used for the simulation with the following characteristics:

~4 satellite launches per year with a 3 years backlog, ie 12 satellites sold with In Orbit Tests penalties within the exposed portfolio

30 satellites at risk in orbit, with a residual lifetime between 1 and 15 years, with a total aggregate satellite lifetime about 320 satellite.years. The satellites are classified in 6 families depending on their design, generation, and production period.

The exposure per satellite is typically 10 M€ on the first quarter after launch, then ~200 k€ per quarter afterward (12 M€ spread over the satellite lifetime)

SAT1 SAT1 SAT2 SAT2 SAT3 SAT3 SAT4 SAT4 SAT5 SAT5 SAT6 SAT6 SAT7 SAT7 SAT8 SAT8 SAT9 SAT9 SAT10 SAT10 SAT11 SAT11 SAT12 SAT12 SAT13 SAT13 SAT14 SAT14 SAT15 SAT15 SAT16 SAT16 SAT17 SAT17 SAT18 SAT18 SAT19 SAT19 SAT20 SAT20 SAT21 SAT21 SAT22 SAT22 SAT23 SAT23 SAT24 SAT24 SAT25 SAT25 SAT26 SAT26 SAT27 SAT27 SAT28 SAT28 SAT29 SAT29 SAT33 SAT33 SAT32 SAT32 SAT30 SAT30 SAT31 SAT31 SAT34 SAT34 SAT35 SAT35 SAT36 SAT36

2 3 9 5 6 1 2 7 8 98 -04 05 -10 11 -17 -23 -29 -30 v.- v.-99 v.-00 v.-0 v.-0 v. v.- v.-06 v.-0 v. v.- v.-12 v.-1 v.-1 v. v.-18 v.-19 v.-2 v.-2 v. v.-24 v.-25 v.-2 v.-2 v. v. n n n n n n n n n jan jan jan janv.-01 ja ja jan jan jan janv.-07 janv.-08 ja jan jan jan janv.-13 janv.-14 ja ja jan jan jan janv.-20 ja ja jan jan jan janv.-26 ja ja jan jan Figure 52: Incentive Satellite Portfolio

Stochastic risks are generated by using the models defined in the Chapter 3:

o IOT failure with a distinction between random failures and generic defects which are common to each satellite family. The failure severity is considering an incentive total loss if the satellite has a loss ratio above 25%, and a 20% incentive loss for each satellite partial failure.

o IOL failure with a distinction between random failures and generic defects which are common to each satellite family. The Time To Failure (Total or Partial) is computed for each satellite based on the defined satellite life curve.

o Outages: are modeled with a Time To Failure model where several occurrences can happen in the satellite lifetime. Each outage incurs a complete incentive loss for the quarter when it occurs.

130

6.2.3 Manufacturer Gross Exposure

The Monte Carlo model generates a data sample for the financial losses incurred by IOT failures, IOL failures and outages. The sum of all losses also constitutes a data sample.

The resulting distribution for all losses is given in the plot below. We observe an asymmetrical distribution spread on the right with a loss expectancy E = 30 and a standard deviation Sigma = 32

In Orbit Incentives - Loss Distribution

0 102030405060708090100

Figure 53: Incentives Portfolio Loss Distribution

A first solution consists in approaching the distribution with a weibull distribution using the least squares adjustment method. The adjustment is given below together with the QQ plot.

0,025 QQ Plot MC vs Weibull 1 Monte Carlo Result 0,9 0,02 Weibull Adjustment 0,8 0,7 0,015 0,6 0,5 0,01 0,4 0,3 0,005 0,2 0,1 0 0 0 20406080100 0 0,1 0,2 0,3 0,4 0,5 0,6 0,7 0,8 0,9 1

Figure 54: Incentives Loss Distribution Adjustment Figure 55: QQ Plot MC Result vs Weibull

The adjustment is smoothed compared to the original distribution where peaks are visible. The KS test rejects the adjustment due to the large discrepancy between the 2 curves at 20 M€.

131

An alternative solution is to model separately the IOT failures and the IOL failures which present very different distributions: indeed the IOT failure has a modal distribution with peaks corresponding to the number of satellite IOT losses. On the contrary the IOL exposure is more smoothed and spread, as shown in the graphs below.

0,3 0,050 0,045 0,2 0,040 0,035 0,2 0,030 0,025

0,1 0,020 0,015

0,1 0,010 0,005

0,0 0,000 0 0 10 20 30 40 50 60 10 20 30 40 50 60

Figure 56: IOT Losses Figure 57: IOL losses

The overall distribution will be a weighted sum of elementary distributions. The proposed modelling and the respective weight of each elementary distribution is given below. The weights are computed by taking the ratio of each failure loss expectancy with the global loss expectancy of the portfolio.

Failure Mode Distribution Weight IOL Losses Truncated LogNormal* E(IOLLoss)/E(Loss) = 57% IOT TL losses Binomial E(IOTTL)/E(Loss) = 33% IOT PL losses Binomial E(IOLPL)/E(Loss) = 10% (*) the lognormal distribution is shifted to negative values and therefore must be truncated at zero to be representative of the risk. The fit of the lognormal distribution is obtained with a least square estimation.

The diagrams below show the resulting modelling compared to the Monte Carlo model result. It shows that the modelling is improved with a better match of the distribution modes. However, due to the approximation done on the IOL loss distribution, the resulting modelling is not exactly matching the original distribution.

0,025 1 0,9 Monte carlo 0,020 0,8 Adjustement 0,7

0,015 0,6 0,5 0,4 0,010 0,3 0,2

0,005 0,1 0

0,000 0 0,1 0,2 0,3 0,4 0,5 0,6 0,7 0,8 0,9 1

Figure 58: Incentives Loss Distribution Adjustment Figure 59: QQ Plot MC Result vs Adjustment

132

6.2.4 Coverage Optimization

The main objective of the presented model is to be able to define different risk management solutions and to assess their performance in terms of risk coverage and financial efficiency.

The solutions envisaged in this chapter are: (1) A complete risk transfer (2) A complete risk retention (3) An intermediate solution with retention up to a certain level and insurance beyond the threshold.

6.2.4.1 Full Risk Transfer

A full risk transfer on the space insurance market is possible. Due to the sensitivity of the risk triggers, the overall risk will be perceived as high and would incur quite significant premium budgets. The insurance coverage needs to be renewed each year and shall cover a 12 month period each time. This strategy makes the company exposed to the insurance market rate variations.

In case of a severe failure occurring on one satellite, insurers might exclude some risk of the covered perimeter during the successive renewals, which would still have to be supported by the manufacturer.

The full coverage solution does not look financially attractive in a situation where the portfolio is sufficiently large to allow an important mutualisation by itself. On the contrary, in smaller portfolios where the risk mutualisation is low, insurance would certainly be the most appropriate solution, isolated risks being efficiently mutualised by the insurer.

6.2.4.2 Full risk retention

The simplest strategy which can be considered by the manufacturer is a complete retention of the risk. In such a case, the manufacturer will gather a provision used to absorb financial losses which might be generated by the portfolio. It is a prerequisite to guarantee the financial robustness of the company in front of accounting auditors therefore, the dimensioning of the provision must be sufficient to cope with a majority of failure cases.

Incentives Risk - Provision

0 102030405060708090100

Figure 60: Provision level vs exposure

133

■ The above chart illustrates a manufacturer provisioning strategy which is based on a coverage of 90% of the failure cases. The provision will be equal to the 90th percentile of the failure distribution.

In case the performance of the fleet is high and creates few losses, the amount of the provision can be released as profit or used to cover the risks of the new project acquisitions entering in the portfolio. Therefore, with such a scheme, the manufacturer will fully benefit from the performance of its satellites. In average, the manufacturer will recover an important part of the provision.

In case of failure occurrences, the internal provision will be used to compensate the losses. If very high losses occur, the provision must be reinstated to maintain a sufficient coverage level for potential future losses.

■ In case of major losses, the impacts will be fully born by the company. This brings an additional question to ensure the viability of such a scheme, the manufacturer should be able to absorb important losses and still keep sufficient reserves to overcome future losses.

If a single loss occurrence can completely consume the provision, the company will be in a difficult situation wrt to potential future claims and will be obliged to regenerate its provision to comply with prudential rules. Such a situation would be impossible to manage since unexpected costs might be incurred by the company with a too important probability.

The provision must be dimensioned at a level allowing probable losses to be absorbed without an immediate refill. In such a case the company can use part of the provision to compensate immediate losses while keeping a provision level compatible with the residual exposure. For example, the fund must be able to absorb a single satellite failure (probability in the order of 5%) without an immediate refill. With the progressive reduction of risks with time, the provision would also progressively cover a larger scope of risks. Besides, excessive usage of the provision beyond the accepted levels could only be incurred by low probability events (e.g a series of large claims in a short time frame) which strongly limits the probability to be obliged to refill the provision.

The charts below illustrate this question with 2 cases:

• In the first example the provision level represents almost 250% of the maximum loss suffered in case of a single loss occurrence. This provision is able to absorb major shocks without requesting a complete and immediate refill of the provision. This can be managed in the long run since the probability of occurrence of 2 major losses in a short time frame is much lower.

• In the second example, the provision level is only about 120% of the maximum loss suffered in case of a single loss occurrence and thus does not show enough margins wrt the portfolio loss expectancy. Indeed a major single loss occurrence which is still quite probable (e.g a satellite total loss at IOT) would completely empty the provision.

134

Incentives Risk - Provision 0,12 Financial Shock in case of single loss 0,10

0,08 percentile

Reserve for 0,06 Loss Target financial shocks Loss Expectancy

Loss Expectancy 0,04

0,02 Minimum capital Additional capital Additional allocation allocation Minimum capital capital

percentile allocation Target Loss Target allocation 0,00 0 2 4 6 8

0 102030405060708090100 10 12 14

Figure 61: Provision with reserves Figure 62: Provision with no reserve

■ As a conclusion, we have observed that a full risk retention strategy can be a suitable solution where risks are sufficiently homogeneous and where the size of the portfolio is sufficient to mutualise risks efficiently. In that case, risk retention seems a very efficient solution. However, extreme loss scenarios would still remain an issue leading to unforeseen costs for the company.

Medium size portfolio can be managed also with a provisioning scheme; however exposure peaks could bring the provision to unacceptable levels and would not be that efficient. To make it short, the provision would be a one shot solution suitable to absorb a single event but unable to handle multiple failures or exposure peaks.

6.2.4.3 Mixed Solution: XS Coverage

To overcome the limitations of the full risk retention, insurance could be used to implement a stop loss and maintain the financial risk born by the manufacturer below a given threshold. The main idea for the insured would be to hedge extreme cases with insurance while supporting losses below a given threshold with a provision.

Stop Loss Coverage

The XS coverage solution could be implemented on the satellite risk portfolio for a period of 4 years. The corresponding gross exposure is illustrated by the graph below:

Weight of scenarios above the XS levels 40% 46% above XS 20 M€ 35%

30% 23% above XS 30 M€ 25%

20% 12% above XS 40 M€ 15%

10%

0% 0 102030405060708090

Figure 63: XS coverage

135

The red part corresponds to the retention level by the company and managed with a 100% provision. The blue part would be covered with an XS insurance, the level of which can be fixed at different levels depending on the risk appetite of the company and the target retention level. The XS coverage can be envisaged in this example for a threshold of 10M€, 20 M€, 30 M€ and 50 M€.

The proposed premium estimation for the XS insurance is based on the insurer pure premium plus the cost of allocated capital remuneration. We have thus computed the loss expectancy for the insurer 4 years portfolio including the deductible (the XS level) for each case, to derive the pure premium. In addition, calculate the 99,5th percentile of the insurer portfolio which is used as reference to dimension the requested allocated capital. A 5% yearly profit is expected on the allocated capital and 10% fees on the global premium.

This leads to PMarkup = (Capital – Loss Expectancy – PMarkup) * 5% * 4 Î PMarkup = 20% * (K - E) / 120% Î and Commercial Premium = 110% * (Pure Premium + PMarkup)

The results are summarized in the table below:

XS 10 M€ XS 20 M€ XS 30 M€ XS 40 M€

Loss Expectancy (E) 12 M€ 6,7 M€ 3,2 M€ 1,5 M€

Loss 99,5%ile (K) 65 M€ 55 M€ 45 M€ 35 M€

Premium (P’) 23 M€ 16 M€ 11 M€ 7,5 M€

Tableau 15: XS premium calculation

Finite facility

The principle of the stop loss has been explained and shows that the risk retention below a given threshold must be managed by the manufacturer which necessitates the management of a reserve and also triggers some accounting and fiscal questions. A more advanced structure can be implemented to manage both the retention and the XS coverage in the same facility.

The finite facility solution is based on the following principles:

The insured takes a risk retention up to a certain level A, the corresponding amount A is provisioned in a dedicated fund managed by the insurer

The insurer takes a risk in XS of the insured retention A and pays all claims to the insured using the fund up to the limit A and with its own money above the limit A. A fixed premium is charged to the insured to cover that risk.

In case the total amount of claims is below the limit A, the insured can recover the unused cash within the fund. In case the total amount of claims is above the limit A, the insured is covered by the fund up to A and by the insurer above A

136

Capitalization XS premium Interests

Insurer Finite Fund Funding Reserve

Yearly Premium

Payment of Claims Payment of Claims above A (XS) below A Insured

No Claim bonus below A Figure 64: finite facility description

The implementation of such facility is done according to the following steps:

The insured pays to the insurer a yearly fixed fee in order to

o Fill in the fund

o Pay a premium to the insurer for the XS coverage

The fund is managed by the insurer and generates interests. In case of a claim the insurer can draw cash from the fund to indemnify the insured

At the end of the coverage period, the residual fund (if any) is paid back by the insurer to the insured with interests

A detailed example is given in the below:

The level of retention taken by the insured is put at 20 M€. This amount will be paid to the insurer through a quarterly payment of 1250 k€. The Insurer will provide a coverage in XS 20 M€. The premium charged by the insurer will be computed as: the insurer loss expectancy (E) + the cost of allocated capital necessary to cover the insurer solvability (99,5%ile) (K) + a commercial markup (C). The premium is estimated at 12 M€ and will be paid by the insured on a quarterly basis with an amount of 750 k€. The diagrams below illustrate the cash flows between the insurer and the insured in 2 scenarios.

20 000 20 000

10 000 10 000

0 0

-10 000 -10 000

Premium Loss in Fund refill A Capital Premium Loss in Fund refill A Capital -20 000 -20 000

Failure Scenario 1: Losses below average Failure Scenario 2: Losses above average

137

In this case we see 3 failures occurrences with an aggregate In this case, we have 4 failure occurrences. The first 2 are not loss below the provisioned amount. The insurer will manage high enough to empty the reserves and are compensated with the financial gaps necessary to pay for the losses and at the the fund however the next 2 failures are in aggregate higher end of the period the balance of the provision will be return to than the total provision and necessitate a direct compensation the insured. by the insurer.

The interest of such a facility compared to a standard XS coverage is that both the provision and the XS are managed by the insurer. It allows notably to take benefit of the capitalization of the provision to improve the no claim bonus received by the insured in low losses scenarios. Besides it allows the insured to put its risk management completely out of its balance sheet.

Overall, the stop loss and finite facilities provide a more expensive solution, but an improved coverage. The choice to include such facilities will depend on the risk appetite of the manufacturer wrt to its fleet performance and also on the financial reserves available within the company.

6.2.5 Synthesis

Satellite Manufacturers are exposed to significant risks related to the performance of their delivered products in orbit. Due to the large size of the satellite fleets, the financial exposure related to satellite underperformances and failures can be modelled as a risk portfolio and measured by estimating the probability distribution of the financial losses.

Different risk coverage solutions have been envisaged from the complete risk transfer up to the complete risk retention. The full risk retention is very efficient for large homogeneous portfolios where the mutualisation effect is working. On the contrary it cannot be envisaged for smaller or unbalanced portfolios. Risk transfer is appropriate when risks are more isolated and cannot be efficiently mutualised.

Intermediate solutions using a Stop Loss coverage and a finite facility shows an interesting solution to hedge extreme risks while making important savings when the fleet performs well.

138

6.3 Satellite Operator

The Business model of satellite operators is to procure and operate satellites to sell services, generally telecommunications pipes or earth images. In general, operators accept satellites deliveries on ground and assume all risks of loss during launch and in orbit. This leads to important amounts at risk in case of satellite failure due either to loss of business / revenues or unforeseen cost of satellite replacement.

Operators need to make important investment to procure satellites and will expect a certain level of Return on Investment to remunerate that investment and the associated risks. The operators’ satellite fleet and future deployments constitute a portfolio of risk measured in terms of loss of company EBIT or loss of Return on Equity (RoE). The main question faced by operators is their capacity to absorb losses and their EBIT objectives and how to protect it from satellite failures.

6.3.1 Operators Overview

Operators can address different businesses from the very developed commercial telecommunication for TV broadcast to the niche or local market in mobile telecommunications or satellite imagery. They can also have different sizes going from a startup company with a single satellite or a couple of spacecrafts deployed over time to the large telecom operators with fleets of 10 to 50 satellites.

This part is made to give an overview of the business model of the main type of operators.

6.3.1.1 Single Satellite Projects

Let’s first consider a 1 satellite project. The typical example is a new space company or a newly created joint venture willing to start business in a new business area or geographical place (local operator).

It is generally made of a manufacturing and a deployment phase where the operator will invest capital to procure a satellite and a launch vehicle to put the satellite in its orbit. The second phase is the operational phase where the operator will exploit the satellite, which incurs a regular OPEX spending to operate the satellite and to sell its capacity to the final customers. In the operational phase, a revenue income is expected from customers to cover the OPEX spending and also repay the high investment in the satellite and generate profit.

Aggregate Cash Flow Revenues

OPEX

CAPEX Satellite Operational life time

Deployment phase Operations phase

Figure 65: Single Satellite Project

139

The company financing is generally a mix of equity from capital riskers or investors and debt from banks. In case of failure of its unique asset, the company is exposed to a complete termination. In such case the outstanding debt must be reimbursed and the equity put at risk might be lost.

The business financial performance can be measured in terms of Net Present Value (NPV) of the company cash flows or in terms of Internal Rate of Return which corresponds to the actualisation rate I for which the project NPV is zero. This represents the profit margin that is made per euro invested in the business. In the telecommunication world, the typical break even for a single satellite project is around 3 to 5 years after launch. The operator would also generally expect an overall Return on Investment between 15% and 30% of IRR. In the other business lines, revenue and profitability expectancy is generally more reduced with an IRR in the order of 10% to 20%.

6.3.1.2 Multi satellite project

When it comes to address a larger business, the fleet to be deployed and operated will necessitate several satellites. This is also generally the case for new operators who need more space assets to have a more robust revenue stream.

In such a situation, the project deployment phase is longer and involves a CAPEX investment in several satellites, and an operation phase with a service ramp up until full capacity is reached. The company cash flows are presented below.

Aggregate Revenues Cash Flow

OPEX

CAPEX

Satellites Operational life time

Deployment phase

Operations phase

Figure 66: Multi Satellite Project

The higher investment will necessitate additional funding from banks and equity providers putting more pressure on the expected return on investment. However, larger fleet with a physical assurance of the service gives by nature a more robust situation.

It is also quite frequent to implement Public Private Partnerships with institutional bodies to develop new services. In this frame, a specific risk sharing can be implemented with the project customer in order to transfer part of the space risks or to access public funds.

140

6.3.1.3 Fleet Operators

Finally, well established operators also exist and operate large satellite fleets. The business model of large operators will be based on a sum of satellite projects spread over time. The satellite deployment strategy aims at maintaining a fleet of satellites with a progressive renewal of satellites in orbit when older satellites reach their end of life. There must be an appropriate overlap of satellites to have a smooth and continuous sellable capacity level and avoid service gaps.

1 500,0

1 000,0

500,0

0,0

-500,0

Revenues Fixed Costs Variable Costs Depreciation EBIT

-1 000,0 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020

Figure 67: Operator Nominal Fleet Figure 68: Operator Nominal Cash Flows

6.3.2 Business Model

This part gives a more detailed overview of the business plans and company cash flows of operators and how it has been modelled to generate scenarios with random failure occurrences.

Financing

The financing of CAPEX can be done with a mix of debt and equity, typically with a gearing of 80/20, in order to improve the profitability for equity providers. However, there is a need to reimburse the loans which necessitates a minimum revenue level to guarantee that banks can be reimbursed. Banks would also generally expect financial protection (notably insurance) to guarantee such debt repayment with a very minor risk. Equity providers would accept a higher level of risk against a higher remuneration perspective, but would still require a minimum return on investment with a sufficient level of confidence. These aspects will drive the operator risk appetite and risk management strategy.

Market Risk

The operator is also subject to market risk, that will incur uncertainty on the revenue level even of the satellite is fully performing. This risk will not be addressed directly in this study. However, we shall consider in the risk management strategy that the operator needs to maintain a certain level of sellable capacity (and consequently enough satellites) to keep its commercial position vis à vis its customers by a presence on the market.

141

Calculation of the company financial indicators

As mentioned previously, the risk management strategy will rely on the piloting of the company financial indicators. We propose the following key indicators and definitions:

Earnings Before Interest and Taxes (EBIT): profits generated by the company based on the sum of revenues and costs incurred by the business including the depreciation of the company assets

Return on Equity (RoE): net company profits generate by the business which can be distributed to the company shareholders.

Loss Model and Results

A company business model has been simulated and reflects the impact of satellite launches and failures on the company revenues, asset depreciation, operating costs, insurance costs, financing of the activity with either equity or debt, cash position.

The company performance is measured with the resulting RoE which can be distributed to the shareholders over a 10 years period.

A complete operator business model has been setup to simulate the impact of a satellite failure on the business plan and the company financial indicators

The model simulates

- Occurrence of risks: launch failures and in orbit life failures

- Fleet status and corresponding service level in transponder per year

- Cost and revenues profiles + CAPEX investments

- Company P&L and cash flows

EBIT, Net Result, Free Cash Flow, Shareholder cash flow

Book value, depreciation

- Company financing

Equity, shareholder dividends, cash balance

Debt drawdown and reimbursement (Debt / Equity ratio management)

- Financial indicators for shareholders: RoE

Risk Management Strategy

We define a simple risk management strategy is case of failure occurrence which determines the reactions of the operator for each failure case, it is described below. Alternative schemes (more complex) might be envisaged but they will not be addressed in this paper.

The objective of the operator is to maintain an appropriate service level in term of transponders to be able to serve his customers. The exposure of the operator is two fold: On the one hand, if a satellite is replaced by a new one, this will incur an important unforeseen CAPEX investment. On the other hand, a satellite failure will incur a service reduction and thus a reduction of the company expected

142

revenues. It generally takes 3 years to procure and launch a replacement satellite; therefore, there might be a capacity shortage and loss of revenues in the replacement period. If a total satellite loss occurs in the last years of the satellite, the capacity and commercial impact will be more reduced since a new generation will compensate the lost capacity more rapidly. In case of partial satellite loss, the satellite will not be replaced and the loss of capacity might incur loss of revenues except if the operator has sufficient spare capacity on the fleet.

failure

Lost service Replacement satellite Capacity shortage

Active satellites

Timeline

In case of a satellite failure, the risk management strategy adopted in this simplified exercise is to procure and re-launch a satellite in case of Total Failure. Satellites beyond 10 years of in orbit life are not replaced in case of failure.

Satellite failures will incur a significant EBIT impact on the year of the incident (immediate depreciation of the asset book value) and lower revenues over the coming years until the satellite is replaced. The satellite replacement will also incur an additional CAPEX investment which must be financed by the company.

Overall, additional costs translate into a degradation of the company profitability. While the minimum profit necessary to honour the company debt shall be maintained in any case, the profitability beyond a given threshold to remunerate equity providers, is put at risk and burnt in case of loss occurrence or compensated by insurance. This will depend on the risk appetite of equity providers.

Monte Carlo Model

The following diagram illustrates the Monte Carlo model developed to simulate random RoE scenarios

Cost and revenue hypothesis

Risk Operated Fleet (random) Company cash flows Outputs

Reliability Prediction RoE Risk Minimal RoE Coverage

143

6.3.3 Risk Management Strategies

We have seen in previous chapters that satellite operators where subject to high risks due to the large investment realized to procure their assets and due to the important return expected from the satellite business to meet their profitability objectives. We will now analyse the risk management strategies available to operators to protect their investment and profit objectives. We have developed an actuarial view point where the impact of a coverage scheme is measured and quantified with a financial indicator distribution.

Depending on the operator size, the mutualisation possibilities and robustness to failures will differ. We have run a specific analysis for different types of operator and derived a risk management strategy trade off which is specific to their problematic. We distinguished mainly 2 cases (a) small medium size operators with a limited mutualisation power and (b) large operators with important fleets.

6.3.3.1 Small / Medium Size Operators

In this chapter, we will analyse the problematic faced by small and medium size operators, ie with a satellite fleet between one and 5 satellites. The result generated by such companies is very sensitive to the fleet health and the risk of company bankruptcy is not negligible due to the reduced number of assets. The performance will be measured in this case with a Net Present Value of the investment in the company.

■ The case of a single satellite operation is quite simple to address. Indeed with a single asset to launch and operate, the failure of such asset immediately leads to the business termination. Therefore the complete investment made by the company is put at risk with quite a high probability which leads to consider with no other choice to insure the satellite. Except for institutional or scientific operators, the investment made cannot remain with no coverage. In a majority of cases, where the company is sponsored by private companies, an insurance coverage is expected and can take several forms. The main insurance protections which can be envisaged are the coverage of the totality or part of the initial investment, possibly with a minimum return on investment; or the replacement value of a new satellite made to continue the business if an interruption period of the underlying service is acceptable

■ Important risk retention is still difficult for small operators with a multi satellite constellation; where a single risk occurrence might destroy the entire company profit or where a complete business termination could still occur with successive satellite failures. The diagram below gives an illustration of a 4 satellite company investment NPV distribution considering the possible loss of satellites.

Figure 69: Project NPV without insurance

144

The NPV is computed with all the company cash flows and basically with CAPEX, OPEX, Revenues and financial fees. It appears from the graph analysis that a lot of loss scenarios would incur a negative NPV for the company. Considering the weight of the aforementioned scenarios, it seems unacceptable for an investor and even more for a bank lender to accept such a high level of risk.

■ This leads to consider an insurance coverage to hedge these negative NPV cases with an insurance limited to extreme cases endangering the company profitability or viability. Besides, if a lower risk appetite is chosen by the company, a minimum NPV might be expected and would lead to a higher insurance level. The scheme consists in insuring any losses only above a given threshold and thus considering an insurance deductible over the fleet. The deductible is adjusted to the level of losses that the company is ready to suffer and corresponds to a minimal acceptable return. Finally, an operator might decide to take no risk at all on satellite losses and insure a systematic replacement of assets. The chart below illustrates these strategies. 0 50 -50 100 150 200 -200 -150 -100 Figure 70: Project NPV vs insurance strategy

In the stop loss coverage case (blue), we see that the project NPV is maintained above the target limit (positive NPV) whatever the loss occurrences. In exchange, the cost of the XS insurance lowers the maximum attainable company profit.

■ Finally, we consider that a more reduced insurance level can be envisaged even with relatively reduced satellite fleets under certain circumstances, where the company revenues or part of it is granted by an institutional customer which is sometimes the case in Public Private Partnerships. This is equivalent to a risk transfer of the first layers of risk (the more probable) to the end customer which grants an acceptable level of return to the private operator in case of minor losses (single failures for example) and allows the operator to insure only double failure cases or consider an insurance franchise to reduce the overall insurance cost.

145

6.3.3.2 Fleet Operators

Fleet operators are following a different logic since they are in an established business with a high capacity demand to satisfy and a very important service continuity to fulfil. They have also larger fleets allowing a higher mutualisation of the available capacity to absorb satellite losses.

We propose here a simplified approach on coverage schemes in order to illustrate the risk retention vs transfer tradeoffs on the company RoE.

Risk Retention

In the absence of any insurance coverage, the financial impacts of satellite failures and the cost of their replacement will be financed either with cash reserves (incurring a reduced dividend on the year of the failure) or with an additional external financing with debt. The extra debt drawn by the company will necessitate an increase debt service payment over the next years which then reduces the final company results which could be distributed to shareholders.

The resulting RoE distribution is strongly spread with a fat tail representing high cost cases with quite a high probability of occurrence. As a counterpart, with no insurance budget at all, the company RoE can reach very high levels in case of limited failure occurrences. This strategy is suitable for an operator with high risk appetite and important cash reserves. Besides it can only be envisaged by operators with a large fleet providing a high mitigation level.

Most probably, a no insurance strategy will be considered as too risky by banks and shareholders, from whom a more prudent insurance strategy will be expected. Besides, in case of successive failures close from each other, the company could run into trouble and have difficulty to finance the replacement of satellites, which should be avoided. Under a purely commercial scheme, the ultimate limitation to risk retention is the capacity of the company to maintain a sufficient activity to support its operating costs and honour its debt repayment.

Book value insurance coverage

At the opposite, the simplest insurance strategy is to insure all the satellite book value against failure. This covers totally or partially the additional CAPEX incurred by a satellite replacement. In the event of a Total Failure of a given satellite, the immediate asset depreciation is covered by insurance and part of the satellite replacement is compensated by insurance. In case of a satellite partial loss, a pro rata indemnity is compensated by insurance.

In such a case, the company RoE is almost fully protected, and low RoE scenarios are quite remote. On the other hand, a significant insurance budget is necessary to cover all the satellite fleet at launch, acceptance and in orbit. This important budget reduces drastically the company profit each year, which translates into a more condensate RoE distribution.

This is illustrated by the chart below where the blue curve represents the full risk retention strategy and shows a very widespread distribution of cases with a very high probability of high profit cases (above 1200 M€ RoE) but as a counterpart a quite significant probability of low return scenarios (below 700 M€ RoE). On the contrary, the red curve representing the “book value” full insurance strategy is much more concentrated with almost 90% of cases between 700 M€ and 1200 M€ RoE.

146

The residual exposure is linked to the lost revenues in the replacement period and the delta between book value and replacement value in case of IOL losses. 0 200 400 600 800 1 000 1 200 1 400 1 600 1 800 2 000 Figure 71: RoE distribution vs insurance strategy

Another important issue for equity providers is to ensure a continuous return and to limit as much as possible the variations of their dividends. In the full retention strategy, in case of a satellite failure, the company EBIT is severely affected by the immediate asset depreciation and the satellite replacement must be financed with reserves or extra loans, which is affecting the dividends which can be distributed on the year of the incident. Overall, this translates in a high risk of suffering low return years which might not be acceptable for equity providers. On the contrary, in the book value insurance case, the EBIT impact and the asset replacement is compensated by insurance proceeds. As a consequence the company EBIT and the shareholder return are much less impacted at the moment of a failure occurrence. The diagrams below illustrate this phenomenon in both cases. We see that the company EBIT is very widespread in the full retention case and very concentrated on the book value insurance case.

450 450

400 400

350 350

300 300

250 250

200 200 Net Result (M€) Net Result (M€) Net Result

150 150 5% - 95% 100 100 +/- 1 Ec. type 5% - 95% Moyenne 50 +/- 1 Ec. type 50 Moyenne 0 0 1 2 3 4 5 6 7 8 9 1 2 3 4 5 6 7 8 9 10 10 Years Year

Figure 72: EBIT No insurance Figure 73: EBIT Full Insurance

147

Insurance with IOL Risk retention

An alternative strategy aims at insuring only launch failures, which have a quite high probability of occurrence, to be indemnified for the CAPEX of the necessary replacement satellites after a failure.

The In Orbit Life risk would therefore be kept by the operator considering that the lower probability of occurrence of satellite failures after the first year would make it easier to manage. Loss of revenues would then be compensated by other satellites if the fleet is sufficiently large at the beginning.

Compared to a full risk retention scheme, the additional expense related to launch insurance will of course translate in a reduced company EBIT in the nominal case. As a counterpart, peaks of risk would be hedged and translate into a reduced probability of low EBIT cases. The chart below illustrates the impact of launch insurance on the company RoE distribution. This intermediate strategy shows an RoE density of probability in between, with a satisfactory distribution of the most probable cases (between 10th %ile and 90th %ile) in an acceptable RoE range.

Figure 74: RoE vs insurance strategy

Insurance with franchise

The last typical scheme which is presented is the case of an insurance of launch and in orbit failures but considering an overall franchise over the fleet. Typically the franchise value can be the value of a full satellite loss which can be kept in retention.

The loss models defined in the present paper allow estimating the cost of such an insurance scheme by simulating the loss expectancy of an insurer in such a scheme and translate it into a commercial premium by applying a give risk remuneration.

148

6.3.4 Conclusion

We have fully simulated the fleet and business model of a various satellite operators.

All the company cash flows are modelled together with the impact of satellite failures on these cash flows. The consequences of satellite failures is then measured on the resulting Return On Equity or Net Present Value for the company shareholder used to measure the company financial performance.

Different insurance strategies to protect the RoE against satellite failures have been analysed. The most adapted strategy depends on the operator mutualisation capabilities and on the shareholders risk appetite.

An actuarial approach has been described which allows to quantify the influence of a chosen strategy on the company financial indicators. This is a powerful tool to support decision making based on a clear representation of risks.

149

150

777... CCCooonnncccllluuusssiiiooonnn

The risk of satellite failure or underperformance is predominant in the space industry especially during and after launch. Space actors need to manage carefully their space risks to maintain a profitable business. The outcomes of this paper might be used by space actors to determine their space risk management strategy.

The risk of launchers and satellites accidental failures has been analyzed in detail using actuary methods and based on a detailed and carefully scrutinized loss history. We have managed to derive models to forecast the probable failure occurrence and magnitude for each phase of the satellite life. Risk correlations have been considered in these models to value their impact when considering large satellite populations with common characteristics.

We have done an extensive modelling exercise to quantify with loss distributions the risk of financial losses of space insurers, manufacturers and operators relative to space risks. In a second step we have studied the possible risk management strategy and hedging of these risks with different approaches. The choice of the risk management strategy will be chosen based on the risk appetite of each actor and the constraints imposed by shareholders, banks and financial authorities.

• To use actuarial methods (credibility, confidence intervals) to estimate the reliability of all launch vehicles and satellite types and compensate the reduced data sets available

• To analyse in detail the loss severity of satellite failures allowing a precise modelling of partial losses with standard distributions using kernel density estimator and estimation methods

• To propose a functional in orbit life model incorporating the design specificities and available redundancies as well as the flight heritage per component

• To analyse the correlation between losses in order to properly address the risk of serial losses in a satellite portfolio

• To incorporate high quality data analysed in detail to extract all the information available

151

• To implement a tool capable of determining the necessary capital allocation to perform the space insurance activity while meeting the solvency requirements imposed by the legislation

• To compute the pure premium of a portfolio as well as the required level of commercial premium necessary to meet profitability objectives with a given confidence level.

• Propose a mathematical explanation about the mechanics of market volatility demonstrating the challenge of rate evolution anticipation

The main purpose of the paper is to adopt an insured position and optimize the management of space risks for a manufacturer or an operator. The analysis is mainly based on Monte Carlo models simulating the impact of random satellite failures on the company financial indicators. The satellite loss model has been used to simulate the loss distribution of complete satellite portfolios and measure the impact of various risk management strategies on the loss distribution. Thanks to the developed models, the risk exposure can be accurately measured and besides the benefits of the different possible risk management strategies can be clearly quantified. The main benefits of the approach are:

• To support the dimensioning of risk provisions

• To support decision making on risk retention and transfer trade offs considering the risk appetite of the space actors

• To quantify the influence of risk management strategies on the company financial indicators

152

888... BBBiiibbbllliiiooogggrrraaappphhhyyy

[1] Spacetrak database (Ascend) – www.spacetrak.com

[2] Spacecraft History – Claude Lafleur – http://claudelafleur.qc.ca

[3] Space Skyrocket - http://space.skyrocket.de/

[4] Aon Space Insurance Market Reports

[5] Marsh Space Insurance Market Report

[6] Willis Inspace End of Year Briefings

[7] The satellite insurance market and underwriting cycles – Piotr Manikowski, Mary A Weiss

[8] Statistical analysis of satellites by mass category – Dubos, Castet, Saleh

[9] Satellite reliability: statistical analysis and modelling – Castet, Saleh

[10] Space Insurance Overview – Chris Kunstadter – WSRF 2010

[11] Satellite Risk and Insurance, An underwriter perspective – Didier Parsoire – WSRF 2010

[12] Space Insurance – Munich Re

[13] Space Insurance Overview – Munich Re press xxx

153

154

999... AAACCCRRROOONNNYYYMMMSSS

GEO - Geostationary Orbit

LEO - Low Earth Orbit

MEO - Medium Earth Orbit

SSO - Sun Synchronous Orbit

LEOP - Launch and Early Orbit Phase

IOT - In Orbit Test

IOL - In Orbit Life

LV - Launch Vehicle

KDE - Kernel Density Estimator

LSE - Least Squares Estimate

MLE – Maximum Likelihood Estimator

CAPEX – Capital Expenditure

OPEX – Operations Expenditures

EBIT – Earnings Before Interest and Taxes

IRR – Internal Rate of Return

RoE – Return on Equity

HR – High Resolution

VHR – Very High Resolution

155

156

111000... AAAnnnnnneeexxxeeesss

10.1 Credibility Theory

Principle

Credibility theory is a branch of actuarial science. It was developed originally as a method to calculate the risk premium by combining the individual risk experience with the class risk experience.

The policy holders can be divided into different homogeneous groups with similar characteristics. Credibility theory is a method to calculate a premium for a group of insurance contracts. The goal is to set up an experience rating system to quantify a given risk, taking into account not only the individual experience with the group, but also the collective experience.

There are two extreme positions: One is to charge the same premium to everyone, estimated by the overall mean of the data. This makes sense only if the portfolio is homogeneous, which means that all risks cells have identical mean claims. However, if the portfolio is not homogeneous, it is not a good idea to charge premium in this way, since the "good" risks will take their business elsewhere (overcharging "good" people and undercharging "bad" risk people), leaving the insurer with only bad risks. This is an example of adverse selection.

The other way around is to charge to group j its own average claims, being as premium charged to the insured. These methods are used if the portfolio is heterogeneous, provided a fairly large claim experience.

To compromise these two extreme positions, we take the weighted average of these two extremes:

zj has the following intuitive meaning: it expresses how "credible" (acceptability) the individual experience of group j is. If it is high, then use higher zj to attach a larger weight to charging the , and in this case, zj is called a credibility factor.

If the group were completely homogeneous then it would be reasonable to set zj = 0, while if the group were completely heterogeneous then it would be reasonable to set zj = 1. Using intermediate values is reasonable to the extent that both individual and group history are useful in inferring future individual behaviour.

157

Mathematical Model

The model supposes the study of a group of L sub elements “e” which have common characteristics but differ to some extend on other points. It is studied over N periods “p”.

The model first uses the claim occurrence frequency for a given sub element “e” of the group ~ K(e) λ = where K(e) is the number of claims over the studied period and S(e) is the total number e S(e) N N of attempts (or total exposure to risk) during the period K(e) = ∑ K(e,k) and S(e) = ∑ S(e,k) k=1 k=1

~ We also have the weighted average reliability λ of all the elements defined by:

~ 1 L ~ L λ = ∑ S(e) *λe and S = ∑ S(e) S e=1 e=1

We then estimate:

1) the variance intra element, which is measuring the average dispersion of the number of claims for all studied elements over time

~ 2 1 1 ~ ~ 2 s = ∑ ∑ S(e,k)(λe,k − λe ) L e=1toL N −1k =1toN

2) and the variance inter element, which is measuring the average dispersion of the number of claims between different elements

~2 1 ~ ~ 2 ~2 σ = 2 * ( ∑ S(e)(λe − λ ) − (L −1)s ) S(e) e=1toL S(1− ∑ 2 ) e=1toL S

σ~2 The credibility factor is then given by CRED = e ~s 2 σ~2 + S(e)

~ ~ Finally the “credible” reliability of a given element e is λe,CRED = CREDe *λe + (1− CREDe )*λ

158

10.2 Confidence Interval estimation

We define a binary event which represents the occurrence or not of a failure. This event is modelled with a random variable Xi following a Bernoulli distribution. For each attempt i (launch or IOT of a satellite) the variable Xi defines the success or failure of the attempt. ⎧ 1 p X i = ⎨ ⎩0 q =1− p 1 n If we observe n attempts, an estimator of p is ˆ pn = ∑ X i n i=1

As empirical average of a theoretical average this estimator is not biased and converging.

n We also have the relation ˆ which follows a binomial distribution B(n,p) npn = ∑ X i i=1

To determine a confidence interval for p with a level 0,95 we need to determine the values p1 and p2 for which P( p1 ≤ pˆ n ≤ p2 ) = 90% or considering a unilateral interval P(npˆ n ≥ np2 ) ≤ 5%

n2 ⎛n⎞ Since ˆ follows a binomial distribution ˆ k n−k where npn P(npn ≥ np2 ) = ∑⎜ ⎟p (1− p) ≤ 5% n2 = np2 k=0 ⎝k ⎠

Based on that by tracing n2 ( p) , we can obtain graphically the value of p2

Otherwise, if the sample of n observations is sufficiently large, we can use the asymptotique law of pˆ − p pˆ by deduction from the central limit theorem n n → N(0,1) n pq

We determine from that a symmetrical interval from a value “a” for which pˆ − p pq pq P(−a ≤ n ≤ a) =1−α then we obtain P( pˆ − a ≤ p ≤ pˆ + a ) =1−α and finally pq n n n n pˆ (1− pˆ ) pˆ (1− pˆ ) by approximating p with pˆ we get P( pˆ − a n n ≤ p ≤ pˆ + a n n ) =1−α n n n n n

“a” is calculated as a = φ −1 (1−α / 2)

159

10.3 Chi2 estimate method The reliability λ of an equipment or a system can be estimated with the non biased estimator r(T) λˆ = where r(T) is the number of observed failures in the interval [0,T] which represents the total T observation duration of all the tested equipments or systems.

We define as α the probability that r failures have been observed with λ > λ + or λ < λ − we will determine λ + and λ − for a given value of α so that P(r −1≤ r(T) ≤ r) = 1−α

In order to determine a confidence interval for λ so that λ− ≤ λ ≤ λ + we need to know the probability law of the random variable r(T). We define r(T) as a Poisson law of parameter λT , this means that r 1 P(r(T ) ≤ r) = ∑ (λT)k e−λT k=0 k!

We can demonstrate that P(r(T) ≤ r) = P(χ 2 (2r + 2) > 2λT) and P(r(T ) > r −1) = P(χ 2 (2r) ≤ 2λT ) where the random variable χ 2 (2r + 2) follows a Chi2 law with 2(r+1) degrees of freedom.

Consequently we obtain the values of the confidence interval: χ 2 (2r) χ 2 (2r + 2) λ− = α / 2 and λ+ = 1−α / 2 2T 2T

2 2 Where χ1−α / 2 (2r + 2) and χα / 2 (2r) are resp. the quantile of order 1-α /2 of the Chi2 law with 2r+2 degrees of freedom and the quantile of order α /2 of the Chi2 law with 2r degrees of freedom.

160

10.4 Kernel Density Estimator

Kernel density estimators belong to a class of estimators called non-parametric density estimators. In comparison to parametric estimators where the estimator has a fixed functional form (structure) and the parameters of this function are the only information we need to store, Non-parametric estimators have no fixed structure and depend upon all the data points to reach an estimate.

To understand kernel estimators we first need to understand histograms whose disadvantages provides the motivation for kernel estimators. A histogram is the simplest non-parametric density estimator and the one that is mostly frequently encountered. When we construct a histogram, we need to consider the width of the bins (equal sub-intervals in which the whole data interval is divided) and the end points of the bins (where each of the bins start). As a result, the problems with histograms are that they are not smooth, depend on the width of the bins and the end points of the bins.

The data points are represented by crosses on the x-axis. If The choice of end points has a particularly marked effect of we choose breaks at 0 and 0.5 and a binwidth of 0.5, the our the shape of a histogram. For example if we use the same histogram looks like this. binwidth but with the end points shifted up to 0.25 and 0.75, then out histogram looks like this. It appears that the this density is unimodal and skewed to the right, according to this histogram. We now have a completely different estimate of the density - it now appears to be bimodal.

We can alleviate these problems by using kernel density estimators.

To remove the dependence on the end points of the bins, kernel estimators centre a kernel function at each data point. And if we use a smooth kernel function for our building block, then we will have a smooth density estimate. This way we have eliminated two of the problems associated with histograms. The problem of bin-width still remains which is tackled using a technique discussed later on. The properties of kernel density estimators are, as compared to histograms: smooth , no end points, depend on bandwidth

161

More formally, Kernel estimators smooth out the contribution of each observed data point over a local neighbourhood of that data point. The contribution of data point x(i) to the estimate at some point x depends on how apart x(i) and x are.

The extent of this contribution is dependent upon the shape of the kernel function adopted and the width (bandwidth) accorded to it. If we denote the kernel function as K and its bandwidth by h, the estimated density at any point x is

where to ensure that the estimates f(x) integrates to 1 and where the kernel function K is usually chosen to be a smooth unimodal function with a peak at 0. Even though Gaussian kernels are the most often used, there are various choices among kernels

The quality of a kernel estimate depends less on the shape of the K than on the value of its bandwidth h. It's important to choose the most appropriate bandwidth as a value that is too small or too large is not useful. Small values of h lead to very spiky estimates (not much smoothing) while larger h values lead to oversmoothing.

The following three figures (http://www.maths.uwa.edu.au/ duongt/seminars/intro2kde/) show the effect of 3 different bandwidths. When the bandwidth is 0.1 (very narrow) then the kernel density estimate is said to undersmoothed as the bandwidth is too small.

A common method to choose the optimal bandwidth is to use the bandwidth that minimises the AMISE (Asymptotic Mean Integrated Squared Error).

162

10.5 Least Squares Estimate

Principle

Using the idea of probability plotting, regression analysis mathematically fits the best straight line to a set of points, in an attempt to estimate the parameters. Essentially, this is a mathematically based version of the probability plotting method.

Background Theory

The method of least squares requires that a straight line be fitted to a set of data points, such that the sum of the squares of the distance of the points to the fitted line is minimized. This minimization can be performed in either the vertical or horizontal direction. If the regression is on X, then the line is fitted so that the horizontal deviations from the points to the line are minimized. If the regression is on Y, then this means that the distance of the vertical deviations from the points to the line is minimized. This is illustrated in the following figure.

Rank Regression on Y

Assume that a set of data pairs (x1,y1), (x2,y2),..., (xN,yN) were obtained and plotted, and that the x-values are known exactly. Then, according to the least squares principle, which minimizes the vertical distance between the data points and the straight line fitted to the data, the best fitting straight line to these data is the straight line y = + x (where the recently introduced (^) symbol indicates that this value is an estimate) such that:

and where and are the least squares estimates of a and b, and N is the number of data points. These equations are minimized by estimates of and such that:

163

and:

Rank Regression on X

Assume that a set of data pairs (x1,y1), (x2,y2),..., (xN,yN) were obtained and plotted, and that the y-values are known exactly. The same least squares principle is applied, this time minimizing the horizontal distance between the data points and the straight line fitted to the data. The best fitting straight line to these data is the straight line x = + y such that:

Again, and are the least squares estimates of a and b, and N is the number of data points. These equations are minimized by estimates of and such that:

(19) and:

(20)

164

10.6 Maximum Likelihood Estimate

The idea behind maximum likelihood parameter estimation is to determine the parameters that maximize the probability (likelihood) of the sample data. From a statistical point of view, the method of maximum likelihood is considered to be more robust (with some exceptions) and yields estimators with good statistical properties.

In other words, MLE methods are versatile and apply to most models and to different types of data. In addition, they provide efficient methods for quantifying uncertainty through confidence bounds. Although the methodology for maximum likelihood estimation is simple, the implementation is mathematically intense. Using today's computer power, however, mathematical complexity is not a big obstacle. The MLE methodology is presented next.

Background Theory

This section presents the theory that underlies maximum likelihood estimation for complete data. If x is a continuous random variable with probability density function: where are k unknown constant parameters which need to be estimated, conduct an experiment and obtain N independent observations, x1, x2,...,xN.

Then the likelihood function is given by the following product:

The logarithmic likelihood function is given by:

The maximum likelihood estimators (MLE) of are obtained by maximizing L or . By maximizing , which is much easier to work with than L, the maximum likelihood estimators (MLE) of are the simultaneous solutions of k equations such that:

165

MLE Method Using the Exponential Distribution

The likelihood function is given by

n n n −λ ∑ti L(λ /t ,t ,...,t ) = f (t ) = λ.e−λti =λn .e i=1 1 2 n ∏ i ∏ i=1 i=1

We then compute the log likelihood and its maximum for λ making the derivative equal to 0 n ∂Λ n n Λ = ln(L) = n.ln(λ) − λ t ∑ i = − ∑ti = 0 i=1 ∂λ λ i=1 n λˆ = Finally the estimator of λ is given by n ∑ti i=1

MLE Method Using the Weibull Distribution T β t −( )β f (t) = .( ) β −1.e η The probability density function of the Weibull distribution is given by η η

t n n n −( i )β β n ti β −1 η The likelihood function is given by L(ti ,β,η) = ∏ f (ti ) = ( ) .∏( ) .∏e i=1 η i=1 η i=1

n n β ti ti β Then the log likelihood is given by Λ = ln L = n.ln( ) + (β −1).∑ln( ) − ∑( ) η i=1 η i=1 η

We finally obtain the values of β and η which maximize the log likelihood by solving n n ∂Λ n ti ti β ti = + ∑∑ln( ) − ( ) ln( ) = 0 and ∂β β i==11η i η η

n ∂Λ − β β ti β = .n + ∑( ) = 0 ∂η η η i=1 η

An iterative calculation method is necessary to solve these equations.

166

10.7 Chi Square Test

After adjusting a data sample with a given probability law, we can accept the hypothesis that this sample comes from this law if the distance between the theoretical CDF F and the empirical CDF Fn is sufficiently small. We need to determine a measure of distance d between the 2 CDF and define a decision rule formulated as “If the event d(F,Fn) < C then F is an acceptable adjustment for Fn”. We also define the rejection error probability as α = P[d(Fn,F) > C], we then fix the parameter α at the chosen level (for example 5% or 10%) in order to tune the confidence we want for the test.

The Chi Square test is generally appropriate of the data sample is discrete data with values xi of probability pior if individual datas in the sample are distributed in classes (ai, ai+1) for which a theoretical frequencies are computed with the theoretical law as pi = P[X ∈(ai ,ai+1 )] = F(ai+1 ) − F(ai ) 1 ≤ i ≤ k

If Ni is the number (random) of observations xi, ou belonging to the class (ai, ai+1), we will compare it to the theoretical number n.pi.

The simple Euclidian distance between Fn, represented by the k observed classes with Ni elements, k and F, represented by the k theoretical classes with n.pi elements, would be 2 . ∑(Ni − n.pi ) i=1 However we prefer to use another distance for which an asymptotic law can be determined more easily. We consider the RV Ni follow binomial laws of parameter n and pi, and that the centred variables (Ni − n.pi ) / n.pi → N(0, 1− pi ) based on that we consider the distance k (N − n.p )2 k (N )2 d (Fn, F) = ∑ i i = ∑ i − n i=1 n.pi i=1 n.pi

This sum of squares of RV centred and asymptotically Normal and linked by the relation k converge to a Chi square law with k-1 degrees of freedom. ∑(Ni − n.pi ) = 0 i=1

The value of the test threshold is then determined by the fractile of order 1-α of the law.

Limitations:

The chi-square goodness-of-fit test depends on an adequate sample size for the approximations to be valid.

167

10.8 Kolmogorov Smirnov Test

The Kolmogorov-Smirnov test (Chakravart, Laha, and Roy, 1967) is also used to decide if a sample comes from a population with a specific distribution. This test is powerful since it considers all the quantiles of available data sample

The Kolmogorov-Smirnov (K-S) test is based on the empirical cumulative distribution function (ECDF).

Given N ordered data points the ECDF is defined as

This is a step function that increases by 1/N at the value of each ordered data point.

The Kolmogorov-Smirnov test is defined by the hypothesis H0:

“The data sample follows a specified distribution F0”

We measure the adequation test confirming or not the acceptability of hypothesis H0 with the Kolmogorov-Smirnov test statistic (or distance) which is defined as:

where F0 is the theoretical cumulative distribution of the distribution being tested which must be a continuous distribution

The hypothesis regarding the distributional form is rejected if the test statistic, D, is greater than the critical value C obtained from a table if the data sample is small or obtained by an approximate value if the data sample is sufficiently large and computed as:

An attractive feature of this test is that the distribution of the K-S test statistic itself does not depend on the underlying cumulative distribution function being tested. However the test only applies to continuous distributions and tends to be more sensitive near the center of the distribution than at the tails. Finally the most serious limitation is that the distribution must be fully specified.

168