Uncertainty Theory-Based Resilience Analysis for LEO Satellite Communication Systems

Abstract

Resilience, the ability of a system to withstand disruptions and quickly return to a normal state, is essential for a low-Earth-orbit satellite communication system (LEO-SCS), as its large number of satellites, may encounter various disturbances. As a developing system with asymmetrical and insufficient data, it is with both aleatory and epistemic uncertainties, which renders existing resilience measures inapplicable. This paper utilizes uncertainty theory to define belief instantaneous availability, based on which a new resilience measure for the LEO-SCS is proposed. As the resilience is mainly determined by the dynamic and uncertain characteristics of an LEO-SCS, an uncertain satellite network evolution model is developed to describe its operating patterns, and an evaluation method is proposed to estimate its resilience. To illustrate our proposed uncertain theory-based resilience evaluation method, an LEO-SCS case with 48 satellites is studied, and its resilience values under different backup strategies are compared to assist in system design decisions.

1. Introduction

Due to short round-trip delays and wide-area coverage, the low-Earth-orbit satellite communication system (LEO-SCS) is becoming an important research topic. Iridium NEXT, OneWeb, and StarLink are typical examples. During system operation, disruptions may occur, causing satellite failure or signal interruption. The failure to quickly and effectively solve these problems may lead to huge economic losses. How to reasonably quantify and evaluate the impact of these failures is important to improve LEO-SCS operation and service stability.

As an extension and expansion of reliability and risk, resilience is the ability of a system to withstand disruption and quickly return to a normal state. Resilience, which encompasses avoidance, robustness, reconstitution, and recovery, has become a key criterion in evaluating alternative space systems, including constellations [1,2]. Researchers have already analyzed the resilience of constellation systems. Turner [3] defined the resilience of a satellite network as the time-averaged network performance under an extreme-event situation and built an extreme event model to quantify the resilience of satellite communication systems. Han et al. [4] proposed a three-dimensional resilience evaluation matrix and analyzed the resilience of a communication constellation based on the coverage capacity and reconstruction energy index. Lowe and Macdonald [5] used a Markov chain and semi-analytical approach to assess the resilience of both networking- and non-networking-capable constellation systems. Researchers have also proposed resilience assessment methods for other networked systems. Reed et al. [6] defined resilience as the ratio of the integral of the performance function to the recovery time. Ouyang et al. [7] defined it as the ratio of the real performance integral to the target one during a year. Li et al. [8] defined resilience as the average performance within the maximum allowable recovery time. Moutsinas et al. [9] developed a resilience measure based on the polynomial chaos expansion method, which could characterize the resilience for a wide range of uncertainty distributions.

It is important to analyze resilience during the design of a system, as it can guide resilience design and provide reasonable strategies. However, current resilience measures and modeling methods cannot be directly applied to the LEO-SCS design process for the following reasons:

• Generally, there are two types of uncertainties, aleatory and epistemic. Epistemic uncertainties can be reduced by collecting more data or refining models, and aleatory ones are natural randomness that cannot be reduced [10]. As a typical newly developing system, the LEO-SCS suffers from performance data insufficiency and performance data asymmetry [11], which limits knowledge on recognizing system performance and leads to epistemic uncertainty. Considering the aleatory uncertainty of the satellite failures [12] and the epistemic uncertainty of the system performance, the resilience of an LEO-SCS needs to be analyzed with both uncertainties. However, existing resilience assessment methods only individually focus on either aleatory uncertainty or epistemic uncertainty [3,4,5,13], which will lead to inaccurate resilience assessment. In addition, the performance measures used in these resilience assessments vary widely and a unified measure is required for the resilience comparison among different systems.
• To measure LEO-SCS resilience requires a system model to be built. Previous LEO-SCS modeling methods have only considered the dynamics of the network topology and the aleatory uncertainty of the performance parameters while neglecting their epistemic uncertainty.

The uncertainty theory, founded by Liu [14], defines uncertain measures to quantify events with epistemic uncertainty. Then, Liu [15] extended the uncertain measure to chance measure for events with both aleatory and epistemic uncertainties. According to the above research, we propose a new resilience measure and modeling method for LEO-SCS based on uncertainty theory. Our contributions are as follows:

• A belief resilience measure is proposed based on uncertainty theory [14,15] and is used to quantify the system resilience as the chance that the system meets the service requirement under disruptions, considering both aleatory and epistemic uncertainties;
• An uncertain satellite network evolution model is proposed for the LEO-SCS, which quantifies both the end-to-end aleatory and epistemic uncertainties and also considers dynamic topology changes;
• A resilience evaluation method is proposed for the LEO-SCS, under which system resilience under different backup strategies can be compared and the results can be used in design decisions.

The remainder of this paper is organized as follows. Section 2 briefly introduces uncertainty and chance measures. A belief resilience measure is proposed in Section 3. Section 4 introduces the LEO-SCS and provides an uncertain satellite network evolution model for it. A resilience evaluation method for the LEO-SCS is presented in Section 5. Section 6 illustrates the effectiveness of our proposed methodology through a specific case and discusses the impact of different backup strategies on system resilience. Concluding remarks are provided in Section 7.

2. Preliminaries

In this section, we introduce some important concepts of the uncertainty and chance measures.

2.1. Uncertain Measure

Definition 1

(Liu [14]). Uncertain measure $\mathcal{M}$ is a real-valued set-function on a σ-algebra $\mathcal{L}$ over a nonempty set Γ that satisfies the following four axioms:

Axiom 1: (Normality Axiom) $\mathcal{M}\left(\mathrm{\Gamma }\right)=1$ for the universal set Γ.

Axiom 2: (Duality Axiom) $\mathcal{M}\left(\mathrm{\Lambda }\right)+\mathcal{M}\left({\mathrm{\Lambda }}^c\right)=1$ for any event Λ.

Axiom 3:(Subadditivity Axiom) For every countable sequence of events ${\mathrm{\Lambda }}_1,{\mathrm{\Lambda }}_2,\cdots$, we have

$$\mathcal{M}\left\{\bigcup _{i=1}^{\infty }{\mathrm{\Lambda }}_i\right\}\le \sum _{i=1}^{\infty }\mathcal{M}\left\{{\mathrm{\Lambda }}_i\right\}.$$

(1)

Axiom 4: (Product Axiom) Let $({\mathrm{\Gamma }}_k,{\mathcal{L}}_k,{\mathcal{M}}_k)$ be uncertainty spaces for $k=1,2,\cdots$. The product uncertain measure $\mathcal{M}$ is an uncertain measure satisfying

$$\mathcal{M}\left\{\bigcup _{k=1}^{\infty }{\mathrm{\Lambda }}_k\right\}=\underset{k=1}{\overset{\infty }{\bigwedge }}\mathcal{M}\left\{{\mathrm{\Lambda }}_k\right\},$$

(2)

where ${\mathrm{\Lambda }}_k$ are arbitrarily chosen events from ${\mathcal{L}}_k$ for $k=1,2,\cdots$, respectively.

Definition 2

(Liu [14]). An uncertain variable is a function ξ from an uncertainty space $(\mathrm{\Gamma },\mathcal{L},\mathcal{M})$ to the set of real numbers such that $\{\xi \in B\}=\{\gamma \in \mathrm{\Gamma }\mid \xi (\gamma )\in \beta \}$ is an event for any Borel set B of real numbers.

Definition 3

(Liu [14]). The uncertainty distribution Φ of an uncertain variable ξ is defined by $\mathrm{\Phi }\left(x\right)=\mathcal{M}\{\xi \le x\}$ for any real number x.

Example 1

(Liu [14]). An uncertain variable ξ is called a linear variable if it has a linear uncertainty distribution

$$\mathrm{\Phi }\left(x\right)=\left\{\begin{array}{c}0,\left(\mathrm{if}\mathit{x}\le \mathit{a}\right)\hfill \\ {\displaystyle \frac{x-a}{b-a}},\left(\mathrm{if}\mathit{a}<\mathit{x}\le \mathit{b}\right),\hfill \\ 1,\left(\mathrm{if}\mathit{x}>\mathit{b}\right)\hfill \end{array}\right.$$

(3)

denoted by $\mathcal{L}(a,b)$, where a and b are real numbers with $a<b$.

Example 2

(Liu [14]). An uncertain variable ξ is called a zigzag variable if it has a zigzag uncertainty distribution

$$\mathrm{\Phi }\left(x\right)=\left\{\begin{array}{c}0,\left(\mathrm{if}\mathit{x}\le \mathit{a}\right)\hfill \\ {\displaystyle \frac{x-a}{2(b-a)}},\left(\mathrm{if}\mathit{a}<\mathit{x}\le \mathit{b}\right),\hfill \\ {\displaystyle \frac{x+c-2b}{2(c-b)}},\left(\mathrm{if}\mathit{b}<\mathit{x}\le \mathit{c}\right)\hfill \\ 1,\left(\mathrm{if}\mathit{x}>\mathit{c}\right)\hfill \end{array}\right.$$

(4)

denoted by $\mathcal{Z}(a,b,c)$, where a, b and c are real numbers with $a<b<c$.

Definition 4

(Liu [16]). An uncertainty distribution Φ is said to be regular if its inverse function ${\mathrm{\Phi }}^{-1}\left(\alpha \right)$ exists and is unique for each $\alpha \in (0,1)$.

Theorem 1

(Liu [16]). Let ${\xi }_1,{\xi }_2,\cdots ,{\xi }_n$ be independent uncertain variables with regular uncertainty distributions ${\mathrm{\Phi }}_1,{\mathrm{\Phi }}_2,\cdots ,{\mathrm{\Phi }}_n$, respectively. If f is a strictly increasing function, then $\xi =f({\xi }_1,{\xi }_2,\cdots ,{\xi }_n)$ has an inverse uncertainty distribution ${\mathrm{\Psi }}^{-1}\left(\alpha \right)=f({\mathrm{\Phi }}_1^{-1}\left(\alpha \right),{\mathrm{\Phi }}_2^{-1}\left(\alpha \right),$$\cdots ,{\mathrm{\Phi }}_n^{-1}\left(\alpha \right))$.

2.2. Chance Measure

The chance measure [15] combines probability and uncertain measures to solve problems with both aleatory and epistemic uncertainties. Its concepts, as used in this article, are as follows.

Let $(\mathrm{\Gamma },\mathcal{L},\mathcal{M})$ be a uncertainty space and $(\mathrm{\Omega },\mathcal{A},\mathrm{Pr})$ be a probability space. Then the $(\mathrm{\Gamma },\mathcal{L},\mathcal{M})\times (\mathrm{\Omega },\mathcal{A},\mathrm{Pr})$ is called a chance space.

Definition 5

(Liu [14] and Liu [15]). An uncertain random variable is a function ξ from a chance space $(\mathrm{\Gamma },\mathcal{L},\mathcal{M})\times (\mathrm{\Omega },\mathcal{A},\mathrm{Pr})$ to the set of real numbers such that $\{\xi \in B\}$ is an event in $\mathcal{L}\times \mathcal{A}$ for any Borel set B of real numbers.

Definition 6

(Liu [14] and Liu [15]). Let ξ be an uncertain random variable on the chance space $(\mathrm{\Gamma },\mathcal{L},\mathcal{M})\times (\mathrm{\Omega },\mathcal{A},\mathrm{Pr})$, and let B be a Borel set of real numbers. Then $\{\xi \in B\}$ is an uncertain random event with chance measure

$$\mathrm{Ch}\{\xi \in B\}=\underset{0}{\overset{1}{\int }}\mathrm{Pr}\{\omega \in \mathrm{\Omega }\mid \mathcal{M}\{\gamma \in \mathrm{\Gamma }\mid \xi (\gamma ,\omega )\in B\}\ge x\}dx.$$

(5)

Definition 7

(Liu [14] and Liu [15]). Let ξ be an uncertain random variable. Then, its chance distribution is defined by $\mathrm{\Phi }\left(x\right)=\mathrm{Ch}\{\xi \le x\}$ for any real number x.

3. Belief Resilience Measure

We present a new belief resilience measure to overcome the limitations of the commonly used resilience measures introduced in Section 1.

3.1. Belief Instantaneous Availability

Instantaneous availability is the probability that a system or component is performing its required function (i.e., required performance) at a given point in time [17], and it can reflect the overall situation of the system or component. We apply this parameter as the basis for the resilience measure. Considering that the system performance parameters are affected by aleatory and epistemic uncertainties, the belief instantaneous availability is defined based on the uncertainty theory [14,15] as follows.

Definition 8.

Belief instantaneous availability is the chance that the system performance margin $m\left(t\right)$ is greater than 0 at time t, i.e.,

$$A_B\left(t\right)=\mathrm{Ch}\left\{m\left(t\right)>0\right\},$$

(6)

where

$$m\left(t\right)=\left\{\begin{array}{c}{p}_{th}-p\left(t\right),\mathrm{if}p\left(t\right)\mathrm{is}\mathrm{STB}\hfill \\ p\left(t\right)-p_{th},\mathrm{if}p\left(t\right)\mathrm{is}\mathrm{LTB},\hfill \\ min\left(p_{th,U}-p\left(t\right),p\left(t\right)-p_{th,L}\right),\mathrm{if}p\left(t\right)\mathrm{is}\mathrm{NTB}\hfill \end{array}\right.$$

(7)

where STB, LTB, and NTB, respectively, are the smaller-the-better, the larger-the-better, and the nominal-the-better parameters, and $m\left(t\right)$ [18] describes the distance between a performance parameter $p\left(t\right)$ and its failure threshold $p_{th}$ at time t. If $m\left(t\right)<0$, a failure occurs, and $m\left(t\right)\ge 0$ means the system is within the available zone that can be operated at time t.

If a performance parameter is mainly with aleatory uncertainties, the performance margin degenerates to a random variable. Let $A_B^{\left(P\right)}\left(t\right)$ denote the belief instantaneous availability under the probability theory and we have

$$A_B\left(t\right)=A_B^{\left(P\right)}\left(t\right)=\mathrm{Pr}\left\{m\left(t\right)>0\right\}.$$

(8)

If a performance parameter is mainly with epistemic uncertainties, the performance margin degenerates to an uncertain variable. Let $A_B^{\left(U\right)}\left(t\right)$ denote the belief instantaneous availability under the uncertainty theory and we have

$$A_B\left(t\right)=A_B^{\left(U\right)}\left(t\right)=\mathcal{M}\left\{m\left(t\right)>0\right\}.$$

(9)

3.2. Belief Resilience

Definition 9.

The belief resilience of a system with epistemic and aleatory uncertainties is the chance that it can withstand disruption and recover quickly.

Define $\epsilon$ as an uncertain random variable that describes a system’s behavior after a disruption, with feasible domain $\Xi$. The belief resilience can be measured as

$$R_E=\mathrm{Ch}\left\{\epsilon \in \Xi \right\}.$$

(10)

If $\epsilon$ is a random variable, we have $R_E=\mathrm{Pr}\left\{\epsilon \in \Xi \right\}$. If $\epsilon$ is an uncertain variable, we have $R_E=\mathcal{M}\left\{\epsilon \in \Xi \right\}$.

We focus on the belief instantaneous availability change after a disruption, and the belief resilience can be defined as

$$R_E=\mathrm{Ch}\left\{{\displaystyle \frac{\underset{t_0}{\overset{t_0+T_a}{\int }}{A}_B\left(t\right|d)dt}{\underset{t_0}{\overset{t_0+T_a}{\int }}{A}_B\left(t\right|ns)dt}}>r_{eth}\right\},$$

(11)

where $t_0$ is the time when a disruption occurs; $T_a$ is the maximum allowable recovery time determined by users; $A_B\left(t\right|d)$ and $A_B\left(t\right|ns)$ are, respectively, the belief instantaneous availability under a specific disruption d and in the normal state $ns$ (without disruption); and $r_{eth}$ is the requirement for the system’s behavior after a disruption.

Based on Definition 8, the belief instantaneous availability under a specific disruption and normal state (without disruption), respectively, can be calculated as

$$A{}_B\left(t\right|d)=\mathrm{Ch}\left\{m\left(t\right|d)>0\right\}\mathrm{and}A{}_B\left(t\right|ns)=\mathrm{Ch}\left\{m\left(t\right|ns)>0\right\},$$

(12)

where $m\left(t\right|d)$ and $m\left(t\right|ns)$ are respective performance margins under specific disruption d and in the normal state $ns$ (without disruption).

4. LEO-SCS and Its Uncertain Evolution Model

4.1. A Short Introduction to LEO-SCS

An LEO-SCS is composed of LEO satellites, user segments, and gateways [19], see Figure 1. The user segment includes various user terminals, such as fixed terminals, handheld devices, and vehicle-based and airborne terminals. The gateway is a ground station that transmits data between the satellite and terrestrial networks. Links between LEO satellites are inter-satellite links (ISLs), links between LEO satellites and user terminals are user links (ULs), and links between LEO satellites and the gateways are feeder links (FLs).

There are both intra-plane and inter-plane ISLs. For example, each satellite in Figure 2 has four adjacent ISLs. In this figure, LEO12, LEO16, and LEO11 are in the same orbit plane, and between them are intra-plane ISLs. LEO61, LEO21, and LEO11 are in different orbit planes, and between them are inter-plane ISLs.

As the number of user terminals is quite large, the Earth’s surface is divided into grids of equal area, and each uses a virtual node (VN) [20,21] to provide services for all user terminals in the grid. Messages are transmitted between the VN and the satellite node through the UL. In an LEO-SCS, ULs and FLs can be built between satellites and connectable gateways/VNs according to the access criteria. A connectable gateway/VN of a satellite is located within its coverage area. In Figure 3, $g1$, $g2$, and $g3$ are connectable gateways of LEO11, and $v1$, $v2$, $v3$, and $v4$ are connectable VNs of LEO12. A satellite connects to a specific gateway/VN according to an access criterion. Access criteria for an LEO-SCS include load balancing, minimum delay, maximum service time, strongest signal, and maximum available channels [22,23].

There are two types of communication methods in LEO-SCS [24]:

• Between user terminals: user terminals can connect directly with an LEO satellite, and the messages are transmitted through one or more LEO satellites from the source to the destination;
• Between user terminal and terrestrial users: a terrestrial user can only connect with its gateway; the gateway and user terminal transfer messages through one or more LEO satellites.

4.2. Uncertain Satellite Network Evolution Model

4.2.1. Assumptions

We build the uncertain satellite network evolution model based on the following assumptions:

• The capacities of satellites, ISLs, ULs, and FLs are adequate, as satellite communication uses high-frequency bands, which have a high transmission rate and large system capacity [25,26];
• User terminals and gateways are perfect, and only satellite failures, which are affected by aleatory uncertainty [12], are considered, as maintenance is not easy in space;
• Processing delays of an LEO-SCS follow regular uncertainty distributions.

4.2.2. Uncertain Satellite Network Evolution Modeling Method

Considering that only limited performance data (e.g., processing delays) can be obtained in an LEO-SCS, the system has the following three characteristics:

• Its topology is dynamic and predictable [22];
• Satellite failure changes the network topology [27];
• Processing delays, which largely affect the end-to-end delay of an LEO-SCS [22], have epistemic uncertainty during system development.

To the best of our knowledge, no researcher has simultaneously considered all three of these characteristics in LEO-SCS modeling. Therefore, we propose an uncertain satellite network evolution modeling method, using a dynamic, uncertain satellite network model to characterize the epistemic uncertainty of satellite performance (i.e., the processing delay) and topology dynamics and applying the evolution rule of the dynamic, uncertain satellite network model to describe the topology evolution process of an LEO-SCS with satellite failures and recoveries.

4.2.3. Dynamic Uncertain Satellite Network Model

Definition 10.

A network is a dynamic uncertain network if its topology changes with time, and the weights of its edges are uncertain variables that vary with time.

A dynamic uncertain network can be denoted as $G(V,E(t),W(t\left)\right)$, where V is the node set, $E\left(t\right)$ is the edge set that varies over time, and $W\left(t\right)$ is the weight set composed of uncertain variables that vary with time, which can be the cost, distance, or capacity of edges.

In an LEO-SCS, the end-to-end delay, which depends on the propagation delay and processing delay [22], is the key performance parameter [28,29,30,31]. Propagation delay is the time used by electromagnetic waves to transmit a certain distance and it depends on the lengths of links (i.e., ISLs, ULs, and FLs). Processing delay is the time required for nodes (i.e., satellites, user terminals, and gateways) to check the frame’s header and determine where to forward the frame. In an LEO-SCS, since the lengths of links periodically change with time, the propagation delay is a deterministic variable that varies with time. However, because limited data on processing delays can be obtained before LEO-SCS deployment, the processing delay has epistemic uncertainty. So, the end-to-end delay of an LEO-SCS is an uncertain variable that varies with time.

To describe an LEO-SCS in the normal state, a dynamic uncertain satellite network model $G(V,E(t),D(t\left)\right)$ can be built, where $V=\{V_s,V_g,V_v\}$ is the node collection of satellites, gateways, and VNs; $E\left(t\right)=\{E_s\left(t\right),E_u\left(t\right),E_f\left(t\right)\}$ is the edge collection of ISLs, ULs, and FLs; and $D\left(t\right)=\{D_s\left(t\right),D_u\left(t\right),D_f\left(t\right)\}$ is the delay of edges. Using this model, both the dynamics of network topology and the epistemic uncertainty of performance parameters can be expressed. Here, we use an LEO-SCS dynamic adjacency matrix to represent the dynamic, uncertain satellite network model, and it can be divided into an inter-satellite adjacency matrix $S_m\left(t\right)$, a satellite-gateway adjacency matrix $G_m\left(t\right)$, and a satellite-VN adjacency matrix $U_m\left(t\right)$ according to the types of links. The LEO-SCS dynamic adjacency matrix is

$$A_G\left(t\right)={\left[\begin{array}{ccc}{S}_m\left(t\right)& G_m\left(t\right)& U_m\left(t\right)\\ G_m^{\prime }\left(t\right)& 0_{Y\times Y}& 0_{Y\times Z}\\ U_m^{\prime }\left(t\right)& 0_{Z\times Y}& 0_{Z\times Z}\end{array}\right]}_{\left(X+Y+Z\right)\times \left(X+Y+Z\right)}$$

(13)

where X, Y, and Z are the numbers of satellites, gateways, and VNs, respectively, in the system. We describe $S_m\left(t\right)$, $G_m\left(t\right)$, and $U_m\left(t\right)$ in

Table 1. Three sub-topologies of LEO-SCS.

Adjacency Matrix	Nodes	Edges	Connection Rules	Delays
$S_m\left(t\right)$	Satellites	ISLs	Each satellite connects to its adjacent satellites	$d_s\left(t\right)=\left\{\begin{array}{c}{l}_s\left(t\right)/c+d_{p,s},\left(\mathrm{case}1\right)\hfill \\ l_s\left(t\right)/c+2d_{p,s},\left(\mathrm{case}2\right)\hfill \end{array}\right.,$ where $l_s\left(t\right)$ is the length of ISL at time t, c is the propagation speed of electromagnetic waves, and $d_{p,s}$ is the processing delay of satellites
$G_m\left(t\right)$	Satellites and gateways	FLs	Each satellite connects to a connectable gateway according to the access criteria	$d_f\left(t\right)=l_f\left(t\right)/c+d_{p,g}$, where $l_f\left(t\right)$ is the length of FL at time t, and $d_{p,g}$ is the processing delay of the gateway
$U_m\left(t\right)$	Satellites and VNs	ULs	Each satellite connects to connectable VNs according to the access criteria	$d_u\left(t\right)=l_u\left(t\right)/c+d_{p,v}$, where $l_u\left(t\right)$ is the length of UL at time t, and $d_{p,v}$ is the processing delay of a VN

Note: Case 1 refers to the situation wherein both satellites on the link are not the last satellite used to transfer the message in the path, and Case 2 is the opposite.

.

Faced with insufficient data, uncertainty statistics methods can be used to obtain the uncertainty distributions of processing delay on the satellite, gateway, and VN.

4.2.4. Evolution Rule of Dynamic Uncertain Satellite Network Model

The dynamic uncertain satellite network model describes the operation of an LEO-SCS in the normal state. However, in the actual operation, the satellite network is evolving due to the failure and recovery of satellites.

Definition 11.

The topology evolution of an LEO-SCS is the topology change of the system caused by satellite entry and exit due to its failure and recovery.

We present the evolution rule of the dynamic, uncertain satellite network model, including timing and an algorithm, to describe the topology evolution of the network structure.

(1)

Evolution timing

According to Definition 11, the topology evolution of the satellite network is caused by satellite failure and recovery. Once a satellite fails, it will de-orbit and a backup satellite will be transferred to the site of failure. The evolution timing of the system is as follows:

• Node exit time depends on the satellite failure time;
• Node entry time depends on the backup strategy of the system. Both in-orbit and ground backup are applied in an LEO-SCS [23,32,33].

  Table 2. Two types of satellite backup strategies.

  Backup Strategy	Strategy Details	Transfer Time
  In-orbit	Each orbital plane has a backup orbit, where one or more backup satellites are deployed. An operating satellite that fails will de-orbit and a satellite on its backup orbit will be transferred to the site of failure.	The in-orbit backup transfer time depends on the satellite orbit height and the relative position of the failed satellite and the backup satellite, which is a deterministic constant.
  Ground	When in-orbit backups are consumed to a certain extent, a carrier rocket will convey ground backups to supplement them. One rocket launch can carry one or more satellites.	The ground backup transfer time is mainly affected by the time to prepare the backup satellite. It can be estimated based on the production cycle, transfer cycle, other information and is a random variable.

  shows two types of satellite backup strategies.

(2)

Evolution algorithm

To model the uncertain satellite network evolution model, satellite failures and recoveries are added to the dynamic, uncertain satellite network model. The evolution algorithm is summarized as Algorithm 1, whose symbols are explained in

Table 3. Symbols in Algorithm 1.

Symbol	Meaning
$G(V,E(t),D(t\left)\right)$	Dynamic uncertain network
$G\left(V\right(t),E(t),D(t\left)\right)$	Uncertain satellite network evolution model
T	Simulation time
${\Phi }_f$	Satellite failure time distribution function
${\Phi }_g$	Ground backup transfer time distribution function
M	Number of satellite orbital planes
$N_s$	Number of satellites per orbit
$N_b$	Number of in-orbit backup satellites per orbit
$N_g$	Number of satellites carried by one rocket
$(m,n)$	Satellite number. If $n\le N_s$, it is the nth satellite in the mth orbit. If $N_s<n\le$ $N_s+N_b$, it is the $(n-N_s)$th backup satellite in the mth orbit.
$T_f$	Satellite failure time
$T_r$	Satellite recovery time
$t_{m,n}^o$	Operation time of satellite $(m,n)$
$t_{m,n}^f$	Failure time of satellite $(m,n)$
$t_{m,n}^t$	Transfer time of backup satellite $(m,n)$
$t_g$	Ground backup transfer time
$st{a}_{m,n}$	Status of satellite $(m,n)$, where $st{a}_{m,n}=0$ and $st{a}_{m,n}=1$ indicate failure and normal states, respectively, at time $t_{m,n}^o$

.

Using Algorithm 1, $G\left(V\right(t),E(t),D(t\left)\right)$ can be obtained by: (a) deleting the node and all its adjacent edges when it exits; and (b) adding the node and corresponding edges back when it enters.

Algorithm 1 Evolution algorithm

Input LEO-SCS parameters: $G(V,E(t),D(t\left)\right)$, M, $N_s$, $N_b$, $N_g$, T; Failure and recovery parameters: ${\Phi }_f$, ${\Phi }_g$ Output LEO-SCS parameters: $G\left(V\right(t),E(t),D(t\left)\right)$ Initialization: Let $t_{m,n}^o=0$ and $st{a}_{m,n}=1$ for $m=1,\cdots M,n=1,\cdots ,N_s+N_b$.                        Set $j=1$. While$t_{m,n}^o<T$ ($m=1,\cdots M,n=1,\cdots N_s$)      Rank $t_{m,n}^o$ from small to large for $m=1,\cdots M,n=1,\cdots N_s$, and denote the jth one      as satellite $(m\ast ,n\ast )$.      If $st{a}_{m\ast ,n\ast }=1$then //satellite $(m\ast ,n\ast )$ is in the normal state         Sample $t_{m\ast ,n\ast }^f$ according to ${\Phi }_f$.         Set $t_{m\ast ,n\ast }^o=t_{m\ast ,n\ast }^f+t_{m\ast ,n\ast }^o$ and $st{a}_{m\ast ,n\ast }=0$.      Else //satellite $(m\ast ,n\ast )$ fails         If $\exists st{a}_{m\ast ,n}=1$ and $t_{m\ast ,n}^o\le t_{m\ast ,n\ast }^o$ for $n=N_s+1,\cdots ,N_s+N_b$then // Orbit $m\ast$         has residual in-orbit backups             Calculate $t_{m\ast ,n}^t$ for $n=N_s+1,\cdots ,N_s+N_b$ if $st{a}_{m\ast ,n}=1$, and denote the one             with the minimal $t_{m\ast ,n}^t$ as backup transfer satellite $(m\ast ,n^{\#})$.             Set $st{a}_{m\ast ,n^{\#}}=0$, $t_{m\ast ,n^{\#}}^o=t_{m\ast ,n\ast }^o$, $t_{m\ast ,n\ast }^o=t_{m\ast ,n\ast }^o+t_{m\ast ,n^{\#}}^t$, and $st{a}_{m\ast ,n\ast }=1$         Else // Orbit $m\ast$ has no in-orbit backup satellite             Set $j=j+1$;         End         If $M\times (N_s+N_b)-{\displaystyle \sum _{m=1}^M}{\displaystyle \sum _{n=1}^{N_s+N_b}}st{a}_{m,n}=N_g$// Launch ground backups             Set $j=1$.             Sample $t_g$ according to ${\Phi }_g$.             For $m=1$ to M and $n=1$ to $N_s+N_b$ do                If $st{a}_{m,n}=0$ then                    Set $st{a}_{m,n}=1$ and $t_{m,n}^o=t_{m\ast ,n\ast }^o+t_g$.                End             End         End      End End

5. Resilience Evaluation for the LEO-SCS

To evaluate the resilience of an LEO-SCS, the end-to-end delay calculation method is presented. Then, the belief instantaneous availability can be computed, and the resilience of the LEO-SCS can be evaluated.

5.1. End-to-End Delay Calculation

Using a virtual topology strategy [34,35], the operation time of an LEO-SCS can be divided into discrete time slices with interval $△t$. When $△t$ is small enough, the topology can be considered static in each time slice. Therefore, the uncertain satellite network evolution model can be divided into multiple static uncertain networks with time interval $△t$, and the static uncertain network at the kth time slice can be denoted as $G_k(V_k,E_k,D_k)$. Then, the end-to-end delay can be calculated on each static uncertain network.

In an LEO-SCS, applications generally choose the delay minimization path for transmission. We use the most shortest path algorithm (Gao. [36]) to find such a path and calculate the end-to-end delay in the uncertain satellite network evolution model. Using this algorithm, an uncertain programming model is built to select the path that satisfies the maximum allowable delay (i.e., the delay threshold) with the maximum belief degree,

$$\begin{array}{c}max{\alpha }_k\hfill \\ \mathrm{s}.\mathrm{t}.\mathcal{M}\left\{{\displaystyle \sum _{e_{i,j}\in p_k}}{d}_{i,j}\le D_{th}\right\}\ge {\alpha }_k\hfill \end{array}$$

(14)

where $a_k$ is the belief degree at the kth time slice, $p_k$ is any path from the source node to the destination node at the kth time slice, $d_{i,j}$ is the delay on edge $e_{i,j}$, and $D_{th}$ is the delay threshold of the application.

Using an uncertain programming model, the delay minimization path with the maximum belief degree can be obtained for the static uncertain network, and the uncertain distribution of the end-to-end delay on the delay minimization path can be calculated. For details, please refer to Gao [36].

5.2. Belief Instantaneous Availability Calculation

The belief instantaneous availability can be computed from the uncertain distribution of the end-to-end delay calculated above. For an LEO-SCS, the service requirement differs by application, and the belief instantaneous availability should be computed separately.

As mentioned in Section 4, we use the end-to-end delay (an STB parameter) as the key performance parameter for LEO-SCS. The belief instantaneous availability for application i under a specific disruption and that under a normal state (without disruption) are influenced by epistemic uncertainties and can be respectively computed as

$$A_{B,i}\left(t\right)=\mathcal{M}\left\{m_i\left(t\right|d)>0\right\}=\mathcal{M}\left\{D_{th,i}-D_i\left(t\right|d)>0\right\}$$

(15)

and

$$A_{B,i}\left(t\right)=\mathcal{M}\left\{m_i\left(t\right|ns)>0\right\}=\mathcal{M}\left\{D_{th,i}-D_i\left(t\right|ns)>0\right\},$$

(16)

where $D_{th,i}$ is the delay threshold of application i, $D_i\left(t\right|d)$ and $D_i\left(t\right|ns)$ are its end-to-end delay under one specific disruption and normal state at time t, respectively, and $m_i\left(t\right|d)$ and $m_i\left(t\right|ns)$ are the delay margin of application i in one specific disruption and normal state at time t, respectively.

Considering the traffic volume of each application, the belief instantaneous availability of an LEO-SCS under one specific disruption and its normal state can be calculated as

$$A{}_B\left(t\right|d)={\displaystyle \frac{{\displaystyle \sum _{i=1}^{N_a}}A{}_{B,i}\left(t\right|d)F_i\left(t\right)}{{\displaystyle \sum _{i=1}^{N_a}}{F}_i\left(t\right)}}\mathrm{and}A{}_B\left(t\right|ns)={\displaystyle \frac{{\displaystyle \sum _{i=1}^{N_a}}A{}_{B,i}\left(t\right|ns)F_i\left(t\right)}{{\displaystyle \sum _{i=1}^{N_a}}{F}_i\left(t\right)}},$$

(17)

respectively, where $N_a$ is the number of applications in the system, and $F_i\left(t\right)$ is the traffic volume of application i at time t. Combining Equations (11) and (15)–(17), the resilience of an LEO-SCS can be computed.

5.3. Resilience Evaluation

Using the belief instantaneous availability calculation method, the resilience of an LEO-SCS can be evaluated as follows:

• Gather the information of applications on the system, including traffic volume $F_i\left(t\right)$, source node, destination node, and delay threshold $D_{th,i}$;
• Use the uncertain satellite network evolution model in Section 4.2 and the delay bounded routing algorithm in Section 5.1 to simulate the end-to-end delay of each application for every time interval $△t$ under a specific disruption (i.e., with satellite failure) and in a normal state (i.e., without satellite failure);
• Using Equations (11) and (17), measure the behavior of the LEO-SCS after the jth disruption,

  $${\displaystyle \frac{\underset{t{}_{0,j}}{\overset{t{}_{0,j}+T{}_a}{\int }}A{}_B\left(t\right|d)dt}{\underset{t_{0,j}}{\overset{t_{0,j}+T{}_a}{\int }}A{}_B\left(t\right|ns)dt}}={\displaystyle \frac{{\displaystyle \sum _{k=\left[\frac{t_{0,j}}{△t}\right]}^{\left[\frac{t_{0,j}+T{}_a}{△t}\right]}}A{}_B(k△t|d)△t}{{\displaystyle \sum _{k=\left[\frac{t_{0,j}}{△t}\right]}^{\left[\frac{t_{0,j}+T{}_a}{△t}\right]}}A{}_B(k△t|ns)△t}},$$

  (18)

  where $t_{0,j}$ is the time at which the jth disruption started;
• Repeat steps (2) and (3) N times, and calculate that there are $N_r$ behaviors after a disruption that are greater than $r_{eth}$. The belief resilience of the LEO-SCS is

  $${\widehat{R}}_E=\frac{N_r}{N}.$$

  (19)

6. Case Study

6.1. Overview

6.1.1. Topology

We consider a Walker LEO-SCS with eight orbital planes at a height of 1300 km. The inclination of each orbital plane is 70 degrees, and six satellites are evenly distributed on each plane. As shown in Figure 4, each satellite has four adjacent satellites, two intra-planes and two inter-planes.

There are four gateways in the system-in Beijing, Haikou, Kashgar, and Jiamusi. These connect the terrestrial network in China with the satellite network, and all can provide satellite connections for terrestrial users.

According to the virtual node strategy in Section 4.1, we divide the Earth’s surface into 104 ground grids, each with an area of about $4.9\times {10}^6$ square kilometers. A virtual node is set at the center of each grid, to provide service for all terminal users in the grid. Figure 5 shows the 104 virtual nodes, which are marked with plus (‘+’) signs.

As described in Section 4.2.1, the processing delay of each node in the system is considered an uncertain variable. To the best of our knowledge, processing delay of communication networks has not yet been characterized as uncertain variables. When the delay is a random variable, it can be represented by the uniform distribution [37,38]. Considering that the delay in an LEO-SCS depends on the propagation delay and processing delay and the latter one is a deterministic variable, we assume that the processing delays of satellites and virtual nodes obey a linear uncertainty distribution, the processing delays of gateways follow a zigzag uncertainty distribution, and their related parameters are shown in

Table 4. Parameters of processing delays on nodes.

Node Type	Processing Delay (ms)
Virtual node	$\mathcal{L}(1,15)$
Satellite	$\mathcal{L}(1,20)$
Gateway	$\mathcal{Z}(2,3,8)$

.

6.1.2. Application

We consider transmissions between user terminals and terrestrial users in China, where all applications have the same priority. The delay bounded routing algorithm in Section 5.2 is used, and the delay thresholds of all applications are 200 ms.

The traffic requirement from zone $Z_{sn}$ to zone $Z_{dn}$ at hour H can be calculated as [39]

$$T\left(Z_{dn},Z_{sn},a_H\right)=\frac{{\left(u_{sn}\times h_{dn}\right)}^{0.5}}{{\left(dist(dn,sn)\right)}^{1.5}}\times a_H,$$

(20)

where $u_{sn}$ is the user density in $Z_{sn}$, $h_{dn}$ is the host density in $Z_{dn}$, $dist(dn,sn)$ is the distance between $Z_{dn}$ and $Z_{sn}$, $a_H$ is the activity percentage at hour H in $Z_{sn}$.

According to the activity percentage per hour of users around the world [39], the number of Internet users, the number of hosts, and other statistical data [40,41], the real-time traffic in the LEO-SCS can be calculated using Equation (20).

6.1.3. Failure and Recovery

We assume that the failure time of satellites in an LEO-SCS are independently and identically distributed with an exponential distribution, with a failure rate of $\lambda =1/T_s$, where $T_s=5$ years is the design lifetime of satellites.

The in-orbit and ground backup strategies in Section 4.2.4 are designed for an LEO-SCS as follows.

• In-orbit backup strategy: each operating orbit has a backup orbit that locates directly below at a height of 1000 km, and one backup satellite is deployed in each backup orbit;
• Ground backup strategy: each launch can carry one backup satellite to supplement the in-orbit backup, and the ground transfer time obeys a uniform distribution, $U(30,60)$ days.

The maximum allowable recovery time of the system is determined as 15 days.

6.2. Resilience Analysis and Discussion

We built the uncertain satellite network evolution model for this Walker LEO-SCS according to Section 4.2, and the system resilience is computed according to the resilience estimation model in Section 5.

Figure 6 shows the belief instantaneous availability of LEO-SCS under both ideal and actual conditions over 6 years. As shown in Figure 6a, the belief instantaneous availability of the system fluctuates in the range of $0.994\sim 1$. Fluctuation is caused by the dynamic movement of the satellites and internet traffic intensity changes over time. From Figure 6b, one can see that the belief instantaneous availability of the system degrades several times under actual conditions, and these are caused by satellite failure.

When a satellite fails, the link connected with it also fails, the network topology of the system evolves, and ground nodes previously connected through the failed satellite must find another connectable satellite. If none exists, the ground node will lose the satellite connection. Transmissions previously relayed through the failed satellite must select a new path. As the LEO-SCS applies the delay bounded routing algorithm, the new connection or path tends to be longer than the original at the same belief degree. So, satellite failure will cause delay-based availability to decrease, and instantaneous availability will fluctuate at a lower level until a backup satellite replaces the failed one. From Figure 6b, it can be seen that: (1) some degradations recover quickly and some slowly, depending on whether the in-orbit backup can be used when the satellite fails; (2) availability degradation varies due to the number of satellite failures and the failure time. Two examples are used to illustrate these phenomena.

Figure 7 shows the belief instantaneous availability of a system when two co-orbiting satellites fail successively. At time $t=4980$ min, the first satellite failed, and the system was restored after 193 min using its in-orbit backup. At time $t=8463$ min, another satellite in the same orbit failed. The only in-orbit backup was used when the first satellite failed, there was no in-orbit backup when the second satellite failed, and the system had to wait for a ground backup. Therefore, the second system recovery consumed a much longer time, and the system was restored at time t = 68,952 min.

Figure 8 shows the belief instantaneous availability of a system under dual satellite failures. The first satellite failed at time $t=100$ h, which slightly reduced the system availability. At time $t=190$ h, another satellite failed in another orbit, but the first failed satellite was not recovered, as its in-orbit backup had been consumed earlier. At this time, two satellites in the system failed. Compared with a single satellite failure, more ground nodes lose satellite connectivity, and more users choose new longer paths in this case. This led to further availability degradation. When the second failed satellite was recovered using its in-orbit backup at time $t=221$ h, the system availability increased to the level under the single satellite failure. At time $t=622$ h, the first failed satellite was recovered using the ground backup, and the system availability returned to the normal.

In the case above, the backup strategies included both in-orbit and ground backup. When dual satellite failures occur, the possibility that different recovery strategies are adopted, as shown in

Table 5. Recovery strategies adopted under dual satellite failures.

Recovery Strategies	Two In-Orbit Backups	One In-Orbit Backup and One Ground Backup	Two Ground Backups
Percentage	9.87%	83.96%	6.17%

. The number of in-orbit backups in each orbit is 1. One can see that over 90% of dual satellite failures use at least one ground backup. Ground backup takes longer to restore the system, and during this time, other satellites are more likely to fail. Therefore, the probability of dual satellite failures can be reduced by increasing the number of in-orbit backups and decreasing the transfer time of the ground backup. Using this method, system resilience can be improved.

According to the analysis above, the satellite recovery time significantly affects the system belief instantaneous availability and thus the system resilience. In an LEO-SCS, the number of in-orbit backups and the satellite orbital lifetime determine the recovery time in practice. We calculated the system resilience under different satellite compositions and backup strategies when the requirement for the system’s behavior after a disruption was 0.99. The results are shown in

Table 6. System resilience under different satellite compositions and backup strategies.

		No. of In-Orbit Backups	1	2	3
	Resilience
Satellite Orbital Lifetime (years)
3 years			0.7484	0.9766	0.9963
5 years			0.8240	0.9828	0.9967
7 years			0.9032	0.9969	0.9973

.

As shown in Table 6, adding more in-orbit backups and extending satellite orbital lifetimes can improve the resilience of an LEO-SCS because more in-orbit backup reduces satellite recovery time and a longer satellite orbital lifetime reduces the probability of satellite failure. The initial increment on in-orbit backups is more effective than subsequent ones. For example, when the number of in-orbit backups increases from 1 to 2, the system resilience increases more than when backups increase from 2 to 3. Therefore, when designing an in-orbit backup strategy for an LEO-SCS, it is necessary to consider satellite orbital lifetimes, system resilience, and cost comprehensively.

7. Conclusions

We proposed a belief resilience measure. Based on this, a dynamic uncertain satellite network evolution model was developed to describe a dynamic uncertain LEO-SCS, and a methodology was proposed to estimate the resilience of the model. A Walker LEO-SCS with 48 satellites was used to demonstrate the effectiveness of our method, and the influence of the number of in-orbit backups and the satellite orbital lifetime on system resilience was analyzed. The results show that the proposed measure can be used to quantify the resilience of systems with aleatory and epistemic uncertainties. The recovery time of satellites is the main factor affecting system resilience, and the number of in-orbit backup satellites and the satellite orbital lifetime play important roles in increasing LEO-SCS resilience. The proposed resilience evaluation methodology can be used for LEO-SCS comparison, optimization, and design.

The number of satellites in an LEO-SCS has reached hundreds or thousands. How to quickly and accurately assess the resilience of such giant systems will be studied further in our future research.