How can just making the ground broadcast stronger neutralize a zombie(sat)?

Question

In April of 2010 the Geo-not-so-stationary satellite Galaxy-15 stopped responding to ground commands. It operates as a "bent-pipe" or Transponder system, which means - roughly speaking - it will amplify and rebroadcast back to earth whatever TV programming it happens to receive from Earth (within prescribed frequencies).

Geostationary satellites need to perform regular station-keeping maneuvers to stay put, and since commercial satellites are typically not able to do this, regular instructions are sent from the ground and must be received in order to keep the satellite wherever it's supposed to be.

So when Galaxy-15 stopped responding to commands, it started to drift uncontrolled within the geostationary "belt". That is a potential collision problem, but the other problem was that all the other systems worked. It maintained it's solar panels pointing towards the sun and kept "Earth lock" meaning that it had its receiving and transmitting antennas pointed down towards Earth.

Once it drifted into another "box" which happened to have TV signals beamed up from the ground in the same microwave band, it would dutifully amplify them and broadcast them back to Earth, and so even without a physical collision it could cause serious interruptions to other satellite's duties. This mindless capture and rebroadcast without control is what makes the term ZombieSat fitting.

The following is from Dealing with Galaxy 15: Zombiesats and on-orbit servicing:

Whatever malfunction did occur did not affect either the satellite’s ability to re-broadcast signals or its ability to keep its transponders pointed at the Earth and solar panels aligned with the Sun (known as “Earth lock”). This allowed the spacecraft to continue to receive and transmit signals. What it did affect was the ability of Intelsat’s ground controllers to maneuver Galaxy 15 to maintain its orbital position. Intelsat issued between 150,000 and 200,000 commands to the satellite in an attempt to get a response to either turn off its communications payload or maneuver. When these efforts failed, the company attempted to send an even stronger signal to try and force an overload of the satellite’s power system and cause it to shut down. This too failed. As a result, the satellite continued to drift slowly eastward through the GEO belt. What had seemed like a small problem was about to get much bigger.

My question: Is this a bug, or a feature? Isn't there some kind of automatic gain control or AGC? I am guessing that the idea in this attempt to shut down the transponders is to rely on the (preseumably) fixed gain of the amplifier - that stronger-in means stronger-out - and so one can trip something analagous to a circuit breaker by shouting really loud into the microphone so to speak. Was the inability of the amplifier to limit its gain designed in as a feature (a brute force shut-down when all else fails), or was it necessary due to other constraints, or did someone just forget to add an AGC?

One might argue that an AGC might diminish weak signals too far while attempting to limit a strong signal, but dynamic frequency-dependent gain has been around in fiber optic Dense Wavelength Division Multiplexing (DWDM) with 40 or 80 wavelengths, (although those are a different types of modulation e.g. digital QPSK)) so I'm thinking that that would not be a reason to avoid AGC.

That they attempted this suggests that either there was no AGC or that they knew it may be inadequate under extreme conditions. So its not even clear to me if the hoped-for shut down would have been exptected behavior, or wishful thinking. Could somebody with a really big steerable dish start shutting down lots of communication satellites this way? Could a day come when billions of people would experience cable TV withdrawl syndrom all at the same time?

above: "Basic +20dB, automatic gain control cell - as used in 1970s telephone networks." A simple example of a circuit which will adjust the amplifiers gain if the signal is too strong, from here.

Answer 1

Without the transcript of the meetings where the design of the signal conditioning electronics was agreed I don't think we can answer this with certainty. However, I can speculate a bit more:

The language used "force an overload... cause it to shut down." is very terminal. Intelsat seem to have been primarily concerned with ensuring Galaxy-15 didn't start to interfere with any other Geo sats. I would guess that the effect of the overload would have been permanent. That they tried it suggests that they thought it had a reasonable chance of success. They probably got the design schematics out and asked their engineers to work out a way to break it any way they could.

One other interesting (and highly unlikely) reason for their urgency might have been the presences of two L band Geostationary Communications and Control Segment transponders on Galaxy-15. Officially the GCCS is managed by the FAA to improve the accuracy of GPS navigation, but it wouldn't be very surprising if other, classified, payloads where included alongside the primary. The cause of the loss of control hasn't officially been established, and the possibility of a foreign goverment ~cough~ China ~cough~ taking control couldn't immediately be ruled out. If the USG thought that their toys were about to walk off on their own they quite possibly ordered Intelsat to nuke their bird with every watt they could aim skyward. Unlikely, but an interesting possibility.

Returning to the AGC part of your question: Only an idiot someone with a good reason would design an amplifier without any sort of overload protection, especially when the amplifier may be exposed to broad-spectrum solar flares. The fact that the attempt to kill Galaxy-15 failed is probable testament to this. I'd expect modern satellites to use a digitally controlled amplifier system, so they would use logic to control the gain rather than an AGC. Combined with a high input impedance this would make it very hard to break the amplifier.

Could you kill a satellite with a large enough signal? Absolutely.

Because the AGC failed? Probably not. EMF excitation somewhere else in the spacecraft would probably be fatal before the input protection broke down in a way that would permanently damage something.

Answer 2

I agree with ForgeMonkey that there is little to say based on public domain sources.

However, for the necessarily speculative nature of an answer I would instead suggest the following as typical approaches within geostationary communications satellites:

1. my starting point is that the Question asks about the transponders, i.e. the payload, rather than the command uplink. I'll come back to commanding later. Also please note that this question does not seem to be addressing the actual recovery process, it is just asking about the use of a high power ground uplink.
2. some satellites used fixed gain, and some use a form of AGC for getting the right level of the signal, it is more likely to be applied at the level of each transponder (Galaxy 15 had 24) than in a digital control loop at the whole payload level.
3. payload protection may not have contemplated a high-power uplink, it is a civil satellite, but even if it did it doesn't help the satellite as a whole because it is the command link, not the payload, that has a problem.
4. satellite level protection may also have assumed payload shedding in the case of a loss of power, it would be usual for the payload to be shed before the TT&C system (the part that receives commands),
5. that said it is not impossible that the same satellite protection may have instigated a computer reset or swap to redundant units in case of a power short-fall. For this to make sense we have to imagine that over-demand for power from the transponders could cause a bus undervoltage and thus appear to have the same symptoms as a lack of power. EDIT In this sense AGC at the transponder level could actually hinder the reset by preventing a bus undervoltage, though they could be developed into a form of emergency command path if the central unit was programmed to respond to "high uplink power => reset TTC".
6. Lastly, the quoted source does not seem to make the same assumption that the high power r.f. was directed at the payload transponders. If it was instead aimed at the command receiver then that device instead would need its own protection logic that triggered a reset if the power level were too high. Its not impossible but it sounds like it would more likely be implemented as a response to an internal failure that had similar electrical symptoms.

Putting this all together it seems we are left with No. 5 or No. 6, though even then its all rather sketchy.