Orbital Propellant as Infrastructure

Abstract

Reusable transportation cannot scale if every vehicle launches with all lifetime propellant or returns to Earth for refueling. I define orbital and surface propellant infrastructure as a measured service that accepts commodity, preserves it, certifies it, transfers it, and isolates faults across vehicles. Cryogenic liquids complicate every step. Environmental heat drives self-pressurization and boiloff. Low gravity changes liquid location, venting, gauging, and acquisition. Transfer creates thermal transients, vapor, contamination, pressure surge, and residuals. The architecture combines low-leak tanks, insulation, sunshades, active cooling, mixers, pressure control, capillary or settled acquisition, standardized couplers, independent metering, emergency disconnect, and protected disposal. Depots are introduced only where campaign demand exceeds their own launched mass, energy, loss, and maintenance. The essential demonstration is not one transfer. It is repeated custody of useful propellant through time.

Propellant service changes vehicle design

A vehicle designed to refuel can carry less propellant across earlier legs, reuse tanks and engines, and specialize around one route. It also becomes dependent on interface compatibility, inventory availability, product quality, transfer equipment, and storage reliability.

I treat a depot as part of the transportation spine, not a passive tank. It performs receipt, quarantine, conditioning, storage, inventory, scheduling, transfer, sampling, fault isolation, and disposal. Its business is assurance.

NASA’s cryogenic fluid management portfolio identifies storage, transfer, and measurement of liquid hydrogen, oxygen, and methane as enabling capabilities. These liquids offer valuable propulsion performance and possible alignment with local production. Their temperatures make heat leak a permanent operational concern.

Heat leak becomes lost mission capability

For stored liquid mass $m$, latent heat $h_{fg}$, and net heat leak $\dot Q$, an ideal boiloff screen is

$$\dot m_b=\frac{\dot Q}{h_{fg}}.$$

If a liquid-hydrogen tank receives 500 watts and $h_{fg}\approx446\ \mathrm{kJ/kg}$, ideal boiloff is about $0.097\ \mathrm{kg/day}$. Over one year that exceeds 35 kilograms. Real tank behavior includes sensible heating, ullage, mixing, vent logic, stratification, supports, penetrations, and varying environment.

Passive control uses multilayer insulation, vapor-cooled shields, low-conductivity supports, favorable orientation, and sunshades. Active cooling can achieve reduced or zero boiloff at the cost of electrical power, cryocooler mass, radiators, redundancy, vibration, and service life. The system optimum depends on stored duration and commodity value.

Hydrogen is especially demanding because of its low temperature and density. Oxygen and methane are easier, not easy. A depot may choose different tank and refrigeration architectures for each commodity.

Low gravity changes the tank

On Earth, gravity places liquid at the bottom and vapor at the top. In orbit, surface tension, acceleration history, wetting, and internal geometry determine phase distribution. A vent can expel valuable liquid. A pump inlet can ingest vapor. A level sensor based on height can become meaningless.

The system needs methods to settle or control the liquid, acquire vapor-free propellant, mix stratification, and estimate inventory. Options include brief acceleration, capillary devices, vanes, diaphragms for some fluids, radio-frequency gauging, thermal methods, pressure-volume-temperature estimation, and flow integration.

No single gauge should authorize a crew departure. I want independent inventory estimates reconciled with transfer meters and tank thermodynamic state. Uncertainty must be included in usable mass:

$$m_{usable}=m_{estimated}-m_{residual}-m_{reserve}-k\sigma_m.$$

A full tank with large uncertainty may support less mission commitment than a smaller tank measured well.

ReceiveIdentify and quarantine commodity

Checks source, composition, temperature, pressure, and interface state.

PreserveControl heat and pressure

Uses insulation, shielding, mixing, cooling, and bounded venting.

KnowMeasure usable inventory

Reconciles diverse gauges, flow meters, residuals, and uncertainty.

DeliverCondition and transfer safely

Manages chilldown, phase, surge, leakage, disconnect, and verification.

Transfer is a thermal operation

Warm lines and receiver tanks flash incoming liquid into vapor. Chilldown can consume commodity before steady transfer begins. Pressure difference, pumps, or other methods move fluid, but each must maintain acceptable phase and avoid surge, cavitation, or structural overpressure.

A controlled transfer sequence includes identity match, mechanical capture, electrical bonding, leak check, line evacuation or conditioning, chilldown, receiver pressure preparation, flow start, stable transfer, inventory reconciliation, line clearing, isolation, leak verification, and disconnect.

MateCapture and identify ConditionPrepare tanks and lines MoveControl flow and pressure MeasureReconcile delivered mass SecureClear, isolate, and disconnect

Emergency disconnect must prevent two damaged open lines from releasing both inventories. Couplers need double isolation, captured residuals, temperature tolerance, debris protection, alignment accommodation, leak detection, and repeated-cycle life. Lunar surface versions also need aggressive dust control.

Standardize commodity and custody

A common coupler is insufficient if providers disagree about purity, pressure, temperature, allowable noncondensable gas, sampling, meter uncertainty, or transfer authority. The service contract should define commodity specification, interface loads, grounding, data, control roles, abort thresholds, and custody point.

Independent metering matters because propellant is safety-critical and potentially traded. The sender’s tank decrease and receiver’s increase should reconcile with measured flow and known line residual. A discrepancy triggers investigation before the mission commits.

Cybersecurity belongs here. Commands that open valves or enable pumps carry physical consequence. Authentication, local interlocks, two-party authorization where appropriate, and immutable event records protect the transfer.

Place depots where demand closes

A depot has dry mass, launch demand, station keeping, energy, boiloff, maintenance, collision exposure, and disposal obligations. It only helps if repeated traffic uses it.

I would compare architectures through lifetime delivered propellant:

$$\eta_{service}=\frac{M_{delivered\ to\ users}} {M_{propellant\ launched}+M_{depot}+M_{spares}+M_{loss}}.$$

The ratio should be evaluated with schedule and failure. A strategically placed depot that occasionally saves a mission can justify lower mass efficiency. A depot with no dependable customers becomes a complicated object that must still be controlled and retired.

Initial infrastructure can begin with compatible vehicle-to-vehicle transfer, then add dedicated storage after cadence exists. Lunar-produced oxygen may enter the network first as a supplemental commodity, isolated by batch, before crew return depends on it.

Propellant becomes infrastructure when a vehicle can arrive with a declared need, obtain certified usable mass through a known interface, and depart without the transfer becoming a one-off experiment. Until repeated storage and custody are demonstrated, a depot remains an ambitious tank.