Passivation: How a Spent Rocket Stage Is Made Unable to Explode

Ask someone what makes space debris and they will describe a collision: two objects meet at ten kilometres a second and a cloud comes out. That happens, but it is not the main way orbit gets dirtier. ESA's account is blunt — the majority of the roughly 200 on-orbit break-ups observed by 2017 were explosions, not collisions, and those events account for about 35 per cent of all space debris ESA.

An explosion in orbit needs no second object, only a sealed tank with something left in it. Passivation is the engineering answer: before a stage or satellite is abandoned, you deliberately empty it of every form of stored energy that could later burst it. It is the cheapest debris mitigation there is, it is Flown and routine on most modern launchers, and the fragments still on orbit from stages abandoned in the 1980s are the record of what happens when it is skipped.

What is actually left in a stage after the engine stops

A rocket upper stage shuts down when the payload is in the right orbit, not when the tanks are dry. Margins exist so the mission does not fail on a bad day, so a nominal flight ends with propellant still aboard. Alongside it sits high-pressure helium or nitrogen that pushed the propellant into the pumps, a battery that ran the avionics, and sometimes spinning wheels and pyrotechnics. ESA describes the mechanism plainly: break-ups arise from "internal pressure resulting from the stored energy in propellant and pressurant tanks, in the form of pressurant gas or residual propellants" ESA.

Then the environment works on it for years. A stage in low orbit crosses in and out of sunlight every ninety minutes, and each cycle drives the tank walls through a thermal swing. Seals creep. Hypergolic propellants that must never meet are held apart by a valve qualified for hours of flight, not decades. Cells left with charge in them can go into thermal runaway. Any one of these turns a two-tonne empty cylinder into several hundred tracked objects, in an orbit chosen for the payload's convenience and usually too high for the atmosphere to clean up — the arithmetic is in the orbital clock.

How you actually take the energy out

There are two families of technique, and most vehicles use both. The first is the depletion burn: after payload separation, restart the engine and burn the residual propellant to nothing. Aim that burn and it lowers the stage's perigee too, shortening its lifetime — the practice described in how to deorbit a satellite at the end of its life. ESA notes the limit: depletion burns work poorly on hydrazine monopropellant systems, where the engine cannot reliably consume the last of it ESA.

The second is venting: open a permanent hole to space and let the tanks equalise with vacuum, using "venting valves or pipe perforators" ESA. The requirement is unforgiving. The valve must stay shut through launch and the whole mission, then open once, reliably, on a vehicle whose avionics are about to be switched off forever, and never close again. ESA's Clean Space programme has pursued shape memory alloy actuators that open when a heater takes the alloy past a transformation temperature near 100 degrees Celsius, for their unlimited shelf life and lower shock than pyrotechnic valves ESA. Batteries get the same treatment by other means: discharge them and keep them discharged, or hold the state of charge permanently below the threshold at which thermal runaway can start ESA.

What the rules require, and how well they hold

Passivation is not advice any more. ESA's compliance verification guidelines require it before end of life for every mission except one ending in a controlled reentry, and attach a number: the probability of successful passivation must be at least 0.90, rising to 0.95 for the high-risk cases — geostationary orbit, and low orbits whose natural decay would take more than 25 years ESA. Propellant and pressurant must be vented to the lowest residual pressure the state of the art allows, verified against worst-case thermal conditions.

Compliance is improving for launch vehicles. ESA's 2026 environment report finds controlled reentries of rocket bodies rose from about 10 per cent to over 65 per cent over the last decade and now outnumber uncontrolled ones — passivation's better sibling, since you need not make an abandoned stage safe if you never abandon it. But the same report puts the two-decade average at 9.8 non-deliberate fragmentations a year and judges current compliance broadly insufficient for a sustainable environment long term ESA.

The failures are specific and recent. A CZ-6A upper stage broke up at 17:15 GMT on 6 August 2024 at roughly 857 by 797 kilometres, just after deploying eighteen Qianfan spacecraft, and NASA had catalogued 283 large fragments within six weeks; an earlier CZ-6A stage, 2022-151B, produced 793, which NASA calls the worst break-up of an upper stage in history; and a DMSP 5D-2 F8 event in July 2024 was, in NASA's assessment, "likely battery related" NASA ODPO. ESA records 2024 as adding over 3,000 catalogued fragments, mostly from propulsion-related breakups ESA. Those are the shells where debris already concentrates, the setting for our scenario on a cascade at 850 kilometres.

Why passivation is not the same as cleaning up

Here is the thing to hold onto: a perfectly passivated stage is still a two-tonne object in a crowded orbit. It cannot explode, which removes one failure mode. It can still be hit, which leaves the other. The Ariane H-10 third stage from flight V26 shows what the old way cost — launched 28 October 1988, recorded in the catalog as ending on 22 December 1988, with nine debris objects dated to that same day, four of them still on orbit thirty-eight years later GCAT. An Ariane third stage had already broken up in 1986, and NASA's fragmentation history credits the response of Arianespace and ESA to that event as an early sign that operators meant to behave responsibly NASA ODPO. The engineering answer arrived. It retrieved nothing.

ClearOrbit's view

Passivation is the highest-leverage thing in debris mitigation and nearly finished as a technical problem. The remaining effort belongs in the boring parts: venting hardware qualified for thirty years rather than thirty minutes, published passivation outcomes per flight so a 0.90 requirement can be audited, and operators treating a failed vent as a reportable anomaly rather than a private one. When a stage breaks up and no cause is published, everyone else's models get worse.

But be precise about what mitigation buys. Every rule here is about not making the problem worse; none of it makes the problem smaller. The 14,090 debris objects and spent stages in the catalog today are the accumulated output of decades in which the rules either did not exist or were not met, and they will still be there when passivation is universal GCAT.

That is the gap ClearOrbit exists to close, and we are direct about where we stand: a ClearOrbit vision, not flown hardware. Nobody has removed a piece of debris from orbit yet. Passivation stops the bleeding; somebody still has to collect the stages abandoned before anyone thought to open a valve.