that is defined for the particular spacecraft under consideration) and is not able to calculate the total MMOD risk (which would include the probability of spacecraft loss or kill), (2) that it provides a point estimate of MMOD risk with no assessment of its associated uncertainty, and (3) that it does not take into consideration in its risk-calculating modules and algorithms the possibility of non-spherical particle impacts. These points are discussed in more detail in the following sections.


As noted previously, NASA currently uses BUMPER to calculate the risk of MMOD impact that would cause mission-limiting or life-threatening damage to the International Space Station, EVA suits, or other spacecraft (and, previously, for the space shuttle).5 This calculated value for risk, or probability of spacecraft failure, is then compared against design requirements to determine whether or not a proposed design, or a proposed design change (e.g., number of shields), will allow the spacecraft to meet its design requirements. Thus, in addition to being used to estimate the risk associated with a given design, BUMPER can also be used as a design tool, given an acceptable level of risk. However, if BUMPER is used as a design tool, the resulting design must be evaluated carefully, because BUMPER assumes that any hole is a failure, regardless of whether it is a pinhole or a 10-cm-diameter hole.

In an effort to rectify this situation (i.e., that the existing risk assessment tool then used by NASA equated all module wall penetrations to spacecraft failure or loss) for the ISS, NASA developed a separate code to specifically calculate the probability of a spacecraft loss given a penetration of the crewed habitation modules. This computer program is known as the Manned Spacecraft and Crew Survivability (MSCSurv) code. Unlike BUMPER, MSCSurv has the ability to compute the uncertainty associated with its output as well as the potential for expansion for use with NASA robotic spacecraft.6,7

Once a penetration occurs, MSCSurv initiates its process of quantifying how the possible hazards associated with the penetration contribute to the probability of crew or station loss. Currently seven general hazards or “loss modes” that are considered a catastrophic loss (or kill) are analyzed by MSCSurv as a result of debris particles penetrating crewed modules:

  • External equipment loss,
  • Critical cracking,
  • Internal systemic loss,
  • Internal payload loss,
  • Crew hypoxia during escape or crew member rescue,
  • Fatal injury to crew, and
  • Thrust-induced angular velocity departure loss.

In addition, MSCSurv considers three other hazards, two of which could lead to a late loss of the station:

  • Non-fatal injury to crew,
  • Late loss of station control, and
  • Critical module depressurization.

Developed in recognition of BUMPER’s structure, input, outputs, and limitations, the MSCSurv program has never been integrated directly with BUMPER into a single program. This level of integration is possible and may offer improvements in removing the duplication in input files, geometry files, and others. A new code integrating


5 Abbott et al., BUMPER-II Analysis Tool: User’s Manual, 1993.

6 J. Williamsen, Vulnerability of Manned Spacecraft to Crew Loss from Orbital Debris Penetration, NASA TM-108452, NASA, Huntsville, Ala., April 1994.

7 H. Evans, K. Blacklock, and J. Williamsen, Manned Spacecraft & Crew Survivability (MSCSurv) Version 4.0 User’s Guide, Report No. 651-001-97-006, Sverdrup Technology, Inc., Huntsville, Ala., September 1997.

The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement