Limiting Future Collision Risk to Spacecraft: An Assessment of NASA's Meteoroid and Orbital Debris Programs (2011)

6

Spacecraft Protection in the MMOD Environment

There are three basic approaches to protecting spacecraft against the hazards of meteoroid and orbital debris (MMOD) impacts. They are typically categorized as passive, active, or operational:¹

• Passive protection approaches are applied before a spacecraft is launched. These methods typically involve spacecraft shielding, redundant system design, orbit selection to lower particulate risks, and so on.

• Active protection approaches are taken once a spacecraft is in orbit in order to reduce the risk to it. These activities may include, for example, the elimination of debris in the path of an orbiting spacecraft, the avoidance of collisions, or the removal of large objects to eliminate future potential debris-generating events.

• Operational approaches are designed to protect a spacecraft against damage from particles that are too large to actively protect against or too small to be seen and avoided. These techniques can include intelligent spacecraft attitude profiles, smart working and living arrangements (e.g., placing astronauts in areas not directly exposed to the particulate flux), and so on.

All of these approaches share a common goal—to protect a spacecraft (and its inhabitants, if any) against system loss as a result of an MMOD impact. This goal is typically translated into a design requirement that specifies a certain probability that the spacecraft will remain operational for a specified number of years in the MMOD environment. Chapter 7 focuses on ensuring the safety of a spacecraft through active means to reduce the debris that poses a hazard to the spacecraft. In addition, Chapter 3 and Chapter 4 provide a comprehensive description of the particulate environment that space systems must be able to survive. This chapter focuses on examining the probability of system failure given an MMOD impact and on the protection of spacecraft to reduce the probability of failure.

CALCULATING THE PROBABILITY OF MMOD IMPACT

NASA currently uses the BUMPER code to calculate the risk of MMOD penetration for the International Space Station (ISS), extravehicular activity (EVA) suits, and other spacecraft and also used BUMPER to calculate the probability of an MMOD impact causing critical damage for each space shuttle mission.² Originally developed

___________________

¹ National Research Council, Orbital Debris: A Technical Assessment, National Academy Press, Washington, D.C., 1995.

² D. Abbott, D.R. Williams, and M.D. Bjorkman, BUMPER-II Analysis Tool: User’s Manual, Report No. D683-29018-2, Boeing Company, Huntsville, Ala., 1993.

by Boeing under contract to NASA Marshall Space Flight Center for use on the Space Station Freedom program in 1986, the original BUMPER code was designed for use on VAX computers and is still used on workstations for space shuttle and ISS assessments. In 1991, the BUMPER code was updated to the BUMPER II code, and configuration control was established at NASA Johnson Space Center in 1994. BUMPER II (hereafter referred to simply as BUMPER) is now clearly considered the standard by which other MMOD risk assessment tools are measured—even the European and Russian space agencies have used versions of it. Two versions of BUMPER have been maintained, one for the ISS program and one for the space shuttle program. The primary differences between the two versions are in the impact damage subroutines related to different exterior materials and failure criteria.

From the perspective of a particle–spacecraft interaction that could lead to spacecraft failure, risk from a single MMOD impact may be considered to be a product of the following three terms:

• The probability of impact, or hit (PH);
• The conditional probability of penetration given that an impact has occurred (PP/PH); and
• The conditional probability that the penetration yields a loss, or kill, of spacecraft or crew given that a penetration has occurred (PK/PP).

These terms can be combined in a number of ways to determine PK for a spacecraft. For example, the first two terms (PH and PP/PH) can combine to form the probability of penetration, or PP. This is essentially what BUMPER was originally designed to do—to determine the probability of penetration of the space station—because a penetration was (conservatively) equated with a crew or station loss. It is because of this original (highly conservative) assumption that the last term—the probability of “kill” given a penetration (PK/PP)—while clearly an integral part of the total risk equation, was never designed for inclusion within BUMPER. However, the ability to quantify the PK/PP term—the vulnerability of spacecraft to loss following penetration—allows spacecraft designers to examine the entire probability of loss, thereby shifting some of the focus on increasing safety with respect to orbital debris from the external portion of the spacecraft or the ISS to the entire spacecraft design envelope, including internal equipment design, crew procedures, and other factors that contribute to potential failure modes and the overall probability of loss.

BUMPER is used as an in-line requirements compliance verification tool by the ISS and was previously used for the space shuttle, as well. It is also being used for development of the Orion Multipurpose Crew Vehicle.³ It has been used by ISS contractors and international partners to design shielding to protect station crews and meet lifespan requirements. BUMPER has also been used to identify ways of reducing the risk posed by MMOD to within established NASA risk levels (through operations, shielding, or other means). Space shuttle mission profiles and operations were often directly affected by risk predictions based on BUMPER calculations, which resulted in a reduced risk from the MMOD environment to the vehicle.⁴

For example, BUMPER predictions were essential in determining the proper positioning of the payload bay door on STS-73 to provide MMOD protection to some otherwise lightly protected pressurized tanks within the payload bay (see Box 6.1 to view images of space shuttle damage from debris impacts). During the mission, a relatively large orbital debris particle did, in fact, impact one of the closed payload bay doors. Had it not been decided to close the door following analysis and interpretation of BUMPER data, the resulting damage to the space shuttle would have been significant. In addition, several modifications to the space shuttle were developed following analysis of BUMPER risk assessments, such as adding isolation valves to the coolant lines on the payload bay door radiators. If one of the two redundant coolant loops was penetrated by an MMOD particle, it could be isolated without affecting the operation of the remaining coolant loop.

Although BUMPER is a powerful tool, it does have some limitations. The major limitations of BUMPER are (1) that it calculates only a portion of the MMOD risk to a spacecraft (the probability of a penetration, however

___________________

³ Larry Price, Orion Deputy Program Manager, Lockheed Martin, “Orion Spacecraft MMOD Protection Design and Assessment,” presentation at the Workshop to Identify Gaps and Possible Directions for NASA’s Micrometeoroid and Orbital Debris Programs, March 10, 2011, National Research Council, Washington, D.C.

⁴ J. Williamsen, Review of Space Shuttle Meteoroid/Orbital Debris Critical Risk Assessment Practices, Report No. P-3838, Institute for Defense Analyses, Alexandria, Va., November 2003.

that is defined for the particular spacecraft under consideration) and is not able to calculate the total MMOD risk (which would include the probability of spacecraft loss or kill), (2) that it provides a point estimate of MMOD risk with no assessment of its associated uncertainty, and (3) that it does not take into consideration in its risk-calculating modules and algorithms the possibility of non-spherical particle impacts. These points are discussed in more detail in the following sections.

CALCULATING THE PROBABILITY OF SPACECRAFT LOSS

As noted previously, NASA currently uses BUMPER to calculate the risk of MMOD impact that would cause mission-limiting or life-threatening damage to the International Space Station, EVA suits, or other spacecraft (and, previously, for the space shuttle).⁵ This calculated value for risk, or probability of spacecraft failure, is then compared against design requirements to determine whether or not a proposed design, or a proposed design change (e.g., number of shields), will allow the spacecraft to meet its design requirements. Thus, in addition to being used to estimate the risk associated with a given design, BUMPER can also be used as a design tool, given an acceptable level of risk. However, if BUMPER is used as a design tool, the resulting design must be evaluated carefully, because BUMPER assumes that any hole is a failure, regardless of whether it is a pinhole or a 10-cm-diameter hole.

In an effort to rectify this situation (i.e., that the existing risk assessment tool then used by NASA equated all module wall penetrations to spacecraft failure or loss) for the ISS, NASA developed a separate code to specifically calculate the probability of a spacecraft loss given a penetration of the crewed habitation modules. This computer program is known as the Manned Spacecraft and Crew Survivability (MSCSurv) code. Unlike BUMPER, MSCSurv has the ability to compute the uncertainty associated with its output as well as the potential for expansion for use with NASA robotic spacecraft.⁶,⁷

Once a penetration occurs, MSCSurv initiates its process of quantifying how the possible hazards associated with the penetration contribute to the probability of crew or station loss. Currently seven general hazards or “loss modes” that are considered a catastrophic loss (or kill) are analyzed by MSCSurv as a result of debris particles penetrating crewed modules:

• External equipment loss,
• Critical cracking,
• Internal systemic loss,
• Internal payload loss,
• Crew hypoxia during escape or crew member rescue,
• Fatal injury to crew, and
• Thrust-induced angular velocity departure loss.

In addition, MSCSurv considers three other hazards, two of which could lead to a late loss of the station:

• Non-fatal injury to crew,
• Late loss of station control, and
• Critical module depressurization.

Developed in recognition of BUMPER’s structure, input, outputs, and limitations, the MSCSurv program has never been integrated directly with BUMPER into a single program. This level of integration is possible and may offer improvements in removing the duplication in input files, geometry files, and others. A new code integrating

___________________

⁵ Abbott et al., BUMPER-II Analysis Tool: User’s Manual, 1993.

⁶ J. Williamsen, Vulnerability of Manned Spacecraft to Crew Loss from Orbital Debris Penetration, NASA TM-108452, NASA, Huntsville, Ala., April 1994.

⁷ H. Evans, K. Blacklock, and J. Williamsen, Manned Spacecraft & Crew Survivability (MSCSurv) Version 4.0 User’s Guide, Report No. 651-001-97-006, Sverdrup Technology, Inc., Huntsville, Ala., September 1997.

both BUMPER and MSCSurv features would allow a more comprehensive evaluation of risk and of the effect of input uncertainties on output risk evaluations.

As discussed elsewhere in this report, hypervelocity impacts are known to produce significant amounts of plasma, and plasma poses a real and present danger to satellite operations. As codes like MSCSurv and Bumper are updated in the future and made applicable to a broader class of spacecraft (and not just large, habitable vehicles like the space shuttle, Orion, or the ISS), the effects of molten or vaporous material and impact-induced plasma should be included in the updated modeling efforts.

CONSIDERATIONS REGARDING UNCERTAINTY IN BUMPER

The uncertainties in BUMPER predictions of MMOD risk come primarily from three areas: damage prediction/ballistic limit equations, environment models, and criteria for defining failure. To attempt to quantify the overall uncertainty bounds on BUMPER MMOD risk predictions, the uncertainty in each of these three areas must be identified. At present, BUMPER provides point estimate predictions of MMOD risk for a given set of input mission parameters but does not provide uncertainty bounds or confidence intervals for its predictions. This makes it difficult to fold the results of BUMPER runs into a formal, end-to-end statistics-based probabilistic risk assessment. With so many uncertainties present in the models used within BUMPER, providing uncertainty bounds with BUMPER results is essential to properly evaluating and understanding this component of the overall MMOD environment risk.

The space shuttle and ISS versions of BUMPER use a variety of equations to predict damage to system components in terms of an impacting particle’s density, velocity, and angle of impact. Some equations are developed by simply drawing a curve through fail/no-fail test data (the so-called ballistic limit equations, or BLEs), while others are developed by performing statistical curve-fits to empirical data (the damage predictor equations, or DPEs). Once a critical damage level is identified for a particular spacecraft component, an appropriate DPE or BLE is manipulated, if necessary, into a form that yields the critical diameter of a particle whose impact would result in the critical damage level.

Damage Predictor Equations

The DPEs are curve-fits to empirical data; that is, they are the results of statistical regression analyses of available test data. As such, uncertainty bounds and/or confidence intervals can be obtained at the time that the regression analyses are being performed to form the DPEs.

Ballistic Limit Equations

Unlike the DPEs, the BLEs are not statistically based. They are not curve-fits, but rather are simply lines of demarcation between regions of penetration and non-penetration in regions where test data exist. In regions where test data does not exist, lines are drawn based on assumed forms and assumed exponents of various terms. As a result, and also unlike for the DPEs, it is simply not possible to obtain uncertainty bounds and/or confidence intervals as part of the current procedure that is used to derive the BLEs. Alternative, innovative approaches must be developed to either (1) obtain uncertainty information from existing BLEs and the data on which they are based or (2) re-derive the BLEs using a statistics-based approach so that uncertainty information is forthcoming out of

the analyses along with the equations themselves. Both of these options, as well as suggested approaches for their implementation, are discussed in more detail in Schonberg et al. (2005).⁸

Uncertainty Modeling Beyond the Testable Regime

The approaches discussed previously can only be used to provide uncertainty bounds and/or confidence intervals for BLEs in the tested regime (typically for impact velocities between 3 and 7 km/s). Since the average impact velocity of orbital debris is expected to be close to10 km/s and the average impact velocity for meteoroids is predicted to be close to 20 km/s (when corrected to a limiting mass), the majority of MMOD debris impacts are expected to occur at speeds in excess of 7 km/s, with a small fraction having velocities in excess of 60 km/s. These impact velocities are beyond the upper-limit capability of nearly all light gas guns. While it is possible to reach higher impact velocities using alternative launching technologies, none of these alternative technologies has the repeatability and consistency of the light gas gun. Therefore, another approach is needed to determine the uncertainty characteristics of the BLEs in BUMPER at speeds beyond 7 km/s or the ability to launch massive enough particles at speeds above 7 km/s.

Current Efforts to Model Uncertainty

NASA has recently performed a series of studies aimed at establishing uncertainty bounds for BUMPER calculations of MMOD risk for the space shuttle and Orion program offices; plans are currently in place to calculate ISS MMOD risk uncertainties using similar procedures. These uncertainty bounds were estimated using a Monte Carlo method wherein the BUMPER code was executed multiple times, while varying the program inputs for the environment, the BLEs, the failure criteria, and the operational parameters.⁹,¹⁰ However, the uncertainty distributions that were input into BUMPER for these calculations were “heuristic” at best; they were estimates provided by subject matter experts, assumed without much supporting data. This process needs increased rigor so that the uncertainty results are also more rigorous.

Debris Shape—Considerations and Effects

It was recognized early in the 1970s that projectile shape would add a component to the failure mechanisms experienced during the hypervelocity impact of a double-sheet structure, also known as the Whipple bumper shield.¹¹ The impact of arbitrarily shaped projectiles (discs, rods) did considerably more damage to the back wall of a Whipple shield configuration when compared with impact damage caused by spherical projectiles of the same mass.¹² For the smaller projectiles, on the order of the thickness of a typical spacecraft wall (i.e., several millime-

___________________

⁸ W.P. Schonberg, H.J. Evans, J.E. Williamsen, R.L. Boyer, and G.S. Nakayama, Uncertainty considerations for ballistic limit equations for aerospace structural systems, Proceedings of the ASME International Mechanical Engineering Congress and Exposition, Paper No. IMECE-2005-79709, Orlando, Fla., American Society of Mechanical Engineers, New York, N.Y., November 2005.

⁹ E. Christiansen, J. Hyde, T. Prior, and D. Ochoa, “BUMPER-II Meteoroid/Orbital Debris Risk Sensitivity Study,” presented to NASA Code Q, Washington, D.C., 2004.

¹⁰ NASA, Lightweight Installable Micrometeoroid and Orbital Debris (MMOD) Shield Concepts for International Space Station (ISS) Modules, Report No. NESC-RP-09-00593m, NASA Engineering and Safety Center, Washington, D.C., 2011.

¹¹ R.H. Morrisson, Investigation of Projectile Shape Effects in Hypervelocity Impact of a Double-Sheet Structure, NASA TN D-6944, NASA, Washington, D.C., 1972.

¹² See A.J. Piekutowski, Debris clouds generated by hypervelocity impact of cylindrical projectiles with thin aluminum plates, International Journal of Impact Engineering 5:509-518, 1987; E.L. Christiansen and J.H. Kerr, Projectile shape effects on shielding performance at 7 km/s

ters), the fragments produced from hypervelocity impact tests were found to have fairly small length-to-diameter (L/D) ratios. As projectiles got larger, on the order of several centimeters, they began to have a wider range of L/D ratios. In such cases, the effects of shape did indeed become more pronounced and would provide a wider range of penetration results for a given characteristic size depending on the orientation at impact. However, these larger projectiles are much less populous in the near-Earth environment and exceed the ballistic limit of most spacecraft shields, regardless of their orientation.

Orbital debris risk assessments performed by NASA through BUMPER use ballistic limit equations that have been developed using high-speed-impact test data and results from numerical simulations that have used spherical projectiles. However, it has become increasingly evident that consideration of particle shape and impact orientation could produce a pronounced effect in reducing predicted risk of failure from MMOD impacts.¹³,¹⁴ Not including the effects of orbital debris shape (and attendant variations in impact orientations) in debris models and risk assessment tools appears to bias the risk results toward a conservative, overprediction of risk.

It is also important to note that computer modeling of shape and orientation effects as well as computerized risk evaluations (using Monte Carlo approaches) have become powerful enough to allow (or even require) the consideration of shape effects for large, long-lived space vehicles such as the ISS. For example, the Department of Defense has developed FATEPEN, a computer model used for just such a purpose in aircraft, vehicle, and ship vulnerability assessment.¹⁵ When developing and providing orbital debris models and damage prediction tools that include the effects of shape and orientations, NASA should leverage this development for potential application in its suite of MMOD effects analysis tools and models.

Since the orbital debris environment is presented in terms of characteristic length and the NASA Standard Breakup Model (SBM) relates characteristic length to shape, it appears that the NASA SBM would be an appropriate first-order model to include as an adjunct to the ORDEM2010 model release as a means of connecting the parameter used to define the man-made particulate environment to a key parameter used in high-speed impact testing of candidate spacecraft design configurations. In some regard, shape has always been included by NASA in characterizing the orbital debris environment, beginning with the sensors used to measure the environment, then extending to the mathematical modeling performed to reduce those measurements to some sort of “size,” and then to the presentation of this information in terms of a particle flux versus a particle characteristic length to define the debris environment. However, when the Hypervelocity Impact Technology Facility performs high-speed impact testing to develop a BLE for a particular spacecraft component, that “characteristic length” is taken to mean “diameter,” and those tests are subsequently conducted using spherical projectiles. Williamsen et al. (2011) provide evidence that a sphere may not be the most benign shape on an equivalent characteristic length basis;¹⁶ spheres can penetrate a spacecraft wall, whereas other equal characteristic length objects may not.

___________________

and 11 km/s, International Journal of Impact Engineering 20:165-172, 1997; B.G. Cour-Palais, The shape effect of non-spherical projectiles in hypervelocity impact, International Journal of Impact Engineering 26:129-144, 2001; A.J. Piekutowski, Debris clouds produced by the hypervelocity impact of nonspherical projectiles, International Journal of Impact Engineering 26:613-624, 2001; K. Hu and W.P. Schonberg, Ballistic limit curves for non-spherical projectiles impacting dual-wall systems, International Journal of Impact Engineering 29:345-356, 2003; F. Schäfer, S. Hiermaier, and E. Schneider, Ballistic limit equation for the normal impact of unyawed ellipsoid-shaped projectiles on aluminium whipple shields, in Proceedings of the 54th International Astronautical Congress (IAC): Space Debris and Space Traffic Management, (J. Bendisch, ed.), September 29-October 3, 2003, Bremen, Germany, Paper No. IAA-03-5.3.06, International Academy of Astronautics, Paris, France, 2003; W.P. Schonberg and J.E. Williamsen, RCS-based ballistic limit curves for non-spherical projectiles impacting dual-wall spacecraft systems, International Journal of Impact Engineering 33:763-770, 2006; J.E. Williamsen and S.W. Evans, Predicting orbital debris shape and orientation effects on spacecraft shield ballistic limits based on characteristic length, International Journal of Impact Engineering 33:862-871, 2006; and J.E. Williamsen, W.P. Schonberg, H. Evans, and S. Evans, A comparison of NASA, DOD, and hydrocode spherical and non-spherical ballistic limit predictions for dual-wall targets and their effect on spacecraft risk, International Journal of Impact Engineering 35:1870-1877, 2008.

¹³ J.E. Williamsen, W.P. Schonberg, and A.B. Jenkin, On the effect of considering more realistic particle shape and mass parameters in MMOD risk assessments, Advances in Space in Research 47:1006-1019, 2011.

¹⁴ J. Williamsen, Review of Space Shuttle Meteoroid/Orbital Debris Critical Risk Assessment Practices, Report No. P-3838, Institute for Defense Analyses, Alexandria, Va., November 2003.

¹⁵ J. Yatteau, R. Zernow, G. Recht, and K. Edquist, FATEPEN (Version 3.0.0) Terminal Ballistic Penetration Model: Volume I—Analyst’s Manual, Applied Research Associates, Naval Surface Weapons Center, Dahlgren, Va., 2005.

¹⁶ J.E. Williamsen, W.P. Schonberg, and A.B. Jenkin, On the effect of considering more realistic particle shape and mass parameters in

As NASA’s understanding of the orbital debris environment has improved, so also has its use of shape in the characterization of that environment. Initially, shape was handled with a decreasing mass density with increasing spherical particle diameter. In theory, it was just a matter of defining an “effective” mass density that would give the correct rate of penetration. However, during that time, hypervelocity tests were conducted that showed that shape had a greater effect on damage than the reduced mass density function predicted. Therefore, it appears that relative size variations and distributions must be considered at the same time as shapes and orientations in order to reach conclusions regarding the effects of particle shape on impact damage (e.g., the effect of a cylinder hitting “end on” must be balanced with the likelihood of such an orientation). This can be achieved through developing ballistic limit curves for particular shapes and orientations taken together using such programs as FATEPEN, and then feeding them into BUMPER, which considers their size and velocity, and determines risk of penetration.

The effects of the shapes of non-spherical orbital debris particles would be seen more often in larger, longer-lived satellites (such as the ISS) than in smaller, shorter-lived satellites because larger, longer-lived satellites are more likely to be impacted by larger particles over time than are smaller, shorter-lived satellites. Whether or not shape effects are important might thus depend on whether the problem is approached by a compact satellite breakup expert or robotic spacecraft mission failure analyst as opposed to someone who is thinking about the operational issues related to habitable spacecraft being impacted by a piece of debris.

In the compact satellite arena, the main driver in a risk assessment calculation is likely the debris that would cause a failure in a robotic spacecraft. In this case, penetration is fairly important (e.g., penetrating an exposed umbilical, degrading a solar array, and so on), as is when, or if, the object is large enough to create more debris by breaking up. Compact, robotic satellites are less likely to be affected by shape effect considerations because once a particle penetrates into such a structure, the effect becomes more a matter of momentum and energy transfer to the structure rather than a matter of particle shape.

However, in the habitable module and rocket body arena, particle shape may indeed become more important, because a large hole in a crewed spacecraft does create a problem completely different from that caused by a small pinhole. The interior effects of a penetration for large spacecraft (such as the ISS, where hypoxia may drive crew loss evaluations) are probably more dependent on the size and shape of the hole, which in turn are themselves dependent on the shape and impact orientation of the original particle.

According to NASA’s Standard Breakup Model,¹⁷ the larger particles are more likely to have higher length-to-diameter ratios, but to be much less massive than a sphere of the same characteristic length. According to this same model, particles smaller than 1 mm are more likely to be chunkier and more cube-shaped, more closely approximating a sphere. However, until recently, very little research has been performed on the effects of such particles on assessed spacecraft risk. One of the reasons might be that, for small satellites, the likelihood of impact and assessed risk values are sufficiently small using even more conservative spherical shape effects. If a first-order assessment using a spherical debris shape assumption renders an assessed risk that is sufficiently small, no further assessments using more complex particles should be necessary. However, for larger, longer-lived spacecraft such as the ISS, a more rigorous analysis considering non-spherical shapes may be more appropriate, and a debris model that provides guidance for actual debris shapes is needed.

A preliminary review of the upcoming ORDEM2010 release indicates that NASA is continuing the practice of suggesting that the characteristic length of an orbital debris particle can be equated to the diameter of a spherical projectile provided that the mass density of the spherical particle decreases with increasing size. The difficulty with that approach is that when one attempts to perform high-speed-impact tests to characterize the damage that would be sustained by a spacecraft when struck by the larger particles, one is constrained by the availability and choices of naturally occurring materials from which the projectiles could be made—one would need to use either hollow spheres, solid spheres filled with voids, or an unrealistic material. In the first two cases, of course, the

___________________

MMOD risk assessments, Advances in Space in Research 47:1006-1019, 2011.

¹⁷ R.C. Reynolds, A. Bade, P. Eichler, A.A. Jackson, P.H. Krisko, M.J. Matney, D.J. Kessler, and P.D. Anz-Meador, NASA Standard Breakup Model, 1998 Revision, Report No. LMSMMSS-32532, Lockheed Martin Space and Mission Systems and Services, Houston, Tex., 1998.

penetration mechanics would be completely different from those for the original debris particle. It would appear, therefore, that given the choice of either changing the density of spheres or using an “SBM flake” with a changing form to capture the effects of the shape of orbital debris particles, from a penetration mechanics standpoint the SBM flake is far superior.