9.4.2 Case 2: Delta II Stage 3 – Saudi Arabia

The third stage of a Delta II launch vehicle (Star 48B), used to place a Global Positioning Satellite in orbit on 13 May 1993, re-entered over Africa on 12 January 2001. Figure 9.4.5 is representative of the pre-re-entry configuration of the Star 48 motor, but does not include the aluminum structure required to attach to the payload or the second stage. The motor consists of a carbon-phenolic exit cone, Ti-6Al-4V titanium high-strength motor case, silica-filled rubber insulation system, and a solid propellant system using high-energy ammonium perchlorate and aluminum with binder. Table 9.4.7 gives pre-re-entry properties of the Star 48B rocket motor. The mass of the Stage 3 at the atmospheric entry point was 206 kg, which includes the aluminum attach points and the inter-stage hardware. The motor case is fabricated from two hemispheres and a center cylindrical section that are welded together. Thick forward and aft attach flanges are used for joining the motor to the GPS and Delta II Stage 2 motor, respectively. The case has a nominal thickness of 0.175 cm, but has two pairs of thickened ribs around the center cylindrical section. One pair of ribs is forward of the equator and the second pair is aft of equator. The wall thickness is approximately 0.317 cm. along the 1.27 cm wide ribs. Multiple attach tabs are welded to these ribs for attaching external hardware. There are 16 pairs of attach tabs located at 22.5° intervals around the case between the payload attach flange and equator.

Initial State and Impact Location

Table 9.4.2 gives an initial state vector for the Delta II Stage 3 prior to breakup. The estimated impact location for the stage was longitude = 44.5961 deg. E, geodetic latitude = 23.7201 deg.

Results of Laboratory Analysis

Figure 9.4.6 shows the Delta third stage motor casing after re-entry. Weight after impact was 67 kg, which included the weight of the nozzle remains. The motor casing had a small crack at the aft end, which was attributed to impact, but did not show significant deformation. It is believed that the composite exit cone made the initial impact with Earth. The exit cone shattered, thereby absorbing most of the impact energy and minimizing damage to the titanium motor casing.

Re-entry analyses predicted that the titanium tank would not reach its melting point (≅ 1650°C for the Ti-6Al-4V alloy) during re-entry. However, the forward dome of the tank had a large hole with a jagged boundary. No evidence of micrometeoroid impact damage was observed. A thorough analysis was performed on all observed features of the tank, but only results of analyses relevant to re-entry survivability modeling are summarized here.

Figure 9.4.7 gives a detailed breakdown of the damage observed on the tank. The red blotches show the location of the melted holes; the short dashed lines show the condition of the forward and aft attach tabs (see Figure 9.4.9 for reference); the broad arc segment shows where melting of the rocket motor’s nozzle flange was observed. Samples were cut from the tank at the locations indicated by the small squares.

Ti-6Al-4V is a two-phase alloy, and the peak re-entry temperature can be estimated from the final microstructure. From the proportions and morphology of the phases, the peak re-entry temperature for the titanium tank was estimated to be between 1050 and 1200°C.

9.4.3 Case 3: Delta II Stage 3 – Thailand

The vehicle state at the atmospheric entry point is given in Table 9.4.2. The estimated impact location for the stage was longitude = 100.6 deg. E, geodetic latitude = 13.71 deg. A photograph of the Star 48B motor remains recovered in Thailand is shown in Figure 9.4.8. The motor, essentially the same design and configuration as that discussed earlier, consists of a Ti-6Al-4V motor case, a 3D carbon–carbon throat, and a carbon-phenolic exit cone. The exit cone did not survive re-entry and is not shown in the figure.

Figure 9.4.9 gives a detailed breakdown of the damage observed on the tank. The irregular blotches show the location of the melted holes; the short dashed lines show the condition of the forward and aft attach tabs (see Figure 9.4.8 for reference); the broad arc segment shows where melting of the rocket motor’s nozzle flange was observed.

Samples were cut from the tank at the locations indicated by the small squares. Estimated maximum temperature ranges at each of the sampled areas are given on the figure. Note that the maximum temperatures in the vicinity of the melted holes were estimated to be between 1450 and 1520°C; values away from the melted areas were estimated to be between 550 and 650°C on the leeward side (the side that exhibited less melting of the attach tabs); and 900 to 1450°C on the windward side.

9.4.4 Case 4: Delta II Stage 3 – Argentina

Fig. 9.4.10 shows the Delta II Stage 3 motor casing found in Argentina. The motor casing is of the same design as the two previously discussed, and the mass and material properties are the same as given in Table 9.4.7. Table 9.4.2 gives the stage’s state vector at the entry interface. The estimated impact location for the stage was longitude = 301.3 deg. E, geodetic latitude = –28.5 deg.

Fig. 9.4.11 shows the condition of the recovered motor casing. Once again, the damage exhibits two characters, likely as a result of the stage’s stabilization with one side forward during a portion of the heating phase of the re-entry and rotation to a different stable attitude at a later point, possibly as the mass loss affected the center of gravity location. Maximum temperatures on the side that experienced the maximum heating varied from 900 to 1150°C away from the melted areas and between 1450 and 1520°C in the neighbourhood of the forward-facing burn area. Maximum temperatures were estimated to be substantially lower in some areas – in the range of 600–750°C.

9.4.5 Implications for Modeling

Analysis of the four recovered objects indicates a probable scenario for the localized melting observed on all. It is hypothesized that the melted holes seen in all four objects were created by localized heating generated by burning of the heavy aluminum splashes during re-entry. It is postulated that as the surface of the molten aluminum oxidized, the high shear force generated by the atmosphere during re-entry immediately removed the oxide layer, allowing fresh aluminum to oxidize. Thus, a continuous oxidation process was established, which caused significant heating in addition to the frictional heat of re-entry. Eventually, the high heating caused the aluminum to ignite. The burning aluminum could then produce heat intense enough to melt or ignite the stainless steel and Ti-6Al-4V tanks. This scenario was supported by microstructural and EDXS analyses, which showed the presence of heavily oxidized, re-solidified tank alloy at the periphery of the holes. Note that past re-entry breakup models often neglected the potential for additional heating from burning aluminum, and this factor could be included in features designed to cause space hardware to demise in a controllable fashion during re-entry. Evidence from Germany arc-jet tests shows that the burning of carbon fibres wrapped around Titanium can also produce heat intense enough to melt the Ti.

9.4.6 Space Shuttle Columbia Accident

Paul D. Wilde

On February 1, 2003 the Space Shuttle Columbia disintegrated during re-entry, killing all seven of its crew and producing tens of thousands of debris impacts in Texas and Louisiana. The Columbia accident was a tragic event that changed NASA’s approach to re-entry safety. The Columbia Accident Investigation Board (CAIB) produced an exhaustive four volume report that included a great deal of evidence and analysis on the risks to people on the ground from re-entry debris impacts. This section contains the most relevant re-entry safety material produced by the CAIB and additional material produced subsequently.

Vehicle Description

Because of its enormous complexity and export controls on the technology involved, a complete description of the Space Shuttle Orbiter is out of scope. However, this section presents a summary of information available relevant to analysis of public safety during re-entry. For example, scaled drawings from the Shuttle Operational Data Book (SODB, see http://spaceflight.nasa.gov/shuttle/reference/sodb) provide various views of an Orbiter construction, such as shown in the Figure 9.4.12.

In response to the Columbia accident, NASA sponsored the development of a re-entry breakup model for the remaining Orbiters as described in some detail elsewhere (Collins et al. 2005). In summary, twelve major subassemblies were defined to represent the initial breakup of an Orbiter. Most of these subassemblies were defined as large “parent” fragments that contained “child” fragments, which would be released if and when the “parent” fragment broke up. The 12 major subassemblies of an Orbiter are:

Observation of Re-Entry Breakup and the Search for Debris

There was evidence of debris departing Columbia at various points along the flight path from Texas to the California coast. Radar, video analysis, and trajectory analysis were used to define high probability areas for ground search in New Mexico, Utah, and Nevada. Working through the Federal Emergency Management Agency (FEMA), local resources were activated to search these high probability areas for Columbia debris. Notices were published and broadcast asking that any debris or sighting information be reported via a NASA toll free phone number.

By far the most significant evidence was the result of a massive search effort to recover debris on the ground in Texas and Louisiana. The US government spent more than $305 million to fund the search, excluding expenditures on NASA employees, and the support of 37 helicopters and seven fixed wing aircraft. More than 25,000 people from 270 organizations took part in the debris recovery operations. The search area covered 2.3 million acres in Texas and Louisiana, including 700,000 acres by foot. The search on foot covered a 4-mile wide corridor centered on a line drawn through 100 the locations of large pieces recovered early in the search. Figure 9.4.13 is representative of the primary debris footprint and centerline estimates with points showing the location of the “significant items” recovered during the search (from AIAA 2006-6501). Specifically, over 4000 ground searchers were spaced 10 feet apart to provide an estimated 75% probability of detection for a 6” × 6” object in the ± 2-mile corridor. The area between the ± 2-mile corridor and the ± 5-mile corridor was searched by air with an estimated 50% probability of detection for a 12” × 12” piece of debris.

Figure 9.4.14 shows filtered radar return data collected by Federal Aviation Administration (FAA) air-traffic control radars during a 40 minute period while Columbia debris fell, superimposed on the estimated primary debris footprint. The linear streaks of dots indicate the paths of aircraft without transponders (since those with transponders were filtered out), and curved paths are due to radar anomalies. The high density of dots near the northeast extreme (i.e. near the heel) of the footprint is due to numerous aircraft flying in the area of Dallas–Fort Worth.

Columbia Breakup Evidence

The estimated position and velocity of the Columbia at the time of the catastrophic breakup are based on the vehicle’s last known state vector as recorded on the ground at the time the telemetry signal was lost. The debris risk analysis commissioned by the CAIB used –99.0413 deg. E, 32.956 deg. N as the Loss of Signal (LOS) point, where Columbia was at an altitude of about 200,000 ft and traveling at Mach 17 (Collins et al., 2003). Although the precise state vector at LOS is not publically available, the debris centerline indicates the vehicle velocity had an azimuth of about 113 degrees (clockwise from North) at the time the catastrophic breakup occurred. The flight plane angle of Columbia at the time of the catastrophic breakup can be estimated using the farthest downrange impact point, which corresponded to debris with a ballistic coefficient near 220 psf (Mrozinski et al., 2006).

Debris Impact Area

There was evidence indicating that debris was shed from Columbia even prior to reaching the coast of California, but the most westerly piece of confirmed debris was recovered in Littlefield, Texas. All the debris was recovered from a relatively sparsely populated area, with an average of about 90 inhabitants per square mile. The recovered debris was located along a path defined by the velocity vector of the vehicle at breakup as shown in Figure 9.4.15. Each dot in this figure marks the measured location of a piece that was initially treated as recovered debris. Many of the impact locations indicated outside the probability of impact contours shown in this figure were later determined erroneous because of coordinate measurement or identification errors (i.e. not actual Columbia debris).

The search recovered over 84,000 pieces of Columbia debris weighing a total of 84,900 pounds by the time the CAIB published its report about six months after the accident. Columbia was the first Orbiter built and flown, so it was the heaviest due to instrumentation, etc. 207,000 lb of dry mass at re-entry was a typical value for Columbia. Thus, at least 39% of the dry mass of Columbia survived to impact. An 800-lb main engine piece produced a hole 14 ft wide and 9 ft deep. Not far away, a 600-lb piece of a main engine made a 6-ft wide hole in the Fort Polk golf course. The largest recovered debris item was a 14 ft by 5 ft piece of fuselage. An intact spherical tank hit an empty parking lot, an office rooftop was destroyed, there was mangled metal along roadsides, and charred chunks of material in fields. Many more pieces were recovered subsequently, but accurate data on those pieces remains unavailable. Only about $50,000 was paid to property owners who claimed damages from falling debris.

9.4.7 VAST Test

Richard G. Stern

Six satellite re-entry tests, four Vehicle Atmospheric Survivability Tests (VASTs), and two Vehicle Atmospheric Survivability Program (VASP) tests, were conducted by the United States during the period 1971 through 1973. The objective of the tests was limited to experimentally determining the re-entry survivability and condition of vehicle payload elements. A by-product of the tests was an insight into a satellite’s aero-thermal breakup process. The breakup phenomenon observed during the six tests revealed that contrary to theory, breakup was essentially independent of attitude behavior and geometry. In addition, the heating encountered by the re-entering satellite was an order of magnitude less than theory would indicate.

Observation of Re-Entry Breakup

The VASP re-entries were observed by a variety of sensors, including optical and radar, as detailed in Tables 9.4.8 and 9.4.9.

Vehicle Description

Figure 9.4.16 presents an inboard profile of a VASP vehicle as configured prior to re-entry. The vehicle is a monocoque structure with a magnesium skin. The vehicle approached re-entry (under attitude control) with the aft end (orbit adjust engine) facing in the direction of the velocity vector. The total weight of the vehicle at re-entry was approximately 11,750 lb.

The vehicle’s forward end contained a secondary sensor. The primary sensor compartment was connected to the aft portion of the vehicle with a beam section open on the bottom and closed on top with magnesium skin. The internal structure was aluminum and magnesium stringers and frames.

The beam section was structurally integrated with the primary sensor compartment. It was structurally similar to the beam section open on the bottom but enclosed with non-structural fiberglass. Two sensors were contained in this compartment supported by an aluminum frame (387 lb). The sensors were complex electro-mechanical devices composed of aluminum, Invar, steel, beryllium and glass.

The sensor support compartment aft of the sensor compartment was a totally enclosed magnesium monocoque structure. This compartment contained a 960-lb electro-mechanical device consisting of two 105-lb motors.

The aft compartment contained the vehicle support equipment. Its contents included batteries, electronics, orbit adjust propellant tank, backup stabilization system propellant tanks and a payload pressurization tank. The vehicle’s solar arrays folded out from the aft bulkhead of the vehicle and exited out perpendicular to the vehicle’s longitudinal axis.

Quantities, weights, dimensions, materials and estimated ballistic coefficient are provided in Table 9.4.10.

VASP Breakup Sequence

The vehicles employed in VASP were deboosted from low Earth orbit with the aft end forward to facilitate deboost. The small orbit adjust engine on the vehicles’ aft end provided the deboost velocity increment. The deboost maneuver was conducted under geocentric control with the vehicles’ longitudinal (thrust) axis aligned parallel to the Earth’s surface and in the plane of the velocity vector. Small reaction control jets maintained this attitude thereafter.

On-board telemetry indicated that aerodynamic torques overpowered the reaction control system (RCS) jets slightly above 50 nm (see Tables 9.4.11 and 9.4.12). The vehicle had a boat tail that provided an aerodynamic angle of attack trim point of 19° in an aft end first attitude.

The flexible solar arrays, which did not produce a significant aero torque, folded back against the vehicle under aerodynamic pressure and were still attached to the vehicle at loss of telemetry at about 50.0 nm altitude (via telemetry Table 9.4.11). The FPS-80 radar at Shemya, Alaska, observed possible loss of the panels at 45.2 nm.

The vehicle trimmed out with its angle of attack oscillating about the aerodynamic trim point at 19° (17° VASP 2) with the vehicle doing a slow roll about the velocity vector. The roll rate was caused by the asymmetrical folding of the solar arrays. This caused the aft end to “see” the velocity vector at an average angle of attack around 19° (17° VASP 2). The vehicle center of mass was such that the boat tail trailed. This attitude behavior remained until the vehicle broke up, which produced aerodynamic lift forces normal to the velocity vector. After the initial major breakup of the external monocoque structure, the internal components were on individual trajectories. The trajectories were for the most part on ballistic no-lift paths. A few objects were observed to exhibit lift via falling leaf motion and generate cross track displacement. The majority of the objects had been shielded from aerodynamic heating prior to breakup. Low ballistic coefficient objects would decelerate rapidly and likely survived by avoiding appreciable heating.

Major breakup and the loss of the boat tail occurred around an altitude of 42 nm. Prior to breakup, the vehicle was oscillating at a relatively high angle of attack. The lifting forces had caused the velocity vector to be nearly horizontal (occasionally climbing). This caused a slow rate of change in aerodynamic heating rates.

The radar data indicated a massive breakup with the resulting objects having radar cross-sections no larger than those of internal components. The breakups of VASP 1 and VASP 2 were very similar, with a cluster of objects grouped closely together with low ballistic coefficient objects trailing at ever-greater distances.

The objective of VASP was to track lead objects contained in the primary sensor compartment. Detailed analysis of radar signatures was limited to objects thought to be sensor components. From specular analysis of radar returns (ARIS) and spectrographic analysis (TRAP), some sensor items were isolated.

Fortuitously, tracking had been concentrated on one of these objects considered to be one of the main sensors. It was cylindrical with a diameter of 2.9 ft and length of 8.9 ft. The object was a complex electro-mechanical device. The two ends of the cylinder were connected by invar rods and completely enclosed with a cylindrical aluminum tank to form a pressure vessel. The two ends consisted of beryllium housing with steel and electric motor components.

After the initial satellite breakup of the VASP 1 vehicle at an altitude of 42 nm, the cylinder continued with a high tumble rate of 10 cycles per second (cps). It was observed to shed low ballistic coefficient material (likely this was the aluminum outer casing). At an altitude of 31.5 nm and experiencing and acceleration of 6.25 times larger than gravity at the Earth’s surface (i.e. 6.25 g’s), it separated into two major pieces. This breakup was likely a result of the axial deceleration and high rotation rate. Tracking continued on the lead fragment for another 29 seconds down to an altitude of 28.6 nm where the aerodynamic heating was about 46% of its peak value at 36 nm. The two components were composed of Invar, beryllium, steel and glass, and at this point would have weighed several hundred pounds each. With heating decreasing and only a slight increase in deceleration (8 g) ahead, the two ends would survive to impact. Radar indicated little or no fragmentation at termination of track. Radar track had been broken in a failed attempt to acquire more downrange objects of potential interest. The radar attempt failed due to the ship’s close proximity to the ground track.

Optical coverage of VASP 1 by the IFLOT camera system at the time of loss of radar track observed eight major objects. The IFLOT camera collected data for 14 seconds before losing track at the point of closest approach (PCA). The track period began 15 seconds after the cylinder was observed to breakup. The IFLOT system had a field of view of 2.6 by 2.6 degrees and was looking 10 degrees up range of the radar and therefore could not have tracked the remnants of the cylinder. The ballistic coefficients of the eight objects ranged from 30 to 100 lb/ft². Two of the eight objects observed optically were observed to fragment into two parts. No correlation of these fragments to specific objects was possible.

Debris Impact Area

The radar coverage of VASP 1 (SV-5) included debris mapping of the impact area downrange of the ARIS tracking ship. The radar mapping lasted for 17.4 minutes, starting two minutes after termination of tracking following vehicle breakup. The total number of fragments observed during mapping was estimated to be 200. All objects were in terminal fall and without winds would impact where observed. The mapping is presented in Figure 9.4.17. Since the objects are in terminal free fall, no estimate of ballistic coefficient was possible. The radar returns indicate the size of the objects ranged from 2 to 10 square inches.

Two concentrated areas of debris were observed with a scattering of individual fragments throughout the mapping period. The first concentration of debris (Area 1) was observed between 209 and 210 degrees azimuth and between 6 and 10 degrees elevation angle with respect to ARIS and at a slant range interval of about 150 to 200 km down-range. This area of debris was observed eight times in 5.7 minutes. The second area (Area 2) of concentrated debris was observed at an azimuth of 208 to 224 degrees and an elevation angle of 6 to 8 degrees and at a slant range of approximately 75 to 175 km. This area of debris was scanned eight times in 7.3 minutes starting 2 minutes after the scanning of Area 1.

Figure 9.4.18 shows the projected impact points of selected objects tracked during the breakup phase. The debris mapping area (terminal fall) shown in Figure 9.4.17 is projected on Figure 9.4.18. It is evident that the low ballistic coefficient items of Figure 9.4.17 are in the region of high ballistic coefficient projected impacts of Figure 9.4.18. This indicates that some high ballistic coefficient items continued to fragment shedding light objects.

On VASP 2, debris from the Primary Sensor Compartment (Figure 9.4.16), including the cylindrical object described in the breakup sequence, was targeted for Eniwetok Lagoon. Figure 9.4.19 shows the projected impact points (observed near terminal fall) in the vicinity of the lagoon.

Lagoon impacts were confirmed by sonobuoys. Time to impact indicated both high and low ballistic coefficient objects impacted. The low ballistic coefficient objects were not anticipated but are consistent with the data of Figure 9.4.17 for VASP 1. Since the breakup of VASP 1 and 2 were similar, the debris footprint (Figures 9.4.17–9.4.19) should be complementary.

Hardware Impacting Around Eniwetok

As indicated earlier, the intent of VASP 2 was to target some sensors of the main sensor compartment into Eniwetok Lagoon. Figure 9.4.19 depicts the projected impact location of some of these objects. Spectrographic analysis allowed a determination of the objects’ material make-up. This, coupled with its deceleration behavior, allowed an estimate as to the particular component. Several fragments were observed to be dual objects. Since the main sensor compartment contained two nearly identical sensors, the component identification could be further refined when dual fragments were observed. Table 9.4.13 identifies the estimated material make-up and type of component of some objects. The pre-re-entry weight and area of each component are provided. No confirmation of the weight or mass impacting the water was available. Sonobuoys did confirm water impacts within the lagoon. Tracked Object A represented a cluster of satellite debris of similar ballistic coefficient fragments. As such, it contained spectrographic evidence of numerous objects representative of the entire satellite, but no specific component could be singled out. This cluster, observed in VASP 1, was used to target the impact point for VASP 2 within the lagoon.

The source of the low ballistic coefficient objects impacting the lagoon (evidenced by long descent times) is consistent with low ballistic coefficient items shown in Table 9.4.10. Remnants of the massive aluminum primary sensor support frame were also a possible source.

Summary and Conclusions

The breakup was consistent with the VAST experiment¹, where the outer monocoque structure of the payload section disintegrated suddenly. The disintegration of the monocoque payload observed optically on VAST 2 was total and simultaneous on both the windward and lee sides. This was evidenced on VASP 1 where the disintegration of the monocoque structure was sudden, leaving only individual components and substructures to continue on their trajectories.

The impact footprints given in Figures 9.4.17 and 9.4.19 show only a fraction of the objects observed due to limiting the analysis to potential sensor elements. The large survival rate of fragments is due to a lower than predicted heating rate and the presence of electro-mechanical devices composed of materials with high melting temperatures.

A surprising result of the tests was the presence of very low ballistic coefficient objects in the downrange portion of the impact footprint. This was particularly surprising since radar had indicated a cessation of objects shedding low ballistic coefficient fragments well past peak heating. The number and distribution of the fragments is exemplified in Figure 9.4.17. These fragments had to evolve from high ballistic coefficient objects to achieve their downrange positions. The nature of this evolution is unclear but does suggest significant heat or mechanical loads at lower altitudes. The presence of light fragments was consistent throughout the mapped area. The low ballistic coefficient objects (probably less than 0.25 lb/ft²) existing in the downrange portion of the debris footprint are likely products of melting followed by cooling and reformation of chaff-like objects.

The data from these tests show that debris will impact over a wide range of times across the debris footprint, with post breakup debris near the heel (defined by low ballistic coefficient impacts) generally impacting later than debris in the toe. Some higher ballistic coefficient debris in the heel reaches the ground sooner because of secondary breakups. Conversely it can take a significant amount of time for debris to impact near the toe of the debris footprint if there are secondary breakups of high ballistic coefficient objects resulting in lower ballistic coefficient debris that requires tens of minutes to impact the Earth’s surface.

9.4.8 Re-Entry Breakup Recorder (REBR)

William Ailor

At present, computer tools are used to estimate the ground hazard associated with re-entries. These tools have been developed from first principles and have been calibrated using limited data derived from visual evidence and analysis of recovered hardware (Ailor et al., April 2005; Patera & Ailor, February 9–11, 1998). These analyses have indicated that there are areas where application of first principles may not be well understood. For example, the heat transfer to a re-entering body may be overestimated for shallow re-entries where the body spends considerable time in the transition regime between free-molecular and continuum flow, leading to predicted breakup altitudes that are higher than actually occur. Accurate breakup altitude predictions are critical for estimating the length of the subsequent ground impact footprint, a critical factor in safety analyses.

To help address these analytical challenges, a system was designed to collect data during an actual re-entry and breakup of a rocket stage or other space hardware. The challenges with designing such a system were:

Given the above considerations, the following strategy was developed:

The Re-Entry Breakup Recorder (REBR) collects data as a launch stage or satellite re-enters the atmosphere and disintegrates due to aerodynamic heating and loads, records and stores the data, separates from the stage or satellite during breakup, decelerates to a subsonic speed, and then broadcasts the recorded data via the Iridium system prior to impact. Figure 9.4.20 shows REBR with its heat shield, and Figure 9.4.21 gives an exploded view of the device. The housing attaches REBR to the host vehicle and is designed to protect REBR from debris impacts during breakup, but to release REBR when exposed to significant aerodynamic heating. The REBR assembly (including Housing and Interface Adaptor) weights 8.6 kg and is 36 cm in diameter and 28 cm long. The REBR itself (instrument package and Heat Shield Assembly) weighs 4 kg and is 30 cm in diameter and 23 cm long.

At present, REBR instrumentation includes:

Data from these sensors are collected and recorded for several minutes as the host vehicle re-enters and breaks apart. When the REBR velocity approaches and continues to decrease below Mach 1, an Iridium modem is activated and REBR makes a call to the Iridium system to download recorded data.

First Flight Tests

REBR’s first complete flight test was conducted in March 2011, when the Japanese HTV2 re-entered the atmosphere with REBR riding inside. HTV2, a supply vehicle for the International Space Station (ISS), carried two REBR assemblies to the ISS when it was launched from Japan’s Tanegashima Space Center aboard the H-IIB launch vehicle. Astronauts aboard the ISS attached one of the REBR assemblies inside the pressurized compartment on HTV2, and it was activated by astronaut Cady Coleman prior to hatch closure and the separation of HTV2 from the ISS on March 28. HTV2 was subsequently deorbited and re-entered Earth’s atmosphere over the South Pacific Ocean with REBR inside on March 29.

Prior to HTV2 separation from the ISS, the second REBR was moved to the European ATV-2, also an ISS supply vehicle. Astronauts hard-mounted this REBR to an instrument rack inside ATV-2 and again activated the REBR just prior to hatch closure and separation from the ISS. ATV-2 was also deorbited into the South Pacific, with final re-entry into the Earth’s atmosphere on June 21, 2011.

Successful operation of both REBRs required that the respective host vehicles experience re-entry heating and loads during re-entry sufficient to break the host vehicle apart, heat the REBR housing sufficiently to melt the low-melt-temperature retaining bolts holding the two halves of the REBR housing together, and release the REBR devices into the air stream. REBR must then reorient and stabilize with the aft end pointed toward space to assure proper communications with the Iridium satellite system.

These conditions were met for the HTV2 re-entry, and REBR performed well, returning data that will be discussed in more detail. Unfortunately, no data was received after the ATV-2 re-entry. The most likely reason for this is that REBR was damaged during breakup of ATV-2, which likely presented a more severe challenge for REBR than did the HTV2 demise.

For HTV2, REBR was attached at the forward end of the vehicle, far away from the main propulsion system, and was protected by HTV2 bulkheads and materials being discarded from the ISS. For ATV-2, REBR was located much closer to that stage’s propulsion system, was hard-mounted to a plate, and was essentially unprotected from any debris that might have resulted from breakup of the propulsion system; videos of the re-entry and breakup of ATV-1, the predecessor to ATV-2, showed a violent, debris producing event during re-entry breakup as described by Ailor et al. (April 2005). Future REBRs will include “hardening” of the electronics to increase resilience to mechanical shocks, and mounting of REBR as far as possible from the propulsion system.

As noted, the HTV2 re-entry was nominal, and the REBR device recorded data during the final re-entry and destruction of the host vehicle and subsequently transmitted that data home via the Iridium system. Figure 9.4.22 shows the REBR attached just inside the HTV2 vehicle and HTV2 after its separation from the ISS. REBR was strapped to the HTV2 structure just inside the hatch at the forward end of the Pressurized Logistics Carrier shown in Figure 9.4.23.

Several hours after release from the ISS, HTV2 initiated a series of motor firings designed to re-enter the vehicle over the South Pacific Ocean. Figure 9.4.24 shows the best-estimate of the re-entry altitude history with significant events indicated. The REBR was activated by a deceleration rate of 0.0125 g at an altitude of approximately 90 km. Recording was stopped after 256 seconds, a pre-set time based on trajectory simulations as a time span that would capture breakup events, and the Iridium modem was commanded to attempt connecting with the Iridium satellite system (in the future, REBR will record data for the complete re-entry, but data transmission will likely terminate when REBR impacts the surface of the Earth). A successful connection was made approximately 373 seconds before impact and REBR initiated download of recorded data, in addition to real-time GPS altitude and location data. All recorded data was uplinked to Iridium by 192 seconds before impact. REBR impacted the ocean and continued to broadcast GPS data for an additional 17 hours as it floated along. The impact location is shown in Figure 9.4.25, and Figure 9.4.26 shows the REBR ground track before and after impact.

REBR Data for HTV2

Figure 9.4.27 compares the magnitude of the HTV2 measured acceleration with that measured by REBR’s low-g accelerometer. Note that there is a short overlap of about 10 seconds. Figure 9.4.28 shows the magnitude of the acceleration measured by REBR’s high-g accelerometers through breakup as compared to the final best-estimate of the re-entry trajectory. Note the stabilizing of the acceleration rate at approximately 6.5 g’s beginning at approximately 210 seconds from REBR activation.

Based on this acceleration profile and on temperature-trend data measured by the outermost sensor in REBR’s heat shield, shown in Figure 9.4.29 (details on the heat shield performance are proprietary to the Boeing Corporation), it is evident that REBR was free of its housing at approximately this time, and that the major portion of the HTV2 breakup process extended from approximately 120 to 200 seconds over an altitude range of 76 to 67 km, with a major breakup event and REBR release between 190 and 200 seconds, corresponding to an altitude of approximately 67 km.

Figures 9.4.30–9.4.32 show the rotation rate of the HTV2 vehicle during this period. Note that the aerodynamic moments cause increasing rates as re-entry progresses, with erratic behavior during the period of HTV2 breakup and REBR release. Note also that REBR stabilized nicely after release, as indicated by the damped rate oscillations. The stable orientation is with REBR’s conical nose pointing forward into the oncoming airstream. This stability is particularly important during subsonic flight, when the nose points to nadir, with the antenna inside the spherical backshell pointing to zenith, enabling communications with the Iridium satellites.

It should be noted that as shown in Figure 9.4.33 the low-g accelerometer did detect small events, likely due to objects released as the acceleration increased, impacting REBR while it was attached inside HTV2. This data also indicated that HTV2’s attitude was beginning to be affected by the atmosphere at approximately 50 seconds (84 km), and that HTV2 had transitioned from a relatively stable aft-on, engines forward attitude, to a broadside but tumbling attitude, beginning at approximately 60 seconds (82 km). At approximately 88 seconds (79 km), the REBR accelerometers detected a mechanical shock. At approximately the same time, REBR’s internal pressure began to drop (see Figure 9.4.34), likely indicating that the HTV2 internal pressure containment had been breached at this time (note that REBR was mounted in the pressurized compartment on HTV2, and was not built to be pressure tight; thus, the rate of change of pressure inside REBR was likely reflective of REBR’s leak rate, not the pressure inside HTV2). There was no increase in temperature on REBR’s heat shield during this period, indicating that REBR was still attached to HTV2 and inside its copper shell.

Summary

The successful first flight test of the REBR verified the overall data collection, protection and communication strategy, and points the way to a more robust and capable system for future data collections. Based on data recorded during the re-entry demise of the Japanese HTV2 vehicle, re-entry breakup of this vehicle occurred over an altitude range of 11 km, with major breakup events beginning at 79 km and extending through 67 km. The flight time during the high-heating phase was approximately 120 seconds. The experience with ATV-2, where the REBR was mounted near the propulsion system and failed to transmit any data, showed that the breakup environment can be severe and this factor should be included in considerations of the placement of the recording device within the space vehicle.

Planned improvements of the REBR include the ability to record data from small, wireless sensors placed at critical locations within the host vehicle. These sensors, activated by command from REBR, should provide temperature, pressure, strain and other data from multiple locations to be recorded, protected, and later broadcast. Data of this type should be directly comparable to predictions from re-entry survivability models. Data of this type could also be extremely valuable during a mishap or accident investigation, just as the data recorded by the Modular Auxiliary Data System (MADS) recorder and sensor operation on the Columbia proved invaluable to the Columbia Accident Investigation Board.

Acknowledgements

The contributors of the section on the REBR wish to thank the European Space Agency (ESA) and the Japanese Aerospace Exploration Agency (JAXA) for the opportunities to flight test REBR. The Department of Defense (DoD) Space Test Program’s human spaceflight team at NASA’s Johnson Space Center played an integral role in ensuring this important technology met all human-rated safety requirements, was properly coordinated with NASA safety levels, and that the payload was delivered to the launch pad on schedule. Their superior professionalism in working through the myriad of technical issues to meet NASA’s and JAXA’s stringent standards and delivering on-time is greatly appreciated. The REBR project was supported by The Aerospace Corporation, the Air Force Space and Missile Systems Center, The Air Force Safety Center, NASA Ames Research Center, NASA Goddard Spaceflight Center, and The Boeing Company.

References

1. Ailor WH, Hallman WP, Steckel GL, Weaver MA. Analysis of Reentered Debris and Implications for Survivability Modeling. 4th European Conference on Space Debris April 2005.

2. Patera RP, Ailor WH. The Realities of Re-entry Disposal. Monterey, CA: Paper 98-174, 8th AAS/AIAA Space Flight Mechanics Meeting; February 9–11, 1998.

• Risk metrics and acceptability criteria – these are important to launch as well, the fundamental decision to perform a controlled re-entry or allow an uncontrolled re-entry has some unique aspects relative to launch.

• Hazard identification and vehicle response modes unique to re-entry – the physics of re-entry leads to some unique aspects relative to launch in terms of failure probability and trajectory analysis.

• Is an uncontrolled re-entry safe enough, or is a controlled re-entry necessary?

• Does the re-entry comply with the applicable risk acceptability criteria?

• What warning/hazard areas are necessary to ensure protection of people in ships and aircraft?

• What is an appropriate amount of insurance coverage in case of an accident?

• What are the dominant sources of risk?

• How can the risks be mitigated?

• What are the dominant sources of uncertainty?

• How can the uncertainty in the risk estimate be reduced?

1. An uncontrolled re-entry to dispose of the upper-stage of a launch vehicle similar to the Delta II.

2. A controlled re-entry from low Earth orbit (LEO) to dispose of a large spacecraft, such as the Automated Transfer Vehicle (ATV) developed by the ESA.

3. The re-entry of a large winged vehicle, such as the Space Shuttle Orbiter.

9.5.1 Risk Acceptability and Other Safety Criteria for Re-Entry

This section builds upon the general discussion of risk metrics and the risk management process used for launch and re-entry operations in the first chapter, providing more specific information pertinent to re-entry operations. As discussed in Chapter 1, complete hazard containment is the preferred approach to ensure safety. Complete containment provides absolute safety through physical limitations that totally isolate the hazards posed by an operation from all surrounding populations and assets. Unfortunately, the goal of complete containment of all hazards is generally not possible for re-entry operations, even for the public and certainly not for vehicle occupants. The primary exception is an uncontrolled re-entry of a SC that is designed to guarantee complete demise (e.g. constructed entirely of materials with low melting temperatures). As long as there is a significant potential for hazardous debris to survive re-entry and reach aircraft altitudes (and thus generally impact with the surface of the Earth), then the possibility of a failure (e.g. during the de-orbit maneuver) poses some risk to the public from potential impacts outside the target area where there may be ships, aircraft, or ground assets. As shown in the examples below, it takes only a few square meters of casualty area associated with uncontrolled re-entry debris to exceed generally accepted risk criteria.

Under the Convention on International Liability Caused by Space Objects (usually referred to simply as the Liability Convention), which was entered into force September 1972, a launching state is “absolutely liable to pay compensation for damage caused by its space objects on the surface of the Earth or to aircraft, and liable for damage due to its faults in space.” As of 1 January 2003, 82 states have ratified, 25 have signed the Liability Convention and two international intergovernmental organizations (i.e. the European Space Agency and European Telecommunications Satellite Organization) have declared their acceptance of the rights and obligations provided for in the Liability Convention. Thus, a launching state (i.e. the government of the citizens that perform the launch or re-entry operation) has a compelling financial motivation and a clear moral obligation to evaluate the risks to the public from the eventual re-entry of SC, mitigate those risks as much as practicable, and ultimately to ensure that those risks are acceptable. Some launching states, such as the US, require commercial operators to have insurance to cover the maximum probable loss (MPL) in order to obtain a launch or re-entry license.

A re-entry safety engineer must completely understand the applicable safety decision-making criteria to develop an efficient and effective hazard or risk analysis. Before designing, or especially before implementing, a re-entry safety analysis the analyst should strive for complete clarity and unanimous consent among all stakeholders on the safety criteria, including the details of how all the safety metrics are defined, and the scope of each requirement in terms of the scenarios and assets to be accounted for. Stakeholders often include the public, the developer/operator of the vehicle, the payload operator, and the government officials for the launching state that ultimately authorizes the mission. In addition, a re-entry safety engineer should completely understand the intended goals and uses of the safety analyses to be performed, which often extend beyond a evaluation of compliance with the applicable risk acceptability criteria as discussed toward the end of this subsection.

Of course, there are many risk acceptability criteria and regulations used around the world to govern the safety of re-entry operations (see Pelton, 2010). Even within a given organization, such as ESA or NASA, it may require a significant effort to achieve unanimous consent among all stakeholders on the precise definition and scope of all safety criteria. The nature of launch and re-entry safety raises several important policy questions that are ideally addressed unequivocally in the risk acceptability and other safety requirements agreed to by all stakeholders:

Figure 9.5.1 is a logic tree for these top-level policy questions. The answers to these fundamental policy questions form the basis of the safety requirements that largely define the scope of the re-entry risk analysis. Since the examples of re-entry risk analyses presented in this chapter were performed to evaluate compliance with US and ESA safety requirements, the remainder of this sub-section summarizes the most salient of those requirements.

The box at the bottom of Figure 9.5.1 without shading indicates the option used at present in the US and by Western European countries. The choice to apply separate safety decision-making criteria to the launch and re-entry missions makes the definition of those missions critical to the scope of the risk analysis performed for each. The following definitions are commonly used in the US at present:

Using these definitions for a launch and re-entry mission, a failure that occurred/was manifested after orbital insertion would not be considered a launch failure, but could be deemed an on-orbit or re-entry failure. The re-entry risk analyst should strive to achieve consensus among all stakeholders regarding the definition of failure, proper treatment of post-orbital insertion failures, etc. For example, FAA regulations state that, for flight safety analysis purposes, a failure occurs when a vehicle does not complete any phase of normal flight or when any anomalous condition exhibits the potential for a vehicle or its debris to impact the Earth or re-enter the atmosphere during the mission. The US Air Force Instruction 91–217 defines a normal flight as the flight of a properly performing launch vehicle whose real-time instantaneous impact point (IIP) does not deviate from the nominal IIP by more than the sum of the wind effects and the three-sigma guidance and performance deviations in the uprange, downrange, left-crossrange, or right-crossrange directions as documented in the final flight safety data package. Once the IIP lifts-off the surface of the Earth, continued normal flight of a properly performing vehicle is defined as the sequences of events, including any planned orbital maneuvers, burn times, jettisons, payload separation, and stored energy depletion actions as documented in the final flight data package.

The use of separate risk limits for launch and re-entry was deemed reasonable in light of the following:

The most prevalent re-entry risk criterion at present is the 1E-4 collective risk limit. The rationale for this collective risk limit was published previously (Wilde, 2011). In the US, high level documents for the DoD and NASA prescribe a limit of 1E-4 Expected Casualties (EC) for re-entry of an SC (US Government Standard Practices for Orbital Debris Mitigation, DoDI 3100.12, and NPR 8719.14). For ESA, the 1E-4 limit applies to the probability of one or more casualties, which is generally close to the EC for a re-entry operation (as explained in Appendix F). The ESA requirement states that:

In case the total casualty risk is larger than 10-4, uncontrolled re-entry is not allowed. Instead, a controlled re-entry must be performed such that the impact foot-print can be ensured over an ocean area, with sufficient clearance of landmasses and traffic routes (ESA/ADMIN/IPOL, 2008).

The ESA glossary lists the definition of “casualty risk” as “the probability of serious injury or death.” However, there is no explicit description of the “total casualty risk,” so that the analyst should seek a mutually agreement among the stakeholder regarding the scope of the risk assessment. For example, the “total casualty risk” presumably includes the risk from a failure prior to the de-orbit burn that could lead to an uncontrolled re-entry, but starting at what time, point, or event on-orbit? It is also important to clarify if the collective risk limit accounts for people on the ground only, and excludes the risks posed to people in ships or aircraft. On this issue, the current ESA requirements are completely clear (see, for example, in ESA/ADMIN/IPOL, 2008, operational requirement OR-06). Unfortunately, not all requirements are so explicit. One apparent difference between the US and ESA re-entry risk criteria involves the treatment of multiple objects associated with a single mission: the “total casualty risk” apparently includes the risk from all objects that re-enter (e.g. the upper-stage and the spacecraft), while in the US, the re-entry of upper-stages and payloads are treated as separate re-entry missions with respect to the collective risk limit of 1E-4 (Common Risk Criteria for National Test Ranges, 2007).

Re-entry (and launch) operations conducted by US and European organizations typically ensure adequate protection of people in ships and aircraft by establishing hazard areas and implementation of other safety procedures that are often, but not always, related to re-entry risk analysis. Chapter 10 discusses the protection for people in aircraft.

It is important to identify other potential goals for a re-entry risk analysis, beyond evaluation of compliance with a given risk acceptability criteria. For example, a re-entry risk analysis can provide vital input to an environmental impact assessment and serve the following specific purposes:

9.5.2 Hazard Identification and Re-Entry Vehicle Response Modes

This section builds on previously presented material, and answers two questions:

Re-entry debris potentially presents the same five hazards that were associated with launching space vehicles:

Previous sections in this chapter addressed methods available to evaluate the survivability of inert debris, as well as propellants and other potentially toxic or explosive materials. The reader should also be familiar with casualty area computations for inert, explosive, and toxic debris based on the chapter on Launch Operations Safety. Since any debris that is toxic or potentially explosive must be considered hazardous, mitigations should be implemented to eliminate or minimize the chance that any potentially explosive or toxic debris survives to impact. Eliminating the potential for an explosive impact is often the single most important public risk mitigation because explosive casualty areas are generally much larger than the casualty areas for inert debris, particularly for people in shelters with windows.

If an analyst can show that no surviving debris will pose a hazard, then the re-entry operation would achieve complete hazard containment, even for an uncontrolled re-entry. Thus, a safety analyst needs to identify the threshold characteristics of re-entry debris that may pose a hazard to various types of assets, such as un-sheltered people (e.g. on the ground or on the deck of a waterborne vessel), people in various structures, ships, or aircraft.

Clearly, the threshold characteristics for re-entry debris depend greatly on the risk metrics used in the risk acceptability criteria. For example, the FAA established, in 14 CFR 417.107(c), that a launch safety analysis must “account for any inert debris impact with a mean expected kinetic energy at impact greater than or equal to 11 ft-lb” (15 J) as a means to protect against serious injuries due to blunt trauma. Thus, any debris with a terminal velocity at ground level that corresponds to at least 11 ft-lb (15 J) must be considered in an analysis designed to evaluate the risk of casualty. The vulnerability of people and structures, including various hazard thresholds, presented in Appendix C are generally useful for launch and re-entry safety analyses.

9.5.3 Re-Entry Vehicle Response Modes

Of course, there are many potential causes of re-entry failures, or accident initiating events. However, there are relatively few types of responses to the failures in terms of predicted vehicle trajectory and breakup behavior. As discussed in Chapter 4 on “Launch Operations Safety” a QRA typically defines generic vehicle response modes (VRMs), sometimes referred to as failure response modes, to assess the risk from all types of accident initiating conditions. The risk from each VRM can be assessed independently since these are mutually exclusive events.

There are some VRMs that are common to both launch and re-entry. For example, either a launch or a re-entry vehicle can experience an on-trajectory explosion, or a premature thrust termination while on-trajectory that results in breakup due to aerodynamic or aero-thermal loads. It is also conceivable that either a launch or a re-entry vehicle can experience a malfunction turn where the vehicle begins to tumble or slowly diverge from the planned trajectory. However, the tremendous velocity on orbit and the relatively small impulse associated with re-entry burns compared to launch vehicle stages makes a large cross-range departure from the flight path virtually impossible for a typical re-entry vehicle. Specifically, debris impacts more than a few hundred kilometers away from the ground-track of the orbit are generally not feasible because a typical re-entry burn from a low Earth orbit provides just a few percent change in the velocity of the vehicle. Thus, even a diabolical malfunction that directed the thrust of a re-entry burn in a most unfavorable way cannot produce debris impacts a large distance from the planned trajectory of a re-entry vehicle without wings. A very important implication of this physical limitation is that a flight termination system on a re-entry vehicle without wings may not provide much, if any, additional protection for people away from the planned trajectory. Furthermore, plasma present during re-entry presents a challenge in maintaining the external communication and command control typically applied in a launch vehicle flight termination system.

There are differences in the physics of various re-entry missions that may warrant a different set of VRMs to provide a valid risk assessment. For example, the different way an Instantaneous Impact Point (IIP) moves for a winged vehicle compared to a capsule means that a controlled re-entry of a capsule will not have all the same VRMs as a winged vehicle re-entry. Specifically, Figure 9.5.2 shows that the IIP for a capsule moves basically only in the opposite direction of the vehicle: for a planned impact off the coast of California the IIP moves west across the continental US during the re-entry burn and the remains essentially stationary except for relatively small movement the can be affected by control of the lift vector.

On the other hand the IIP for a winged vehicle would initially move in a similar manner (i.e. in the opposite direction of the progress of the vehicle) during the re-entry burn. However, after the re-entry burn was completed the Space Shuttle IIP then progressed across the continental US as the Orbiter traversed toward the planned landing location in Florida during the final re-entry of the Colombia as shown in Figure 9.5.3. The aerodynamics of the Orbiter enabled landing at locations up to about 800 nm (1500 km) cross-range from the orbital track.

The exact set of VRMs most appropriate for re-entry depends on the nature of the vehicle and the re-entry mission, as well as the level of fidelity of the available input data. Given the present safety policies and typical data available for a controlled re-entry, a typical QRA for a re-entry mission conducted in the US will:

The following examples show how the probabilities listed under item four are tied to VRMs used in a typical re-entry risk analysis.

9.5.4 Sample Uncontrolled Re-Entry Risk Analysis for an Upper-Stage

Analysis Method and Input Data Overview

This analysis uses an approach similar to the one used for ATV-1 and Hubble (Lottati et al., July 2004) independent public risk assessments performed by ACTA Inc and the Aerospace Corp. (Patera, 2008). However, in this analysis the casualty and fatality areas from debris predicted to survive to impact were computed using the BUSV input data corresponding to the random re-entry of the Delta II Stage 2. In addition, there were a few refinements deemed necessary to resolve the maximum feasible consequence and not just quantify the expected casualties (E_C):

The breakup state vector corresponding to the random re-entry of the Delta II Stage 2 was deemed suitable as input data for the aero-thermal demise analysis of this hypothetical upper-stage in the same weight class as the Delta II Stage 2 because both these stages have ballistic coefficients within 20% of each other, as well as similar structural construction and structural properties. In addition, the breakup of many other space structures disposed of by random re-entry have been known to occur at a remarkably similar altitude (near 78 km).

Probability of Impact on Each Population Center

The probability of a random re-entry event was assumed to be one: the probability of failure during launch was ignored. This assumption is reasonable given that the failure of the launch vehicle should not be considered a safety feature with respect to protection of the public from disposal of the upper-stage.

The probability of impact for the hypothetical upper-stage debris following a random re-entry was derived by assuming the impact probability on a given latitude band is equivalent to the dwell time of the ground track for the vehicle on orbit. As previously mentioned, this method has been applied to previous re-entry risk assessments, including assessments performed for the ATV-1, Hubble, and others. This method asserts that the orbital position density function is essentially equivalent to the probability of impact distribution function from a RR because:

This approach leads to a probability density function with the following equation:

Where denotes the latitude at the centroid of a population center, and α denotes the orbital inclination (i.e. 34.5 degrees for this example). This probability density function can be used to compute the conditional probability of impact within a latitude band (j), given a RR event occurs, as the value of the probability density function divided by the sum of the values for all the latitude bands under the orbital inclination as follows.

Figure 9.5.4 shows the probability of impact within each ½ degree latitude band under the hypothetical upper-stage inclination computed using this method. Notice that the latitude bands near to extremes are subject to significantly higher probability of impact. Also note that the population centers must not be centered at latitudes equal to the orbital inclination, but offset such that the entire population center is with latitudes that do not exceed the orbital inclination, otherwise this probability density function produces an erroneous result.

Since the probability of impact is uniformly distributed across all longitudes within a given latitude band, the conditional probability of impact on a population center, given a random re-entry event, can be computed based on the ratio of the population center area to the total area of the latitude band as follows.

Population Model

The population data were derived from LandScan data, a global database of high-resolution population estimates produced by Oak Ridge National Laboratory (ORNL) (Oak Ridge National Laboratory, “LandScan Dataset”). The LandScan dataset is based on a grid of cells (with boundaries parallel to lines of constant latitude and longitude) that are 30 seconds in latitude by 30 seconds in longitude (0.85 km² at the Equator). LandScan is a high resolution and accurate global population model (see Figure 9.5.5).

The collective risk estimate uses a probability of impact that is a function of latitude only, thus the population data input for the EC analysis was aggregated into latitude bands. Each latitude band spans 30 seconds of latitude.

The maximum consequence analysis must account for the various population densities within a given latitude band. Thus, to develop the population and sheltering input data for the maximum consequence analysis, the LandScan grid cells were aggregated into 27,340 population center areas underneath the 34.5 degree orbital inclination. These population centers (cities and regions) are useful for reference and for associating demographic data used to define the allocation of sheltering types as described below.

The process used to convert LandScan data into population input data appropriate for a debris risk analysis involves the following definitions.

The process used to convert LandScan data into population input data appropriate for a debris risk analysis was generally as follows:

Accurate population data account for the high density population centers (i.e. urban regions) separately. Therefore, the population of cities was subtracted from the province-level regions and accounted for separately, typically using data from the World Gazetteer (www.world-gazetteer.com) as the basis for locating the populations of cities. Figures 9.5.6 and 9.5.7 show the cumulative distribution of the population center areas and the associated population densities input to this analysis. Note that the data consists of populations estimated using 2006 LandScan data. Therefore, there was a slight non-conservatism in this analysis due to the absence of worldwide population growth, which Patera estimated with a constant 1% annual rate (see Hazard Analysis for Uncontrolled Space Vehicle Re-entry, September October 2008). The use of average population densities is a source of potentially more significant non-conservatism if the population centers are so large that there is actually a large variation of the density within the population center. This issue would arise for example if a population center is on a coastline, such that the population center area includes a significant portion of water. For the maximum consequence analysis, the probability of more or less than the average number of casualties given an impact on a population center is modeled using a Poisson distribution as explained below. Thus, the present analysis accounts, or at least attempts to account for the possibility that a cluster of people (e.g. within a particular building) could exceed the average population density assigned to a population center.

Sheltering Model and Casualty Areas

A global population dataset with sheltering distributions was developed specifically for use in analyzing the random re-entry case. The sheltering distributions were constructed as a function of gross domestic product (GDP) per capita using the sample data published previously (Larson, August 2005). The development of the sheltering model accounts for variations due to local time of day and season of the year, but the input to the RR risk analysis was averaged over these because the re-entry time and season cannot be reliably forecast. The development of the sheltering model also distinguished between urban and rural environments: any area where the population density was estimated as greater than 600 people per square statute mile was treated as an urban environment. However, the sheltering distribution input data for the RR collective risk analysis (to estimate the expected casualties) were averaged over all population centers within a latitude band. Since the present maximum consequence analysis treated population cells, not just latitude bands as done for the collective risk estimate, a potential improvement would be to input separate sheltering distributions for each population cell. However, the present results indicate little sensitivity to the differences in the sheltering distributions computed for the latitude bands.

Table 9.5.1 lists the basic definitions for the 15 shelter types used for the random re-entry input data, and the percentage of people in each shelter condition between the latitudes of ± 34.5 degrees (on average throughout a year). Figure 9.5.8 presents the resulting sheltering distributions for urban areas in all countries, organized in ascending order of GDP per capita. Separate sheltering distributions in rural areas were also computed for all countries in a similar manner.

Figure 9.5.9 depicts the average number of people in each sheltering type over the course of a year as a function of latitude computed with the sheltering distributions and the population data described above. These data were input for the present RR risk assessment.

Four different building classes were used in this analysis, the same four classes of buildings described in Appendix C and used in RCC 321-07 (Common Risk Criteria for National Test Ranges, 2007): Class A, B, C, or D. These four generic classes of buildings conservatively represent the construction types typical for buildings, and relate directly to the type of information typically available from community planning maps, census data and similar sources:

The casualty and fatality areas corresponding to a random re-entry of the hypothetical upper-stage were estimated using state-of-the-art vulnerability models for inert debris impact. A top-level description of the processes used to develop the inert debris impact consequence models appears in Chapter 4.

Collective Risk and Risk Profile Method

The collective risk posed to each population center from the potential RR of the hypothetical upper-stage was computed based on the following equation:

In this equation, is the average casualty area that accounts for the distribution of shelter types of the j^th population center, is the absolute probability of impact on the j^th population center (due to a random re-entry of the upper-stage), and is the area of the population center potentially impacted. The expected fatality calculation is entirely the same, except the fatality area is input for each shelter type.

A risk profile is a plot that shows the probability of exceeding various outcomes (e.g. number of casualties, or amount of monetary damages) forecast to result from a future event. Specifically, the abscissa of a casualty risk profile is the number of casualties (K) and the ordinate is the probability of K or more casualties. Thus, a risk profile provides more information about the nature of the risks posed by an event than mean risk values, such as the E_C. Risk profiles have been used as a tool for risk management in various applications around the world, including establishing the amount of insurance appropriate for commercial launches and re-entries (Collins et al., August 2006; County of Santa Barbara, Planning and Development, Environmental Thresholds and Guidelines Manual, October 2008).

A risk profile for the hypothetical upper-stage RR event was constructed based on the mean number of casualties predicted given an impact by the single piece with the maximum casualty area on a population center, X_AVE. Thus, the probability of more than one fragment impact producing a casualty during a single re-entry event was neglected. This assumption was deemed reasonable given that (1) the probability of a casualty producing impact from a single re-entry event is less than 2E-4 (since the EC is less than 2E-4); (2) the footprint is so large (on the order of 10,000 km²); (3) the number of fragments hazardous to people on the ground that survive re-entry so small (about a dozen) that the likelihood of two impacts within a high density population center is very low, and (4) the EC contribution from the single largest piece of debris was more than half the total EC due to all the debris impacts. Note that the average predicted casualty area (accounting for sheltering) from the largest single piece of debris predicted to survive from a random re-entry of the hypothetical upper-stage (a large cylindrical propellant tank like the one recovered in Texas following the Delta II Stage 2 re-entry in January 1997) corresponds to a radius of about 1 meter.

The mean number of casualties predicted given an impact on a population center can be computed by dividing the E_C contribution from that population center by the probability of impact on that population center, , or simply as the population multiplied by the average casualty area divided by the area of the population as follows:

As previously mentioned, the probability of various numbers of casualties given an impact on a population center was modeled using a Poisson distribution. Before explaining how this calculation was done, note that this situation was considered suitable for modeling with the Poisson distribution because this distribution applies when the following conditions are met:

The Poisson is a discrete distribution with only one parameter as input: the average outcome of the event. Here the event is defined as an impact of the piece of debris with the largest casualty area from the hypothetical upper-stage on a given population center following a RR, and the average outcome is the average number of casualties (X_AVE) produced by the event. Note that the average outcome is a real number, but each event can only produce an integer outcome. Based on the Poisson distribution, the probability of each integer outcome was computed as follows:

Here k denotes an integer outcome (equal in this case to the numbers of casualties), and the average outcome, so here equals X_AVE.

Thus, the Poisson distribution was used to model the probability of various numbers of casualties for an impact of the largest piece of debris on a given population center. In essence, the Poisson distribution was used to model the uncertainty is the density of the population center in the immediate vicinity of the impact and uncertainty in the casualty area produced by the given impact.

After computing the probability of each number of casualties given the impact on each population center in this manner, the total probability of each number of casualties was computed as the sum over all the population centers. The risk profile for the largest piece of debris was then constructed based on the probability of k or more casualties due to a RR of the hypothetical upper-stage. A more rigorous MPL analysis could be done by using a Monte Carlo technique to account for uncertainties and biases (Collins & Chrostowski, August 2008) and other higher fidelity model elements such as the dependence of casualty area and population density for various shelter types, however that was beyond the scope of the present effort. Using the Monte Carlo approach becomes necessary if the conditions make the Poisson distribution a poor model (e.g. if a large number of small fragments lead to a conditional EC given the random re-entry event that is not much less than one).

The expected number of casualties (E_C) due to the impact from a single piece of debris or from a collection of fragments can be computed from the area under the risk profile from 1 to X_MAX. The proof of this follows: the risk profile is discrete and is defined for each value of k as the sum of all of the probabilities of exactly p(k) for k< = X_MAX as shown below.

Results for Random Re-Entry

This analysis indicates that the range of credible risks from the disposal re-entry of the hypothetical upper-stage is from 90 to 140 E-6 Expected Casualties (EC) and 45 to 70 E-6 Expected Fatalities (EF) depending on whether the breakup during re-entry fragments the largest components (i.e. the nozzle, propellant and LOX tanks). The results based on the assumption of a relatively energetic breakup represent the upper bound of the credible range of risk. The lower bound of the credible range of risk from a random re-entry of the hypothetical upper-stage was based on the assumption a less energetic breakup where the nozzle, propellant and LOX tanks remain intact and all the components are liberated at about 78 km. Thus, the best estimates of the collective risks from the planned disposal of the upper-stage were near the typical limit of 100 E-6 EC, but above 30 E-6 EF (a supplemental limit given in the RCC 321 Standard). The maximum individual risks are near 1E-12 probability of casualty or fatality.

The EC estimates produced here for a RR of the hypothetical upper-stage are quite consistent with those published by the Aerospace Corporation (Patera, 2008) for random re-entry of a generic spacecraft. Specifically, Figure 9.5.10 shows Aerospace’s conditional risk estimates (given the re-entry occurs) per square meter of casualty area as a function of orbital inclination (Patera, 2008). According to Figure 9.5.10, the casualty expectation from a random re-entry from an orbital inclination near 34.5 degree is about 1.65 × 10^–5 per square meter of casualty area. Considering the sheltering model employed herein, an average casualty area of about 7.4 square meters based on inert impacts only for a random re-entry with highly energetic breakup; this corresponds to 1.2E-4 EC according to Patera. Thus, the estimated casualty area lead to a collect risk (1.4E-4) that was within 15% of a value based on the Patera paper.

Figure 9.5.11 contains the risk profile generated for the hypothetical upper-stage RR with a low energy breakup. This risk profile was based only on the single debris piece with the largest estimated casualty area given a relatively high degree of fragmentation: 54 sft (5 sq. m.) for people under a metal roof based on the assumption of a breakup where the propellant and LOX tanks remain intact. The final risk profile estimated used population input data for a 15′ × 15′ grid from the Gridded Population of the World database (Columbia University; Gridded Population of the World Version 3 (GPWv3)). These results indicate that more than one casualty as the result of hypothetical upper-stage RR with an EC near the typical limit of 1E-4 is over two orders of magnitude less likely than a single casualty.

Conclusions

This analysis of the hypothetical upper-stage RR demonstrated the following:

Comparison of Model Results to Data from Delta II Upper-Stage Re-Entries

The results of launch and re-entry risk analysis tools should be compared to empirical data to the largest extent possible because such comparisons can reveal modeling flaws, identify key sources of uncertainty, and improve confidence in risk predictions under similar circumstances. This part of the analysis compares the output of Range Risk Analysis Tool (RRAT) to the data collected from the January 22, 1997 Delta II upper-stage re-entry where debris was recovered in Texas and Oklahoma. Figure 9.5.12 compares the 95% confidence of containment ellipses predicted by RRAT compared to the recovered debris locations in Texas, and shows the interstate highways. In this case, the RRAT input data for the BUSV and the ballistic coefficient were based on estimates shown previously in this chapter. The RRAT input for Figure 9.5.12 included a rough estimate of the uncertainties in the BUSV: 2% one-sigma for each velocity component and 1000 ft (305 m) one-sigma for each position coordinate. These results were based on wind data (mean and uncertainties) from the GRAM database (Justus et al., August 1995) built into RRAT, even though a measured wind profile was available. The results in Figure 9.5.12 show that the roughly 25 km wide and 750 km long predicted debris footprint easily contains the actual impact locations in Texas. The results shown in Figure 9.5.13 were generated without the BUSV uncertainty input, but otherwise the same input data. Thus, comparison of Figure 9.5.12 and 9.5.13 illustrates the significant influence of the estimated BUSV uncertainty on the predicted footprint. However, the predicted footprint without the estimated BUSV uncertainty still contained the actual impact locations. The results in Figure 9.5.14 show that the predicted footprint, accounting for all sources of uncertainty in the input data, contains the cloth impact location in Oklahoma. Note that the winds were significant enough to push the recovered debris significantly cross-range; the recovered sphere, tank, and cloth were displaced to the East from the ground-track of the nominal orbit by 6, 8, and 33 km respectively. These results demonstrate that the RRAT predicted footprints were consistent with the available empirical data for this random re-entry event, even without any special accounting for the winds of the day.

RRAT computed 2E-3 EC given this event, largely because the center of Austin, TX (population of about 200,000 people, in a county, Travis, with about four times that amount in 1997) was within 20 miles of the propellant tank impact location.

9.5.5 Risk Analysis for the ATV-1

Summary of ATV Controlled Re-Entry Safety Analysis Method

This section presents the approach used to evaluate the safety of a controlled re-entry of the ATV, including the development of critical input data and warning areas. Since no toxic or explosive materials were predicted to survive to impact, the only hazard from a controlled re-entry of the ATV was posed by inert debris impacts. Since the controlled re-entry was a planned event, the probability was assumed to be one. Therefore, the first step in the analysis that involved a substantial effort was the development of BUSVs for debris generating events.

The development of ATV BUSV input data began with establishing three baseline trajectories, one for the nominal, degraded, and uncontrolled conditions. The next step involved computing dispersed trajectories for the controlled re-entry conditions that accounted for uncertainties in the re-entry burn, atmospheric conditions, vehicle dynamics, etc. The following outlines the analysis approach and critical input data involved in the development of the baseline and dispersed trajectory data for the controlled re-entry cases.

The following outlines the analysis approach and critical input data involved in the development of the ATV fragmentation models for nominal and degraded ATV re-entries. A separate subsection below describes the fragmentation analysis in more detail since that was such a critical input to the risk analysis.

The next major step of the analysis involved the development of population and sheltering data, which used the same approach described in the previous section.

US standards employ three primary risk metrics to define hazard areas that ensure adequate protection for occupants of ships and aircraft: individual risk, collective risk, and catastrophic risk. This analysis applied the following process to develop hazard areas that demonstrate compliance with US standards.

Summary of Fragmentation Analysis Method and Results

Randy Nyman

As previously mentioned, a thermal network model named CATNS was applied to compute the fragmentation of the ATV during re-entry. The thermal network uses nodes to represent a mass element of the body structure. All nodes in the network are interconnected by thermal conductors that represent the ability of heat to flow from one part of the network to another. Figure 9.5.16 illustrates a representative thermal network for a section of a rocket inter-stage.

Nodes that represent outer surface elements of the structure are assigned a heated surface area and the heating rate assigned to the surface is calculated from the time varying local re-entry stagnation and radiation exchange heating rates. As with lumped mass fragments, stagnation heating rate to a complex re-entry body is modeled using the blunt body stagnation heating equations and the re-entry body is characterized by a series of simple geometric shapes (cylinders, cones, hemispheres, plates). The stagnation point heat flux rates are computed at each trajectory time step using the computed re-entry velocity and the atmospheric properties at the re-entry body altitude. The temperature distribution in the thermal network is solved over 20 sub-steps within each trajectory time step. The temperature solution uses an explicit forward finite differencing scheme where the temperature at each node is computed using equation (66)

(66)

where:

The user must define the input thermal model file that specifies the nodes, conductors and surface elements that receive direct heating. This process typically requires access to the design drawings of the re-entry body and can be a time consuming process to generate accurately. During re-entry simulation, heat is applied to the surface nodes and the surface temperatures begin to rise. Temperature increases until the material melting temperature is reached. Upon reaching the melting temperature, further heat input results in phase change from solid to liquid and the temperature is held constant. Liquefied material is assumed to be removed from the body by the gas flow that sweeps over the body. As mass is lost from a node, the node thermal capacity is reduced and conductance to adjacent nodes is reduced by assuming the cross sectional area of each conductor is reduced in proportion to the mass loss. When the mass of the node is reduced to zero, it is removed from the thermal network. Heat that was applied to the removed surface node is then transferred to one or more underlying nodes (this mapping information is provided by the user as part of the input thermal model file).

It is recognized that as structural materials heat up they lose strength. Consequently, CATNS provides an alternative method to remove nodes before they fully melt. The alternative approach applies a user-prescribed pressure threshold such that if the computed local dynamic pressure exceeds the ultimate strength of the material, the node is removed. The ultimate strength is reduced as the node temperature increases. Local pressure around the body is computed based on the angle between the local point and the stagnation point measured with respect to the stagnations radius. Although this approach is not based on a rigorous solution of structural loads, it provides an approximate method to remove node elements that are weakened by high temperatures without requiring that they reach melting conditions. Because the dynamic pressure typically rises quite rapidly as the body falls through altitudes near 75 km, uncertainty in the structural integrity often has a relatively small influence on the predicted altitude for major breakup.

One of the major range safety issues is whether a re-entry can result in propellant tanks that survive to ground impact with residual propellant. Such impact could produce explosions and be significantly more hazardous than if the tanks impacted empty. To evaluate this problem, CATNS includes a capability to model heat transfer from liquid tank walls to the liquid inside the tank. This heat transfer is assumed to take place by boiling in a thin layer of fluid near the tank wall. It is further assumed that the entire tank wall remains wetted and that nucleating boiling occurs. The vaporized liquid is assumed to mix with the bulk fluid and re-condense, thereby increasing the bulk fluid temperature. This process is allowed to continue until the bulk fluid temperature reaches the boiling point, after which the fluid temperature remains fixed and all further incoming heat causes phase change from liquid to gas. The boiling heat transfer coefficient is computed using equation (67):

(67)

where:

If the user designates that the re-entry body contains liquid tanks, CATNS will compute internal pressurization of the tank using temperature dependent saturation pressure data for the liquid in the tank. Figure 9.5.17 shows a sample saturation pressure curve for liquid oxygen. LOX tanks are considered quite susceptible to overpressure failure during re-entry due to the rapid increase in saturation pressure as a function of bulk fluid temperature. As shown in Figure 9.5.18, liquid kerosene has very little pressure increase with temperature.

The tank may have up to three openings for which the user must provide minor loss coefficients. CATNS computes the ratio of gas and liquid volume in the tank and uses this mixture quality to determine the rate at which mass is vented through the openings. Flow calculations check for choked flow conditions. The user may specify a differential pressure threshold that must be achieved before an opening is activated. This simulates the action of a pressure relief valve. Figure 9.5.19 illustrates an example CATNS re-entry tank pressurization calculation for an upper-stage tank with RP1 and LOX separated by a common bulkhead dome. The differential pressure strength rating of the internal dome is predicted to be exceeded due to the rise in LOX temperature. This would lead to a predicted tank failure and a high probability of a propellant explosion during re-entry.

Key Findings

Paul D. Wilde

The primary conclusion of this study was that ATV re-entries satisfy all elements of the criteria for public risk acceptability if ship and aircraft hazard areas are defined and implemented as prescribed by the definitive US standard for launch and re-entry safety: RCC 321-07. RCC 321-07 is a voluntary consensus standard (accepted by all US agencies that oversee launch and re-entry operations) of risk acceptability requirements for flight, with a supplement to provide the rationale, guidelines, and best practices of implementation. The RCC 321-07 Standard set the following limits on public risk that would apply to each ATV re-entry:

The total collective risks posed by an ATV re-entry, accounting for uncontrolled and controlled conditions, are near 42 × 10^–6 E_C and 24 × 10^–6 E_F, and no more than 62 × 10^–6 E_C and 36 × 10^–6 E_F. The best estimates were that an average of 42 casualties and 24 fatalities would result from one million ATV re-entries.

This study found that the possibility of an uncontrolled ATV re-entry, which was conservatively estimated as 0.01 (upper boundary) probability, dominates the collective risks to the public. Table 9.5.2 shows the influence of sheltering and fragmentation on the uncontrolled re-entry risks. The best collective risk estimates for an uncontrolled ATV re-entry were about 38 × 10^–6 E_C and 20 × 10^–6 E_F, based on debris predicted to survive an uncontrolled re-entry, a relatively crude sheltering model, and much more sophisticated vulnerability models. Without sheltering, 40 × 10^–6 E_C and 32 × 10^–6 E_F were estimated for uncontrolled re-entry. If no explosion occurs to prompt major breakup, then substantially more debris was predicted to survive, and the collective risks posed by an uncontrolled re-entry could be as high as 58 × 10^–6 E_C and 27 × 10^–6 E_F. The maximum individual risk from an uncontrolled ATV re-entry was negligible because virtually the entire population of the world is exposed.

The collective risks from a controlled re-entry are relatively small: (1) the predicted risk from land impacts is essentially zero due to the remote location of the planned debris impact area; (2) the collective risks to ship occupants are no more than 2 × 10^–7 E_C or E_F based on conservative estimates of ship traffic; and (3) the collective risks to aircraft are less than 4 × 10^–6 in terms of both expected casualties and expected fatalities if the recommended hazard area was strictly enforced. However, if ships fail to heed warnings about planned ATV debris impact areas, the maximum risks to individual occupants of ships could exceed 1 × 10^–7.

This analysis demonstrated that the maximum individual risk was less than 1 × 10^–6 probability of casualty, P_C, based on the conservative assumption that ships fail to head warnings to keep out of hazard areas. Figure 9.5.20 plots the contours of maximum individual risk assuming a person was present and unsheltered, such as standing on the deck of a ship, at points throughout the region where ATV debris was predicted to impact during a nominal re-entry. The results shown in Figure 9.5.20 use the coloring scheme shown in Figure 9.5.21. For example, an individual person standing unsheltered in the darkest shaded region (yellow in the color version available in e-book format) would have a probability of casualty greater than 1 × 10^–7, but less than 1 × 10^–6. Accounting for fragments that produce a larger casualty area to someone sheltered below the deck of a ship compared to the unsheltered casualty area, this analysis also demonstrated that the maximum individual risk would also not exceed 1 × 10^–6 P_C.

Other major findings of this study include the following:

This analysis found that the controlled re-entry of the ATV would comply with US standards for catastrophe aversion if US standards were used for the development of appropriate ship and aircraft hazard areas. Only scenarios capable of producing at least five casualties were considered significant in the development of the ATV catastrophe risk profile. The only significant risks of multiple casualties or fatalities from the ATV-1 re-entry were to occupants of ships or aircraft in the vicinity of the planned debris impacts Table 9.5.3 shows all the scenarios foreseen and estimated probabilities where planned ATV-1 debris impacts could produce multiple casualties. The data for the ordinate of the risk profile are the sum of all of the probabilities for scenarios that produce N or more casualties.

The consequence and the probability of each potentially catastrophic scenario were conservatively estimated. For example, the probability of an impact to an aircraft assumes an aircraft is continuously present at the boundary of the aircraft hazard area during the period while the debris fall through aircraft altitudes, which seems unlikely given the low level of air traffic in that general vicinity. The probability of a ship impact was based on the highest number of expected ship impacts computed for the three cases examined: the Jules Verne (2 × 10^–5), a degraded re-entry for a generic ATV (1.7 × 10^–5), and a nominal re-entry for a generic ATV (4 × 10^–6). For a potentially catastrophic ship impact, the occupants were assumed to be below deck, where the casualty area was predicted to be larger than for unsheltered occupants due to the potential for partial collapse of the deck structure following such an impact.

Figure 9.5.23 shows the resulting risk profile computed for a controlled ATV re-entry. These results demonstrate that potential impacts to aircraft dominate the risk of a catastrophe from an ATV re-entry, and emphasize the importance of properly defined and implemented aircraft hazard areas.

Ship and Aircraft Hazard Area Results

The results indicated that the maximum widths of the 99% and 99.999% contours predicted for a degraded re-entry are close to 31 km and 45 km, significantly wider than those for the nominal case: a 23 km maximum width of the 99% contour. The increase in the cross-range dispersion was attributed to higher induced velocities from the higher propellant load for the degraded case. In all other respects, the debris from the nominal and degraded re-entries was predicted to be quite similar. The overall extent of the cross-range dispersions was dominated by explosion induced velocities, although lift, winds, ballistic coefficient uncertainty (which is a factor in the cross-range dispersion due to winds), and the dispersion of the predicted state vectors at breakup also contribute. The cross-range dispersion due to lift for the debris was estimated to be no more the 15 km from edge to edge, comparable to that found and computed for the Columbia accident (Lin et al., September 2003). The downrange extent of the estimated hazard areas was due to approximately equal contributions from the dispersion of feasible trajectories and the dispersion of impact points associated with the various characteristics of the debris predicted to survive (i.e. different ballistic coefficients, breakup induced velocities, etc.). This means that the collection of feasible impact points computed by TAOS for an idealized fragment representing the intact spacecraft under nominal conditions spanned about half of the downrange extent of the predicted hazard areas. Thus, for a given re-entry event the predicted footprint was about half as long as shown in these figures.

As previously mentioned, US standards require the restriction of ships from the union of the area enclosed by the 1 × 10^–5 probability of impact contour for “debris capable of causing a casualty” and the area where the probability of impact exceeds 1 × 10^–6 for “debris capable of causing a catastrophe.” This analysis applied the conservative assumption that all the debris predicted to survive to impact did so with the original mass at the time of liberation from the main body of the ATV: any fragments predicted to partially demise were treated as if the entire mass survived to impact. As a result of this conservative assumption, all the debris predicted to survive to impact from the nominal and degraded cases impacted with at least 15J (11 ft-lb) of kinetic energy. Therefore, during the development of ship hazard areas for the ATV to comply with US standards, such as the one shown in Figure 9.5.24, all the debris predicted to survive to impact was treated as having the potential for producing serious injuries to occupants of the vehicle.

The development of appropriate ship hazard areas based on US standards also requires a determination of the largest ships that may be present in the area potentially threaten by debris impacts because the probability of impact on a ship depends on the size of the ship. In the absence of specific data about ship sizes in a potential hazard area, US regulations (issued by the FAA) require an assumption that the largest ship that may be present has an exposed area equal to at least 120,000 ft² (11,150 m²) (see Federal Aviation Administration, August 25, 2006 at §B417.11(c)(1)). In addition, analysis of the best available data indicated that the ship traffic was predominantly large tankers in the area where ATV debris impacts were planned. An examination of ship design data demonstrated that large tankers can indeed be expected to have projected areas that could be impacted by ATV debris as large as 120,000 ft² (Scott, 1985). Therefore, this study used an area of 11,150 m² exposed to debris impacts to represent the largest ships expected in the area where ATV debris impacts were planned.

In accordance with US standards, this analysis determined the nominal ATV debris capable of causing a catastrophic accident for ships based on any debris capable of deck penetration. Since data on ship traffic indicated that tankers in general, and large tankers specifically, were the most prevalent ships in the area where ATV debris impacts were planned, the analysis used the conservative assumption that any fragment with at least 4067J (3000 ft-lb) of kinetic energy at impact was capable of causing a catastrophe. The 4067J (3000 ft-lb) of kinetic energy threshold corresponds to the deck penetration thresholds for ships with lengths between 30 m and 91 m (100 and 300 ft) provided by US standards as described in Appendix C.

Although the width of the probability of impact contours appeared quite similar, the 99% contour extended significantly farther in the downrange direction than the 1 × 10^–5 probability of impact contour for large ships. In practice, a ship hazard area established according to US standards would almost certainly include some buffer region added around the probability of impact contours to account for modeling and input data uncertainties, such as those associated with the debris that could survive to impact, the results of various sensitivity studies, etc. Even so, these results suggest that the ship warning areas based on European standards would be similar, but somewhat longer in the downrange direction than those based on US standards for the nominal ATV.

Figure 9.5.25 shows the probability of impact computed by RRAT for debris from a nominal ATV re-entry, assuming that a B747 aircraft is present and flying in each grid cell defined in the region. The lowest probability of impact contour shown (in red in the e-book format and simply the outermost contour in the printed version) in Figure 9.5.25 demarks the region within which a B747 would exceed a 1 × 10^–8 probability of impact anywhere on the aircraft by debris conservatively deemed capable of causing a catastrophe. Lower probability of impact contours were impossible to resolve within the time constraints for this analysis. The inner most (yellow) region in Figure 9.5.25 covers the area within which a B747 would exceed a 1 × 10^–7 probability of impact anywhere on the aircraft by debris conservatively deemed capable of causing a catastrophe. The sample aircraft hazard area shown in Figure 9.5.25 considers that (1) all debris expected to survive to impact during a nominal re-entry for the Jules Verne is conservatively considered capable of causing a catastrophic accident given an impact anywhere on an aircraft based on the aircraft vulnerability guidelines published in RCC 321-07; (2) the presence of a single large commercial transport aircraft at the boundary of a minimally compliant aircraft hazard area could make a significant contribution to the total collective risk computed for the ATV mission; and (3) it seems prudent to abide by the provisional catastrophe aversion criterion put forward in the US Standard. In practice, an aircraft hazard area established according to US standards would include a substantial buffer region to account for operational considerations and modeling uncertainties, for example associated with the debris that could survive to impact, the results of various sensitivity studies, air traffic control constraints, etc. The results of this study demonstrate that the probability of impact contours computed for the 747 are larger than those computed for the two mission essential aircraft: a Gulfstream V and a B757. Therefore, the mission essential aircraft planned to remain at least 100 km away from the debris centerline were exposed to less than 1 × 10^–8 probability of impact with any ATV-1 debris.

9.5.6 Risk Analysis for the Columbia Accident

Summary of Analysis Method

The CAIB sponsored debris risk analysis involved the following steps:

The CAIB data on the recovered debris included material descriptions that allowed categorization of debris into basic material types such as tile, metal, composite, and fabric. Data on 75,440 pieces of recovered debris included impact coordinates. Figure 9.5.26 is a histogram of estimated fragment areas based on data for 15,470 pieces of recovered debris; an exponential distribution provides a reasonable fit.

Table 9.5.5 lists hazard, casualty, and fatality area estimates and fatality area estimated computed for 11 categories of recovered Columbia debris as defined in the table. The hazard area covers all cases of impact without injury, non-fatal injury and fatal injury. In addition, the numbers of recovered fragments in each category are included, facilitating the computation of total hazard area, casualty area and fatality area. Figure 9.5.27 contains a histogram showing the distribution of total hazard, casualty and fatality areas among the debris classes.

Comparison of Model Results and Gathered Debris

Figures 9.5.28 and 9.5.29 compare the distribution of the gathered debris and the model results from the CAIB study in both the downrange and cross-range directions. The model results used input wind data for February 1, 2003 obtained from both the Dallas/Fort Worth and the Shreveport airports, together with monthly average input data for upper atmospheric winds, temperature and density. The standard deviation used for the lift-to-drag ratio was 0.04 for all debris groups because this value produced the best fit to the cross-range dispersion of the debris. The 0.04 lift to drag ratio for tumbling debris was between the historical model input of values of 0.03 for cylindrical and 0.05 for flat plate debris, which were derived based on empirical data collected during the Apollo program. The excellent match between the model and actual results for the cross-range distribution of debris impacts was considered a validation of the lift dispersion model. However, the match between the model and actual results for the down-range impact distribution was simply due to the method used to model the progressive nature of the breakup. The liberation of debris from the Orbiter was assumed to occur over a two minute interval and all fragments were assumed to originate from points along a trajectory defined by a 220 psf piece, which was assumed representative of an intact Orbiter (and the highest ballistic coefficient debris). The approximate time/position that a fragment was liberated from the parent body was computed to provide a good match with observed down-range distribution of the recovered debris.

In response to the CAIB report, the NASA developed an innovative method to compute Orbiter re-entry risks based on a probabilistic footprint model (Collins et al., 2005). For the Entry Over flight Risk Assessment (EORA) study, Orbiter breakup debris was defined for initial conditions at various breakup altitudes as input to NASA’s Object Re-entry Survival Analysis Tool (ORSAT). ORSAT was used to estimate aerodynamic heating rates and associated thermal demise or weight reduction of re-entering fragments. The debris results from ORSAT were grouped by ballistic coefficient and assigned casualty area values for people in the open and for people within a variety of shelter types. The EORA study produced casualty area tables for various debris ballistic coefficients and shelter categories for each of the assumed failure conditions. Values from these tables may then be directly applied to population density and sheltering distributions to compute expected casualties along a re-entry trajectory if the probability of impact is known. As a validation, the casualty areas estimated in the EORA study for debris from the hypothetical loss of control (LOC) altitude closest to matching the Columbia breakup were compared with the casualty areas from the reconstruction of the actual Columbia debris, which are described above. The comparison showed that the debris lists were somewhat different, but the casualty expectations estimated using the traditional footprint approach applied during launch (and in the CAIB public risk study) and the new method used by NASA for STS re-entry (described below) matched reasonably well over a range of population conditions.

In response to the Columbia accident and CAIB findings, NASA developed an innovative approach to estimate Orbiter re-entry debris risks, which was implemented in the Public Entry Risk Assessment (PERA) program. The PERA program departed from the traditional launch and re-entry risk assessment approach, which uses a deterministic debris list in terms of the number of fragments in each category of debris (based on ballistic coefficient and induced velocities, etc.). Instead, the developers of PERA used a probabilistic approach to directly describe the distribution of casualty area for a given shelter type within the debris impact footprint. The developers of PERA believed that this approach would better account for the inherent variability in the nature of the debris produced by an Orbiter re-entry failure of a given type and the variety of Orbiter re-entry failure types. The developers of PERA also believed that the number of possible LOC conditions, the progressive nature of breakup for much of the re-entry, and the diversity of the land area at risk, were all much greater for an Orbiter re-entry than in the launch range safety problem. Figures 9.5.30 and 9.5.31 show the PERA results for the cross-range and downrange distributions of casualty area the Columbia accident.

Summary of Key Results from Columbia Public Risk Analysis

Table 9.5.6 presents the key results of the CAIB public risk study: a range of estimated conditional collective risk to the public, given the Columbia disintegrated where, when, and how it did. These risk estimates were based on the conservative assumption that the mix of the gathered debris was representative of the mix for any unrecovered debris that survived to impact. This assumption was considered conservative because it is likely that any surviving unrecovered debris fragments were relatively small and light (i.e. lower ballistic coefficients), and thus less threatening to people on the ground, since higher ballistic coefficient debris would have been more likely to land in the ground search pattern (near the centerline of the debris field) and been recovered. The column containing P (≥1 casualties) provides an estimate of the conditional probability of one or more casualties. These conditional risk estimates indicate that the probability of one or more casualties on the ground was less than 50%. Therefore, the absence of serious injuries to people on the ground due to the Columbia accident was the statistically expected outcome based on census data and numerical modeling methods consistent with risk analysis standards available in advance of the accident. The results in Table 9.5.6 also show that uncertainty in the amount of Columbia debris that survived to impact had a significant influence on the estimated public risks, but not enough to change the central conclusion.

The CAIB public risk study showed that sheltering played an important role because an average roof provided building occupants substantial protection from the average piece of debris, which weighed less than 1 lb. The CAIB analysis also computed individual risk on the ground, and reported that the highest conditional probability of any particular person becoming a casualty was 7.6E-5. In other words, no individual had greater than about 1 in 10,000 chance of suffering a serious injury or worse, given the Columbia accident occurred where and how it did.

The results of the CAIB public risk analysis and subsequent analyses demonstrate that the relatively low population density in the area of the debris impacts had a critical influence on the outcome. A subsequent risk analysis that used the same methods as the CAIB study produced the risk profile results shown in the Figure 9.5.32 demonstrated that a similar breakup of an Orbiter over a major city would have been statistically expected to produce a few ground casualties. Specifically, an analysis was performed that assumed the final re-entry of Columbia was delayed by on-orbit, such that the debris would have impacted a more densely populated area of Texas that includes the Houston metropolitan area. Figure 9.5.32 shows that such an event would have had more than a 50% chance of producing at least three ground casualties, although the chance of 10 or more casualties would have remained well below 1 in 10,000.

The CAIB published the results of a preliminary study of the conditional risks to aircraft that indicated the expected number of plane impacts was approximately 0.03. The CAIB study results were based on estimates of the aircraft density, but a subsequent study sponsored by the FAA used data on the actual commercial aircraft trajectories at the time of the accident. The FAA sponsored study estimated that the expected number of impacts with commercial aircraft was between 3 in 1000 and 1 in 10, depending primarily on the uncertainty associated with how many small fragments survived to aircraft altitudes but were unrecovered (Carbon and Larson, 2005). Further investigation sponsored by the FAA revealed that the conditional risk was about 0.008 expected impacts for general aviation aircraft in the region based on the best available air-traffic density model and the recovered debris from Columbia. The highest probability of impact to any individual aircraft was estimated to be between 1 in 10,000 about 1 in 100, depending primarily on the uncertainty associated with how many small fragments survived to aircraft altitudes but were unrecovered. The Columbia accident led NASA and the FAA to develop and implement a system to protect aircraft during subsequent Shuttle re-entries (Murray et al., 2010). Also in the wake of the Columbia accident, multiple US agencies collaborated to develop consensus based aircraft protection standards and models to characterize aircraft vulnerability to launch and re-entry debris (Wilde and Draper, 2010).

Summary and Conclusions from Columbia Public Risk Analysis

A thorough independent investigation of the conditional public risks that accounted for all Columbia debris recovered, used rigorous and conservative methods, and included projections for potential impacts from unrecovered debris concluded that no ground casualties was actually the most likely outcome given the accident occurred where, when, and how it did. The Columbia accident highlighted the potential threats to public safety posed by re-entry and changed NASA’s approach to re-entry safety from entirely focused on the people on-board to a formal public risk acceptability policy that demands rigorous analysis to demonstrate compliance with quantitative criteria.¹

References

1. Ailor W, Wilde P. Requirements for Warning Aircraft of Reentering Debris. Rome, IT: 3rd IAASS Safety Conference; 2008.

2. Carbon S, Larson E. Modeling of Risk to Aircraft from Space Vehicle Debris. San Francisco, CA: AIAA Paper 2005–6506; 2005; AIAA Atmospheric Flight Mechanics Conference and Exhibit.

3. Collins JD, Chrostowski JD. Calculation and Communication of Explosive Risk Considering Uncertainty and Bias. Palm Springs, CA: 33rd US Dept. of Defense Explosives Safety Seminar; August 2008.

4. Collins JD, Chrostowski JD, Wilde PD. Measures and Techniques for Inserting Catastrophe Aversion into the Explosive Safety Risk Management Process. Philadelphia, PA: 32th US Dept. of Defense Explosives Safety Seminar; August 2006.

5. Collins JD, Lin, Mark YY, Larson EWF. Determination of Debris Risk to the Public Due to the Columbia Breakup during Re-entry. Published as Appendix D.16 in Vol. II of the Columbia Accident Investigation Board Final Report 2003; pp. 475–506.

6. Collins JD, Nyman R, Lottati I. Estimation of the Space Shuttle Orbiter Reentry Debris Casualty Area. San Francisco, CA: AIAA Paper 2005–6321; 2005; AIAA Atmospheric Flight Mechanics Conference and Exhibit.

7. Center for International Earth Science Information Network (CIESIN). Columbia University; Gridded Population of the World Version 3 (GPWv3). Available at http://sedac.ciesin.columbia.edu/gpw;.

8. County of Santa Barbara, Planning and Development, Environmental Thresholds and Guidelines Manual. October 2008.

9. ESA/ADMIN/IPOL. 2, dated April 2008 on page 7: “OR-07”. 2008.

10. ESA/ADMIN/IPOL. 2, dated April 2008 on page 7: “OR-06 For space systems that are disposed of by re-entry, the prime contractor shall perform an analysis to determine the characteristics of fragments surviving to ground impact, and assess the total casualty risk to the population on ground assuming an uncontrolled re-entry”. 2008.

11. Federal Register, Vol. 75, No. 233, 6 December 2010, page 75620.

12. Federal Aviation Administration. Flight Safety Analysis Handbook, Version 1.0, Office of Commercial Space Transportation, 800 Independence Avenue. 2009; Room 331, Washington, DC 20591.

13. Licensing and Safety Requirements for Launch; Final Rule. Federal Aviation Administration, Department of Transportation August 25, 2006; 14 CFR Parts 401, 406, 413, 415, 417 Federal Register, Vol. 71, No. 165.

14. Hazard Analysis for Uncontrolled Space Vehicle Re-entry. Patera R.P., Journal of Spacecraftand Rockets, Vol. 45September – October 2008. No. 5.

15. Justus CG, Jeffries III WR, Yung SP, Johnson DL. The NASA/MSPC Global Reference Atmospheric Model – 1995 Version (GRAM 95). NASA Technical Memorandum 4715, Marshall Space Flight Center, AL August 1995.

16. Larson EWF. Large Region Population Sheltering Models for Space Vehicles. San Francisco, CA: AIAA Paper 2005-6322, AIAA Atmospheric Flight Mechanics Conference and Exhibit; August 2005.

17. Lin, M. Y.Y., Larson E.W.F., and Collins J.D., Determination of Debris Risk to the Public Due to the Columbia Breakup During Re-entry. Report No. 03-517-01, ACTA, Inc., Torrance, CA, prepared for Columbia Accident Investigation Board. September 2003. Also Appendix D.16 to the Columbia Accident Investigation Board Final Report, Vol. II, pp. 475–506.

18. Lottati I, Larson EWF, E., Collins JD. Independent Assessment of the Risk to the Public of a Random Re-entry of the Hubble Spacecraft. Report No. 04-542-01, ACTA Inc July 2004; prepared for NASA-Headquarters Independent Program Assessment Office.

19. Mrozinski R, Mendeck G, Graybeal S. Debris Field Estimation Methods for the STS-107 Columbia Investigation. Keystone, CO: AIAA Paper 2006–6501; 2005; AIAA Atmospheric Flight Mechanics Conference and Exhibit.

20. Murray D, Mitchell M. Lessons Learned in Operational Space and Air Traffic Management. Orlando, FL: AIAA 2010–1349; 2010; Presented at the 48th AIAA Aerospace Sciences Meeting.

21. Nuclear Regulatory Commission. Nuclear Regulatory Safety Policy Goals. Federal Register. 1986;Vol. 51 page 28044.

22. Oak Ridge National Laboratory. “LandScan Dataset, ”. In: www.ornl.gov/sci/landscan/;.

23. Pelton JN, Jaku R. Space Safety Standards and Regulations 2010; ISBN: 9781856177528.

24. Risk Committee, Range Safety Group, Range Commanders Council. Common Risk Criteria for National Test Ranges. RCC 321–07 and subsequent such as RCC 321–10 Standard and Supplement 2007.

25. Patera RP. Risk to Commercial Aircraft from Re-entering Space Debris Honolulu, HI: Patera, R.P., AIAA 2008-6891; 2008; AIAA Atmospheric Flight Mechanics Conference and Exhibit.

26. Scott R. Standard Ship Designs: Bulk Carriers and Tankers. Fairplay Publications Ltd. 1985.

27. Wilde P, Nyman R, Draper C, Bavandi A. Independent Study of the Risks from the Re-entry of the Automated Transfer Vehicle. Rome, IT: 3rd IAASS Safety Conference; 2008.

28. Wilde PD, Draper C. Aircraft Protection Standards and Implementation Guidelines for Range Safety. Orlando, FL: AIAA 2010-1542, Presented at the 48th AIAA Aerospace Sciences Meeting, 4–7; January 2010.

29. Wilde PD. Public Risk Criteria and Rationale for Commercial Launch and Re-entry. 5th IAASS Safety Conference, Versailles, France October 17–19 2011.

9.6.1 Design for Demise Concept

In 1995 NASA established a human casualty risk threshold of 1 in 10,000 per re-entry event for its spacecraft, launch vehicle orbital stages, and other related hardware. This criterion was later adopted by the full US Government and by several other national space agencies, as well as the multinational European Space Agency. To evaluate compliance with this safety standard, NASA employs a specially designed computer model developed at the Lyndon B. Johnson Space Center and named Object Re-entry Survival Analysis Tool (ORSAT).

Application of ORSAT for dozens of spacecraft and launch vehicle orbital stages revealed a number of trends. First, components comprised of high melting temperature materials, such as titanium, beryllium, and stainless steel, were the most likely objects to survive re-entry and pose hazards to people on Earth. Second, certain component types repeatedly appeared on lists of surviving objects. The most common were propellant and pressurant tanks, parts of solar array drive mechanisms, and parts of reaction wheel assemblies. Third, space vehicles with an initial mass greater than 500 kg would often initially be found to be non-compliant with the human casualty risk threshold of 1 in 10,000.

To address these issues in a synergistic manner, personnel of the NASA Goddard Space Flight Center and the NASA Johnson Space Center jointly undertook a new endeavor aimed at reducing the number of hazardous satellite debris to reach the surface of the Earth. This program is called Design for Demise (D4D). Beginning as early as possible in the design and development of a new space mission, preferably no later than Phase A, both the spacecraft bus and the payload instruments and structural components are evaluated for the potential to survive an uncontrolled re-entry. An iterative process between the satellite designers and re-entry survival assessment specialists seeks to identify components likely to impact the Earth and to find cost-effective countermeasures to minimize the number and mass of such objects. Those components with the greatest contribution to human casualty risks are tackled first.

In addition to solving re-entry risk challenges for specific satellites, the Design for Demise program has produced new hardware designs which can be applied to other space missions, simplifying assessments for future satellites, further reducing costs, and limiting risks to people. The ultimate goal is promote new space vehicle design practices which consider re-entry hazards from the start.

9.6.2 Design Options

Design options typically fall within one of five major categories of countermeasures: change of materials, mass removal, layering, change of shape, and containment. The objective of each of these solutions is either to reduce the number of hazardous objects striking the Earth or to reduce the impact kinetic energy to an acceptable level, i.e., less than 15 J.

Material Type

High melting temperature materials have long been used in satellite and launch vehicle stage construction for a variety of physical attributes, not the least of which is inherent strength. Propellant and pressurant tanks are often built with titanium or stainless steel. For example, the US Delta II second stage employs a single, integrated stainless steel propellant tank with a dry mass in excess of 250 kg, as well as four titanium spheres with masses of 10 kg or 30 kg for the attitude control and pressurant systems. Each of these tanks represents a potential lethal hazard to people on the Earth after re-entry. Similarly, titanium is often used for the casings of solid rocket motors, like those used for the Delta II third stage. Examples of all of these tank types have been found on the ground following known re-entries.

One of the most widely recognized re-entry risks since 2001 was the potential uncontrolled re-entry of the disabled USA-193 spacecraft. At the heart of the satellite was a titanium tank with approximately 450 kg of frozen hydrazine. Multiple, detailed analyses indicated that the full titanium tank had the potential of surviving re-entry intact (as is common for empty tanks), allowing its contents to later vaporize and to pose a hazard to people on Earth. In the face of this threat, the US destroyed the spacecraft just prior to re-entry in February 2008, thereby eliminating the hazard: Had the USA-193 tank been made of a lower melting temperature material, such an extreme measure would have been unnecessary.

At the time of the USA-193 episode, NASA was developing the spacecraft for the Global Precipitation Measurement (GPM) mission. An ORSAT analysis in 2002 had identified the titanium tank proposed to carry more than 500 kg of hydrazine as a significant re-entry risk. Consequently, NASA sponsored an effort to design, manufacture, and flight qualify an equal-capacity aluminum tank. In addition, an all-aluminum internal propellant management device (PMD) was sought. Both efforts presented technical challenges: hydrazine compatibility with aluminum 6061 had to be proven, as was a high wettability process for an aluminum PMD. In the end, the two objectives were fully achieved. Not only was the re-entry risk for the tank reduced to zero, but also weight savings were found.

A 2005 assessment of the survivability of the US National Polar-orbiting Operational Environmental Satellite System (NPOESS) spacecraft found that the proposed titanium propellant tank would impact the surface of the Earth with a mass of 90 kg. A series of alternative tank designs with different materials, wall thicknesses, and shapes were examined. Several options were identified that would result in a completely demisable tank.

As noted previously, reaction wheel assemblies are usually found to have surviving components. In part, this is due to the layered construction of the assemblies. Inside the housing can be flywheels, shafts, and bearings. By the time the housing demises, insufficient time in the re-entry process remains for some of the interior components to demise, i.e., not enough energy can be absorbed. NASA studied three commercially available reaction wheel assemblies and found that all three had components surviving with impact energies in excess of 15 J. For one spacecraft design, the re-entry risk from reaction wheel assemblies alone (a total of five were needed) resulted in a re-entry human casualty risk exceeding 1 in 10,000.

An effort by spacecraft engineers at the Goddard Space Flight Center, again working on the GPM project, yielded a new reaction wheel assembly design which posed no risk to people on Earth. Although one interior component was assessed to survive re-entry, the impact energy (< 7 J) was not sufficient to cause injury. The design was also approved for use on NASA’s Lunar Reconnaissance Orbiter.

Even the scientific payload for GPM was designed with component demisability in mind. The US microwave imager was restricted to no more than three individual parts satisfying either of two conditions: (1) individual parts with a melting temperature exceeding 1000°C and any linear dimension exceeding 0.2 m, and (2) individual parts with a mass greater than 3.0 kg of stainless steel alloys, 1.0 kg of titanium alloys, 1.0 kg of beryllium alloys, or 1.0 kg of any material with a melting point greater than 1000°C.

Likewise, JAXA, NASA’s partner for GPM, limited use of titanium in the dual frequency precipitation radar that it was contributing to the spacecraft. Aluminum was used instead of titanium for the instrument flexures, and Al-SiC was used for end fittings to the carbon fiber spacecraft upper bus structure. Moreover, the solar array panels were designed without titanium inserts, and Al–SiC end fittings were used for the boom composite tubes.

NASA’s Gamma-ray Large Area Space Telescope (GLAST) was also the subject of an effort to reduce the amount of debris expected to survive an uncontrolled re-entry. An examination of eight titanium payload struts found them to be survivable. The struts were then redesigned with graphite epoxy to be demisable.

Mass Removal

Whether or not a component survives re-entry is often dictated by its mass. Even low melting temperature materials, like aluminum, can survive re-entry if they are used in sufficient quantities. Such can happen with spacecraft structural members. Sometimes simply removing mass by strategically-located machine cut-outs of bulkheads can lead to demise by a combination of less mass and improved heat transfer processes, while still retaining the necessary structural integrity.

Since the 1990s increasing use has been made of spacecraft and launch vehicle tanks comprised of thin metallic shells wrapped with multiple layers of composite materials. Such tanks can save both weight and money (up to 50%) and lead to reduced re-entry risks. The internal shells can be aluminum or sufficiently thin titanium to permit re-entry demise. The aforementioned propellant tank for the GPM mission was, in actuality, a composite overwrapped pressure vessel (COPV) with an aluminum liner.

Layering

When launch vehicles are carrying a payload which is substantially below their maximum payload capacity, increased acceleration forces can result. To avoid this problem, simple weights can be added as ballast. Unfortunately, such items might also pose re-entry risks. For a variety of reasons, the use of lower melting temperature materials for the ballast is not always possible. An alternative is to construct each of the ballast blocks of multiple thin layers. The thickness of each layer is design either to allow complete demise during re-entry or to reduce the mass to a point at which the impacting energy is less than 15 J.

NASA’s Radiation Belt Storm Probes (RBSP) encountered a similar problem. A total of 30–40 tungsten weights of about 1 kg each were envisioned for balancing purposes. However, analyses showed that 1-kg tungsten blocks would survive re-entry. Lead was proposed as an alternative, but it was not acceptable due to other properties. The final solution was to design each tungsten block with several thin plates of tungsten held together with an aluminum band. During re-entry, the aluminum band would quickly melt, releasing the individual plates. Although the individual plates were assessed to survive, they impacted the ground with less than 15 J of energy and were deemed acceptable.

A detailed examination of the balance weight design for NASA’s Soil Moisture Active and Passive (SMAP) mission was undertaken in the same manner. Designs which led to either no surviving debris or to debris with impact energies less than 15 J were identified.

Shape Considerations

The rate of heat transfer into a re-entering object is dependent upon its speed, which in turn is dependent upon its ballistic coefficient, i.e., mass and shape. If the ballistic coefficient of a component can be altered, then the survivability of the component might also change. In one NASA program the spacecraft included titanium flexures to support the primary instrument. These titanium flexures were found to survive re-entry with an impact energy greater than 15 J. Different materials were considered to replace the titanium, but none were acceptable. Instead, the shape of the flexures was altered, changing the ballistic coefficient enough to eliminate the re-entry hazard.

Containment

Sometimes re-entry risks can be reduced by making objects more survivable. This seemingly contradictory statement can in fact be true. For example, consider the case of an instrument that consists of a outer shell and multiple components inside, i.e., a standard “black box”. Such shells are normally constructed of thin aluminum sheets, which typically burn-up quickly during re-entry. At that point the internal components are released. If these components do not themselves demise, the aggregate re-entry risk at first order will be proportional to the number of surviving components and when coupled with other surviving objects might exceed the 1 in 10,000 limit.

On the other hand, if the instrument shell were made of a different material or thickness, the unit would impact the ground as a single object. In this case, strengthening the shell to survive re-entry would result in a lower overall re-entry risk. Consider ten survivable cubes of 0.01 m side dimension inside a box with dimensions of 0.5 m × 0.2 m × 0.2 m. The maximum impacting area of the box is 0.1 m², yielding a debris casualty area of (0.6 + [0.1]^0.5)² or 0.84 m². If the individual cubes are allowed to strike the Earth, the debris casualty area is 10 × (0.6 + [0.0001]^0.5)² or 3.6 m².