Description of Driving Event:
This Lessons Learned is based on Reliability Practice No. PD-EC-1102; from NASA Technical Memorandum 4322A, NASA Reliability Preferred Practices for Design and Test. Benefit: Reliability is greatly enhanced because the likelihood of serious mission degradation or spacecraft loss is significantly reduced. Implementation Method: Prepare design requirements which specify mean velocity, mass density, and mass distribution for the impacting particles in terms of the integral fluence. This fluence (sample units m-2) represents the expected number of impacting particles per unit area, above several different mass thresholds for the mission (using the worst case trajectory if more than one is contemplated). The design must then satisfy two separate requirements: (1) that the smallest penetrating particle have a probability of impact below 5%, using the product of fluence with vulnerable area and a Poisson distribution, and (2) that for smaller particles, of which many will impact any given spacecraft surface, the resulting degradation of surface properties (e.g., optical, thermal, dielectric) does not exceed allowable ranges for surface performance (considering, e.g., pitting, spallation, contamination, etc.). In practice, the first of these refers to a sum of probabilities over a variety of vulnerable spacecraft surfaces (each having specific values for area and threshold penetrating mass), allocated so as to make effective use of resources (e.g., shielding mass) and to achieve the desired probability for mission success. For this purpose, experience dictates that a two-surface configuration, of which the outer surface serves as the thermal blanket as well, provides the least massive meteoroid protection. Technical Rationale: For a given mission (specified in terms of geocentric and heliocentric positions as functions of time, for example), the environments comprising impacting solid particles are both independent of mission control and rather uncertain. The flux and fluence of such particles can be evaluated from suitable numerical models (here for space debris and for interplanetary meteoroids, although others may occur, e.g., for Saturn ring particles). The integral fluence typically decreases as mass increases according to a power law, illustrated here using the exponent a:
Here F and F1 represent the integral fluences (sample units m-2) for particles with masses greater than m and m1 respectively, accumulated over the mission. Table 1 provides examples of such distributions (where the exponent is not necessarily constant over the range of masses of interest) and additionally specifies mean density and impact velocity. For large particles, the distributions represented by equation (1) or Table 1 imply that the exposed surface area As of a spacecraft subsystem has a probability
that no particle larger than the mass ms (corresponding to the fluence F) will hit, where equation (2) is obtained assuming Poisson statistics for the particle impacts. If the surface is designed so that no particle of mass ms or larger, impacting at the mean velocity, can penetrate or lead to other component failure (e.g., by spallation), then the probability of no failure is also Ps (assuming that penetration leads to component failure with unit probability). When Ps is small for each subsystem (as is the case when the area-fluence product in eq. 2 is much less than unity), the sum
represents the probability of failure (Pt) of the system, where ps is the conditional probability that the system fails when subsystem s fails. If the values of ps are not independent then equation (3) must be replaced by the appropriate combination of probabilities. Finally, the probability of mission success, considering particle impact alone, becomes (1-Pt), and design must proceed to ensure that this quantity exceeds the 95% probability cited above. To protect a subsystem against those large particles for which equation (2) applies, and for impact velocities larger than a few km/s, hypervelocity impact experiments show that a two-surface configuration (often named a bumper shield) prevents penetration far more effectively than a single surface of the same mass. This is so because the kinetic energy of impact leads to the vaporization (or liquefaction or disintegration) of the projectile when it hits the outer target surface; the momentum is thereby dispersed over a large area as the vapor expands in the space between the surfaces, and becomes less capable of rupturing the second surface than had the latter been hit directly. Typically a thickness of a few tenths of a millimeter, and a standoff distance of a few centimeters, suffice to prevent penetration of a spacecraft structural wall by a milligram particle arriving normally at 15 km/s. For a sample configuration, Figure 1 displays the threshold penetration mass as a function of impact velocity. Such a figure can be used to verify by analysis that the design does not fail for the mass necessary for equations (1) through (3) to provide the required probability; and a parametric set of such figures spanning a suitable design space can be used to select the design appropriate for a given spacecraft assembly. In this design process, the uncertainties in penetration threshold and the variability thereof with angle of incidence (Fig. 1 and related data are commonly presented for normal impact, oblique impacts being less well characterized) must be considered, possibly by application of margin to some measure of shield effectiveness (the use of Poisson statistics for probability of impact is intended to cover only environment uncertainties, not shielding ones). In many cases, thermal blankets of a single design and standoff will serve as an appropriate bumper shield for much of the spacecraft body. Analytic formulations for hypervelocity penetration, and for bumper spacing and other parameters, should be selected carefully for relevance to the specific impact regime (e.g., projectile speed, direction, density, etc.). The resulting design should be verified by testing whenever possible, and the tests should span or simulate the range of expected projectile sizes and velocities. For much smaller particles, the power-law distribution (eq. 1) ensures that the area-fluence product exceeds unity for most exposed spacecraft surfaces, and that numerous small particles will strike the surface. For surfaces which are shielded as described above, these smaller particles are of no consequence, except as they alter the thermal properties of the surface; the thermal control design must provide enough latitude that these changes do not lead to internal temperatures beyond the acceptable range for flight. For other surfaces, concern arises only if a few critical surface properties must be maintained; for example, structural integrity and magnetic cleanliness are not threatened by these small impacts. Among such critical properties, optical quality is often the most serious, as in lenses or mirrors whose performance can be degraded by pitting, erosion, or contamination. For such components, ad hoc solutions to the particle impact problem, possibly involving articulating covers, may be necessary if analysis demonstrates that the particle fluence represents a significant hazard to unprotected surfaces. Typically, if a specific fluence value is required for design purposes in these cases, a margin of a factor 2 is applied to the nominal values (e.g., Table 1) to account for the uncertainty in the environment of these smaller particles. | Table 1. | Integral fluence of cometary meteoroids as a function of particle mass for three subsets of the Galileo mission (columns two and three include interplanetary meteoroids near Jupiter, as focused by Jupiter's gravitational field). |
Particle Mass-M
(grams) | Integral Fluence(1) Received
during Transit*
(Particles-m-2 of mass greater
than M) | Integral Fluence(2) Received
during Orbit**
(Particles-m-2 of mass greater
than M) | Mission Integral
Fluence(3)
(Particles-m-2 of mass greater
than M) | 10-12
10-10
10-8
10-6
10-5
10-4
10-3
10-2
10-1
10-0 | 1.06 x 104
4.27 x 103
5.37 x 102
21.2
1.33
8.15 x 10-2
4.99 x 10-3
3.06 x 10-4
1.87 x 10-5
1.15 x 10-6 | 7.89 x 103
3.17 x 103
3.99 x 102
15.7
9.6 x 10-1
5.9 x 10-2
3.6 x 10-3
2.2 x 10-4
1.36 x 10-5
8.3 x 10-7 | 1.85 x 104
7.44 x 103
9.36 x 102
36.9
2.29
1.41 x 10-1
8.59 x 10-3
5.26 x 10-4
3.23 x 10-5
1.98 x 10-6 | Mean relative
speed (km/s) | 15.9 | 15.9 | 15.9 | Particle mass
density (g/cm3)
(cometary origin) | 0.5 | 0.5 | 0.5 | *Tabulated values envelope the Galileo transfer trajectories including VEEGA, delta VEGA 2 , delta VEGA 3 , and direct.
** Fluence resulting from JOI and the first 5 orbits of the Galileo 79-1 Tour, includes gravitational focusing from Jupiter.
(1) 95% confidence environment - 2.0 x fluence spectra
(2) 95% confidence environment - 5.6 x fluence spectra
(3) 95% confidence environment - 4.4 x fluence spectra |
| Figure 1. | Meteoroid critical mass as a function of impact speed for the Cassini propellant tanks, including a bumper shield and fluid within the tanks. The lines are for different densities of the impacting meteoroid, with and without fluid in the tanks, and the power-law segments represent different regimes of failure. |
(Click image for a larger view)
![refer to [D] description](/offices/oce/llis/llis_lib/images/1009055main1_0679s.jpg "refer to [D] description") [D]
Lesson(s) Learned:
Impact of Nonpractice:
As an example of noncompliance, consider a spacecraft bus, containing critical electronic parts, whose shear plate and thermal blanket are adjacent (i.e., not separated by the standoff which characterizes a suitable two-surface particle shield). The largest incident particle, namely that for which the area-fluence product is near unity (ref. Table 1) is then, for long-duration missions in low Earth orbit or in the inner solar system, capable of penetrating the electronics housing or of producing spallation from the inner surface. In either case a single impact introduces numerous fast-moving fragments into the electronics themselves, several electronic parts will be disabled simultaneously, and the probability is high that the subsystem's function will be severely compromised, resulting in mission failure if the subsystem is critical. Even if redundant assemblies are provided, they should not be packaged together, because one particle impact may destroy them both. Even if packaged separately, the likelihood of two impacts (of a penetrating particle) is only modestly smaller than that of one impact, so that redundancy is a far more expensive and less effective option than the provision of suitable particle impact shielding in the first place. An equally serious failure resulting from noncompliance is illustrated by the scenario, extensively investigated for the Galileo spacecraft, that a meteoroid penetration of the propellant tanks could result in loss of fuel, a consequent change in the spacecraft velocity vector, unintended reentry into the Earth's atmosphere (instead of the intended close flyby for gravitational assist), and widespread atmospheric dispersion of radioactive fuel from the RTGs (radioisotope thermoelectric generators). In this scenario, failure to provide adequate meteoroid protection could have both life-threatening and major legal consequences, albeit with small probability. An exceptionally thorough analysis, in which the velocity distributions and the time dependence of the meteoroid flux were used in addition to the appropriate analogs of the above equations, was needed to quantify this small probability.
Recommendation(s):
Practice:
Design spacecraft external surfaces to ensure 95 percent probability of no mission-critical failures from particle impact.
Evidence of Recurrence Control Effectiveness:
This practice has been used on Voyager
Documents Related to Lesson:
N/A
Mission Directorate(s):
- Exploration Systems
- Science
- Space Operations
- Aeronautics Research
Additional Key Phrase(s):
- Extra-Vehicular Activity
- Flight Equipment
- Hardware
- Human Factors
- Launch Vehicle
- Payloads
- Risk Management/Assessment
- Spacecraft
Additional Info:
|
![refer to [D] description](/offices/oce/llis/llis_lib/images/1009051main1_0679eq1.jpg "refer to [D] description")
![refer to [D] description](/offices/oce/llis/llis_lib/images/1009052main1_0679eq2.jpg "refer to [D] description")
![refer to [D] description](/offices/oce/llis/llis_lib/images/1009053main1_0679eq3.jpg "refer to [D] description")
![refer to [D] description](/offices/oce/llis/llis_lib/images/1009054main1_0679l.jpg "refer to [D] description")
