Reducing the Effects of Damaging Impacts
The ISS program has begun to develop systems and procedures to reduce the risk to the ISS and its crew in the event of a damaging meteoroid or debris impact. A current focus is on developing a software tool to aid in determining the effectiveness of various risk reduction systems and procedures. The ISS partners are also working to establish baseline damage control procedures (such as keeping some hatches closed) and to determine which equipment (such as oxygen masks) will be necessary to cope with and mitigate the operational and crew safety hazards resulting from a damaging penetration of the station. The program has also begun to develop repair tools and strategies.
MSCSurv Computer Code
NASA has developed an analysis tool, the Manned Spacecraft Crew Survivability (MSCSurv) computer code, to attempt to quantify the probability of space station or crew loss in the event of a meteoroid or orbital debris penetration of the space station (Williamsen and Guay, 1996). The code randomly generates the parameters—debris diameter, velocity, approach angle, and strike location on the space station geometric model—of an individual orbital debris particle impact, based on the relative probability distribution of each parameter. It then determines whether this particular impact would penetrate a pressurized module by comparing the impact parameters to the ballistic limit of the space station shielding at the impact location. Currently, this code addresses only crewed modules and does not include secondary effects caused by the failure of other items, such
as the thermal control system compartment, the high-pressure oxygen/nitrogen tanks, the gyrodynes, or the plasma contactors.
If the code determines that a penetration will occur, it checks for seven possible failure modes that could result in crew or station loss. These are:
immediate critical crack propagation (unzipping)
loss of control or structural failure due to venting
penetration of critical equipment
crew injury from fragments
crew injury from light flash and overpressure
individual crew hypoxia and multiple crew hypoxia from rescue attempts
delayed loss of the station resulting from irreparable failures of critical systems
The code determines the overall likelihood of loss by dividing the number of penetration combinations resulting in a loss by the total number of penetrations.
This tool also has been used to perform preliminary evaluations of the effectiveness of various escape protocols and of the efficacy of having personal oxygen bottles readily available. Figure 5-1 depicts current MSCSurv predictions for the probability of loss in the event of a penetration under baseline assumptions for three cases: where hatch closure is used to isolate the half of the station in which the leak has occurred, where the individual leaking module can be isolated as the crew proceeds to the safe haven, and where the leak can be immediately located. Figure 5-2 shows MSCSurv predictions for the same cases if oxygen masks are readily available to the crew.
Damage Control Procedures and Supplementary Equipment
The ISS team is developing a set of procedures for the crew to follow when a pressurized module is penetrated by meteoroids and debris. The Russian approach currently differs from the U.S. approach in terms of operational responses to a penetration. For example, once a warning is given, the Russian approach calls for the crew to assess the situation and then to proceed directly to the Soyuz vehicle. Under the planned U.S. procedure, the crew will first establish communications with each other to verify the health and safety of each crew member. The ISS team is working to standardize the operating procedures (Remaklus, 1996).
The current ISS design does not include dedicated hardware to alert the crew to a penetration and to help them locate it. However, sensors that can monitor pressure and changes in pressure are distributed throughout the station as part of the ISS life support system. Sonic impact warning systems for detecting and locating leaks are also not currently planned for the ISS (although test results indicate that astronauts may be able to detect penetrations by the sound of the air hissing through the hole). The Russian ISS team has performed a trade study of possible leak detection and location system concepts. According to NASA, the
most technically feasible option is based on using 30 to 40 piezoelectric sensors per module to record acoustic signals from the penetration and the resulting air outflow. Negotiations to determine the cost and schedule impacts of implementing such a system are ongoing (Meteoroid/Debris FGB Design Team, 1996).
A major concern in the event of a penetration is the health and location of each crew member. The station partners have agreed that portable oxygen masks should be available in each ISS module. Risk assessment studies have indicated that their immediate availability in the event of a penetration could significantly improve crew survivability. Various crew locator systems are also being considered. One approach is a routine call-in using the existing ISS communication system. However, there is some concern that this system may not provide the quick response needed in an emergency. Another approach being evaluated is the use of more automated bar code or badge swipe systems.
Another important concern in the event of a penetration is the ability of astronauts to isolate a penetrated module by closing its hatches. All ISS hatch designs permit closure under some pressure difference, a necessary feature to isolate a penetrated module. The Russian hatches between modules, however, often contain drag-through ventilation and electrical umbilicals, and closing them can take minutes.
The ability to repair penetrations of ISS modules will be useful for ensuring that minor penetrations do not cause massive disruptions in operations. The ISS design currently includes a kit to repair penetrations from the inside of a module. Design concepts for hole repair kits from outside the station have been developed, and a prototype may be tested in space around the year 2000.
ANALYSIS AND FINDINGS
Because of the statistical size distribution of meteoroids and orbital debris, effective damage control should be able to prevent the catastrophic loss of ISS equipment and lives in most cases where existing shielding is insufficient to stop incoming objects. The ISS team, however, has been very slow to devote serious attention to damage control issues. Despite the late start, the ISS damage control protocol is now evolving, aided by the MSCSurv analysis tool.
To date, the ISS damage control approach has focused on catastrophic events that can rapidly result in the loss of life or of the station through fairly straightforward effects. Impacts that are not immediately catastrophic, however, could cause complex failures that could result in the loss of the ISS or in a major disruption of its operations. Indeed, it is likely that a penetration will result in failures in more than one system. A failure modes and effects analysis that accommodates multiple system failures will be useful both in ensuring that multiple key components are not unnecessarily exposed to simultaneous failures and in conducting post-impact damage control and analysis. One area on which this analysis should focus is determining whether an independent emergency attitude control and
reboost capability is needed to minimize the likelihood of a catastrophic spin-up or drag-induced reentry if the primary systems are disabled by meteoroid or debris impact or by some other means.
MSCSurv Computer Code
Although the committee is not in a position to validate the assumptions and implementation of the MSCSurv code, the committee does believe that it could be quite useful in assessing the relative merits of a variety of options that could be implemented to minimize the hazards to the crew and to the station. The cautions of the MSCSurv code author regarding the use of the code are worth repeating:
The probability of loss (Ploss) calculations require significantly more information to compute accurately than PNP calculations. Therefore, there is considerable uncertainty in absolute Ploss values.
The benefit lies in relative comparisons of one set of operating/design assumptions to another, instead of to an absolute Ploss value.
The probability of penetration, not Ploss, should form the basis for any design requirement.
Damage Control Procedures and Supplementary Equipment
The ISS team has been slow to begin work on damage control hardware, such as differential pressure sensors and oxygen masks. However, it is important that such hardware be developed as soon as possible because modifications to the ISS in orbit, when feasible, could be difficult and costly. Unlike the shuttles, the space station cannot be modified during regularly scheduled visits to a repair facility. If needed damage control hardware cannot be developed before the launch date, modifying the ISS to facilitate the subsequent addition of the hardware could help reduce future costs. However, some damage control approaches may be infeasible unless they are executed before launch. For example, major modifications to the hatches between ISS modules probably would not be feasible once the station is in orbit.
Developing procedures for the crew to follow in the event of a penetration can be a cost-effective method of reducing the hazard to the crew and to the station itself. Ground and on-orbit damage control training for the entire crew is needed to ensure standardization and crew coordination during an emergency. Significant differences, however, still exist between the planned Russian and U.S. operational approaches, and the ISS program needs to work to standardize these procedures. In these negotiations, NASA would be wise not to discount the many years of experience the Russians have had operating space stations.
Returning the ISS to full operational status after a penetrating impact will require the development of permanent repair procedures. For repair to be possible, the ISS needs to be designed in such a way that damaged components,
systems, and modules can be isolated and essential electrical power, control signals, and services can be rerouted around the affected area until permanent repairs can be made. Current plans to repair the ISS from the inside appear marginal because 80 percent of the Russian modules and 30 percent of the non-Russian modules cannot be accessed from the inside (under depressurized conditions pressurized space suits will not fit through the connecting hatches). Permanent repair from the outside will probably require the use of specialized processes, such as EVA welding.
Improved knowledge of failure modes, such as petalling, wall weakening, and the frequency of single and multiple punctures, are also crucial for repair efforts. When the shielding is overmatched by the orbital debris threat, a number of failure modes can occur. These include erosion and pressure wall weakening, spallation, single and multiple puncture, and enhanced perforation with petalling. A full understanding of the character and extent of damage that will have to be dealt with will be critical to effective damage control and recovery.
Finding 5. Damage control and repair hardware and procedures are at an early stage of development. If work in these areas is not accelerated immediately, some damage control approaches will become infeasible, and more difficult and costly on-orbit modifications of the ISS will eventually be required.
Recommendation 12. NASA should continue to refine the Manned Spacecraft Crew Survivability (MSCSurv) program. It should be updated to reflect failure modes associated with critical and high-energy systems, toxic gas releases, nonpenetrating impacts, and equipment and system failures caused by impact.
Recommendation 13. NASA should intensify its cooperation with the Russian Space Agency in identifying and resolving areas of difference in design features, operational procedures, and repair techniques to mitigate the hazardous effects of meteoroid and orbital debris penetrations. Issues to be discussed should include emergency procedures, crew location aids, warning systems, oxygen masks, and hatch positioning.
Recommendation 14. The capability of the International Space Station to continue safe operations with damaged wiring, piping, and other systems needs to be assessed. An analysis of failure modes and effects that addresses multiple failures resulting from single penetrations should be performed.
Recommendation 15. The International Space Station program should accelerate efforts to plan for mitigating the effects of penetration. Recent efforts to evaluate relative hazards and to assess response strategies should be expanded and
accelerated. The involvement of the astronaut corps in this effort is vital. More work is needed to develop escape protocols, evaluate the use of sensors to detect and localize penetrations, and develop procedures for making permanent repairs. If enhancements are to be made in orbit when the station is operational, then program managers must prepare for the enhancement now.
Recommendation 16. A study of the failure modes of shielded pressure walls should be performed over the critical range of the threat size, shape, and velocity to fully characterize damage control and repair requirements for potential International Space Station orbital debris penetration.
Meteoroid/Debris FGB Design Team. 1996. NASA/Russia TIM #17 Protocol, Houston Texas, February 19–March 1, 1996. Briefing presented to the NRC Committee on International Space Station Meteoroid/Debris Risk Management, Houston, Texas, April 3, 1996.
Remaklus, D. 1996. Crew Response to Depressurization. Briefing presented to the NRC Committee on International Space Station Meteoroid/Debris Risk Management, Houston, Texas, April 3, 1996.
Williamsen, J., and T. Guay. 1996. Quantifying and Enhancing Space Station Safety Following Orbital Debris Penetration. Briefing presented to the NRC Committee on International Space Station Meteoroid/Debris Risk Management, Houston, Texas, April 3, 1996.