How do you prove spacecraft’s compliance with on-ground casualty risk requirements?

ESA’s DIVE Technical Note – Guidelines for Analysing and Testing the Demise of Man Made Space Objects During Re-entry provides guidelines for modelling and testing the demise of spacecraft during reentry. With the publication of this document, ESA intends to help equipment and system developers prove their compliance with the on-ground casualty risk requirements.

The Technical Note is based on investigation, research and technology development activities carried out during past years in the Agency to better understand demisability.

Design for Demise is the intentional design of space system hardware such that it will disintegrate during an uncontrolled atmospheric reentry in order to reduce the on-ground casualty risk.

Understanding and applying Design for Demise (D4D) is difficult for two reasons:

Reentry processes, such as fragmentation, are not fully understood yet
Performing a demise verification on-ground requires to simulate conditions similar to the ones in space. This is extremely challenging since it requires to simulate the re-entry dynamics, high heat fluxes and mechanical stresses.

Currently we use reentry simulations to assess the potential on-ground casualty risk reduction due to design for demise techniques. Component-based simulations (e.g. simulations performed by the ESA DRAMA tool) allow the obtaining of quick results, with limited modelling effort (e.g. simple shape objects) and time, while having a user-friendly reentry tool for the users. On the other hand, detailed simulations (e.g. simulations performed by the SCARAB, SAM or DEBRISK tools) allow us to investigate better the demise and fragmentation aspects of the reentry analysis, but they will cost in terms of effort and time consumption. In both cases, many uncertainties affect the results of these simulations.

In parallel, on-grounds tests in plasma wind tunnels and static facilities help improving our knowledge about demise phenomena and re-entry predictions. These tests also help to verify and improve the results of the simulations.

To verify and validate on-ground tests and simulations, one would need to carry out in-flight experiments.

Therefore, proving that a spacecraft design is compliant with the ESA Reentry Safety requirement is a real challenge. The ESA DIVE Technical Note has been established to ease equipment and system developers to prove that their design is compliant with the on-ground casualty risk requirement.

DIVE is based on the top-down repartition of the spacecraft into three main levels:

system
equipment
material.

An example of DIVE’s content is the following. The main ESA Re-entry Safety requirement states: “The space system shall be designed and operated such that the re-entry casualty risk does not exceed 10-4 for all re-entry events.”

This requirement is at system level, but it flows down to equipment level. Therefore the DIVE working group has derived from it a new one at equipment level: “The equipment shall demise when released at geodetic altitude of B km or above assuming an initial release temperature of A K, with a 5% significance level based on Monte Carlo analysis for the defined reentry corridor.”
The release temperature shall be assumed to be 300 K, unless properly justified, while the required release altitude shall be defined as the minimum release altitude for which the equipment is required to demise. It can be derived using system level analyses. Right now, it is still challenging to verify the requirement at equipment level, but we expect fast developments in tests and simulation tools. These enhancements should facilitate future verifications.

In general, systems have to ensure the break-up and the release of the equipment at favourable conditions for the demise, while the pieces of equipment have to ensure the reduction of the casualty risk by demising or keeping together dangerous fragments.

A component-based simulation is used to verify the demisability of the systems, but the simulation works by using equipment models found in the tool database. In the case of missing elements, the DIVE process will help to model them.

When the result of the simulation shows that the mission will not comply with the on-ground risk requirement, it will be necessary either to perform a controlled reentry or to apply design changes to the critical pieces of the equipment (those having a significant impact at system level).

The modelling of new equipment is possible only if all materials are available in the database, otherwise the materials should be modelled as well. Then one carries out a component-based simulation to validate the model.

In some cases, a detailed model simulation is required.

This new simulation should pay attention to the following elements:

the fragmentation events must be only melt-driven
no thermo-physical effects should prevent the fragmentation events
the heat flux distribution should be simulated

If these three elements are validated, then one can translate the detailed model to a component-based simulation. The result of this process is a new database entry.

When these three elements can’t be validated, then one need to test the equipment in on-ground testing facilities.

Lastly, to model a new material two possible ways are foreseen. The first is to prove that the material is similar to materials already in the ESA ESTIMATE database, the second involves testing the material to unfold its main characteristics related to its demisability properties.

To conclude, DIVE is a Technical Note which will be applied and tested in future demise activities. The long-term aim is to have validated models to facilitate and simplify the review procedures.

Among the next challenges that will have to be tackled in the framework of Design for Demise, an exceptional step forward will be to identify and summarise all the known techniques that could be used to improve demisability. Each of these techniques will reduce the on-ground casualty risk, but also have an impact on the spacecraft design. Both of these effects should be assessed.

To answer to these needs, an ESSB Handbook, called Design for Demise Guidelines for Space Debris Mitigation, is currently under development within ESA. Moreover, the Handbook aims at building upon the work carried out in the frame of DIVE, flowing down requirements at subsystem, equipment and material level from the ones at system level. It will also keep on providing guidelines about software modelling, verification and testing.

DIVE is available here (note that to access the database you must register first on the ESA Space Debris User Portal https://sdup.esoc.esa.int/ ).