ISO 16126:2014

INTERNATIONAL ISO
STANDARD 16126
First edition
2014-04-01
Space systems — Assessment of
survivability of unmanned spacecraft
against space debris and meteoroid
impacts to ensure successful post-
mission disposal
Systèmes spatiaux — Évaluation de la capacité de survie des véhicules
spatiaux non habités face aux débris spatiaux et aux impacts de
météoroïdes pour garantir une élimination efficace d’après-mission
Reference number
ISO 16126:2014(E)
©
ISO 2014

---------------------- Page: 1 ----------------------
ISO 16126:2014(E)

COPYRIGHT PROTECTED DOCUMENT
© ISO 2014
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.org
Web www.iso.org
Published in Switzerland
ii © ISO 2014 – All rights reserved

---------------------- Page: 2 ----------------------
ISO 16126:2014(E)

Contents Page
Foreword .iv
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 3
5 Impact survivability assessment requirements . 3
6 Impact survivability assessment procedure . 3
6.1 General . 3
6.2 Definition of survivability requirement . 3
6.3 Impact risk analysis . 3
7 Procedure for performing a simple impact risk analysis . 4
7.1 General . 4
7.2 Spacecraft operating parameters and architecture design . 5
7.3 Identification of critical components and surfaces . 5
7.4 Ballistic limits . 5
7.5 Failure probability analysis . 5
7.6 Completion of analysis . 6
8 Procedure for performing a detailed impact risk analysis . 6
8.1 General . 6
8.2 Spacecraft operating parameters and architecture design . 6
8.3 Identification of critical components. 6
8.4 Ballistic limits . 7
8.5 Failure probability analysis . 8
8.6 Iteration of analysis. 8
Annex A (informative) Supplementary information on the simple impact risk
analysis procedure .10
Annex B (informative) Ballistic limit equations .12
Annex C (informative) Background information on hypervelocity impact testing and modelling .14
Annex D (informative) Method to calculate impact-induced Probability of No Failure .16
Annex E (informative) Options for improving impact survivability .17
Bibliography .19
© ISO 2014 – All rights reserved iii

---------------------- Page: 3 ----------------------
ISO 16126:2014(E)

Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the meaning of ISO specific terms and expressions related to conformity
assessment, as well as information about ISO’s adherence to the WTO principles in the Technical Barriers
to Trade (TBT) see the following URL: Foreword - Supplementary information
The committee responsible for this document is ISO/TC 20, Aircraft and space vehicles, Subcommittee
SC 14, Space systems and operations.
iv © ISO 2014 – All rights reserved

---------------------- Page: 4 ----------------------
INTERNATIONAL STANDARD ISO 16126:2014(E)
Space systems — Assessment of survivability of unmanned
spacecraft against space debris and meteoroid impacts to
ensure successful post-mission disposal
1 Scope
This International Standard defines requirements and a procedure for assessing the survivability of
an unmanned spacecraft against space debris and meteoroid impacts to ensure the survival of critical
components required to perform post-mission disposal. This International Standard also describes
two impact risk analysis procedures that can be used to satisfy the requirements. The procedures are
consistent with those defined in References [1] and [2].
This International Standard is part of a set of International Standards that collectively aim to reduce
the growth of space debris by ensuring that spacecraft are designed, operated, and disposed of in a
manner that prevents them from generating debris throughout their orbital lifetime. All of the primary
[3]
debris mitigation requirements are contained in a top-level International Standard. The remaining
International Standards, of which this is one, provide methods and processes to enable compliance with
the primary requirements.
2 Normative references
The following documents, in whole or in part, are normatively referenced in this document and are
indispensable for its application. For dated references, only the edition cited applies. For undated
references, the latest edition of the referenced document (including any amendments) applies.
ISO 10795:2011, Space systems — Programme management and quality — Vocabulary
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO 10795:2011 and the following
apply.
3.1
at-risk area
area of those parts of a surface on a component that are most vulnerable to impacts from space debris
or meteoroids
Note 1 to entry: See A.1 for a more detailed explanation of at-risk area.
3.2
ballistic limit
impact-induced threshold of failure of a structure
Note 1 to entry: A common failure threshold is the critical size of an impacting particle at which perforation
occurs. However, depending on the characteristics of the item being hit, failure modes other than perforation are
also possible.
3.3
catastrophic collision
collision leading to the destruction by fragmentation of a spacecraft
© ISO 2014 – All rights reserved 1

---------------------- Page: 5 ----------------------
ISO 16126:2014(E)

3.4
critical component
component whose failure would prevent the completion of an essential function on a spacecraft, such as
post-mission disposal
3.5
critical surface
surface of a component which, when damaged by impact, will cause the
component to fail
3.6
disposal
actions performed by a spacecraft to permanently reduce its chance of accidental break-up, and to
achieve its required long-term clearance of the protected regions
[SOURCE: ISO 24113:2011, 3.4, modified]
3.7
impact survivability
ability of a spacecraft to function after being exposed to the space debris or meteoroid environment
Note 1 to entry: A measure of impact survivability is the Probability of No Failure (PNF).
3.8
lethal collision
collision leading to the loss of a critical component on a spacecraft
3.9
orbital lifetime
period of time from when a spacecraft achieves Earth orbit to when it commences re-entry
[SOURCE: ISO 24113:2011, 3.12, modified]
3.10
protected region
region in space that is protected with regard to the generation of space debris to ensure its safe and
sustainable use in the future
[SOURCE: ISO 24113:2011, 3.14]
3.11
re-entry
process in which atmospheric drag cascades deceleration of a spacecraft (or any part thereof), leading
to its destruction or return to Earth
[SOURCE: ISO 24113:2011, 3.15, modified]
3.12
space debris
orbital debris
man-made objects, including fragments and elements thereof, in Earth orbit or re-entering the
atmosphere, that are non-functional
[SOURCE: ISO 24113:2011, 3.17]
3.13
spacecraft
system designed to perform specific tasks or functions in space
[SOURCE: ISO 24113:2011, 3.18]
2 © ISO 2014 – All rights reserved

---------------------- Page: 6 ----------------------
ISO 16126:2014(E)

4 Abbreviated terms
BLE ballistic limit equation
HVI hypervelocity impact
IADC Inter-Agency Space Debris Coordination Committee
ISO International Organization for Standardization
M/OD meteoroid/orbital debris
PNF Probability of No Failure
PNP Probability of No Perforation
S/C spacecraft
5 Impact survivability assessment requirements
5.1 During the design of a spacecraft, if an assessment is required to determine the survivability of
the spacecraft against space debris and meteoroid impacts for the purpose of achieving successful post-
mission disposal, then the procedure in Clause 6 shall be followed.
5.2 The results of an impact survivability assessment, the methodology used, and any assumptions
made shall be approved by the customer of the spacecraft.
6 Impact survivability assessment procedure
6.1 General
6.2 and 6.3 describe a procedure for assessing the space debris and meteoroid impact survivability of a
spacecraft.
6.2 Definition of survivability requirement
6.2.1 Specify a requirement for the survivability of the spacecraft against space debris and meteoroid
impacts for the purpose of achieving successful post-mission disposal.
6.2.2 Express the survivability requirement in terms of a minimum allowable value of impact-induced
Probability of No Failure, PNF , over the operational phase of the spacecraft.
min
NOTE The operational phase of a spacecraft can be understood by referring to Annex B in Reference [3].
6.3 Impact risk analysis
6.3.1 Perform an impact risk analysis to determine and compare the impact-induced Probability of No
Failure of the spacecraft, PNF , with the minimum allowable value, PNF .
s/c min
6.3.2 If PNF < PNF , then take appropriate steps to reduce the impact risk.
s/c min
NOTE Clauses 7 and 8 describe two procedures for analysing and reducing the impact risk.
© ISO 2014 – All rights reserved 3

---------------------- Page: 7 ----------------------
ISO 16126:2014(E)

7 Procedure for performing a simple impact risk analysis
7.1 General
7.1.1 A procedure for performing a simple analysis of the risk that a spacecraft will not be able to
complete a successful post-mission disposal, as a result of impacts from space debris and meteoroids,
is illustrated in Figure 1. The procedure, which is based on that recommended in Reference [1], is used
to determine whether impacts from small-size space debris and meteoroids could cause the failure
of components that are critical for post-mission disposal. That is, the procedure is concerned with
evaluating lethal collisions rather than catastrophic collisions. If the risk analysis shows that there is a
significant probability of failure, then this indicates the need for a more rigorous analysis to determine
and validate possible protection enhancements to the spacecraft, including the design of shielding.
Clause 8 provides such an approach.
Figure 1 — Procedure for performing a simple analysis of the risk to a spacecraft from space
debris and meteoroid impacts
7.1.2 7.2 to 7.6 describe each step in the procedure.
4 © ISO 2014 – All rights reserved

---------------------- Page: 8 ----------------------
ISO 16126:2014(E)

7.2 Spacecraft operating parameters and architecture design
7.2.1 Define the operating parameters of the spacecraft, such as its orbit and attitude orientation
relative to the direction of motion.
7.2.2 Define the architecture design of the spacecraft, such as its configuration and dimensions, and
the material properties of each of its surfaces, including any shielding.
7.3 Identification of critical components and surfaces
7.3.1 Identify every component on the spacecraft that contributes to post-mission disposal.
7.3.2 For each component identified in 7.3.1, determine its redundancy, impact damage modes, and
failure criteria.
7.3.3 Use a reliability analysis technique, such as Fault Tree Analysis or Failure Modes and Effects
Analysis, to identify the system-level consequences that might result when each of the components in
7.3.2 is damaged by impact.
7.3.4 Identify the critical components, i.e. those components which, when damaged by impact, would
prevent post-mission disposal.
7.3.5 For each critical component, identify its most critical surface.
7.3.6 For each critical component, calculate the at-risk area of its most critical surface.
NOTE A.1 provides additional information on the calculation of at-risk area of a critical surface.
7.4 Ballistic limits
For each critical surface, do the following:
a) identify other elements of the spacecraft, e.g. components and structures that lie between the at-
risk area of the critical surface and the space environment;
b) in the direction that has the least intervening material protecting the at-risk area of the critical
surface from the space environment, identify the thickness and density of each layer of the material
and hence its areal density;
c) in the direction that has the least intervening material protecting the at-risk area of the critical
surface from the space environment, sum the areal densities of the material layers to obtain the
total areal density between the at-risk area of the critical surface and the environment;
d) calculate the minimum diameter of space debris or meteoroid impactor that will penetrate the total
areal density of material between the at-risk area of the critical surface and the environment.
NOTE A.2 provides additional information on the calculation of areal density and the minimum diameter of
impactor that will penetrate a given areal density.
7.5 Failure probability analysis
7.5.1 For each critical surface, determine the expected number of impact-induced failures of the at-
risk area of the critical surface.
7.5.2 Sum the expected number of impact-induced failures of the at-risk areas of all the critical surfaces
to obtain the expected number of impact-induced failures of all the critical components.
7.5.3 Calculate the probability that one or more of the critical components will fail during the
operational phase of the spacecraft as a result of impact with space debris or meteoroids, i.e. determine
© ISO 2014 – All rights reserved 5

---------------------- Page: 9 ----------------------
ISO 16126:2014(E)

the impact-induced Probability of No Failure of the spacecraft, PNF , to achieve its post-mission
s/c
disposal.
NOTE A.3 provides additional information on the calculation of the expected number of impact-induced
failures and the probability of failure.
7.6 Completion of analysis
7.6.1 If PNF ≥ PNF , then end the analysis.
s/c min
7.6.2 If PNF < PNF , then perform a detailed impact risk analysis.
s/c min
NOTE Clause 8 describes a procedure for performing a detailed impact risk analysis.
8 Procedure for performing a detailed impact risk analysis
8.1 General
8.1.1 A procedure for performing a detailed analysis of the risk that a spacecraft will not be able to
complete a successful post-mission disposal, as a result of impacts from small-size space debris and
meteoroids, is shown in Figure 2. Thus, the procedure is concerned with evaluating lethal collisions
rather than catastrophic collisions. The procedure, which is based on that recommended in Reference
[2], is used to provide a more accurate determination of the Probability of No Failure of the spacecraft,
PNF , than that obtained in Clause 7. This is important when making decisions concerning the need for
s/c
additional protection on the spacecraft and the design of that protection.
8.1.2 Figure 2 provides a simple illustration of the key steps in the procedure and the flow of
information required between these steps. It is possible that the implementation of such a procedure in
practice can be more complicated than that depicted in the figure.
8.1.3 8.2 to 8.6 describe each step in the procedure.
8.2 Spacecraft operating parameters and architecture design
8.2.1 Define the operating parameters of the spacecraft, such as its orbit and attitude orientation
relative to the direction of motion.
8.2.2 Define the architecture design of the spacecraft, such as its configuration and dimensions, and
the material properties of each of its surfaces, including any shielding.
8.3 Identification of critical components
8.3.1 Identify every component on the spacecraft that contributes to post-mission disposal.
8.3.2 For each component identified in 8.3.1, determine its redundancy, impact damage modes, and
failure criteria.
8.3.3 Use a reliability analysis technique, such as Fault Tree Analysis or Failure Modes and Effects
Analysis, to identify the system-level consequences that might result when each of the components in
8.3.2 is damaged by impact.
8.3.4 Identify the critical components, i.e. those components which, when damaged by impact, would
prevent post-mission disposal.
6 © ISO 2014 – All rights reserved

---------------------- Page: 10 ----------------------
ISO 16126:2014(E)

Figure 2 — Procedure for performing a detailed analysis of the risk to a spacecraft from space
debris and meteoroid impacts
8.4 Ballistic limits
8.4.1 Identify existing ballistic limit equations (BLEs) that might be suitable for determining the
ballistic limit of each surface or combination of surfaces on the spacecraft (including components).
NOTE Annex B identifies some commonly used BLEs.
8.4.2 If a suitable BLE cannot be identified for a particular surface or combination of surfaces, then
adapt an existing formula or derive a new formula.
8.4.3 In satisfying 8.4.2, perform a set of hypervelocity impact (HVI) tests to derive a new BLE or
verify the validity of an adapted BLE. Although the exact nature of the tests will depend on a range of
factors, such as the configuration to be investigated, the following might be suitable for a variety of
circumstances:
a) impact shots in each of the following three velocity ranges: the ballistic range (typically below
−1 −1 −1
~3 km⋅s ), the transition range (typically between ~3 km⋅s and ~7 km⋅s ), and the hypervelocity
−1
range (typically above ~7 km⋅s );
© ISO 2014 – All rights reserved 7

---------------------- Page: 11 ----------------------
ISO 16126:2014(E)

b) impact shots at each of the following two angles: the angle perpendicular to the outermost surface
and the average angle of impact on the outermost surface as determined from the flux analysis in
8.5.3.
NOTE 1 C.1 provides background information on HVI testing.
NOTE 2 Hydrocode analyses are sometimes performed to complement HVI tests, particularly for investigating
ballistic limits at impact velocities that are beyond the capability of impact test facilities. Annex C.2 provides
background information on hydrocode modelling and its applicability.
8.4.4 For each surface or combination of surfaces on the spacecraft (including components), associate
a BLE.
8.4.5 For those surfaces that have failure criteria besides penetration, such as a maximum area of
impact crater damage, associate the appropriate crater/hole damage formulae.
NOTE Reference [2] identifies some commonly used crater/hole damage formulae.
8.5 Failure probability analysis
8.5.1 Select a space debris and meteoroid impact risk analysis code.
NOTE C.3 provides background information on space debris and meteoroid impact risk modelling.
8.5.2 Select space debris and meteoroid environment models that are suitable for use with the impact
risk analysis code chosen in 8.5.1.
NOTE ISO 14200 provides guidance on the selection and use of space debris and meteoroid environment
models.
8.5.3 Apply the chosen space debris and meteoroid environment models, with the information arising
from 8.2, to produce a data set of impact fluxes on the spacecraft.
8.5.4 Apply the chosen impact risk analysis code, with the data set of impact fluxes and the information
arising from 8.2 to 8.4, to calculate the probability that one or more of the selected critical components
will fail during the operational phase of the spacecraft as a result of impact with space debris or
meteoroids, i.e. determine the impact-induced Probability of No Failure of the spacecraft, PNF , to
s/c
achieve its post-mission disposal.
NOTE Annex D describes a method for calculating the Probability of No Failure that is commonly used in
impact risk analysis codes.
8.6 Iteration of analysis
8.6.1 If PNF ≥ PNF , then end the analysis.
s/c min
8.6.2 If PNF < PNF , then iterate the analysis by considering the following (in order of preference):
s/c min
a) revise the analysis assumptions in terms of failure criteria or spacecraft modelling; or
b) compare the flux values obtained from the selected space debris and meteoroid environment models
with those from other models, e.g. as discussed in Reference [4] to characterize the differences
due to inherent uncertainties in the models and, if appropriate, select alternative models for the
analysis; or
c) perform additional impact testing and, if necessary, hydrocode modelling to remove engineering
conservatism in the BLEs; or
d) identify those areas of the spacecraft design which are the greatest contributors to the spacecraft
impact failure probability, and systematically apply one or more modifications, such as those listed
in Annex E; or
8 © ISO 2014 – All rights reserved

---------------------- Page: 12 ----------------------
ISO 16126:2014(E)

e) examine alternatives for designing the spacecraft so that it can be orientated in such a way that its
most vulnerable, critical components do not face the direction of greatest impact flux.
© ISO 2014 – All rights reserved 9

---------------------- Page: 13 ----------------------
ISO 16126:2014(E)

Annex A
(informative)

Supplementary information on the simple impact risk analysis
procedure
A.1 Critical components
On a typical unmanned spacecraft, many of the components will contribute to its post-mission disposal,
such as elements of the attitude and orbit control subsystem, the communication subsystem, and the
power subsystem. However, to determine whether a component is critical, consideration also has to be
given to how it might respond under impact (i.e. its damage modes), whether there is any redundancy,
and the criteria for failure.
The identification of the critical surface on a critical component depends on the failure criterion for that
component. For example, an unpressurized tank might only fail as a result of full penetration of the tank
wall, whereas a pressurized tank can fail because of the pressure shock on the external surface of the
tank wall. In the former case, the critical surface would be the interior surface of the tank wall, and the
tank wall itself can be treated as part of the material protecting the surface from the space environment.
In the latter case, the critical surface would be the external surface.
To calculate the at-risk area of a critical surface it is necessary to do the following:
a) determine the area of those parts of the critical surface that are most exposed to space (and
therefore vulnerable to impact failure). If the critical surface is equally protected by other parts of
the spacecraft, then the at-risk area is simply the total area of the critical surface.
b) adjust the at-risk area to take account of the orientation of the spacecraft. This gives the average
cross-sectional area at risk. For spacecraft that maintain their orientation relative to the velocity
vector, the average cross-sectional area at risk is the area projected in the impact threat direction.
For spacecraft that tumble randomly, the area is one-quarter of the projected area with the greatest
exposure to space.
A.2 Ballistic limit
The areal density of a layer of material, σ, is its mass density, ρ, multiplied by its thickness, T. The minimum
[1]
diameter, d, of M/OD impactor that will penetrate an areal density, σ, is given by Formula (A.1):
dK=×σ (A.1)
where K has a value of 0,07 for a typical material such as aluminium alloy 6061-T6, assuming that the
−2
units for d and σ are cm and g⋅cm , respectively. Higher K values can be achieved for specially designed
shields such as the Whipple shield (K = 0,35) and the multi-shock shield (K = 0,70). Note that these K
values are only intended to give an estimate of the shielding effectiveness of a material. The calculation
of the minimum diameter, d, provides a lower bound on the size of impactor that might be expected to
penetrate the material, i.e. it is a conservative value for the ballistic limit.
It should be noted that Formula (A.1) does not require any information on the properties of a typical
M/OD impactor, such as mean impact speed or mean angle of impact, since these are e
...

DRAFT INTERNATIONAL STANDARD ISO/DIS 16126
ISO/TC 20/SC 14 Secretariat: ANSI
Voting begins on Voting terminates on

2012-03-28 2012-08-28
INTERNATIONAL ORGANIZATION FOR STANDARDIZATION  •  МЕЖДУНАРОДНАЯ ОРГАНИЗАЦИЯ ПО СТАНДАРТИЗАЦИИ  •  ORGANISATION INTERNATIONALE DE NORMALISATION


Space systems — Assessment of survivability of unmanned
spacecraft against space debris and meteoroid impacts to
ensure successful post-mission disposal
ICS 49.140













To expedite distribution, this document is circulated as received from the committee
secretariat. ISO Central Secretariat work of editing and text composition will be undertaken at
publication stage.
Pour accélérer la distribution, le présent document est distribué tel qu'il est parvenu du
secrétariat du comité. Le travail de rédaction et de composition de texte sera effectué au
Secrétariat central de l'ISO au stade de publication.



THIS DOCUMENT IS A DRAFT CIRCULATED FOR COMMENT AND APPROVAL. IT IS THEREFORE SUBJECT TO CHANGE AND MAY NOT BE
REFERRED TO AS AN INTERNATIONAL STANDARD UNTIL PUBLISHED AS SUCH.
IN ADDITION TO THEIR EVALUATION AS BEING ACCEPTABLE FOR INDUSTRIAL, TECHNOLOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL TO BECOME STANDARDS TO
WHICH REFERENCE MAY BE MADE IN NATIONAL REGULATIONS.
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT, WITH THEIR COMMENTS, NOTIFICATION OF ANY RELEVANT PATENT RIGHTS OF WHICH
THEY ARE AWARE AND TO PROVIDE SUPPORTING DOCUMENTATION.
©  International Organization for Standardization, 2012

---------------------- Page: 1 ----------------------
ISO/DIS 16126

Copyright notice
This ISO document is a Draft International Standard and is copyright-protected by ISO. Except as permitted
under the applicable laws of the user’s country, neither this ISO draft nor any extract from it may be
reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic,
photocopying, recording or otherwise, without prior written permission being secured.
Requests for permission to reproduce should be addressed to either ISO at the address below or ISO’s
member body in the country of the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.org
Web www.iso.org
Reproduction may be subject to royalty payments or a licensing agreement.
Violators may be prosecuted.

ii © ISO 2012 – All rights reserved

---------------------- Page: 2 ----------------------
ISO/DIS 16126

Contents Page
1 Scope. 1
2 Normative references. 1
3 Terms and definitions. 1
4 Abbreviated terms. 3
5 Impact survivability assessment requirements. 3
6 Impact survivability assessment procedure. 3
6.1 General. 3
6.2 Definition of survivability requirement. 3
6.3 Impact risk analysis. 3
7 Procedure for performing a simple impact risk analysis. 4
7.1 General. 4
7.2 Spacecraft operating parameters and architecture design. 5
7.3 Identification of critical components and surfaces. 5
7.4 Ballistic limits. 5
7.5 Failure probability analysis. 5
7.6 Completion of analysis. 6
8 Procedure for performing a detailed impact risk analysis. 6
8.1 General. 6
8.2 Spacecraft operating parameters and architecture design. 6
8.3 Identification of critical components. 6
8.4 Ballistic limits. 7
8.5 Failure probability analysis. 8
8.6 Iteration of analysis. 8
Annex A. 9
Annex B. 11
Annex C. 13
Annex D. 15
Annex E. 16
Bibliography. 17
© ISO 2006 – All rights reserved III

---------------------- Page: 3 ----------------------
ISO/DIS 16126

Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies
(ISO member bodies). The work of preparing International Standards is normally carried out through ISO
technical committees. Each member body interested in a subject for which a technical committee has been
established has the right to be represented on that committee. International organizations, governmental and
non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the
International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.
The main task of technical committees is to prepare International Standards. Draft International Standards
adopted by the technical committees are circulated to the member bodies for voting. Publication as an
International Standard requires approval by at least 75 % of the member bodies casting a vote.
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
rights. ISO shall not be held responsible for identifying any or all such patent rights.
ISO 16126 was prepared by Technical Committee ISO/TC 20, AIRCRAFT AND SPACE VEHICLES,
Subcommittee SC 14, SPACE SYSTEMS AND OPERATIONS.
IV © ISO 2006 – All rights reserved

---------------------- Page: 4 ----------------------
DRAFT INTERNATIONAL STANDARD
ISO/DIS 16126
Space systems — Assessment of survivability of unmanned
spacecraft against space debris and meteoroid impacts to
ensure successful post-mission disposal
1 Scope
This International Standard defines requirements and a procedure for assessing the survivability of an
unmanned spacecraft against space debris and meteoroid impacts to ensure the survival of critical
components required to perform post-mission disposal. This standard also describes two impact risk analysis
procedures that may be used to satisfy the requirements. The procedures are consistent with those defined in
References [1] and [2].
This International Standard is part of a set of standards that collectively aim to reduce the growth of space
debris by ensuring that spacecraft and launch vehicle orbital stages are designed, operated, and disposed of
in a manner that prevents them from generating debris throughout their orbital lifetime. All of the primary
[3]
debris mitigation requirements are contained in a top-level standard . The remaining standards, of which this
is one, provide methods and processes to enable compliance with the primary requirements.
Although this International Standard can be applied during the design of a launch vehicle orbital stage, it is
intended for use only during the design of an unmanned spacecraft.
2 Normative references
The following referenced documents are indispensable for the application of this document. For dated
references, only the edition cited applies. For undated references, the latest edition of the referenced
document (including any amendments) applies.
ISO 10795:2011, Space systems — Programme management — Glossary of terms for use in ISO standards
for space systems and operations
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO 10795:2011 and the following apply.
3.1
at-risk area
area of those parts of a surface on a component that are most vulnerable to impacts from space debris or
meteoroids
NOTE See Annex A.1 for a more detailed explanation of at-risk area.
3.2
ballistic limit
impact-induced threshold of failure of a structure
NOTE A common failure threshold is the critical size of an impacting particle at which perforation occurs. However,
depending on the characteristics of the item being hit, failure modes other than perforation are also possible.
3.3
catastrophic collision
collision leading to the destruction by fragmentation of a spacecraft or launch vehicle orbital stage
© ISO 2006 – All rights reserved
1

---------------------- Page: 5 ----------------------
ISO/DIS 16126

3.4
critical component
component whose failure would prevent the completion of an essential function on a spacecraft or launch
vehicle orbital stage, such as post-mission disposal
3.5
critical surface
surface of a component which, when damaged by impact, will cause the component to
fail
3.6
disposal
the actions performed by a spacecraft or launch vehicle orbital stage to permanently reduce its chance of
accidental break-up, and to achieve its required long-term clearance of the protected regions
[ISO 24113:2011, definition 3.4]
3.7
impact survivability
ability of a spacecraft to function after being exposed to the space debris or meteoroid environment
NOTE A measure of impact survivability is the Probability of No Failure (PNF).
3.8
launch vehicle orbital stage
stage of a launch vehicle that is designed to achieve orbit
[ISO 24113:2011, definition 3.9]
3.9
lethal collision
collision leading to the loss of a critical component on a spacecraft or launch vehicle orbital stage
3.10
orbital lifetime
period of time from when a spacecraft or launch vehicle orbital stage achieves Earth orbit to when it
commences re-entry
[ISO 24113:2011, definition 3.12]
3.11
protected region
region in space that is protected with regard to the generation of space debris to ensure its safe and
sustainable use in the future
[ISO 24113:2011, definition 3.14]
3.12
re-entry
process in which atmospheric drag cascades deceleration of a spacecraft or launch vehicle orbital stage (or
any part thereof), leading to its destruction or return to Earth
[ISO 24113:2011, definition 3.15]
3.13
space debris
orbital debris
all man-made objects including fragments and elements thereof, in Earth orbit or re-entering the atmosphere,
that are non-functional
© ISO 2006 – All rights reserved
2

---------------------- Page: 6 ----------------------
ISO/DIS 16126

[ISO 24113:2011, definition 3.17]
3.14
spacecraft
system designed to perform specific tasks or functions in space
[ISO 24113:2011, definition 3.18]
4 Abbreviated terms
BLE Ballistic Limit Equation
HVI Hypervelocity Impact
IADC Inter Agency Space Debris Coordination Committee
ISO International Organization for Standardization
M/OD Meteoroid / Orbital Debris
PNF Probability of No Failure
PNP Probability of No Perforation
S/C Spacecraft
5 Impact survivability assessment requirements
5.1 During the design of a spacecraft, if an assessment is required to determine the survivability of the
spacecraft against space debris and meteoroid impacts for the purpose of achieving successful post-mission
disposal, then the procedure in Clause 6 shall be followed.
5.2 The results of an impact survivability assessment, the methodology used and any assumptions made,
shall be approved by the customer of the spacecraft.
6 Impact survivability assessment procedure
6.1 General
Clauses 6.2 and 6.3 describe a procedure for assessing the space debris and meteoroid impact survivability
of a spacecraft.
6.2 Definition of survivability requirement
6.2.1 Specify a requirement for the survivability of the spacecraft against space debris and meteoroid
impacts for the purpose of achieving successful post-mission disposal.
6.2.2 Express the survivability requirement in terms of a minimum allowable value of impact-induced
Probability of No Failure, PNF , over the operational phase of the spacecraft.
min
NOTE The operational phase of a spacecraft can be understood by referring to Annex B in Reference [3].
6.3 Impact risk analysis
6.3.1 Perform an impact risk analysis to determine and compare the impact-induced Probability of No
Failure of the spacecraft, PNF , with the minimum allowable value, PNF .
s/c min
© ISO 2006 – All rights reserved 3

---------------------- Page: 7 ----------------------
ISO/DIS 16126

6.3.2 If PNF < PNF , then take appropriate steps to reduce the impact risk.
s/c min
NOTE Clauses 7 and 8 describe two procedures for analysing and reducing the impact risk.
7 Procedure for performing a simple impact risk analysis
7.1 General
7.1.1 A procedure for performing a simple analysis of the risk that a spacecraft will not be able to complete
a successful post-mission disposal, as a result of impacts from space debris and meteoroids, is illustrated in
Figure 1. The procedure, which is based on that recommended in Reference [1], is used to determine whether
impacts from small size space debris and meteoroids could cause the failure of components that are critical
for post-mission disposal. That is, the procedure is concerned with evaluating lethal collisions rather than
catastrophic collisions. If the risk analysis shows that there is a significant probability of failure, then this
indicates the need for a more rigorous analysis to determine and validate possible protection enhancements
to the spacecraft, including the design of shielding. Clause 8 provides such an approach.
Figure 1 — Procedure for performing a simple analysis of the risk to a spacecraft from space debris
and meteoroid impacts
© ISO 2006 – All rights reserved
4

---------------------- Page: 8 ----------------------
ISO/DIS 16126

7.1.2 Clauses 7.2 to 7.6 describe each step in the procedure.
7.2 Spacecraft operating parameters and architecture design
7.2.1 Define the operating parameters of the spacecraft, such as its orbit and attitude orientation relative to
the direction of motion.
7.2.2 Define the architecture design of the spacecraft, such as its configuration and dimensions, and the
material properties of each of its surfaces, including any shielding.
7.3 Identification of critical components and surfaces
7.3.1 Identify every component on the spacecraft that contributes to post-mission disposal.
7.3.2 For each component identified in Clause 7.3.1, determine its redundancy, impact damage modes and
failure criteria.
7.3.3 Use a reliability analysis technique, such as Fault Tree Analysis or Failure Modes and Effects
Analysis, to identify the system level consequences that might result when each of the components in Clause
7.3.2 is damaged by impact.
7.3.4 Identify the critical components, i.e. those components which, when damaged by impact, would
prevent post-mission disposal.
7.3.5 For each critical component, identify its most critical surface.
7.3.6 For each critical component, calculate the at-risk area of its most critical surface.
NOTE Annex A.1 provides additional information on the calculation of at-risk area of a critical surface.
7.4 Ballistic limits
For each critical surface:
a) identify other elements of the spacecraft, e.g. components and structures, that lie between the at-risk area
of the critical surface and the space environment;
b) in the direction that has the least intervening material protecting the at-risk area of the critical surface from
the space environment, identify the thickness and density of each layer of the material and hence its areal
density;
c) in the direction that has the least intervening material protecting the at-risk area of the critical surface from
the space environment, sum the areal densities of the material layers to obtain the total areal density between
the at-risk area of the critical surface and the environment;
d) calculate the minimum diameter of space debris or meteoroid impactor that will penetrate the total areal
density of material between the at-risk area of the critical surface and the environment.
NOTE Annex A.2 provides additional information on the calculation of areal density and the minimum diameter of
impactor that will penetrate a given areal density.
7.5 Failure probability analysis
7.5.1 For each critical surface, determine the expected number of impact-induced failures of the at-risk area
of the critical surface.
© ISO 2006 – All rights reserved
5

---------------------- Page: 9 ----------------------
ISO/DIS 16126

7.5.2 Sum the expected number of impact-induced failures of the at-risk areas of all the critical surfaces to
obtain the expected number of impact-induced failures of all the critical components.
7.5.3 Calculate the probability that one or more of the critical components will fail during the operational
phase of the spacecraft as a result of impact with space debris or meteoroids, i.e. determine the impact-
induced Probability of No Failure of the spacecraft, PNF , to achieve its post-mission disposal.
s/c
NOTE Annex A.3 provides additional information on the calculation of the expected number of impact-induced
failures and the probability of failure.
7.6 Completion of analysis
7.6.1 If PNF ≥ PNF , then end the analysis.
s/c min
7.6.2 If PNF < PNF , then perform a more rigorous impact risk analysis.
s/c min
NOTE Clause 8 describes a procedure for performing a detailed impact risk analysis.
8 Procedure for performing a detailed impact risk analysis
8.1 General
8.1.1 A procedure for performing a detailed analysis of the risk that a spacecraft will not be able to complete
a successful post-mission disposal, as a result of impacts from small size space debris and meteoroids, is
shown in Figure 2. Thus, the procedure is concerned with evaluating lethal collisions rather than catastrophic
collisions. The procedure, which is based on that recommended in Reference [2], is used to provide a more
accurate determination of the Probability of No Failure of the spacecraft, PNFs/c, than that obtained in Clause
7. This is important when making decisions concerning the need for additional protection on the spacecraft
and the design of that protection.
8.1.2 Figure 2 provides a simple illustration of the key steps in the procedure and the flow of information
required between these steps. It is possible that the implementation of such a procedure in practice may be
more complicated than that depicted in the figure.
8.1.3 Clauses 8.2 to 8.6 describe each step in the procedure.
8.2 Spacecraft operating parameters and architecture design
8.2.1 Define the operating parameters of the spacecraft, such as its orbit and attitude orientation relative to
the direction of motion.
8.2.2 Define the architecture design of the spacecraft, such as its configuration and dimensions, and the
material properties of each of its surfaces, including any shielding.
8.3 Identification of critical components
8.3.1 Identify every component on the spacecraft that contributes to post-mission disposal.
8.3.2 For each component identified in Clause 8.3.1, determine its redundancy, impact damage modes and
failure criteria.
8.3.3 Use a reliability analysis technique, such as Fault Tree Analysis or Failure Modes and Effects
Analysis, to identify the system level consequences that might result when each of the components in Clause
8.3.2 is damaged by impact.
8.3.4 Identify the critical components, i.e. those components which, when damaged by impact, would
prevent post-mission disposal.
© ISO 2006 – All rights reserved
6

---------------------- Page: 10 ----------------------
ISO/DIS 16126

Figure 2 — Procedure for performing a detailed analysis of the risk to a spacecraft from space debris
and meteoroid impacts
8.4 Ballistic limits
8.4.1 Identify existing Ballistic Limit Equations (BLEs) that might be suitable for determining the ballistic limit
of each surface or combination of surfaces on the spacecraft (including components).
NOTE Annex B identifies some commonly used BLEs.
8.4.2 If a suitable BLE can not be identified for a particular surface or combination of surfaces, then adapt
an existing equation or derive a new equation.
8.4.3 In satisfying Clause 8.4.2, perform a set of hypervelocity impact (HVI) tests to derive a new BLE or
verify the validity of an adapted BLE. Although the exact nature of the tests will depend on a range of factors,
such as the configuration to be investigated, the following might be suitable for a variety of circumstances:
-1
a) Impact shots in each of the following three velocity ranges: the ballistic range (below ~3 km s ), the
-1 -1 -1
transition range (between ~3 km s and ~7 km s ), and the hypervelocity range (above ~7 km s ), and
© ISO 2006 – All rights reserved 7

---------------------- Page: 11 ----------------------
ISO/DIS 16126

b) Impact shots at each of the following two angles: the angle perpendicular to the outermost surface, and
the average angle of impact on the outermost surface as determined from the flux analysis in Clause
8.5.3.
NOTE 1 Annex C.1 provides background information on HVI testing.
NOTE 2 Hydrocode analyses are sometimes performed to complement HVI tests, particularly for investigating
ballistic limits at impact velocities that are beyond the capability of impact test facilities. Annex C.2 provides background
information on hydrocode modelling and its applicability.
8.4.4 For each surface or combination of surfaces on the spacecraft (including components), associate a
BLE.
8.4.5 For those surfaces that have failure criteria besides penetration, such as a maximum area of impact
crater damage, associate the appropriate crater / hole damage equations.
NOTE Reference [2] identifies some commonly used crater / hole damage equations.
8.5 Failure probability analysis
8.5.1 Select a space debris and meteoroid impact risk analysis code.
NOTE Annex C.3 provides background information on space debris and meteoroid impact risk modelling.
8.5.2 Select space debris and meteoroid environment models that are suitable for use with the impact risk
analysis code chosen in Clause 8.5.1.
NOTE ISO 14200:— provides guidance on the selection and use of space debris and meteoroid environment
models.
8.5.3 Apply the chosen space debris and meteoroid environment models, with the information arising from
Clause 8.2, to produce a dataset of impact fluxes on the spacecraft.
8.5.4 Apply the chosen impact risk analysis code, with the impact flux dataset and the information arising
from Clauses 8.2 to 8.4, to calculate the probability that one or more of the selected critical components will
fail during the operational phase of the spacecraft as a result of impact with space debris or meteoroids, i.e.
determine the impact-induced Probability of No Failure of the spacecraft, PNF , to achieve its post-mission
s/c
disposal.
NOTE Annex D describes a method for calculating the Probability of No Failure that is commonly used in impact
risk analysis codes.
8.6 Iteration of analysis
8.6.1 If PNF ≥ PNF , then end the analysis.
s/c min
8.6.2 If PNF < PNF , then iterate the analysis by considering the following (in order of preference):
s/c min
a) Revise the analysis assumptions in terms of failure criteria or spacecraft modelling, or
b) Perform additional impact testing and, if necessary, hydrocode modelling to remove engineering
conservatism in the BLEs, or
c) Identify those areas of the spacecraft design which are the greatest contributors to the spacecraft impact
failure probability, and systematically apply one or more modifications, such as those listed in Annex E, or
d) Examine alternatives for designing the spacecraft so that it can be orientated in such a way that its most
vulnerable, critical components do not face the direction of greatest impact flux.
© ISO 2006 – All rights reserved
8

---------------------- Page: 12 ----------------------
ISO/DIS 16126

Annex A
(informative)
Supplementary information on the simple impact risk analysis procedure
A.1 Critical components
On a typical unmanned spacecraft many of the components will contribute to its post-mission disposal, such
as elements of the attitude and orbit control subsystem, the communication subsystem, and the power
subsystem. However, to determine whether a component is critical, consideration also has to be given to how
it might respond under impact (i.e. its damage modes), whether there is any redundancy, and the criteria for
failure.
The identification of the critical surface on a critical component depends on the failure criterion for that
component. For example, an unpressurized tank might only fail as a result of full penetration of the tank wall,
whereas a pressurized tank may fail because of the pressure shock on the external surface of the tank wall. In
the former case, the critical surface would be the interior surface of the tank wall, and the tank wall itself may
be treated as part of the material protecting the surface from the space environment. In the latter case, the
critical surface would be the external surface.
To calculate the at-risk area of a critical surface it is necessary to:
a) Determine the area of those parts of the critical surface that are most exposed to space (and therefore
vulnerable to impact failure). If the critical surface is equally protected by other parts of the spacecraft then
the at-risk area is simply the total area of the critical surface;
b) Adjust the at-risk area to take account of the orientation of the spacecraft. This gives the average cross-
sectional area at risk. For spacecraft that maintain their orientation relative to the velocity vector the
average cross-sectional area at risk is the area projected in the impact threat direction. For spacecraft that
tumble randomly, the area is one-quarter of the projected area with the greatest exposure to space.
A.2 Ballistic limit
The areal density of a layer of material, σ, is its mass density, ρ, multiplied by its thickness, T. The minimum
[1]
diameter, d, of M/OD impactor that will penetrate an areal density, σ, is given by :
d = K × σ (A.1)
where K has a value of 0.07 for a typical material such as aluminium alloy 6061-T6, assuming that the units
-2
for d and σ are cm and g cm , respectively. Higher K values can be achieved for specially designed shields
such as the Whipple shield (K = 0.35) and the multi-shock shield (K = 0.70). Note that these K values are only
intended to give an estimate of the shielding effectiveness of a material. The calculation of the minimum
diameter, d, provides a lower bound on the size of impactor that might be expected to penetrate the material,
i.e. it is a conservative value for the ballistic limit.
It should be noted that Equation (A.1) does not require any information on the properties of a typical M/OD
impactor, such as mean impact speed or mean angle of impact, since these are embedded within the K term.
For a more precise determination of ballistic limit, in which particle characteristics are explicitly considered, it
is necessary to use the equations in Annex B.
It should also be noted that the ballisitic limit is dependent on the criterion for failure. Although, in this case,
the failure criterion is assumed to be perforation, other criteria can also be applied depending on the
characteristics of the component being hit. For example, a titanium propellant tank has three notable impact-
related failure modes: rupture caus
...