ISO 16126:2024

Space systems - Survivability of unmanned spacecraft against space debris and meteoroid impacts for the purpose of space debris mitigation

This document defines requirements and procedures for analysing the risk that an unmanned spacecraft fails as a result of a space debris or meteoroid impact.

Systèmes spatiaux — Titre manque

General Information

• Status: Published
• Publication Date: 01-Dec-2024
• ICS: 49.140 - Space systems and operations
• Technical Committee: ISO/TC 20/SC 14 - Space systems and operations
• Drafting Committee: ISO/TC 20/SC 14/WG 7 - Orbital Debris Working Group
• Current Stage: 6060 - International Standard published
• Start Date: 02-Dec-2024
• Due Date: 30-Jan-2026
• Completion Date: 02-Dec-2024

Relations

• Revises: ISO 16126:2014 - Space systems - Assessment of survivability of unmanned spacecraft against space debris and meteoroid impacts to ensure successful post-mission disposal
• Effective Date: 23-Apr-2020

Overview

ISO 16126:2024 - Space systems - Survivability of unmanned spacecraft against space debris and meteoroid impacts for the purpose of space debris mitigation - defines requirements and procedures for analysing the risk that an unmanned spacecraft fails as a result of a space debris (SD) or meteoroid (M) impact. The second edition updates impact risk analysis methods to support compliance with the top‑level space debris mitigation standard ISO 24113, and provides informative annexes to help implement shielding, ballistic limit equations, and modelling approaches.

Keywords: ISO 16126:2024, space debris mitigation, survivability, unmanned spacecraft, impact risk analysis, shielding, ballistic limit.

Key technical topics and requirements

• Scope and intent: Focused on quantifying the probability of spacecraft failure due to SD/M impacts, primarily to ensure post‑mission disposal and to limit impact‑induced catastrophic break‑up.
• Two principal analysis cases:
  • Case 1 - Failure defined as inability to perform successful post‑mission disposal (impact risk to critical equipment).
  • Case 2 - Failure defined as catastrophic break‑up; subdivided into:
    • Case 2a - Break‑up from impact on equipment with stored energy (e.g., pressurised vessels).
    • Case 2b - Break‑up from high‑energy SD/M impacts (energy‑to‑mass ratio considerations; typical EMR threshold referenced ~40 J/g).
• Failure probability thresholds and analysis procedures: The standard defines how to set and calculate failure probabilities for critical functions and catastrophic break‑up scenarios.
• Technical models and tools: Includes symbols, ballistic limit equations (BLEs), rupture limit equations (RLEs), methods for small SD/M analysis, and guidance on hypervelocity impact (HVI) regimes.
• Design guidance: Informative annexes cover shielding design, advanced shielding examples, material constraints, and implementation guidance across project lifecycle phases (including Phase A).

Practical applications and users

ISO 16126:2024 is practical for:

• Spacecraft systems and structural designers (shielding and layout to protect critical equipment)
• Mission and systems engineers performing impact risk assessments and failure‑probability analyses
• Project managers and safety engineers ensuring compliance with space debris mitigation requirements
• Regulatory agencies, certification bodies, and insurers assessing mission risk and debris‑mitigation conformity
• Researchers and test facilities developing hypervelocity testing, ballistic‑limit validation, and materials selection

Typical uses:

• Demonstrating compliance with ISO 24113 for post‑mission disposal reliability
• Selecting and validating shielding approaches against small SD/M (≤ 1 cm)
• Assessing risk of catastrophic break‑up and designing mitigations for pressurised systems

Related standards

• ISO 24113 - Space debris mitigation requirements (top‑level)
• ISO 14300‑1 - Project lifecycle and phase definitions (referenced for lifecycle phases)

ISO 16126:2024 provides structured, practical guidance for integrating impact survivability into spacecraft design and mission planning to reduce space debris generation.

Standards Content (Sample)

International
Standard
ISO 16126
Second edition
Space systems — Survivability of
2024-12
unmanned spacecraft against space
debris and meteoroid impacts
for the purpose of space debris
mitigation
Reference number
© ISO 2024
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
ii
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Symbols and abbreviated terms. 2
4.1 Symbols .2
4.2 Abbreviated terms .5
5 Requirements for impact risk analysis . 5
5.1 General .5
5.2 Failure probability thresholds .6
5.3 Failure probability analysis .6
6 Impact risk analysis procedure for case 1 . 6
7 Impact risk analysis procedures for case 2 . 10
7.1 General .10
7.2 Case 2a .10
7.3 Case 2b .14
Annex A (informative) Procedure for an impact risk analysis during phase A . 17
Annex B (informative) Methods and models for analysing the impact risk from small SD/M .18
Annex C (informative) Ballistic limit equations .29
Annex D (informative) Guidance for implementing impact protection on a spacecraft .43
Annex E (informative) Examples of advanced shielding for unmanned spacecraft .50
Annex F (informative) Typical environmental constraints for shield materials .56
Bibliography .57

iii
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out through
ISO technical committees. Each member body interested in a subject for which a technical committee
has been established has the right to be represented on that committee. International organizations,
governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely
with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of ISO document should be noted. This document was drafted in accordance with the editorial rules of the
ISO/IEC Directives, Part 2 (see www.iso.org/directives).
ISO draws attention to the possibility that the implementation of this document may involve the use of (a)
patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent
rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a)
patent(s) which may be required to implement this document. However, implementers are cautioned that
this may not represent the latest information, which may be obtained from the patent database available at
www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 20, Aircraft and space vehicles, Subcommittee
SC 14, Space systems and operations.
This second edition cancels and replaces the first edition (ISO 16126:2014), which has been technically
revised.
The main changes are as follows:
— the provision of new impact risk analysis requirements and procedures aimed specifically at satisfying
the high-level impact risk requirements defined in the top-level International Standard on space debris
mitigation, ISO 24113;
— the provision of new informative annexes to assist in the implementation of the impact risk analysis
procedures.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.

iv
Introduction
The purpose of this document is to help satisfy two of the high-level requirements defined in the top-level
International Standard on space debris mitigation, ISO 24113. Specifically, this document aims to maximise
the survival of critical equipment required to perform post-mission disposal of an unmanned spacecraft,
and to limit the possibility of an impact-induced break-up of the spacecraft. The analysis procedures in this
document are consistent with those defined in References [1] and [2].
In principle, this document can also be used to assess the impact survivability of an unmanned spacecraft in
support of other mission objectives. However, careful adaptation of the document can be necessary if put to
such use.
This document is part of a set of International Standards that collectively aim to reduce the growth of space
debris by ensuring that spacecraft are designed, operated, and disposed of in a manner that prevents them
from generating space debris throughout their orbital lifetime. All of the primary space debris mitigation
requirements are contained in ISO 24113. The remaining International Standards, of which this is one,
provide supporting methods and procedures to enable compliance with the primary requirements.

v
International Standard ISO 16126:2024(en)
Space systems — Survivability of unmanned spacecraft
against space debris and meteoroid impacts for the purpose
of space debris mitigation
1 Scope
This document defines requirements and procedures for analysing the risk that an unmanned spacecraft
fails as a result of a space debris or meteoroid impact.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content constitutes
requirements of this document. For dated references, only the edition cited applies. For undated references,
the latest edition of the referenced document (including any amendments) applies.
ISO 24113, Space systems — Space debris mitigation requirements
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO 24113 and the following apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— IEC Electropedia: available at https:// www .electropedia .org/
— ISO Online browsing platform: available at https:// www .iso .org/ obp
3.1
ballistic limit
threshold of impact-induced failure of a structure
Note 1 to entry: A common failure threshold is the critical size of an impacting particle at which perforation occurs.
However, depending on the characteristics of the item being hit, failure thresholds other than perforation are also
possible.
3.2
catastrophic break-up
event that completely destroys an object and generates space debris
3.3
critical equipment
item(s) on a spacecraft whose failure would prevent the completion of one or more essential functions, such
as post-mission disposal
3.4
high-energy SD/M
space debris or meteoroid object whose impact kinetic energy exceeds the threshold necessary to cause the
catastrophic break-up (3.2) of a spacecraft
Note 1 to entry: The threshold is usually expressed in terms of the kinetic energy of an SD/M impact relative to the
mass of the spacecraft, i.e. an energy-to-mass ratio (EMR). A typical value for the EMR threshold is 40 J/g.

3.5
project lifecycle
phases of a project from mission analysis through to disposal
Note 1 to entry: The phases of a project are summarised in Table 1. A more detailed description can be found in
[3]
ISO 14300-1 .
Table 1 — Summary of the phases of a project
Phase Description
Pre-phase A Mission analysis
Phase A Feasibility
Phase B Definition
Phase C Development
Phase D Production
Phase E Utilization
Phase F Disposal
3.6
small SD/M
space debris or meteoroid object whose size does not exceed one centimetre in its largest dimension
Note 1 to entry: This threshold is defined for two reasons. First, in impact risk analysis models it is difficult to
characterise accurately the penetrative damage inside a spacecraft from an SD/M impactor larger than one centimetre
in size. Second, it is difficult for current shielding technology to protect a spacecraft against an SD/M impactor larger
than one centimetre in size.
4 Symbols and abbreviated terms
4.1 Symbols
A power law term
B power law term
C speed of sound of the material in a target wall (km/s)
D constant value
d critical diameter of an impactor at the threshold of failure of a wall, panel or shield (cm)
c
d diameter of largest fragment in an in-line cloud ejection cone (cm)
LF
d diameter of impacting particle or projectile (cm)
p
G constant value
H Brinell hardness of the material in a target wall
K factor that combines the material properties of a target
K factor that combines the material properties of a CFRP target
CFRP
K factor that distinguishes between different types of impact damage failure
f
K factor that combines the material properties of a target
K factor that combines the material properties of a target
K factor that combines the material properties of a target
K factor that combines the material properties of a target
3D
K factor that combines the material properties of a target
3S
K factor that combines the material properties of a target
k factor that distinguishes between different types of impact damage failure
L adjustable coefficient to separate the ruptured and non-ruptured data points in an RLE
L adjustable coefficient to separate the ruptured and non-ruptured data points in an RLE
L adjustable coefficient to separate the ruptured and non-ruptured data points in an RLE
m mass of impacting particle or projectile (g)
p
1)
p internal pressure in a pressurised tank (ksi)
int
p constant value
r outer radius of a pressurised tank (cm)
o
S stand-off distance between the outer bumper of a shield and a back wall (cm)
t thickness of aluminium wall (cm)
al
t thickness of bumper shield (cm)
b
t thickness of CFRP wall (cm)
CFRP
t thickness of composite material in a COPV (cm)
comp
t thickness of foam core in sandwich panel (cm)
f
t total thickness of honeycomb cell walls perforated by a projectile impacting at angle θ (cm)
hc
t thickness of liner material in a COPV (cm)
lin
t total thickness of cylindrical portion of COPV material overwrap, i.e. t + t (cm)
tot comp liner
t thickness of a single wall, or thickness of back wall in a multiple wall configuration (cm)
w
v impact velocity (km/s)
v high velocity limit for transition from fragmentation to hypervelocity regime (km/s)
h
v low velocity limit for transition from ballistic to fragmentation regime (km/s)
l
v velocity of largest fragment in an in-line cloud ejection cone (km/s)
LF
v normal component of impact velocity, i.e. v cosθ (km/s)
n
α weighting coefficient
β weighting coefficient
γ weighting coefficient
1) 1 ksi = 6,895 MPa.
δ weighting coefficient
ζ weighting coefficient
ζ weighting coefficient
η weighting coefficient
θ impact angle with respect to surface normal (degrees)
κ weighting coefficient
λ weighting coefficient
μ weighting coefficient
ξ weighting coefficient
ρ areal density of one or more layers of material (g/cm )
A
ρ areal density of foam core in sandwich panel (g/cm )
A,f
ρ density of aluminium wall (g/cm )
al
ρ density of bumper shield (g/cm )
b
ρ density of CFRP wall (g/cm )
CFRP
ρ density of the composite material in a COPV (g/cm )
comp
ρ density of foam core in sandwich panel (g/cm )
f
ρ density of honeycomb core in a sandwich panel (g/cm )
hc
ρ density of impacting particle or projectile (g/cm )
p
ρ density of a single wall, or density of back wall in a multiple wall configuration (g/cm )
w
σ hoop stress of a pressurised tank, i.e. p r /t (ksi)
h int o tot
σ ultimate tensile stress of the material in a pressurised tank (ksi)
u
σ unidirectional ultimate stress of the composite material in a COPV (ksi)
u, comp
σ ultimate stress of the liner material in a COPV (MPa)
u, lin
σ yield stress of the liner material in a COPV (MPa)
y, lin
σ yield stress of material in a single wall or the back wall in a multiple wall configuration (ksi)
y, w
ϕ angle between central axis of in-line cloud ejection cone and surface normal (degrees)
ψ spread angle of in-line cloud ejection cone (degrees)

4.2 Abbreviated terms
AIT assembly integration and test
BLE ballistic limit equation
CFRP carbon fibre reinforced plastic
COPV composite overwrapped pressure vessel
CVCM collected volatile condensable material
EMR energy-to-mass ratio
FTA fault tree analysis
GEO geostationary orbit
GVF geometric view factor
HVI hypervelocity impact
IADC Inter-Agency Space Debris Coordination Committee
LEO low Earth orbit
MLI multi-layer insulation
MVF modified view factor
REACH registration, evaluation, authorisation and restriction of chemicals
RLE rupture limit equation
RML recovery mass loss
SD/M space debris/meteoroid(s)
STENVI standard environment interface
TT&C telemetry, tracking, and command
5 Requirements for impact risk analysis
5.1 General
5.1.1 The top-level International Standard on space debris mitigation, ISO 24113, specifies two high-level
SD/M impact risk assessment requirements that aim to:
a) ensure the post-mission disposal of a spacecraft;
b) limit the probability that a spacecraft experiences an SD/M impact-induced break-up before its end of life.
5.1.2 To satisfy these high-level requirements, the following two distinct analysis cases can be defined:
a) case 1: an analysis of the probability of SD/M impact-induced failure of the spacecraft, where failure is
defined by an inability to perform successful disposal;
b) case 2: an analysis of the probability of SD/M impact-induced failure of the spacecraft, where failure is
defined by a catastrophic break-up.

5.1.3 The analysis in case 2 can be subdivided by analysing the following two types of catastrophic break-
up separately:
a) case 2a: a catastrophic break-up caused by the impact of a small SD/M on an equipment item containing
a large amount of stored energy, such as a pressurised vessel;
b) case 2b: a catastrophic break-up caused by the impact of a high-energy SD/M on the spacecraft.
5.1.4 Detailed requirements to support the implementation of these analyses are provided in 5.2 and 5.3.
5.2 Failure probability thresholds
5.2.1 For case 1, during the design of a spacecraft for which a disposal manoeuvre has been planned, a
threshold shall be specified for the probability that an SD/M impact prevents the disposal from being
successful.
5.2.2 For case 2a, during the definition of a mission and the design of a spacecraft, a threshold shall be
specified for the probability that the spacecraft experiences a catastrophic break-up before its end of life as
a result of a small SD/M impacting an equipment item containing a large amount of stored energy.
5.2.3 For case 2b, during the definition of a mission and the design of a spacecraft, a threshold shall be
specified for the probability that the spacecraft experiences a catastrophic break-up before its end of life as
a result of a high-energy SD/M impacting the spacecraft.
NOTE The threshold in case 2b can be specified taking into account the significance of the mission, the mission
requirements, and the expected severity of adverse effects on the orbital environment if a break-up occurs.
5.2.4 The failure probability thresholds shall be set by the approving agent responsible for requirements
in the space debris mitigation plan.
NOTE Each of the probability thresholds can be expressed as a maximum value for the probability of failure, P .
F max
5.3 Failure probability analysis
5.3.1 To satisfy each of the failure probability thresholds in 5.2, an analysis shall be performed in which the
corresponding probability of failure, P , is calculated and compared with the specified maximum value, P .
F F max
5.3.2 If P > P , then measures shall be taken to reduce P so that it is below the maximum value.
F F max F
5.3.3 The analysis and reduction of P for each of the analysis cases shall follow a clearly defined procedure.
F
NOTE An example procedure for analysis case 1 is described in Clause 6. Example procedures for analysis cases 2a
and 2b are described in Clause 7. For some types of spacecraft, such as small ones or those operating in GEO, simplified
procedures for analysis cases 2a and 2b can be considered if the impact risks are sufficiently low.
5.3.4 The results of the impact risk analysis, the methodology used, and any assumptions made shall be
approved by the approving agent of the spacecraft.
6 Impact risk analysis procedure for case 1
6.1 The consideration of SD/M at sub-centimetre sizes is particularly important when analysing the
impact risks that can prevent the successful disposal of a spacecraft. An analysis of such impactors:
a) enables the probability of impact-induced failure of the spacecraft to be calculated, where failure is
defined by not being able to perform a successful disposal;

b) allows any impact vulnerabilities in the spacecraft design to be identified;
c) guides the implementation of appropriate levels of impact protection in the spacecraft.
6.2 A procedure for performing a detailed analysis of the probability that a spacecraft cannot complete a
successful post-mission disposal, as a result of impacts from small SD/M, is shown in Figure 1. The procedure
is designed to be followed in phases B and C of the spacecraft project lifecycle.
NOTE It is also possible to perform a simple impact risk analysis during phase A for the purpose of defining
key aspects of the proposed design of the spacecraft, such as its geometric characteristics. A procedure for such an
analysis is described in Annex A.
6.3 During the preliminary design in phase B, the aim of an impact risk analysis is to be sufficiently
detailed that it can suggest and enable efficient protection solutions which can otherwise be impossible
during the final stages of development.
6.4 By contrast, in the late development stages a redesign of the general spacecraft architecture is not
usually possible due to the complex subsystem interrelationships that are characteristic of spacecraft. Thus,
during phase C, the main goal is to refine the impact risk analysis of the spacecraft and identify areas of its
design where additional shielding is necessary.

Figure 1 illustrates the key steps in the procedure and the flow of information between the steps.
Figure 1 — Impact risk analysis procedure for case 1

Table 2 provides a more detailed description of each step in the procedure.
Table 2 — Impact risk analysis procedure for case 1
Step Description Further infor-
mation
1 Definition of spacecraft operating parameters and architecture design
1.1 Define the operating parameters of the spacecraft, such as its operational orbits and attitude
orientation relative to the direction of motion.
1.2 Define the architecture design of the spacecraft, such as its geometric characteristics and B.2.2.2
dimensions, the layout of all equipment, and the material properties of all surfaces, including
any shielding.
2 Identification of critical equipment
2.1 Identify every equipment item on the spacecraft that contributes to post-mission disposal.
2.2 For each equipment item determine its redundancy, impact damage modes and any other
design aspects that are pertinent, such as operating pressures.
2.3 Use a reliability analysis technique, such as fault tree analysis or failure modes and effects
analysis, to identify the system-level consequences that result when each of the equipment
items is damaged by impact.
2.4 Identify the critical equipment, i.e. those items which, when damaged by impact, can prevent
post-mission disposal.
2.5 On each critical equipment item, identify the critical surfaces, i.e. those surfaces which, when
damaged by impact, cause the item to fail.
3 Identification of BLEs
3.1 Identify existing BLEs that are suitable for determining the ballistic limit of each surface or C.3.1 to C.3.8,
combination of surfaces on the spacecraft, especially the critical equipment. C.5.1 to C.5.3
3.2 If a suitable BLE cannot be identified for a particular surface or combination of surfaces, then C.4.1 to C.4.3,
perform a set of HVI tests, as well as hydrocode simulations if SD/M environment models C.5.1 to C.5.3
indicate significant flux at velocities higher than the maximum velocity in the HVI tests, to
adapt an existing BLE or derive a new one.
3.3 For each surface or combination of surfaces on the spacecraft, especially the critical equip- B.2.2.3
ment items, define an impact failure criterion, such as perforation.
4 Analysis of probability of impact-induced failure
4.1 Select an SD/M impact risk analysis model that can evaluate the probability of impact-induced B.3.1 to B.3.3
failure of a spacecraft.
4.2 Select an SD/M environment model that is suitable for use with the chosen impact risk analysis B.2.2.4, B.2.2.5
model, and use it to produce a data set of directional impact fluxes on the spacecraft over the
life of its normal operations.
4.3 Use the chosen SD/M impact risk analysis model to compute the impact and perforation fluxes B.2.2.5, B.2.2.6
on external surfaces of the spacecraft.
4.4 Use the chosen SD/M impact risk analysis model to compute the probabilities of impact and B.2.2.7
perforation for external surfaces of the spacecraft.
4.5 Use the chosen SD/M impact risk analysis model to compute the perforation fluxes on the B.2.2.8
surfaces of equipment inside the spacecraft.
4.6 Use the chosen SD/M impact risk analysis model to calculate P , i.e. the probability that one B.2.2.9
F
or more of the selected critical equipment items fail during the normal operations of the
spacecraft as a result of an SD/M impact, thereby preventing the successful disposal of the
spacecraft.
5 Revision of the analysis or design
5.1 If P > P , revise aspects of the analysis or design by considering the following (in order B.2.2.10
F F max
of preference):
a) modify the analysis assumptions in terms of failure criteria or spacecraft
modelling;
TTabablele 2 2 ((ccoonnttiinnueuedd))
Step Description Further infor-
mation
b) compare the flux values obtained from the selected SD/M environment models Reference [4]
with those from other models to characterize the differences due to inherent
uncertainties in the models and, if appropriate, select alternative models for the
analysis;
c) perform additional impact testing and, if necessary, hydrocode modelling to C.4.1 to C.4.3
remove engineering conservatism in the BLEs;
d) identify those areas of the spacecraft design which are the greatest contributors Annex D
to the spacecraft impact failure probability, and systematically apply one or more
shielding modifications;
e) examine alternatives for designing the spacecraft so that it can be orientated in Annex D
such a way that its most vulnerable, critical equipment does not face the direction
of greatest impact flux.
7 Impact risk analysis procedures for case 2
7.1 General
7.1.1 Impact risk analysis procedures for cases 2a and 2b are provided in 7.2 and 7.3, respectively. The
procedures are designed to be followed in phases B and C of the spacecraft project lifecycle. Preliminary
analysis of case 2b during phase A can also aid selection of the operational orbit of the spacecraft.
7.1.2 The overall probability of impact-induced failure for case 2 is calculated by combining the probability
of impact-induced failure for case 2a and case 2b.
7.2 Case 2a
7.2.1 The consideration of SD/M at sub-centimetre sizes is particularly important when analysing the
impact risks that can cause a catastrophic break-up. An analysis of such impactors:
a) enables the probability of impact-induced failure of a spacecraft to be calculated, where failure is defined
by a catastrophic break-up;
b) allows any impact vulnerabilities to be identified in the design and location of spacecraft equipment
containing large amounts of stored energy;
c) guides the implementation of appropriate levels of impact protection for spacecraft equipment
containing large amounts of stored energy.
7.2.2 A procedure for performing a detailed analysis of the probability that a spacecraft fails as a result
of a catastrophic break-up caused by the impact of a small SD/M on an equipment item containing a large
amount of stored energy, is shown in Figure 2.
7.2.3 Since the impact risk analysis for case 2a can be thought of as a subset of the analysis for case 1, the
steps in the procedure are almost identical to those described in Clause 6. Table 3 provides a more detailed
description of each step in the procedure.
7.2.4 Alternatively, a much simplified version of the procedure, which does not necessitate the use of an
SD/M impact risk analysis model, can be implemented as follows.
a) Select and use an SD/M environment model to calculate the most likely impact velocity and angle for an
SD/M particle on a spacecraft in its particular orbit.

b) Select and use a BLE, with the information in a), to calculate the diameter of an SD/M particle that is
most likely to cause the break-up of an equipment item containing a large amount of stored energy.
For example, in the case of a metallic pressurised vessel, the RLE in C.3.7 can be used together with
information on the vessel design and its operating pressure.
c) Use the chosen SD/M environment model to calculate the impact flux of SD/M particles, with diameter
as calculated in b), on the spacecraft.
d) Use the equations in B.2.2.7, with the flux information in c), to calculate the probability that the
equipment item breaks up.
e) In the case of an equipment item depleting its contents, repeat steps b) to d) to evaluate the effect of
pressure change.
f) Repeat steps b) to e) for all equipment items containing a large amount of stored energy, and calculate
the overall probability that the spacecraft fails as a result of a catastrophic break-up caused by the
impact of a small SD/M.
NOTE This procedure provides a quick but approximate result. It can be useful when there is a need to perform
multiple assessments to understand the effect of operational parameters changing over time, such as the pressure
inside a vessel.
Figure 2 — Impact risk analysis procedure for case 2a

Table 3 — Impact risk analysis procedure for case 2a
Step Description Further infor-
mation
1 Definition of spacecraft operating parameters and architecture design
1.1 Define the operating parameters of the spacecraft, such as its operational orbits
and attitude orientation relative to the direction of motion.
1.2 Define the architecture design of the spacecraft, such as its geometric character- B.2.2.2
istics and dimensions, the layout of all equipment, and the material properties of
all surfaces, including any shielding.
2 Identification of critical equipment
2.1 Identify every equipment item on the spacecraft that contains a large amount of
stored energy, including pressure vessels, high-pressure propellant tanks and
high-pressure batteries.
2.2 For each equipment item determine its redundancy, impact damage modes and any
other design aspects that are pertinent, such as operating pressures.
2.3 Use a reliability analysis technique, such as fault tree analysis or failure modes and
effects analysis, to identify the system-level consequences that result when each
of the equipment items is damaged by impact.
2.4 Identify the critical equipment, i.e. those items which, when damaged by impact,
would rupture causing a catastrophic break-up and, in so doing, make a conservative
assumption that the surrounding spacecraft structure will not be able to contain
the fragments and content of the ruptured items.
2.5 On each critical equipment item, identify the critical surfaces, i.e. those surfaces
which, when damaged by impact, cause the item to break-up catastrophically.
3 Identification of BLEs
3.1 Identify existing BLEs that are suitable for determining the ballistic limit of each C.3.1 to C.3.8,
surface or combination of surfaces on the spacecraft, especially the critical equipment. C.5.1 to C.5.3
3.2 If a suitable BLE cannot be identified for a particular surface or combination of C.4.1 to C.4.3,
surfaces, then perform a set of HVI tests, as well as hydrocode simulations if SD/M C.5.1 to C.5.3
environment models indicate significant flux at velocities higher than the maximum
velocity in the HVI tests, to adapt an existing BLE or derive a new one.
3.3 For each surface or combination of surfaces on the spacecraft, especially the critical B.2.2.3
equipment items, define an impact failure criterion, such as perforation or rupture.
4 Analysis of probability of break-up due to a small SD/M impact
4.1 Select an SD/M impact risk analysis model that can evaluate the probability of B.3.1 to B.3.3
impact-induced failure of a spacecraft.
4.2 Select an SD/M environment model that is suitable for use with the chosen impact B.2.2.4, B.2.2.5
risk analysis model, and use it to produce a data set of directional impact fluxes on
the spacecraft over the life of its normal operations.
4.3 Use the chosen SD/M impact risk analysis model to compute the impact and perfo- B.2.2.5, B.2.2.6
ration fluxes on external surfaces of the spacecraft.
4.4 Use the chosen SD/M impact risk analysis model to compute the probabilities of B.2.2.7
impact and perforation for external surfaces of the spacecraft.
4.5 Use the chosen SD/M impact risk analysis model to compute the perforation fluxes B.2.2.8
on the surfaces of equipment inside the spacecraft.
4.6 Use the chosen SD/M impact risk analysis model to calculate P , i.e. the probability B.2.2.9
F
that one or more of the selected critical equipment items break-up catastrophically
during the normal operations of the spacecraft as a result of an impact with a small
SD/M.
5 Revision of the analysis or design
5.1 If P > P , revise aspects of the analysis or design by considering the following B.2.2.10
F F max
(in order of preference):
a) modify the analysis assumptions in terms of failure criteria or
spacecraft modelling;
TTabablele 3 3 ((ccoonnttiinnueuedd))
Step Description Further infor-
mation
b) compare the flux values obtained from the selected SD/M environment Reference [4]
models with those from other models to characterize the differences
due to inherent uncertainties in the models and, if appropriate, select
alternative models for the analysis;
c) perform additional impact testing and, if necessary, hydrocode C.4.1 to C.4.3
modelling to remove engineering conservatism in the BLEs;
d) identify those areas of the spacecraft design which are the greatest Annex D
contributors to the spacecraft impact failure probability, and
systematically apply one or more shielding modifications;
e) examine alternatives for designing the spacecraft so that it can be Annex D
orientated in such a way that its most vulnerable, critical equipment
does not face the direction of greatest impact flux;
f) identify any aspects of the spacecraft design which can be modified
to limit the release of fragments into the space environment if a
catastrophic break-up occurs.
7.3 Case 2b
7.3.1 The consideration of a high-energy SD/M is particularly important when analysing the impact risks
that can cause a catastrophic break-up. An analysis of such impactors enables the probability of impact-
induced failure of a spacecraft to be calculated, where failure is defined by a catastrophic break-up.

7.3.2 A procedure for performing a detailed analysis of the probability that a spacecraft fails as a result of
a catastrophic break-up caused by the impact of a high-energy SD/M on the spacecraft, is shown in Figure 3.
Figure 3 — Impact risk analysis procedure for case 2b

Table 4 provides a more detailed description of each step in the procedure.
Table 4 — Impact risk analysis procedure for case 2b
Step Description
1 Definition of spacecraft operating parameters and architecture design
1.1 Define the operating parameters of the spacecraft, such as its operational orbits and attitude orien-
tation relative to the direction of motion.
1.2 Define the architecture design of the spacecraft, such as its geometric characteristics and dimensions.
2 Specification of catastrophic break-up EMR threshold
2.1 Apply an EMR value for the threshold of an impact-induced catastrophic break-up.
3 Analysis of probability of break-up due to a high-energy SD/M impact
3.1 Select an SD/M impact risk analysis model that can evaluate the probability of impact-induced failure
of a spacecraft.
3.2 Select an SD/M environment model that is suitable for use with the chosen impact risk analysis
model, and use it to produce a data set of directional impact fluxes on the spacecraft over the life of
its normal operations.
3.3 Use the chosen impact risk analysis model to calculate P , i.e. the probability that the spacecraft breaks
F
up catastrophically during its normal operations as a result of an impact with a high-energy SD/M.
During this analysis, if the EMR threshold is exceeded by SD/M objects of size greater than 10 cm,
then these objects can be disregarded providing the spacecraft has a collision avoidance capability.
Note that this is not conservative since the collision avoidance capability can also fail.
4 Revision of the analysis or design
4.1 If P > P , revise aspects of the analysis or design by considering the following (in order of pref-
F F max
erence):
a) modify the analysis assumptions in terms of catastrophic break-up threshold or
spacecraft modelling;
b) compare the flux values obtained from the selected SD/M environment models with those
from other models, e.g. as discussed in Reference [4], to characterize the differences due
to inherent uncertainties in the models and, if appropriate, select alternative models for
the analysis;
c) examine alternatives for designing the spacecraft in such a way that its geometric
characteristics or orientation reduces the collision cross-section in the direction of
greatest impact flux.
d) examine alternative operational orbits with lower impact fluxes which still meet the
mission requirements
Annex A
(informative)
Procedure for an impact risk analysis during phase A
For the feasibility studies in phase A of the spacecraft project lifecycle, a simple impact risk analysis can
help with defining key aspects of the proposed design, such as operational orbit and spacecraft geometric
characteristics.
A procedure for performing a simple impact risk analysis during phase A is listed in Table A.1. This can be
used to provide a preliminary assessment of the spacecraft design with respect to case 1 and case 2.
Table A.1 — Impact risk analysis procedure during phase A
Step Description
1 Select an SD/M environment model and use it to compute the directional impact fluxes on the spacecraft
for its proposed operational orbits until its end of life
[4]
ISO 14200 provides guidance on the selection and use of suitable SD/M environment models for impact
risk analysis.
An example of an SD/M impact flux data file is provided in Reference [46]. This format, known as STENVI, was
developed by the IADC as a standardised means of transferring flux data from SD/M environment models to
impact risk analysis models. It lists the flux data in discrete bins. The fluxes can be aggregated in different
ways to produce a variety of graphical plots, such as:
a) the total flux of SD/M impacting the spacecraft from each azimuth and elevation direction;
b) the flux of SD/M of a given size range or velocity range impacting the spacecraft from each azimuth
and elevation direction.
2 Incorporate the results of the impact flux analysis into the overall system engineering process to help
define the spacecraft geometric characteristics and the approximate additional mass margins for
impact protection
At this early stage in the assessment it can be necessary to treat the spacecraft as a sphere or a bounding
box, if attitude laws are known. In some instances it is also possible to evaluate individual major surfaces of
the spacecraft. The results of such an assessment can influence the preliminary layout of a spacecraft. For
example, if there were a large flux from a particular direction, then the possibility of modifying the geometric
characteristics of the spacecraft can be considered to reduce its projected area in that direction. Early analysis
can also inform the choice of mission orbit by showing differences between SD/M fluxes in candidate orbits.
3 Repeat the preceding steps if any of the proposed operational orbits of the spacecraft are changed
significantly
For the purpose of an impact risk analysis, a significant orbital change can be considered as one in which the
SD/M spatial density changes by at least 10 %.

Annex B
(informative)
Methods and models for analysing the impact risk from small SD/M
B.1 General
Case 1 (in Clause 6) and case 2a (in 7.2), respectively, describe impact risk analysis procedures for analysing
the probability that:
a) a spacecraft is not able to complete a successful post-mission disposal as a result of impacts from
small SD/M;
b) a spacecraft experiences a catastrophic break-up as a result of an impact from a small SD/M on an
equipment item containing a large amount of stored energy.
This annex provides information on methods and models that can be used for these analyses.
B.2 Analysis methods
B.2.1 General
If the criterion for impact-induced failure of a spacecraft is defined as perforation of the external structure,
then a logical consequence of this specification is that engineers will concentrate on applying any necessary
impact protection to the external structure whilst giving little consideration to the equipment inside the
spacecraft. On the face of it, th
...