SUMMARY

This paper has provided a discussion of three specific topics relating to control
of risks involved with a reentering payload. Specifically, the discussions address factors
relating to employment of a destruct system on the reentering vehicle in order to reduce
risks to the public.

Factors such as nature of the impact area (city /rural), number of pieces produced
by a destruct, effects of various types of destruct, and use of other risk reduction
methods were discussed in the context of factors affecting a decision to destruct an
inbound vehicle.

The type of information and nature of its presentation to an operator were noted
in the context of things affecting an operator's ability to make a destruct decision. The
operator's innate abilities as well as preparation and training were also discussed as
important factors.

Finally, risks and other considerations engendered by the addition of destruct
ordnance to a reentry vehicle were presented.



The analysis above was conducted for persons in the open, however if various sheltering
is considered, casualty expectancies will decrease proportional to the penetration energy
of the fragments. These effects have not been evaluated in this study, however, they can
significantly effect public risks if cities are exposed or areas where uniform density
assumptions are invalid.

The typical envelope for fragments of various ballistic coefficient ratios (Beta) and
for typical imparted velocities are shown in Figure 3. In general, destruct action shortens
the impact range of the various fragments because their ballistic coefficient is less than
the original vehicle. Shown in Figure 3 are illustrations of how both wind and ballistic
coefficient effect the impact location and impact area size. Destruct action on a
reentering vehicle typically shorten the impact range proportional to the ballistic
coefficient reduction achieved and spread debris over larger areas. It must be noted, that
destruct of a vehicle normally will produce fragments having significant variation and
uncertainties in the ballistic coefficients. In most cases the fragments will also have some
lift as well. The cumulative effects of destroying the vehicle will tend to produce a
number of debris classes rather than a uniform ballistic category and debris will be
spread over several of the beta circles rather than being confined to just one of the areas.

FIGURE 3: TYPICAL IMPACT AREAS

ot intact reentry venicte.





fe) Could be used later if sufficient lift/drag obtained.

° Penalties are weight and mechanical control complexities.

B. Operator Ability to Make a Destruct Decision Based on Impact Point Being
outside of Landing Area

This analysis discusses the ability of an operator to make a determination to
destroy based on where the estimated impact point is outside the range (i.e., not destroy
if impact is in unpopulated area versus destroy if in a higher populated area)? Included
in this discussion, the analysis will address the factors that affect the operator's ability
to make such determinations and how such a strategy might affect risk.

Before addressing the ability of an operator to make a destruct determination, the
elements that make up such an ability should be determined. In other words, what is
essential to an ability to make such a decision?

Before looking at that question, it is important to note the distinction between an
ability to make a determination and an ability to execute the decision. As described in
the tasking above, this analysis is concerned with factors affecting an operator's “ability
to make a determination." Factors relating to execution of a destruct decision, such as
the existence of command facilities and on-board ordnance, are not part of an ability to
make a decision and are not discussed here.

What, then, are the elements of an ability to make a destruct determination? or
what conditions must exist to make a supportable decision to destroy? The following
are suggested as appropriate elements:

° The operator must have sufficient timely information, presented in forms
for quick assimilation, to determine

- Impact point if no action is taken.

- Predicted impact point(s) of debris, and estimated public risk, if
action is taken at various times during the reentry.

° The operator must have individual expertise to properly interpret the
available information

There is a lot of detail summarized in these two general statements. An
examination of a typical reentry scenario, from an operator's viewpoint, will reveal the
multiple factors which make up the summarized elements.



of structure hit vs. an open area impact) to define a lethal area. For example, a small
fragment will generally have a small lethal area even if it is entering a very high speed.
A large device will have a larger lethal area due to it's size alone, but may also produce
extraordinary effects if its size and speed results in a structural collapse, substantial
“splatter,” or both. Splatter is the ejecta from the impact point, consisting of matter from
both the impacting unit and the ground/structure receiving the impact.

2. City vs. Rural Factors. Population densities of less than 10 people per square mile
are normally considered rural. This type of environment is characterized predominately
by single family dwellings. Potential worst case casualties in such an environment is
approximately four to five.

Cities, on the other hand, have average densities of 3000-4000 per square mile,
with peak densities in certain complexes of 10,000-20,000 per square mile. Even though
the size is small, casualty expectancy from a hit are orders of magnitude higher simply
because of population density. Lethal area increases because of possible roof failure in
multistory facilities, splatter, etc. This can add at least another order of magnitude to
casualty expectancy. Consequently, potential worst case casualties rise into the hundreds
of dead and injured.

3. Number of Pieces Generated By Destruct. A destruct may be a severe event
(explosion) or a benign, designed severance of parts, producing a planned number of
pieces with known sizes. In either case, resulting pieces may have ballistic coefficients
as high as the original reentry body. Smaller pieces hitting within a population center
may produce less damage due to the reduced likelihood of major structural failure.
Impact point(s) for pieces will generally be short (uprange) of the non-destruct impact
point. Some cross-range movement may occur depending on imparted velocities to the
pieces at destruct time, ballistic coefficients of thepieces, and wind direction and speed.

4. Destruct Methods and Effectiveness for Ballistic Reentry Vehicles. The risks associated
with the flight termination depends upon the method employed. The following
examines the potential options for terminating flight and associated issues that must be
considered:

a. Explosion

° Generates large number of small high velocity fragments
(depending on amount of explosive).

° Ballistic coefficients of resulting pieces are hard to predict and
depends on sphere construction and internal parts.

° Imparted velocities to the pieces at destruct time will spread the
impact footprint over a larger area.



In summary, the public risk levels will generally be increased by increasing the
number of reentering fragments and larger areas will be exposed to the debris threat.
It is unlikely that uniform population densities can be achieved as the debris areas grow
and population centers are likely to be included, thereby further increasing public risks.

SECTION 2: LANDING SITE FACTORS ANALYSIS

In order to understand how factors associated with the landing site, this analysis
examines three aspects to be covered:

A. Factors affecting a decision to destroy or not, when the impact area is
highly populated

B. Operator ability to make a destruct decision based on impact point being
outside of the landing area

C. _ Risks associated with having a destruct system

Each of these will be discussed individually in the sections which follow. Each
begins with a specific description of a situation and then explores the associated issues
affecting risks.

A. To Destroy or Not, When the Impact Area Is Highly Populated

Given that a vehicle falls into a highly populated area (100% probability), this
analysis discusses the differences in risks to the public between destroying and not
destroying the vehicle. It further discusses the factors involved in considering the
differences in public risk, such as population distribution, type of shelters, potential use
of other safety devices (e.g., parachutes and controls) (note: this section may be primarily
qualitative). In approaching this analysis, OCST focussed on various factors and
interrelationships that can influence the risks in different scenarios, rather than numerical
solutions to a casualty expectation problem.

1. Assumptions. For this analysis, the reentering body is assumed to be a spherical
mass of 1000 lbs, 4 feet in diameter. Such a device will have a ballistic coefficient of
approximately 133 lb,/ft?, and will impact at a terminal velocity of about 334 ft/sec or
228 mi/hr. Kinetic energy of this mass at impact (1.7 x 10° ft-lbs) is sufficient to
penetrate approximately 24 inches of high strength, reinforced concrete--the equivalent
of three to four floors of modern offices, condos, or apartments. It would crater about
11 feet in sandy loam.

The degree of the threat from a reentering device is generally related to it's size
and kinetic energy. Size and kinetic energy interact with the impact environment (type

6





100K feet and producing an average descent speed of 20 ft/sec
would lead to a total descent time of 83 minutes. If average wind
were 25 mph, this would produce a 35 mile drift.

The device would have to be designed for all possible opening
environments (speed, altitude, etc.) for maximum flexibility.

High altitude parachute opening would enable intercept by aircraft
and additional control actions if necessary.

Parafoils have high lift-to-drag ratios and can move a substantial
lateral distance for each unit of altitude lost. These can be used to
move the impact point, with the distance proportional to altitude of
deployment. By "flaring" just prior to landing, vertical velocity can
be reduced to near zero. Depending on relative wind direction,
horizontal motion still may be present. Radio control, either by an
interceptor or by tracking, would be required.

On-board Emergency Propulsion

°o

Could be used to boost the vehicle beyond or bring it in short of a
population center.

Stable platform or attitude control required to achieve a known
thrust vector direction.

Most efficient if done before reentry; becomes less and less effective
as time to impact becomes smaller.

Weight and operational complexity penalties are associated with this ©
option.

Recovery hazard is increased if the device is unused, and there ia
a possible increase in impact lethal area unless used in conjunction
with a parachute.

Mechanical Lift or Drag Devices

°

Pop-out panels/wings/flaps could provide directional stability, lift
and drag modulation.

Would require thermal protection if deployed during heating phase
of reentry.



INTRODUCTION

This paper summarizes worked conducted by OCST to analyze the effects and public risk
sensitivities to destruct or flight termination actions taken on ballistic reentry vehicles (See Source
Materials). Flight termination systems have been used to effectively limit vehicle deviations
during powered flight regimes but are not commonly employed for risk control with un-powered
reentering vehicles. This memorandum provides an overview of the capabilities, limitations and
effectiveness of using destruct systems to control or minimize public risks from such reentry
vehicles.

Using certain example assumptions, Section 1 of this paper provides a parametric risk
analysis of the effect of various parameters on casualty expectancy.

Section 2 analyzes examines risks as a result of factors associated with a specific
landing-site. The analysis identifies and discusses those factors or interrelationships that would
affect a decision to destroy a reentry vehicle known to be endangering a populated area. The
research will concentrate on factors affecting public risks, differences in associated public risks,
information and support systems necessary to make a decision to destroy, and other risks
associated with incorporating destruct systems on reentry vehicles.

SECTION 1: PARAMETRIC RISK ANALYSIS

This analysis is based on a number of assumptions and conditions specified by OCST.
The basic parameters used were:

1. The vehicle reenters from altitudes of 100 to 300 nautical miles.

2. The trajectory for an orbital vehicle is such that impact occurs 90 degrees in longitude
from de-orbit boost.

3. The vehicle is defined as a sphere of 48 inches, weighing 1000 pounds.

4. The vehicle is on an anomalous flight path and is exposing a populated area having a
uniform population density of 10 persons per square mile.

5. No control of the vehicle is possible until after reentry and the vehicle has no lift and
only drag and gravity forces act upon the vehicle.

These parameters result in a vehicle that reenters with a ballistic coefficient of
approximately 133 pounds per square foot and a terminal impact velocity condition of
approximately 334 feet per second (approximately 228 MPH).



combinations of reentry off-nominal conditions and population areas may
be so numerous and so complex that only the real-time computers can
determine the optimum course of action.

Some of the information necessary for an operator to make a decision must
be developed before the real time reentry event. For example, the operator
should not have to make determinations of what areas are acceptable for
landing during the actual event. Even more basic, any required layouts of
the populated areas on plot charts or computer displays should be
prepared beforehand. In other words, a major factor affecting the operator's
ability to make a decision is preparation.

A sub-factor of the information issue is the magnitude of reentry errors
that the operator attempts to accommodate. Miss distances of several
hundred miles are possible with only small errors in deorbit conditions.
As the miss distance increases, the ability to acquire data from the reentry
vehicle diminished due to acquisition problems and possibly reduced
reaction computation times. Additionally, the computational complexity
increases proportional to the square of the radial distance within which the
operator attempts to control risks. When miss distances exceed several
hundred miles, control capability is probably unattainable.

Operator Preparation, Training, and Expertise. Another aspect of

preparation, or at least one related to it, is individual expertise. An
operator performing a function such as this needs a basic aptitude for
assimilating complex information rapidly and being able to make a
decision under pressure. This relates to both innate abilities and to the
individual.

The operator must be well trained in this specific function. He/she must
know the mission rules; there will not be time to look them up. Because
not every situation can be pre-conceived, the operator must understand the
displays and systems that are presenting data to him, instantly
comprehend it, and be able to recognize when portions of it may not be
valid.

This scenario and walk-through analysis has focused on the minimum set
of factors affecting an operator's ability to make a destruct determination,
based on whether a reentering vehicle may impact outside the planned
landing range.



1. Scenario. A “range” exists and is the planned landing area for a reentering
payload which has been in orbit for some number of days. Actually, a specific point
within the range is the planned landing point. The range itself is very sparsely
populated; only a small number of mission essential personnel and observers are within
miles of the planned landing point. Outside the immediate boundaries of the range, the
population is also sparse, although with a slightly higher population density than within
the range. Some few miles from the range boundary along a certain direction,
population begins to increase at the suburban extremities of a large city. Inside the
suburban ring is a several square mile, high-density metropolitan area.

2. Assumptions. The inbound vehicle is carrying a destruct package, and the
“operator” has available the facilities to initiate the destruct. There is no other control
of the vehicle.

3. Analysis. How will the operator know whether to use the destruct system or not?
First, he/she must know where the vehicle is going to land. If it is headed toward the
planned landing site, obviously no action is needed. But he/she must be able to know
this. If it is headed "out of bounds,” but into a sparsely populated area, destruct may
be initiated or not, depending on previously established mission rules for the operation.
If impact is predicted near or in the city, the operator will still want to know where the
debris is likely to fall. The operator must see and assess the changing state of the
situation from moment to moment, and predict ahead, so as to initiate the action before
consequences progress to an unacceptable level, or when a minimum risk level is
achieved.

Several things can now be concluded about factors affecting the operator's ability
to make a destruct decision.

° Information_and_Its Presentation. Perhaps the most obvious factors
affecting the operator's ability to make the decision are preplanning and
knowledge about what's happening with the inbound vehicle where it's
going. Absent such knowledge, no rational decision either to continue
flight or to destruct the vehicle could be made. This is fundamental and
essential.

Several things are implied by this. First, some form of sensors must
provide the raw data (position, direction, speed, etc.) which can be
processed into a useable form. The processing capability to convert the
data must exist. For example, estimated impact predictions for the intact
vehicle and debris area if the vehicle were destroyed must be computed.
The debris impact area and its size vary with time of destruct action. The
data must be displayed in a form the operator can easily use. And all of
it must be accurate and timely so that if action is required, it can be done
soon enough to prevent or minimize serious consequences. The

i



Casualty expectancy may not change because of large numbers of
fragments, even if resulting impact area has a lower average
population density. Severity will be less.

Most effective if done before reentry heating. Most fragments
consumed when they are small.

b. Shaped-charge Disassembly

°

°

Generates a quantifiable number of pieces.
Ballistic coefficients are more predictable.

Larger pieces—not as susceptible to burn up during reentry if
initiated before reentry.

Very small imparted velocities to pieces—reduced dispersion and
more exposure control at impact.

c. Destruction of Reentry Thermal Protection

°

°

Vehicle breaks up due to reentry heat.
Depending on structure, may be completely consumed.

Number of pieces surviving may be small and will land short of
normal impact point.

May be an effective method but may be difficult to design and
implement mechanically.

In addition to destruct-type flight termination systems, the following describes other
alternatives for terminating or modifying the flight path of the vehicle:

a Parachutes, Drogues, Parafoils, etc.

°

to)

Will reduce terminal velocity, accident severity.
May move impact location depending on when deployed.

Deploying at higher speeds and altitudes typically requires stronger
parachutes or more drogue and reefing stages.

Increases wind drift distances. For example, a device deployed at



action would have to be initiated prior to the vehicles entry into dense atmosphere at
attitudes above 300,000 feet.

FIGURE 2: CASUALTY EXPECTANCY

Casualty Expectancy

1E-03

1E-04

1E-05,

0 5 10 15 20 25 30 35
Number of Fragments

3. Imparted velocity from destruct action.

There would be no direct effect on casualty expectancy from the velocities
imparted to the fragments as long as the impact area had a uniform population density
and they survived reentry. The main effect of imparted velocity will be to increase the
size of the area being exposed. If destruct occurs before reentry and imparted velocities
are large, the fragments can be spread over areas of hundreds of miles. Destruct action
taken at lower altitudes after reentry will tend to limit the impact area size due to the
drag effects.

4. Ballistic coefficient of reentering fragments.

As with imparted velocity, the ballistic coefficient of the reentering fragments will
have a more significant impact on the location of the impact area's but may have little
effect on public risk. Destruct action on any vehicle tends to produce fragments with
ballistic coefficients lower than that of the original vehicle. The effect of this is a
decrease in impact range depending on the altitude of destruct., One effect on public
risk that does occur as the ballistic coefficients become small is a decrease in the
potential severity of the fragment impacts and their potential for penetrating structures.



SOURCE MATERIALS

"Flight Termination System Risk Sensitivity Analysis of Reentry Vehicles," DRAFT
Technical Memorandum, Research Triangle Institute, August 6, 1991.

"Flight Termination System Risk Sensitivity Analysis of Reentry Vehicles, Subtask
3: Specific Landing Site Analysis," DRAFT Technical Memorandum, Research

Triangle Institute, October 9, 1991.





The destruct of a reentry vehicle would generate multiple fragments. The public risk
sensitivity to such destruct action is directly proportional to the total lethal area produced by
these fragments. Shown in Table | below is the lethal areas produced by destructing the reentry
vehicle into various numbers of fragments and the corresponding casualty expectancy.

TABLE 1. PUBLIC RISK VERSUS NUMBER OF FRAGMENTS

NUMBER OF | FRAGMENT LETHAL AREA | CASUALTY
FRAGMENTS | DIAMETER (Sq, Ft) EXPECTANCY
ft)
1 4 78.5 2.8 x 10°
2 4 157 5.6 x 105
5 3.58 330 12x 10"
10 253 392 1.4.x 10
15 2.07 “44 1.6 x 10*
20 18 493 4 18x 10*
25 16 531 1.9 x 10*
30 1.46 570 2.0 x 10*

Shown in Figure 2 is a plot of the casualty expectancy versus the number and size
fragments determined in Table 1 above. This figure indicates the rapid rise in casualty
expectancy as the number of fragments are initially increased and then a leveling effect
as the fragment size decrease offsets the increasing number of fragments.

The effects of other parameters specified for examination for their effect on public
risk were: .

1. Destruct Altitude from 20,000 to 500,000 feet.

The altitude of destruct will not change the public risk levels so long as the
impact region has a uniform population density. The impact location of the fragments
will vary with destruct altitude, change in ballistic coefficient and due to the effect of
winds on the falling fragments.

2. Fraction of fragments surviving reentry from 10% to 100%.
The casualty expectancy is directly proportional to the number of fragments

surviving reentry. For example if 30 fragments are generated and only 10% survive, the
casualty expectancy would be reduced by 10% from 2.0 x 10“ to 2.0 x 10°. Such destruct



The probable average number of casualties, called casualty expectancy (Ec), is determined
using the following equation:

Ec = Probability of Impact (P; x Lethal Fragment Area, LA) x Population Density (Pp)

Since the reentry vehicle will impact with a probability of unity and the population density
is given as 10 persons per square mile, the primary effect on public risk will be determined by
the lethal area of the reentering vehicle.

Shown in Figure 1 is a graphical illustration depicting the method used for determining
the lethal area of a single fragment. A human has a radius of approximately 1 foot and for this
case the reentry vehicle has a diameter of 4 feet. This produces a radius for the lethal area of 5
feet and an area of 78.5 square feet. The casualty expectancy for the intact vehicle is then:

Ec = P,x LAx Py

Ec = 1 x 78.5 x 10/5280)"

Ec = 2.8 x 10°

FIGURE 1: LETHAL AREA



Cc. Risks Associated With Having a Destruct System

This analysis qualitatively discuss the risks uniquely associated with a destruct
system being part of the vehicle (i.e., regardless of whether the system is used or not),
e.g., ordnance handling issues.

Several issues are raised in examining the safety of vehicles with on-board
destruct systems:

1. Installing a destruct system (ordnance, safe and arm device(s), receivers, antennas)
on a reentry vehicle increases certain risks. The destruct system, containing
ordnance elements, is itself a hazardous system that can endanger personnel
during ground processing of the payload. However, there are procedures for safe
handling and testing of these systems. Such procedures are well-established
within the companies that manufacture or launch vehicles carrying ordnance.
Companies not having an already developed base of expertise in destruct systems
would have to develop such a base.

2. Ground processing of a vehicle carrying a destruct system will be different than
for one that does not, simply because it is an ordnance carrying vehicle. Special
technician certifications are needed. Facility requirements are different.
Transportation requirements are different. A vehicle otherwise considered
non-hazardous can be processed and tested almost anywhere. An ordnance
carrying vehicle cannot. The addition of ordnance requires observation of
quantity-distance separation criteria between the processing facility and the
public. In short, processing such a vehicle is somewhat more complex,
hazardous, time-consuming, and expensive.

3. The degree of increased risk caused by the addition of a destruct system varies
from nearly insignificant to substantial, depending on the design of the destruct
system and type/quantity of ordnance used. If safe designs are used, only
cutting types of ordnance are used, installed late in the processing cycle, and the
system is not armed until reentry is to occur, then the increased prelaunch risks
are small.

4. Probably the greatest risk occurs after the reentry device has landed, and destruct
was not necessary. In such an instance, there will exist a device on the ground,
not necessarily under immediate secure protection. If the vehicle's destruct
system were still armed, a hazardous situation would definitely exist.
Presumably, procedures not yet defined would require the destruct system to
either be commanded into a safe state or to be automatically de-armed during
descent. Even so, there will remain an ordnance carrying vehicle to be located,
secured, transported, and post-flight processed.

13