Project Overview

A heat shield is the unique sub-system of a space capsule that is designed to protect the rest of the space capsule, and its human or scientific payload, from the extreme and uncertain temperature and pressure loads encountered during the capsule’s entry into an atmosphere. For the National Aeronautics and Space Administration (NASA) Orion space capsule (Figure 1), the heat shield is designed to withstand temperatures of thousands of degrees, and pressures several times that of the normal atmosphere, during the entry of the capsule into the Earth’s atmosphere.  Heat shields typically employ a variety of thermal mechanisms (e.g., conduction, convection radiation, ablation and melting) to accomplish this extremely important objective.  The heat shield is usually the only sub-system of the space capsule for which no form of redundancy exists. Hence, even if everything else in the mission goes perfectly, the success of the entire mission ultimately depends entirely upon the success of the heat shield. This piece of equipment is so important, that it is routinely over-designed; in fact, the mission goals and objectives may be limited in order to accommodate this over design.

The NASA Space Transportation System (STS, i.e., “space shuttle”) Columbia (Figure 2) is the most obvious example of a heat shield failure. The vehicle was completely destroyed (February 1, 2003, Figure 3) during re-entry into Earth’s atmosphere because of unforeseen and undetected damage to the tile-based heat shield. The damage was caused by pieces of insulating foam shedding from the fuel tanks during the ascent phase of the mission from Earth two weeks earlier. The Columbia failure grounded all subsequent STS flights for about two and a half years while an in-depth investigation was conducted. The findings, observations and recommendations of the investigation resulted in significant cultural changes throughout the agency and expense increases and operational changes to provide a variety of heat shield inspections for the remaining 21 STS flights through 2011. 

The overall goals of the current project were to: 1) quantify the reliability of the Orion thermal protection system (TPS, i.e., “heat shield”) to withstand the a wide variety of possible re-entry conditions and thermal loads, and 2) identify the key sensitivities of the predicted reliability to uncertainties and TPS design variables. Within these goals, the objective of this particular effort was to quantify and assess the TPS reliability using a combination of probabilistic technology (PT) and uncertainty quantification methods including Analysis of Variance (ANOVA), classical statistical methods, response surface modeling (RSM), and expert judgment.

Perhaps the most important factor influencing the heat shield reliability is the ablator (heat shield) thickness. More thickness provides greater TPS reliability, but increases the mass required to be launched into space. At the time of this work, the Orion Program could not explicitly design ablator thickness for a given mass-constrained reliability allocation. Without this ability, risks ranging from mission success to program viability cannot be quantified. Too much conservatism in the heat shield thickness causes a prohibitive mass and cost penalty while an overly aggressive reduction of design heat shield thickness risks mission success and crew safety.  As a result, PPI provided to the Orion team, a Decision Support Tool that enables decision makers real-time assessment capabilities of the risks and benefits associated with their choices, including a mean to enable optimal resource allocation across diverse choices of investment. This decision support capability has very broad application into other fields such as space communication.

Problem Definition

As shown below in the left side of Figure 4, three primary types of uncertainties must be initially quantified. These uncertainty types are the recession, material property and heat shield bond temperature uncertainties. Recession is a process by which the material within the heat shield ablates (vaporizes) which then brings the high temperature atmospheric re-entry flow closer to the heat shield bond line (where the heat shield attaches to the space craft structure), thus increasing the heat load to which the heat shield bond line is exposed. Each of these uncertainty types may be time-dependent functions of the ablation process, which itself is an extremely complicated thermodynamic and flow physics phenomenon. These uncertainties all influence the estimation of the recession amount and rate, and the bond line temperature estimate. The predicted recession amount and rate obviously then also influence (through material removal) the bond line temperature estimate at a given time and flight condition. The failure probability uncertainty is related to how the failure mode condition is modeled and what specific choice for the failure mode model is used.

The final uncertainty (right side of Figure 4) is the reliability margin uncertainty. This is the uncertainty in what actually constitutes a “safe” versus “failed” re-entry into the Earth’s atmosphere. For example, in the case of the failed STS Columbia, there was considerable speculation (after the fact) as to whether, had the exact location and extent of the damage to the Columbia heat shield been known prior to re-entry, was there any possible re-entry trajectory and vehicle orientation that could have been employed during re-entry to save the crew at the expense of destroying the vehicle?  Could, for instance, the less damaged side of the vehicle been oriented more into the oncoming re-entry flow field to provide more heat shielding protection to the crew?  Once inspection of the remaining STS heat shield tiles was initiated in 2005, it was found that every prior shuttle flight, and every flight since, had some level of damage to the heat shield tiles. The damage could be assessed, but no one in management would say that a certain level of observed damaged was “safe”. Thus, many heat shield tiles were probably replaced before they actually needed to be replaced.

The work described here was executed in two phases: Phase 1 was a six-month proof of concept demonstration of capability, whereas the multi-year Phase 2 included new data, numerous process improvements and more detail. The Phase 2 work actually resulted in reliability assessments that were used by the Orion Program. Also, the capabilities developed during Phase 2 were extended over several years to investigate related problems not within the original charter.

PredictionProbe’s Solution

During Phase 1 of the work (NESC 11-00698), the team investigated the sensitivity of reliability predictions to various input parameters. This effort included multiple studies to examine the heat shield predicted bond line temperature reliability based on seven body point locations for two different possible re-entry trajectories. Each body point and trajectory combination were subjected to five different assumed aerothermal environments. The predicted reliability was assessed based on a composite material failure criterion, which associated an increased probability of system failure proportional to the exceedance of the assumed “safe” bond line temperature limit. The study investigated the sensitivity of reliability predictions to various input and problem formulation parameters. Three predicted reliability estimates sets were produced for each body point and, using two different reliability formulation models and two different probabilistic analysis methods (Monte Carlo Simulation and First-Order Reliability Method, or FORM).

The Phase 2 reliability assessment was built around new test data and an updated vehicle trajectory. The new data used were the recently obtained arc jet test data defined during the Phase 1 effort by an application of Design of Experiments (see accompanying Case Study on this topic). Other process improvements during Phase 2 included:

• Addition of a new factor to the bond line temperature modeling process,
• Splitting the Phase 1 model form uncertainty into two separate pieces (temperature
• reproducibility and validation uncertainties),
• A new procedure to compute the temperature reproducibility and validation uncertainties,
• Inclusion of new failure mode data,
• A new failure mode modeling process, and
• Explicit consideration of failure mode model uncertainty.

Both efforts employed the PPI tool UNIPASS. The Phase 2 work also employed the PPI tool SPISE. Stand-alone sequential reliability assessments using the UNIPASS tool were formulated and conducted by a NASA employee. This NASA employee also contracted with PPI to provide a parallel implementation of the reliability assessments in SPISE. For the latter work, all of the physics and failure models, as well as all the associated uncertainties, were provided to PPI for integration and execution into SPISE by NASA.

Results and Conclusions

During Phase 1, the amount of model form uncertainty was a user input into the process. This one uncertainty input was intended to account for the observed differences between the reference STAB ablation model computational code predictions and the measured arc jet test data. The specific recession, temperature, failure probability and reliability margin uncertainties noted above were not modeled due to lack of data. Material property uncertainties were modeled, and the STAB-bond line temperature response was strongly influenced by the specific amount and types of these material property variations. Due to limited amount and uncertainty of available arc jet test data, no credible heat shield reliability estimate could be produced, although the reliability assessment process was developed and exercised. The reliability modeling process did provide insight into response sensitivities, but it was clear that better data (e.g., arc jet testing, material properties testing, etc.) and an improved reliability process and a better definition of the heat shield failure mode would be needed to provide a quantified heat shield reliability estimate.

In contrast, the Phase 2 effort produced a wealth of information. Using the revised reliability assessment process and seven representative heat shield body points, the target reliability was shown to be achievable for all body points analyzed (see Figure 5). However, given that most of the uncertainty source evaluations have confidence levels below the 95-percent level, the predicted reliability for heat shield bond line cannot be stated with 95-percent confidence. The result is the NASA Engineering and Safety Center (NESC) team’s best estimate is that the target reliability is achieved with between 50- and 95-percent confidence.

Of the seven body points analyzed, one body point dominated the reliability assessment for the assumed trajectory due to the combination of plausible material property variations and transitional flow effects. This point barely met the reliability target. It was later determined that this body point may not represent the worst case on the heat shield for this trajectory given the combination of effects due to recession and bond line temperature estimation.

The amount of predicted recession was found to be most sensitive to uncertainty in heat shield char thermal conductivity, the normalized recession rate as a function of temperature, and the surface roughness. The predicted bond line temperature was most sensitive to uncertainty in the amount of recession, the pyrolysis gas blowing coefficient, and the char emissivity and thermal conductivity. The estimated heat shield reliability was most sensitive to uncertainty in the amount of recession and the failure mode formulation.

As a result of this activity the: 1) TPS reliability was quantified and shown to meet the target reliability; 2) key sensitivities and numerous uncertainties were quantified; 3) specific guidance was provided to improve the reliability assessment (e.g., number of additional test samples required of various kinds); and 4) the work enabled additional studies to be quickly and easily performed.

The team also identified additional candidate failure modes: cracks in the heat shield; the potential for excessive local surface recession in specific areas of the heat shield due to heating amplification; failures associated with phase changes of the ablator material within the heat shield; and failure due to micrometeoroid and orbital debris damage. These failure modes could be examined at specific points in the heat shield. In fact, an analysis of cracks in the heat shield was done as a follow-on study.