The Pursuit of Occupant Safety in Commercial Human Spaceflight

Introduction

Ensuring safety to the extent practical is an integral part of human spacecraft design and operations; however, the fact remains that spaceflight is inherently risky. NASA, the military, and the Federal Aviation Administration (FAA) recognize this intrinsic concern and offer considerable guidance and insight for protecting the onboard occupants as well as the uninvolved public from hazardous events.^1–3 This article presents an overview of research undertaken in support of the Center of Excellence for Commercial Space Transportation's (COE CST's) interests regarding commercial human spaceflight safety analysis and risk communication, primarily centered on aspects of vehicle design and operations. Related studies have addressed more specific medical concerns pertaining to the occupants onboard the vehicle.^4–6

Efforts to date in this area include reviewing prior space program safety practices, ⁷ characterizing the process of human-rating within a risk scenario framework,^8,9 assessing provisioning options for providing medical care, ¹⁰ exploring the concept of “how safe is safe enough?”^11,12 and contrasting the risk of spaceflight to more typical terrestrial transportation and adventure sport activities. ¹³ Current efforts involve an ongoing review of the FAA's Recommended Practices for Human Space Flight Occupant Safety. ³

Human-Rating

Unmanned launch vehicles of the early space age were generally considered too unreliable for human use, since they successfully reached orbit only around 80% of the time. To improve the likelihood of crew survival and mission success, redundancy began to be added to critical systems, reliability of components was increased, and launch escape systems were developed. ⁷ These processes eventually came to be synonymous with the term “human-rating” (or its precursor “man-rating”), which originally appeared in the late 1940s to describe test aircraft that were deemed safe for human operation. The first vehicles found in the literature to be referred to as “man-rated” in this context were the X-series of experimental rocket planes. Subsequent use of the term evolved to differentiate between the earliest rockets that served as missiles and those intended to carry astronauts into space, where increased reliability was required.^8,9

Historically, the initial focus for spacecraft human-rating was primarily on safety; however, in subsequent decades, the term evolved to include aspects of crew performance and operations in addition. ¹⁴ Although the human-rating process for the Mercury, Gemini, and Apollo Programs was centered on safety concerns, as the space program progressed into the later Apollo and early Skylab era, the concept of human-rating began to incorporate improvements to operability as well. The Skylab and Shuttle Programs later added emphasis on human performance and health management. Unlike safety, however, which can be quantified as a probabilistic risk to loss of life, crew performance, often referred to as “human-in-the-loop” or the “human-machine interface,” is less well characterized by such a single comprehensive metric and remains a related area of study. ¹⁵

In 1988, a set of guidelines produced at the NASA Johnson Space Center (JSC) attempted to bring clarity to the term by defining a human-rated system as one that required an escape system or safe haven for the crew in the event of an emergency situation. Interestingly, based on this definition, the Space Shuttle was not considered by the JSC group to be human-rated; rather, it was referred to as “Highly Reliable.” ¹⁶ It was not until 1992 that human-rating began to take its current role as a requirements-based methodology. That year, NASA formed a committee to develop a set of human-rating requirements, ¹⁷ which eventually evolved into JSC 28354 Human-Rating Requirements ¹⁸ and, ultimately, NASA NPR 8705.2C Human-Rating Requirements for Space Systems, ¹⁹ the agency's current governing document.

The fundamental tenets of a human-rated space system can be summed up as accommodating the needs of the crew, effectively utilizing their capabilities to accomplish the mission objectives, and protecting the crewmembers, as well as ground teams and the uninvolved public, from hazardous events,^8,9 as summarized in Table 1.

This process of defining requirements and then identifying, quantifying, and mitigating risk is accomplished by using various standard techniques implemented throughout the systems engineering design process and/or through operational protocols and training.^22,23 Risk can further be defined in terms of technical, programmatic, schedule and budget goals as well, but these aspects are not addressed in the current effort. To begin with, high-level objectives are derived from mission goals and a baseline design concept can be established with the initial assumption made that everything will function as planned to accomplish the intended outcome. ²⁰ From this starting point, a systematic risk analysis method is employed essentially along the lines of asking “what if this component fails?”; evaluating “what can cause it to fail?”; determining “what happens if it fails?”; and estimating “what is the likelihood of it failing?”.

As outlined in Table 2, a risk analysis process is used to address these outcomes by identifying all known inherent hazards and their resultant failure modes, analyzing the consequence of a given failure, estimating the probability and severity of the failure occurrence, and combining the individual failures in a fault tree analysis to identify and model co-dependent responses. From this information, increasing the degree of safety is then accomplished by prioritizing and mitigating the ensuing most “likely and severe” risks to the extent practical. In the event that all levels of fault tolerance provided by the vehicle are exhausted and a catastrophic event occurs, various means of crew survival methods (CSM) can be implemented. CSM approaches can include incorporating a launch abort system for ascent, wearing a pressure garment to protect against a cabin leak, enabling a bailout if an anomaly is encountered during reentry, etc., as a final attempt at preventing fatalities. Finally, as operational performance data are amassed, the model is updated to improve the statistical risk prediction accuracy and “lessons learned” from failures encountered over time are incorporated by modifying the design or operations to increase safety.

Although detailed implementation of risk reduction is unique to the specific vehicle being considered, more generally applicable design-independent considerations can be characterized by using a proposed hierarchal framework tentatively defined as a working concept for this research in terms of a “Good Day, Not so Good Day, and Bad Day”. Table 3 outlines a synopsis of example scenarios and mitigation strategies within each category.

Essentially, human-rating can be considered as much a design philosophy as a product outcome. Whether an end qualification is established from a requirements verification process or an outcome-based product assessment, or whether it leads to formal certification or licensing, ²⁴ the overarching intent of human-rating is to protect the crew and ground personnel, including the uninvolved public, to the extent practical, as well as to accommodate and utilize the crew in a manner that enables the mission objectives to be efficiently achieved. The engineering analysis, design, and operational approaches used to address vehicle safety concerns can also be extended to protecting occupant health by similarly considering medical care needs and outfitting options.

Medical Level of Care

The rigors of spaceflight present unique and particularly challenging physiological and environmental conditions that occur under very unforgiving operational circumstances. In this context, the potential for illness or injury can be considered a “human failure mode” of sorts for the occupants, and approached in an analogous sense to the vehicle risk analysis and mitigation process. Consequently, some form of onboard medical care equipment is likely to be included in addition to the typical risk reduction methods incorporated by vehicle design. This implies outfitting the vehicle with select medical care capabilities, which can be determined by prioritizing risks based on the likelihood and severity of potential impacts to health for a given flight profile, and includes proper medical training by onboard crew as well as positioning of personnel and facilities needed on standby at the landing site. ²⁵

Lessons learned from past medical incidents in space along with review of existing commercial aviation standards offer valuable insight into determining appropriate medical care for the commercial space industry. Deciding on an acceptable “level of care” to provide for commercial spaceflights should take into account the unique risks and durations posed by different phases of suborbital and orbital missions, as well as the feasibility of effectively accommodating medical concerns that may arise in flight. In general, although existing NASA and civil aviation medical standards and practices may not be directly applicable to commercial human spaceflight, they do provide a benchmark that can be tailored to the different flight profiles and expected scenarios. ¹⁰ Finally, some assessment of “fitness to fly” criteria^5,26 can be considered as warranted to identify any high-risk underlying health concerns for susceptible individuals as a preflight preventative measure.

Given the wide variety of anticipated commercial space flight vehicles and operational scenarios, it is not likely that a single, comprehensive level of care need will be defined. Rather, if an agreeable minimum standard set of guidelines can be established as a baseline of good practice, then individual companies will have the opportunity to offer medical levels of care, as well as additional design amenities—which translate into making the vehicle “safer” and/or “nicer”—as a discriminating feature of their business model.

How Safe is “Safe Enough”?

In light of the combined risks associated with the potential for space vehicle anomalies and human health concerns alluded to earlier, the question comes down to deciding how safe is safe enough within the constraints of “acceptable” and “achievable.” ²⁷ Although no vehicle can be assured to be 100% reliable, a threshold of “safe enough” can be established and statistically analyzed with increasing fidelity as the design matures from concept to operations. ¹¹ The question of acceptability must be determined by the stakeholders. ¹² For government missions, this decision is made at a programmatic level, it becomes a business model determinant for industry, and for an individual deciding to fly, the answer represents a personal tolerance for risk. Informing this personal decision leads to the next objective of addressing how to effectively communicate the potential risks encountered by flying in space to candidate participants.

Risk Communication

Operators of commercial spacecraft are required to inform prospective space flight participants of the safety record of their launch and entry vehicles before receiving compensation or entering into an agreement to fly. ²⁸ This information must be conveyed to an individual before he or she can legally consent to fly. Expressing what risk assessment outcomes such as “probability of loss of life is 1 in 270” really mean should be communicated to paying passengers in a comprehendible manner that facilitates realistic risk perception. To offer insight into potentially more effective ways to inform potential participants of the risks associated with spaceflight, space fatality data were contrasted with other transportation and adventure activities (e.g., flying, driving, mountaineering, etc.). For example, it can be shown that the actuarial risk of loss of life while flying in space on the Shuttle or Soyuz was roughly on par with climbing Mt. Everest in recent years, thus providing potential space flight participants with a more common terrestrial activity as a reference point for comparison when assessing personal risk tolerance. ¹³

Summary and Next Steps

The research conducted to date under the auspices of the COE CST tasks 184 and 320 as described earlier has addressed the topics of human-rating, risk analysis including medical levels of care, and risk communication to help clarify understanding for informed consent of potential participants. A notional framework was established in terms of having a “good day, not so good day, bad day” to characterize degrees of successful flight scenarios. In addition to the cited publications resulting from this work as indicated throughout, contributions have been made to the FAA's Predecisional Human-Rating Ground Rules and Assumptions document prepared for discussion in 2012 (including associated terminology and definitions), the Draft Established Practices for Human Space Flight Occupant Safety, ²⁹ and the Recommended Practices for Human Space Flight Occupant Safety. ³ Ongoing work as part of current task 353 is aimed at providing suggested edits and/or additional subject areas to be included in the Recommended Practices for any future versions released, and compiling considerations for design and operational solutions that are capable of addressing the needs stated in each subject area referenced in the document's framework as a step toward identifying best practices and/or industry consensus standards. In support of these objectives, a road mapping workshop is planned (task 373) for mid-2018 to solicit input and discussion from colleagues across academia, government, and industry that will help shape future COE CST research directions in this area.

In summary, the human-rating process is used to determine those design features that are necessary to complete the desired objectives, to identify hazards to the crew along with their associated outcome severity and likelihood of occurrence, then to mitigate those risks to the extent practical, and, finally, to specify crew survival methods in the event a catastrophic failure should occur. By its nature, spaceflight is a risky venture, so regardless of the diligence pursued in designing such a complex system intended to safely operate in such an unforgiving environment, failures do and will occur. This residual risk must be communicated to participants. Ultimately, the decision to accept any degree of risk must be balanced with the commensurate reward, which, in this case, ranges from the often life-altering experience for an individual space traveler who sees the planet from this very unique vantage point, to helping advance humanity as a spacefaring species.