Design and Operational Considerations for Human Spaceflight Occupant Safety

Human/System Integration Considerations

Requirements vary depending on the duration or purpose of the spaceflight. Very short-duration suborbital transport may, for example, omit certain facilities related to food and hygiene. Toilets may not be necessary for a 1-h suborbital flight, while a 3-h flight may require hygiene facilities. The difference in cost is significant, due to the complexity of operating hygiene facilities in a microgravity environment. The same principle can be applied to safety. Very short-duration suborbital flights may be more efficient without space-suited occupants, but such configuration would increase the human-related safety risks. The possibility of immediate return or other than spacesuit safety systems would have to be considered to ensure a reasonable level of safety (Point A to Point A suborbital flight). Longer duration suborbital flights may not take the risk of Environmental Control and Life Support System (ECLSS) failure because the vehicle will not be in the immediate range of the landing facilities, and hence may require spacesuit operations and accommodations (Point A to Point B suborbital flight). The integration of the spacesuit within the spaceship flight deck/cockpit/cabin adds to the complexity, cost, and mass, while these considerations might be avoided in short-duration Point A to Point A flights. Therefore, the recommendation to categorize or classify suborbital flights is proposed, to distinguish the 2 areas and the complexity levels in each. Such categorization and subsequent category-specific recommendations will support the human spaceflight industry by providing more specific guidelines or controls relevant to the immediate operational scope of the vehicle, rather than providing broad recommendations.

Organizational Control Considerations

Certain operations and system components of suborbital or orbital vehicles are subject to export control regulations. This limits the access to U.S. spacecraft technology for some non-U.S. individuals during the design, development, operational, and maintenance phases. These controls are important from the perspective of U.S. national security, and indirectly also to spaceflight occupant safety. They apply to persons who are not citizens or permanent residents of the United States. Human spaceflight is inherently an international endeavor, it is critical to identify export control requirements from the very beginning when discussing the organizational ontology. Controls may require prior U.S. government approval to transfer technology, items, or services to selected foreign individuals. Suborbital flights may also include transcontinental travel that may be affected by export control regulations. Human spaceflight transportation is an international topic both on academic and industrial levels. It is critical for both to identify export-controlled safety components, systems, and operations to ensure compliance with international laws.

There are 2 primary export control regulations affecting CST. The first one is the International Traffic in Arms Regulations (ITAR), 22 Code of Federal Regulations (CFR), Parts 120–130, ³ under the jurisdiction of the U.S. Department of State, regulating items, information, or services “specially designed” for military applications. The ITAR regulates certain “Spacecraft and Related Articles” under the U.S. Munitions List (USML), category XV, identifying the performance levels, characteristics, or functions of a spacecraft that warrant regulation as a military commodity, such as a spacecraft with certain propulsion or optical systems. Launch operations and services are regulated under the USML category IV—Launch Vehicles, Guided Missiles, Ballistic Missiles, Rockets, Torpedoes, Bombs, and Mines. Non-U.S. individuals participating in any design, development, maintenance, or operation phases related to any U.S. origin systems enumerated in the ITAR may require a U.S. export control license from the Department of State.

The second regulation is the Export Administration Regulations (EARs), 15 CFR Parts 730–774 under the jurisdiction of the U.S. Department of Commerce, ⁴ regulating commercial and certain military commodities that are “dual use” in nature, with both commercial and military applications. “Propulsion Systems, Space Vehicles, and Related Equipment” is subject to the category 9 of the EAR's Commerce Control List (CCL). Most commercial spacecrafts that do not contain any classified components are enumerated in the EAR under Export Control Classification Number (ECCN) 9A515. ⁵

Since national security is the regulatory focus of both the EAR and the ITAR, the CST should consider these regulations and the technologies identified in the USML and CCL. Compliance should be implemented either horizontally across all spacecraft categories and subcategories, or vertically through functional domains of individually regulated systems and subsystems. National security considerations must be implemented at this early phase.

In addition, different controls exist for launch and human spaceflight operations based on either the orbital characteristics or the celestial body surface operations (22 CFR 124.15). ³ The ITAR, which retains jurisdictional authority over space launch-related services of U.S. origin technologies, requires a special license or agreement, such as a Technical Assistance Agreement to “provide assistance (including training) in the integration of a satellite to a launch vehicle, including both planning and on-site support, regardless of (i) the jurisdiction (EAR or ITAR), ownership, or origin of the satellite or (ii) whether technical data are used; and, providing assistance (including training) in the launch failure analysis of a launch vehicle, regardless of (i) the jurisdiction (EAR or ITAR), ownership, or origin of the launch vehicle or (ii) whether technical data are used.”

The proposed classification on Figure 1 is not meant to be exhaustive. Depending on the industrial needs or emergent phenomena during the first CST operations, this framework of systems may be expanded to provide guidance through the export-controlled CST environment. Figure 2 shows an example of evolution of this classification system.

OPEN IN VIEWER

Fig. 2.

Proposed (example) categorization for advanced CST operations. GSO, geostationary orbit; LLO, low lunar orbit; MEO, medium Earth orbit.

This proposed categorization does not only encompass the vehicle and trajectory differences but also considers the vehicle's occupants and their different functions during the commercial spaceflight. The flight may indeed need to accommodate both a flight crew and spaceflight participants (SFP).

The occupants' functions (operator and passenger) and their capabilities determine the levels to which the human/system integration (HSI) process must be applied (Fig. 3) in vehicles with different missions and purposes. The following examples illustrate how requirements might change according to occupant's functions:

OPEN IN VIEWER

Fig. 3.

Proposed classification for advanced CST operations with emphasis on human/system integration as an advancement of structure depicted in Figure 2.

Overall, the individual categories are intended to help industry focus only on relevant constraints and requirements, to better select appropriate technologies or commercially off-the-shelf components rather than to provide a broad set of environmental factors that may not be relevant at the early stage of development. This approach would also support the formation and modularization of the industry's evolution and expansion rather than requiring a “revolution” or significant changes in product or process development.

Human Rating and HSI

The human dynamics in spaceflight is not sufficiently addressed in existing norms, standards, or guides, especially in terms of safety. In current aviation operations, safety issues are likely to arise from human error rather than component error: human error has been attributed as the cause in some form to 70%–80% of aviation accidents. ⁶ To better understand safety issues that might arise during operational flights, it is critical to account for operator-induced errors, as well as issues that might emerge from human/machine interaction, early in the system design phase. HSI and human-centered design (HCD) holistic design methods and approaches enable creative and innovative problem-solving. ⁷

HSI can be broadly defined as given in Fitts et al. ⁸ : 1.

The understanding of the relationship between humans/operators, environment, hardware, and software.

Addressing HSI and HCD from the onset of system concept is critical to design a robust human-rated vehicle. The National Aeronautics and Space Administration (NASA) defines the following 3 primary tenets for human rating ⁹ : 1.

Human rating is the process of designing, evaluating, and assuring that the total system can safely conduct the required human missions.

HSI success is highly dependent on the results of the humans in the loop simulations (HITLS) and their implementation. Assurance of mitigation of risky scenarios addressing occupant safety during any possible Human spaceflight (HSF) scenario, with a reasonable probability of occurrence, is of very high importance. Current human-rating procedures suggest the use of well-proven, traditional tools such as

Due to the significant difference between the various CST vehicles (Vertical take-off vertical landing [VTVL], Horizontal take-off horizontal landing [HTHL], etc.) and mission types, a well-structured HITLS with defined partitioning of virtual and analog simulation components that can simulate/demonstrate human activity, safety, and performance in virtual and analog environments would significantly enhance occupant safety. Currently, there is no simulation fidelity scale for CST that would provide a more comprehensive (holistic) understanding of the flight scenarios in the simulation process. Individual risk areas are addressed using system analysis tools ad hoc based on the decision of the vehicle rating program manager (NASA Procedural Requirements—NPR 8705.2C, see Table 2).

Fire Events

Fire poses a serious threat to all occupants and increases the likelihood of the development of many other serious risks, such as toxic inhalation of gases, possible burns, and increased risk of fatalities. Automatic fire detection systems are the most preferable. Fires in microgravity environment do not behave the same way as fires on Earth. Hot gases form different convection patterns, and there is no buoyance from flames (vertical flame formation). Therefore, fire can be expected to form different formations and spread differently than in terrestrial gravity environment.

Detecting a fire is the first instrument in defending the flight crew and participants from deadly toxic smoke.^10–13 The ability to detect and suppress fires should be provided for the flight crew, cabin attendants, and space participants. Materials that are nontoxic to humans should be used for fire suppression and these materials should be designed to be easily cleaned up after use. The potential for a fire in a spacecraft can be mitigated by keeping oxygen (O₂) concentration at low levels. Maintaining a total O₂ pressure below 30% can also reduce the risk. However, O₂ levels need to be high enough to sustain crew respiration.

Flame retardant materials should be used in pressurized spacecraft cabins and should have

Smoke is usually the first indicator of fire in a spacecraft. It is important that airflow be maintained within the flight station so that smoke can be visually detected, because the sense of smell is reduced during human operations in microgravity; sometimes even completely impaired for the first few days of spaceflight. In addition, artificially generated airflow should move air/smoke and other combustion products near sensors for detection in a microgravity environment.

Gasper/ventilation fans (2: primary and secondary fans) should be used to circulate the internal atmosphere and allow for visual identification of smoke and prevention of carbon dioxide (CO₂) and carbon monoxide (CO) buildup in areas that would otherwise have no airflow. For redundancy, the smoke and fire detection systems should be independent of a master caution warning system and should also have independent power sources. As well, a warning system that alerts the crew of smoke and fire detection system failure is required. Detectors should be positioned in every separated compartments and equipment areas (passenger cabin, cargo compartment, electronic equipment areas, hydraulic equipment bays, storage and cargo areas, lavatories, and all ventilation ducts).

The selected extinguishing system must function without gravity assistance. Water-based foam fire extinguishers and CO₂ units are currently used in the International Space Station (ISS). However, CO₂ and other fire suppression mechanisms used on Earth have asphyxiant characteristics to humans, compounding the problem. ¹⁴ Another possible method is a fire extinguishing or mitigation technique using depressurization of the cabin. However, caution must be exercised as venting will promote airflow over the fire, which will increase the heat intensity and momentarily increase the O₂ concentration.

Ionizing Radiation

The ionizing radiation topic requires the special attention of all CST stakeholders. It is important to inform the crew and SFPs about safe levels of radiation. The history of aviation reveals that aviation crews are facing health problems after their long-term service as pilots, copilots, or flight attendants. Ionizing radiation exposure, especially during transcontinental flights, contributes to increased health risks requiring the classification of air flight crew as radiation workers. In other words, the overexposure to ionizing radiation is already a serious concern at normal air cruise flight levels. For these reasons, a clear guideline for frequently flying space crews and SFPs should be issued, and a simple radiation monitoring COTS hardware should be recommended to prevent yearly exposure overdose. ¹⁵

The 2 distinct spaceflight profiles, suborbital and orbital, with different flight paths, trajectories, and missions (length of stay) will directly affect the ionizing radiation exposure level, dose absorbed, and subsequent health effects. Occupants will be exposed to an increased lifetime risk of developing cancer, as well as possible mutagenesis that might be transmitted to their progeny. In human spaceflight, minimizing ionizing exposure risks and establishing mitigation safety parameters are paramount. ¹⁶ Risk mitigation of crew and occupant radiation exposure can be achieved by several ways:

Advancing new technologies in the development of accurate measurement devices, such as passive and real-time dosimeters. These devices can be placed in different areas of the vehicle, as well as on the humans themselves, to accurately monitor radiation and develop a strategy to limit operator and occupant exposure.

Additional factors besides scheduling spaceflights according to solar cycles to minimize exposure are individual's susceptibility and crew/participant's medical history. These are important factors that will have to guide the operator to determine if a participant is “go” or “no-go.” Efforts toward establishing protection against SPEs should be the primary goal. Radiation mitigation due to galactic cosmic rays is far more challenging due to the high energies. ¹⁷ The most used and realistic up-to-date industry standard is to reduce radiation exposure through the ALARA principle: “As Low As Reasonably Achievable.” ¹⁸

The Florida Institute of Technology supports research in this area through the development of a compact cabin radiation detector that would provide real-time information and precisely indicate the radiation magnitude and direction of primary, secondary, or radiation scattering, to determine the most effective placement of the shielding.

ECLSS and Air Quality

The ECLSS in a space vehicle performs several functions: it provides O₂ for metabolic consumption, provides water for hygiene purposes and food preparation, removes CO₂, filters particulates and microorganisms, removes toxicants (organic volatile trace gases), monitors and controls air total and partial pressures (nitrogen, O₂, CO₂, methane, hydrogen, and water vapor), maintains cabin pressure at nominal levels (14.7 psi) that require least adaptation by the vehicle occupants (NASA Space Shuttle and ISS), maintains temperature and humidity, and distributes air throughout the vehicle. The complexity and functions of the ECLSS depend on whether it is designed for suborbital or orbital spaceflight.

Air quality is critical to maintain healthy levels of air components (79% nitrogen and 21% O₂) and nominal pressures (14.7 psi). Possible variations in pressure and air components pose a significant threat to occupant safety. These threats include mild to severe hypoxia, decompression sickness, and inhalation component toxicity. These can create a wide array of distinct or vague signs that could lead to symptoms ranging from mild headaches to severe impairment, posing significant safety threats to occupants. NASA established a list of official spacecraft maximum allowable concentrations (SMACs) for selected airborne contaminants. The guidelines are available in peer-reviewed published literature. NASA established SMACs for 56 chemical compounds that are particularly relevant to the atmospheric contamination of ISS. ¹⁹

There are well-established SMACs for short-term duration flights (1–24 h), which apply suborbital and orbital flights. These measurements are also well established for flights lasting up to a few months (6 months–1 year). Data are still under research for long-term missions (1,000 days and over). It is also important to understand the population variability that these types of commercial spaceflights will encompass. Because there will be a wider range of population participating in spaceflight, it is reasonable to expect problems such as allergic reactions. ¹⁹ Furthermore, the natural chemical idiosyncrasy to certain contaminants is also difficult to predict. Therefore, it is expected that a wider participation of occupants from a broad population will also increase the chances of developing an adverse reaction. ¹⁹

Cabin Decompression

One of the major problems the operators and vehicle developers are facing during commercial spaceflight is the risk of decompression. There are different levels of space vehicle depressurization. Rapid decompression typically lasts longer than 0.1–0.5 s, which still allows the lungs to decompress more quickly than the cabin. The risk of lung damage is present, but it is significantly reduced. In explosive cabin decompression that occurs in less than 0.1–0.5 s, the risk of lung trauma is very high, as well as the risk of stomach rupture, severe decompression sickness, and freezing temperatures. Unsecured objects can also become projectiles' risk hurting occupants. All these risks reduce the chances of explosive decompression survivability to almost 0.^20,21

In case of gradual cabin decompression (rather than rapid or explosive), the failure to pressurize is notable but survivable if there are automatic pressurizing mechanisms, warning systems, and coordinated efforts to fix the emergency. Military pilots don their O₂ masks to a positive pressure breathing system, and therefore, the lungs fill with O₂ passively, but exhaling requires an effort. However, O₂ masks will not function in suborbital or orbital flight environments because they require not only an O₂ supply but also environmental pressure maintenance.

The vehicle should be designed to prevent incapacitation or injury of occupants by providing enough air to maintain cabin pressure, and a pressure suit with adaptable ECLSS to detect and control pressure and provide adequate O₂ flow. Satisfactory dexterity of pressure spacesuit will need to be a requirement, particularly for the crew.^22,23

G-Load

Of all the g-load risks and health effects possible, the most significant one is the gz-axis acceleration. The high g-load either transient or sustained angular acceleration increases the risk of incapacitation. It also can seriously increase the risk if there are underlying medical conditions that could progress into fatalities. High rates and extended periods of angular acceleration can significantly incapacitate any occupant. If the occupant is a crew member, the risk then increases to an additional operational safety risk. Short periods of g-loads can be sustained using breathing maneuvers and pressure bladders in suit designs, but longer periods of g-loads can physiologically and psychologically impact individual performance. Underlying predisposition to strokes or embolisms could severely impact occupant health under higher g-loads.

Vehicle designs can effectively decrease and minimize g-loads. Although the vehicle may still experience periods of high acceleration during re-entry or approach to landing, countermeasures for the flight crew, such as anti-g suit or specific crew seating configurations, can prevent vehicle acceleration from impairing the flight crew.

Therefore, it is important to differentiate between suborbital and orbital flights. Spaceflight type accounts for g-load and the number of times exposed to G forces. Suborbital flight profiles, seat design, and vehicle architecture will impact the direction of acceleration relative to the z-axis. Accumulation of exposures (i.e., parabolic flights) has different effects on different individuals. It can increase tolerance in some individuals but could increase adverse health risk in others. The eye's retina is highly susceptible to develop hypoxia due to g-load, with the final stage leading to loss of consciousness (G-LOC). Therefore, a thorough medical assessment is critical to determine suitability before spaceflight. The CST industry should also take advantage and use the existing NASA human spaceflight experience, standards, and technical reports describing human endurance and performance in different acceleration levels, NASA, CCT-REQ-1130, 3.10.2.1. ²⁴

Humans in the Loop: Simulations

While the SFP's well-being and comfort is a high priority, their attitude is similar to that of regular aircraft passengers, their attention is mostly focused on experiencing the extreme environments of the flight. Preflight training should introduce the major extremes of the flight, including loads and simulated microgravity. During the flight, passengers will have to focus on adaptation to hypergravity and then hypogravity and microgravity. The spaceflight crew, on the contrary, is required to adapt quickly and durably to the environmental extremes and demonstrate high cognitive capacity and capability during various spaceflight phases. Therefore, a high-fidelity simulation that enables the integration of environmental extremes and human cognitive and physical ergonomics is highly recommended for effective HSI and ultimately safe commercial operations.

Each vehicle configuration and type of flight profile will impose different requirements on the crew competencies and level of automation (i.e., function allocation). For example, winged body suborbital or orbital vehicles that may benefit from existing airport infrastructure have to consider cockpit design factors that influence spacecraft orientation during the complex task of flying. A wide array of information is available in the cockpit to allow the pilot to understand the direction and position of the vehicle. This information is conveyed visually from the outside environment via windows and from inside the vehicle via various instruments and displays. Because vision is the primary sense for maintaining orientation, the first design concentration should be the optimal location of windows and displays. These visual cues should provide adequate information for piloting, and they should be designed to also address vestibular and tactile sensory perception to reduce Coriolis Forces stimulation of the semicircular canals during head movement. Coriolis Forces can be a source of confusion and motion sickness. The flight station windows should allow both forward and peripheral views of the horizon, as these views provide the best visual cues for maintaining spatial orientation during a piloted landing phase. Window views or stereoscopic displays allow proper depth perception and provide more accurate visual cues than 2D representations of the environment from a single camera view.

The Florida Institute of Technology focuses on research in the HSI area through the development of custom simulation tools such as an adaptive spaceship cockpit simulator (ASCS) that integrates human and cockpit functions with the hyperbaric environment of a spacesuit (Fig. 4). The system enables simulation of microgravity sensations while providing motion control force feedback during orbit vehicle orientation. The ASCS motion base is an initial step to commercial human spaceflight midfidelity simulation tools that will enhance HSI methods and techniques in extreme environments of the HSF.

OPEN IN VIEWER

Fig. 4.

Inside the Florida Tech Spaceship Cockpit Simulator ASCS and Single Person Spacecraft 1:1 model.^25,26

Cabin and Flight Deck (Cockpit) Instrument and Display Design Best Practices

As crewed CST vehicles are more complex than aviation vehicles, the need to rely on instrumental and display information increases. Flight instruments and displays provide flight status, navigational information, and information about the health and status of the vehicle. Informational displays for the flight crew should be designed for simple and accurate interpretation in all possible realistic scenarios considering spaceflight's extreme environments. They should be clustered according to their functionality and use, especially because a high g-load narrows the field of view. Placing associated displays together provides efficient scanning, minimizes head movement, and enhances situational awareness and decision-making.

Because each suborbital and orbital vehicle will also operate in the aviation airspace, it is not unreasonable to recommend to the industry to work with existing Federal Aviation Regulations (FARs) in this area. FAA FARs: 121.303–121.359 describe the requirements on the following flight deck and cabin information systems, control instrumentation, and equipment (Table 3).

Emergency Equipment

Suborbital and orbital vehicles have different requirements on emergency equipment. While the suborbital vehicles' trajectory is well monitored in case an emergency landing is needed, the orbital vehicles may have a much larger spread of emergency equipment, in case of emergency landing. The following emergency equipment should be considered, especially for orbital vehicles (14 CFR 91.513):

Fire extinguishers or automated extinguishing system (water and CO₂), also usable in microgravity.

General Systems Design Safety

Systems controls and performance measurements are required to address the physiological, psychological, and environmental needs of the multiagent human/machine system that will operate a space vehicle in the commercial space environment. Acceleration, microgravity, smoke and fire hazards, CO and CO₂ buildup, and radiation are just a few of the variables that must be considered when designing a commercial spacecraft. General safety requirements on systems design and operations usually take into consideration a combination of factors, including safety design, fail-safe design, standardization, elimination or minimization of risks or hazards, safety devices, warning systems, and special procedures. Following system engineering and design safety/risk mitigation processes may be well known. They are all applicable for the crewed CST vehicles as the best practices to consider.

General safety and systems design must provide a mechanism of safety analysis that would address the hazards throughout the entire system's safety life cycle. Issues can arise during the design, development, manufacturing, construction, facilities, transportation, and operations associated with hardware, software, maintenance, operations, and exposure testing to extreme environments. If the system is well implemented, it can quickly identify and mitigate hazards, and thus eliminate or reduce the risk of potential mishaps and accidents.

Flight Crew and Operations Authority

The automated systems impose a requirement to maintain human authority over system goals and their attainment. Authority involves both control over systems and responsibility and accountability for system functioning. Human control over technical systems, including transparency, predictability, and sufficient means of influencing the systems, is considered to be the main prerequisite responsible for accountability issues.

To enhance risk mitigation, there must be an organizational structure that incorporates a just and safe culture.^28–30 This type of culture is a top/down approach; it starts with the executives and transitions through appropriate leadership levels to the operators. Allocation of shared authority and responsibility must be articulated in the documentation that incorporates clear and concise definitions, nomenclature, vocabulary, and, most importantly, instructions that depict those who will be assigned authority, responsibility, and accountability to support sociocognitive stability. ³¹

National Versus International Travel

Mere space travel is not subject to U.S. export control regulations. However, the transfer of a spacecraft or launch vehicle and related technologies to a foreign country, including landing, is considered an export. In addition, payload integration and launch activities and services are subject to the ITAR. Emerging international spaceport operations are outpacing the outdated inflexibility of both the EAR and the ITAR, and a fresh approach to complex international space travel is needed. Therefore, it is recommended to follow the national security requirements and refer to the existing EAR and ITAR legal frameworks that already encompass CST components.