NASA-STD-3001 Technical Brief Mishaps During Entry, Descent and Landing Overview Overview

Executive Summary Re-entry into the Earth’s atmosphere, descent and subsequent landing are a few of the stages in spaceflight that are life-threatening due to the myriad of processes and vehicle reliabilities that must occur in order for the crew to land not only safely, but unharmed. The crew and vehicle are subjected to the vacuum of space, extreme heat, high speeds, g-forces and vibrations. Historically, astronauts have sustained minor injuries, but the loss of life has occurred, let alone came close to occurring in other cases, and it is imperative that these should be lessons in the understanding of vehicle design and protecting the crew within.

STS-107: Rear (L-R) David Brown, Laurel Clark, Michael Anderson, Ilan Ramon; Front (L-R) Rick Husband, Kalpana Chawla, William McCool Soyuz 11: (L-R) Georgi Dobrovolski, Viktor Patsayev and Soyuz 1: Vladimir Komarov Vladislav Volkov

NASA Office of the Chief Health & Medical Officer (OCHMO) 1 This Technical Brief is derived from NASA-STD-3001 and is for reference only. It does not supersede or waive existing Agency, Program, or Contract requirements. 06/12/2020 NASA-STD-3001 Technical Brief Mishaps During Entry, Descent and Landing Background Entry Events Soyuz 11 – June 30, 19711 During separation of the orbital and service modules from the descent module, the pyrotechnic system did not operate as intended. All of the pyrotechnics fired simultaneously rather than the designed sequential firing mode, which was believed to be due to the excessive vibration loads on the vehicle. This caused a pressure equalization seal to open in the descent module at a higher-than-designed altitude, resulting in the rapid depressurization of the crew module. The rapid depress led to loss of consciousness of the crew despite attempts by one of the crew to block the leakage of air from the vehicle. The spacecraft otherwise made a nominal automatic touchdown with no known anomalies at the time of the recovery team.

The lives of Georgi Dobrovolski, Vladislav Volkov, and Viktor Patsayev were lost due to the vacuum experienced.

Contributing factors: • Absence of an open-valve warning system • Absence of an emergency valve-choking system • No structural shock testing performed for a worst-case scenario • Crew were not wearing pressurized suits for re-entry

Relevant Standards Volume 1: 4.4 Medical Diagnosis, Intervention, Treatment, and Care, 4.4.1.1 Astronaut Training Volume 2: [V2 6006] Total Pressure Tolerance Range for Indefinite Crew Exposure, [V2 9055] Protective Equipment Automation, [V2 6007] Rate of Pressure Change, [V2 11032] LEA Suited Decompression Sickness Prevention Capability

Soyuz TMA-11 (15S) – April 19, 2008 During entry, the Soyuz instrumentation and propulsion module (IPM) failed to properly separate from the descent module (DM). This resulted in a ballistic entry, higher g loads during descent, and the spacecraft landing more than 400 km short of the intended target. The abnormal entry attitude(hatch-forward) during early descent caused excessive heating on the hatch and back shell of the descent module. The recovery team's arrival at the landing site was delayed by approximately 45 minutes due to the off-target landing. Yi So- yeon was later hospitalized because of injuries sustained during entry and landing. The South Korean Science Ministry stated that the astronaut had a minor injury to her neck muscles and had bruised her spinal column.

Contributing events: A Russian investigation into the cause of the DM/IPM separation system failure concluded that one of the five pyrotechnically actuated locks, which attach the Soyuz instrumentation and propulsion module to the descent module, failed to release at the proper time.

Relevant Standards Volume 1: 4.4 Medical Diagnosis, Intervention, Treatment, and Care Volume 2: [V2 6064] Sustained Translational Acceleration Limits, [V2 8033] Crew Restraint Provision

1. Decompression Events and LEA Suit Technical Brief

NASA Office of the Chief Health & Medical Officer (OCHMO) 2 This Technical Brief is derived from NASA-STD-3001 and is for reference only. It does not supersede or waive existing Agency, Program, or Contract requirements. 06/12/2020 NASA-STD-3001 Technical Brief Mishaps During Entry, Descent and Landing Background Entry Events

STS-107 – February 1, 20031 Damage to the Thermal Protection System from a debris strike on ascent resulted in the loss of crew and vehicle on entry on February 1, 2003. At 81.7 seconds Mission Elapsed Time a piece of foam insulation from the External Tank (ET) left bipod ramp separated from the ET and struck the orbiter left wing leading edge in the vicinity of the lower half of reinforced carbon-carbon (RCC) panel #8, causing a breach in the RCC. During re-entry this breach allowed super-heated air to penetrate through the leading edge insulation and progressively melt the aluminum structure of the left wing, resulting in a weakening of the structure until increasing aerodynamic forces caused loss of control, failure of the wing, and break-up of the orbiter. This breakup occurred in a flight regime in which, given the design of the orbiter, there was no possibility for the crew to survive. Contributing lethal events: • Depressurization of the crew module, which started at or shortly after orbiter breakup. Existing crew equipment protects for this type of lethal event, but inadequate time existed to configure the equipment for the environment encountered. The crew would have only had about 40 seconds to don gloves and helmets. • The combination of the lack of upper body restraint and a helmet that, by design, does not internally conform to the head while exposed to cyclical motion resulted in lethal mechanical injuries for some of the unconscious or deceased crew members. If the harnesses had been locked or the crew had been conscious and able to brace, the injuries likely would not have been lethal. • Separation from the crew module and the seats with associated forces, material interactions, and thermal consequences. This event is the least understood due to limitations in current knowledge of mechanisms at this Mach number and altitude. Seat restraints played a role in the lethality of this event. Although the seat restraints played a significant role in the lethal-level mechanical injuries, there is currently no full range of equipment to protect for this event. This event was not survivable by any means currently known to the investigative team. • Exposure to near vacuum, aerodynamic accelerations, and cold temperatures. Current crew survival equipment is not certified to protect the crew above 100,000 feet, although it may potentially be capable of protecting the crew. Relevant Standards Volume 2: [V2 3006] Human-Centered Task Analysis, [V2 6006] Total Pressure Tolerance Range for Indefinite Crew Exposure, [V2 6007] Rate of Pressure Change, [V2 6064] Sustained Translational Acceleration Limits, [V2 6065] Rotational Velocity, [V2 6066] Sustained Rotational Acceleration Due to Cross-Coupled Rotation, [V2 6067] Transient Rotational Acceleration, [V2 6069] Acceleration Injury Prevention, [V2 8033] Crew Restraint Provision, [V2 11024] Ability to Work in Suits, [V2 11032] LEA Suited Decompression Sickness Prevention Capability

1. Decompression Events and LEA Suit Technical Brief

NASA Office of the Chief Health & Medical Officer (OCHMO) 3 This Technical Brief is derived from NASA-STD-3001 and is for reference only. It does not supersede or waive existing Agency, Program, or Contract requirements. 06/12/2020 NASA-STD-3001 Technical Brief Mishaps During Entry, Descent and Landing Background Descent Events Apollo ASTP – July 24, 1975

On July 24, 1975 as the spacecraft descended, the commander, who was reading the checklist, failed to tell the command module pilot to move the Earth Landing System auto/manual switch to auto. The crew saw that the spacecraft was well below the deployment altitude and proceeded to manually deploy the chutes. Drogue chutes were deployed manually at 18,550 feet instead of 23,500 feet as the automatic system would have done. At 10,000 feet the commander realized that ELS was not in AUTO and quickly switched ELS Logic and AUTO, deploying the main parachutes at 7,150 feet and disabling the RCS instead of 10,500 feet. The Reaction Control System (RCS) was not disabled manually (RCS command switch turned to “off”) at this time. It was disabled manually at 16,000 feet instead of when the checklist indicated at 24,000 feet, which was due to the alarm noise levels leading to the inability to communicate properly to initiate the command. The cabin pressure relief valve opened automatically at 24,500 feet. During a 30-second period of high thruster activity after drogue parachute deployment, a mixture of air and propellant combustion products followed by a mixture of air and nitrogen tetroxide oxidizer (N2O4) vapors were sucked into the cabin. One of the positive roll thrusters is located only two feet away from the steam vent that pulls in outside air when the cabin relief valve is open. This exposed the crew to a high level of N2O4 since emergency oxygen masks were not available until landing. The pilot passed out, but the commander quickly put the oxygen mask on him and he was revived. The exposure resulted in a two-week hospital stay for the crew after landing.

Contributing factors:

• Failure to follow a time-critical procedure in a tightly coupled system • The noise from an alarm caused communication difficulties between the crew and it could not be confirmed if the switch was thrown • Nitrogen tetroxide (N2O4) flooded the cabin when the cabin pressure relief opened, which was due to the closure of the propellant isolation valves from crew not activating the ELS at the correct altitude – cabin pressure relief valve was located two feet from the positive RCS roll thrusters

Relevant Standards Volume 1: 4.4.3.7 Toxic Exposure Prevention, Protection, and Treatment Volume 2: [V2 3006] Human-Centered Task Analysis, [V2 6081] Alarm Maximum Sound Level Limit, [V2 6025] Contamination Monitoring and Alerting, [V2 6048] Toxic Hazard Level Four, [V2 7055] Priority of Stowage Accessibility, [V2 9053] Protective Equipment, [V2 9055] Protective Equipment Automation, [V2 10109] Automation and Robotics Shut-Down Capabilities, [V2 10002] Crew Interface Effectiveness, [V2 10110] Automation and Robotics Override Capabilities

NASA Office of the Chief Health & Medical Officer (OCHMO) 4 This Technical Brief is derived from NASA-STD-3001 and is for reference only. It does not supersede or waive existing Agency, Program, or Contract requirements. 06/12/2020 NASA-STD-3001 Technical Brief Mishaps During Entry, Descent and Landing Background Landing Events Mercury MR-4 – July 21, 1961

After landing on July 21, 1961 the spacecraft hatch pyrotechnic charges prematurely fired. The crew member was able to escape from the emergency situation, but because of waves flooding the capsule, the capsule sunk. The crew member was nearly drowned. The crew member was rescued after three to four minutes in the water.

Contributing factors: • Hatch opening prematurely without command, which led to the flooding of the cabin prior to the arrival of rescue crew • Water ingress through open valve in suit and though neck dam

Relevant Standards Volume 2: [V2 11001] Suited Donning and Doffing

Additional Recommendations • LEA suit should be able to withstand water ingress in the event of a cabin egress during a water landing. Virgil “Gus” Grissom during recovery following the capsule sinking. Source: NASA Soyuz 1 – April 24, 1967

On April 24, 1967 on the maiden flight of the Russian Soyuz spacecraft, the cosmonaut encountered an anomaly with the parachute system during descent. During the descent the drag chutes successfully deployed, but the main chutes failed to deploy properly. Detecting increasing speeds, the computer deployed a backup parachute. Because the drag chute was still attached and failed to release, the backup chute became tangled with the drag chute, preventing the deployment of the backup chute and resulting in a high-speed impact with the ground. Vladimir Komarov died on Soyuz 1 shortly after impact. Source: impact. RussianSpaceWeb.com

Contributing factors: • Exhaust residue from the attitude control jets fouled the craft's ion orientation sensors, making control difficult • Drag and main parachutes malfunctioned, entangling the backup parachute as it deployed • Underlying issues included manufacturing oversight, external political pressures and inadequate preparation

Relevant Standards Volume 2: [V2 6064] Sustained Translational Acceleration Limits, [V2 10110] Automation and Robotics Override Capabilities

NASA Office of the Chief Health & Medical Officer (OCHMO) 5 This Technical Brief is derived from NASA-STD-3001 and is for reference only. It does not supersede or waive existing Agency, Program, or Contract requirements. 06/12/2020 NASA-STD-3001 Technical Brief Mishaps During Entry, Descent and Landing Background Landing Events Soyuz 5 – January 18, 1969 On January 18, 1969 following retrofire, the explosive volts failed to fire and detach the capsule, which caused the aircraft to be inverted, which left the heat shield pointed in the wrong way. As a result, the heat damage on Soyuz 5 caused the parachute to partially deploy, as well as the soft landing rockets failed to fire, resulting in a harder than normal landing. Because of the force of the impact, Boris Volynov broke several teeth due to the force of being torn from his seat and thrown across the cabin.

As a result of the re-entry, the vehicle landed off-course in the Ural mountain wilderness of near freezing temperatures. Volynov left the vehicle in an attempt to find shelter as he expected a delay in rescue. He was only found due to rescuers following footsteps in the snow and blood spots from when he spit in the snow.

Relevant Standards Volume 1: 4.4.3.9 Medical and Survival Kits Volume 2: [V2 6064] Sustained Translational Acceleration Limits, [V2 8033] Crew Restraint Provision, [V2 10084] Communication Capability

Additional Recommendations • Crew recovery operations should anticipate off-nominal landing in rough terrain or locations that could be inaccessible by vehicle or helicopter.

Soyuz 18-1 (18a) – April 5, 1975 During ascent on April 5, 1975, there was an excessive amount vibration that caused an electrical malfunction in the Soyuz booster prematurely fired two of the four explosive latches holding the core of the first and second stage together. This severed the electrical connections necessary for firing the remaining two latches. When the core first stage burned out it could not be cast off as designed.

Ignition of the second stage occurred normally, but the booster was rapidly dragged off course by the weight of the depleted core first stage. When the course deviation reached 10-degrees, the automatic safety system activated, shutting down the booster and separating the Soyuz capsule from the launch vehicle. At the time of separation, the Soyuz was 180 km high and traveling at 5.5 km per second.

The crew endured a 20+ g re-entry and landed in the Altai Mountains in southern Siberia. The capsule rolled down a snow-covered mountain side, and was caught in bushes just short of a precipice. The parachute snagged on some vegetation. The cosmonauts were able to don their cold-weather clothing and clambered outside waiting an hour in the sub-freezing cold next to the capsule, the crew was discovered by locals speaking Russian. It wasn’t until the next day that the crew were able to be air-lifted out.

One crew member suffered internal injuries from the high-g re-entry and downhill fall and never flew again.

Relevant Standards Volume 1: 4.4.3.9 Medical and Survival Kits Volume 2: [V2 6064] Sustained Translational Acceleration Limits, [V2 8033] Crew Restraint Provision

Additional Recommendations • Crew recovery operations should anticipate off-nominal landing in higher altitudes or locations that could be inaccessible by vehicle or helicopter.

NASA Office of the Chief Health & Medical Officer (OCHMO) 6 This Technical Brief is derived from NASA-STD-3001 and is for reference only. It does not supersede or waive existing Agency, Program, or Contract requirements. 06/12/2020 NASA-STD-3001 Technical Brief Mishaps During Entry, Descent and Landing Background Landing Events Soyuz 23 – October 16, 1976 During the attempted docking with Salyut 5, the vehicle suffered an automatic docking system malfunction during final approach. The cosmonauts were ordered to return to Earth. They had less than 2 days of battery power left and had already missed the landing opportunity for that day, so they powered down systems to conserve power. On October 16, 1976 the Soyuz 23 descent module landed in Lake Tengiz, 2 km from shore. The water caused an electrical short which caused the reserve parachute to deploy. Parachute lines from the main and reserve parachute kept the capsule lying on its side in the water, preventing the hatch from opening and blocking the air vent. Transmission antennas became inoperable due to submersion in the water, and the inner walls of the capsule became covered with ice.

The crew removed their pressure suits during this time to don their flights suits, however this took an hour and a half and required the use of a knife to cut themselves out. Attempts to recover the crew were not only thwarted by the icy waters of the lake, but also the bogs and marshes in the area. Due to the lack of light, the rescue had to be delayed further until daylight, leaving the crew in the capsule for 11 hours since landing. The recovery team concluded the crew was dead due to the lack of communications from the building CO2 in the cabin resulting in a loss of consciousness. They towed Soyuz 23 during recovery (above) and the capsule for 45-minutes back to the shore to await the special team to shortly after recovery (below) from Lake remove the bodies. After eleven hours in the capsule the crew inside finally Tengiz. Sources: SpaceFacts.de and AmericaSpace.com opened the hatch from the inside.

Relevant Standards Volume 1: 4.4.3.9 Medical and Survival Kits Volume 2: [V2 6004] Nominal Vehicle/Habitat Carbon Dioxide Levels, [V2 6011] Post-Landing Relative Humidity, [V2 9053] Protective Equipment, [V2 10084] Communication Capability, [V2 11001] Suited Donning and Doffing Additional Recommendations • Manual parachute release capability • Crew recovery operations should anticipate off-nominal landing in rough terrain or locations that could be inaccessible by vehicle or helicopter.

Soyuz TM-7 – April 27, 1989 On April 27, 1989 a double-impact, “hard landing” resulted in an injury to a crew member's leg. The injury required medical treatment at the landing site. The hard landing has been attributed to gusty winds at the landing site.

Relevant Standards Volume 1: 4.4.3.9 Medical and Survival Kits Volume 2: [V2 6064] Sustained Translational Acceleration Limits, [V2 8033] Crew Restraint Provision

NASA Office of the Chief Health & Medical Officer (OCHMO) 7 This Technical Brief is derived from NASA-STD-3001 and is for reference only. It does not supersede or waive existing Agency, Program, or Contract requirements. 06/12/2020 NASA-STD-3001 Technical Brief Mishaps During Entry, Descent and Landing Application Notes Application Notes

Vehicle design and operations should remember the past and the events that occurred, either leading to the loss of crew or injury. As highlighted in previous examples, there were several events that happened during the most dynamic phases of the mission. A loss of the oxygen and atmosphere, to the ingress of toxic fumes occurred due to an opening in the vehicle, and even an improper parachute deployment. In the most extreme event, the vehicle could break-up during entry leading to a loss of the crew.

In many of the events, they could have been preventable either through risk mitigation or verification testing. The crew may need to have the ability to perform tasks manually when the automatic functions fails, or alternatively, a normally manual function may need to be automatic in the event the crew fail to perform a critical task. However, sometimes it can be as simple as providing quick access to the tools or life-saving equipment to the crew in the vehicle.

There are lessons that can be learned from minor events, as well as repeated ones. We can not assume that an event that regularly happens is without fault or will eventually lead to a failure, loss of vehicle or even the loss of life.

Hanger housing the Columbia recovery during the accident investigation.

NASA Office of the Chief Health & Medical Officer (OCHMO) 8 This Technical Brief is derived from NASA-STD-3001 and is for reference only. It does not supersede or waive existing Agency, Program, or Contract requirements. 06/12/2020 NASA-STD-3001 Technical Brief Mishaps During Entry, Descent and Landing References References

• “A Watery Yarn: The Unlucky Voyage of Soyuz 23 (Part 2).” Ben Evans. AmericaSpace. October 27th, 2013. https://www.americaspace.com/ • “Asynchronicity: The Near Loss of the Apollo-Soyuz Test Project Crew.” NASA Safety Center. August 16, 2016. https://sashare.sp.jsc.nasa.gov/Teams/NASA-STD-3001/TW/RefLib/Apollo/Asynchronicity- The%20Near%20Loss%20of%20the%20ASTP%20Crew.pdf • Columbia Crew Survival Investigation Report. NASA/SP-2008-565. National Aeronautics and Space Administration. http://i.cdn.turner.com/cnn/2008/images/12/30/nasa.shuttle.pt1.pdf • “’Creeping and Unpleasant’: The Near-Space Experience of Soyuz 18A”. Ben Evans. AmericaSpace.com. September 29th, 2013. https://www.americaspace.com/2013/09/29/creeping-and-unpleasant-the-near-space- experience-of-soyuz-18a/ • “Descent into the Void.” System Failure Case Studies. September 2010; Volume 4, Issue 9. https://spaceflight.nasa.gov/outreach/SignificantIncidents/assets/descent-into-the-void.pdf • FLIGHT JOURNAL: The Aviation Adventure - Past, Present, and Future. June 2002 Volume 7, No.3. http://www.jamesoberg.com/062002flightjournalsoyuz5.html • Mercury Project Summary (NASA SP-45). NASA. https://spaceflight.nasa.gov/outreach/SignificantIncidents/assets/1.-project-review.pdf • Mir Hardware Heritage. David S. F. Portree. Johnson Space Center, NASA. March 1995. https://spaceflight.nasa.gov/outreach/SignificantIncidents/assets/mir-hardware-heritage.pdf • Results of the Second US Manned Suborbital Space Flight July 21, 1961. NASA. https://spaceflight.nasa.gov/outreach/SignificantIncidents/assets/results-of-the-second-us-manned-suborbital- flight.pdf • “Secret Space Escapes.” Science Channel. 2015. • Significant Incidents & Close Calls in Human Spaceflight. NASA. 2016. https://spaceflight.nasa.gov/outreach/SignificantIncidents/index.html • “Soyuz 1”. Encyclopedia Astronautica. March 30, 2015. https://spaceflight.nasa.gov/outreach/SignificantIncidents/assets/soyuz-1.pdf • Space Facts. http://www.spacefacts.de/ • Probabilistic Risk Assessment (PRA) on Soyuz Spacecraft as an Assured Crew Return Vehicle (ACRV). NASA. April 8, 1997. • The Crew That Never Came Home: The Misfortunes of Soyuz 11.” Space Safety Magazine. http://www.spacesafetymagazine.com/space-disasters/soyuz-11/crew-home-misfortunes-soyuz-11/ • “Tragic Tangle.” System Failure Case Studies. June 2010; Volume 4, Issue 6. https://spaceflight.nasa.gov/outreach/SignificantIncidents/assets/tragic-tangle.pdf

NASA Office of the Chief Health & Medical Officer (OCHMO) 9 This Technical Brief is derived from NASA-STD-3001 and is for reference only. It does not supersede or waive existing Agency, Program, or Contract requirements. 06/12/2020 NASA-STD-3001 Technical Brief Mishaps During Entry, Descent and Landing

Back-Up

NASA Office of the Chief Health & Medical Officer (OCHMO) 10 This Technical Brief is derived from NASA-STD-3001 and is for reference only. It does not supersede or waive existing Agency, Program, or Contract requirements. 06/12/2020 NASA-STD-3001 Technical Brief Mishaps During Entry, Descent and Landing Referenced Standards Volume 1 • 4.4 Medical Diagnosis, Intervention, Treatment, and Care a. Medical diagnosis, intervention, treatment, and care for illness and injury shall be available to all crewmembers. b. Care on Earth shall be in accordance with current U.S. medical standards and managed by the Flight Medicine Clinic (FMC). c. Medical intervention and care for assigned crews shall be managed by the assigned flight surgeons. d. In-flight medical intervention and care shall be available to all crewmembers and shall be provided as close to current U.S. medical standards as the program and mission allow. e. The level of in-flight medical intervention and care to be provided for assigned crews shall be as described under the levels of care in section 4.1 of this Standard. • 4.4.1.1 Astronaut Training a. Beginning with the astronaut candidate year, general medical training shall be provided to the astronaut corps. b. Topics such as first aid, cardiopulmonary resuscitation (CPR), altitude physiological training, carbon dioxide exposure training, familiarization with medical issues, procedures of space flight, and psychological training shall be addressed. c. Supervised physical conditioning training shall be available. • 4.4.3.7 Toxic Exposure Prevention, Protection, and Treatment a. Engineering controls shall be used when possible as the first line in personal protection of crew. b. Personal Protective Equipment (PPE) and treatment of crewmembers subject to potential toxic exposure shall be part of in-flight medical intervention and care during all space missions. • 4.4.3.9 Medical and Survival Kits Requirements for vehicle medical kits (routine and survival) shall be documented in the Program MORD and be consistent with the capabilities described in the Program Health Care Concept of Operations.

NASA Office of the Chief Health & Medical Officer (OCHMO) 11 This Technical Brief is derived from NASA-STD-3001 and is for reference only. It does not supersede or waive existing Agency, Program, or Contract requirements. 06/12/2020 NASA-STD-3001 Technical Brief Mishaps During Entry, Descent and Landing Referenced Standards Volume 2 • [V2 3006] Each human spaceflight program or project shall perform a task analysis to support hardware and operations design. [Rationale: A detailed task analysis of crew required activities is required to determine appropriate human spacecraft designs and layout along with the appropriate operational activities. This task analysis is utilized by numerous other standards such as net habitable volume, cognitive workload, situational awareness, display design, information management, EVA suit mobility, etc.] • [V2 6004] The system shall limit the average 1-hour CO2 partial pressure (ppCO2) in the habitat volume to no more than 3 mmHg (760 mmHg cabin pressure). [Rationale: Achieving this level is dependent on individual and total crew generation of CO2 for all planned activities (factoring in metabolic rates and respiratory quotient) appropriate CO2 scrubbing and adequate ventilation flow rates to ensure that no localized pockets of CO2 are generated throughout the habitat. Note: Off-nominal CO2 values are not included within this NASA Technical Standard due to the unique circumstances of each mission (expected human performance, duration of exposure, access to medical care, etc.) and will be derived as a lower level program/project requirement.] • [V2 6006] The system shall maintain the pressure to which the crew is exposed to between 26.2 kPa < pressure ≤ 103 kPa (3.8 psia < pressure ≤ 15.0 psia) for indefinite human exposure without measurable impairments to health or performance. [Rationale: Designers and physiologists have to evaluate and trade off the various atmospheric combinations. A low total pressure is desirable because it allows simple transfer to a low pressure EVA suit. (Low pressure EVA suits are less stiff and allow greater range of motion). Low total pressure requires a higher percentage of oxygen in the atmosphere to provide an acceptable ppO2. Oxygen-rich atmospheres, however, present safety hazards because of their ability to feed fires. The lowest pressure at which normoxia (PIO2 = 149 mmHg) is maintained at 100% O2 is 3.8 psia. Total pressure has to be considered in conjunction with O2 and CO2 requirements. Under certain spacesuit operations (e.g., DCS treatment, leak checks), the crewmember may be exposed to pressure above or below this range for a limited period of time.] • [V2 6007] The rate of change of total internal vehicle pressure shall not exceed 13.5 psi/min. [Rationale: The rate of change of pressure is to be limited to prevent injury to crewmembers’ ears and lungs during depressurization and repressurization. The positive rate of change limit is designed to prevent barotraumas in spaceflight conditions, where microgravity may have affected head and sinus congestion, and is therefore much more conservative than the 30 psi/min (1550 mmHg/min) (75 ft/min) descent rate limit allowed by the U.S. Navy dive manual. The negative rate of change limit is consistent with the U.S. Navy dive manual 13.5 psi/min (700 mmHg/min) (30 ft/min) ascent rate allowance.] • [V2 6011] For nominal post-landing operations, the system shall limit RH to the levels in Table 2, Average Relative Humidity Exposure Limits for Post-Landing Operations. [Rationale: Average humidity is to be maintained above the lower limits stated to ensure that the environment is not too dry for the nominal functioning of mucous membranes. During low humidity exposures, additional water is to be provided to the crew to prevented hydration. Humidity is to be maintained below the upper limits for crew comfort to allow for effective evaporation and to limit the formation of condensation. In unsuited scenarios, high RH may interfere with the nominal evaporation process that enables perspiration to cool the body. Thus, high RH in warm environments can pose an additional hazard for core body temperature excess.]

NASA Office of the Chief Health & Medical Officer (OCHMO) 12 This Technical Brief is derived from NASA-STD-3001 and is for reference only. It does not supersede or waive existing Agency, Program, or Contract requirements. 06/12/2020 NASA-STD-3001 Technical Brief Mishaps During Entry, Descent and Landing Referenced Standards Volume 2

• [V2 6025] The system shall monitor and display atmospheric compound levels that result from contamination events, e.g., toxic release, systems leaks, or externally originated, before, during, and after an event and alert the crew in sufficient time for them to take appropriate action. [Rationale: Alerting the crew when contaminants are present is necessary for them to take appropriate action to maintain health and safety. In addition, monitoring after the event is important to verify that levels are safe for human exposure. Monitoring is required to identify when components are detected so that alerting can occur. Potential contaminants, e.g., hydrazine, monomethylhydrazine (MMH), nitrogen tetroxide/nitrogen dioxide and ammonia, need to be monitored after EVA.] • [V2 6048] The system shall prevent Toxic Hazard Level Four chemicals, as defined in JSC-26895, from entering the habitable volume of the spacecraft. [Rationale: Toxic Hazard Level Four compounds cannot be cleaned up by the crew and pose a risk of permanent injury or worse.] • [V2 6064] The system shall limit the magnitude, direction, and duration of crew exposure to sustained (>0.5 seconds) translational acceleration by staying below the limits in Figure 3, +Gx Sustained Translational Acceleration Limits; Figure 4, -Gx Sustained Translational Acceleration Limits; Figure 5, Ascent and Ascent Aborts +Gz Sustained Translational Acceleration Limits; Figure 6, Return to Earth +Gz Sustained Translational Acceleration Limits; and Figure 7, ±Gy Sustained Translational Acceleration Limits. [Rationale: The limits in these figures represent safe levels of sustained translational acceleration under nominal and off-nominal conditions. Exposure to acceleration above these limits could significantly affect human performance for maneuvering and interacting with a spacecraft. The limits for return to Earth are lower than launch limits because crewmembers could have degraded capabilities because of deconditioning from exposure to reduced gravity. For the extreme conditions of a launch abort or emergency entry, limits are higher because it may be necessary to expose the crew to accelerations more severe than those experienced nominally. Humans are never to be exposed to translational acceleration rates greater than these elevated limits, as this significantly increases the risk of incapacitation, thereby threatening crew survival. In using Figures 3 through 7, the acceleration vectors are relative to the “axis” of the upper body, particularly with a focus on a line running from the eye to the heart. However, the acceleration limit charts do not account for all body types or temporary off-axis accelerations or body positions. This is why the limits are set conservatively. Therefore, brief excursions past the limits in one axis should be reviewed and may be found to be acceptable.] • [V2 6065] The system shall limit crew exposure to rotational velocities in yaw, pitch, and roll by staying below the limits specified in Figure 8, Rotational Velocity Limits. [Rationale: The limits in this figure represent safe levels of sustained rotational acceleration for crewmembers under nominal and off-nominal conditions. Exposure to rotational acceleration above these limits could significantly affect human performance for maneuvering and interacting with a spacecraft. The limits for return to Earth are lower than launch limits because crewmembers could have degraded capabilities because of deconditioning from exposure to reduced gravity. For the extreme conditions of a launch abort or emergency entry, limits are higher because it may be necessary to expose the crew to accelerations more severe than those experienced nominally. Humans are never to be exposed to rotational acceleration rates greater than these elevated limits as this significantly increases the risk of incapacitation, thereby threatening crew survival.] • [V2 6066] The system shall prevent the crew exposure to sustained (>0.5 second) rotational accelerations caused by cross-coupled rotations greater than 2 rad/s2. [Rationale: Crewmembers are not expected to be able to tolerate sustained cross-coupled rotational accelerations (simultaneous rotations about two different axes) in excess of 2 rad/s2 without significant discomfort and disorientation. Sustained cross-coupled rotational accelerations exceeding this amount have been found to significantly impact human performance and autonomic function (e.g., nausea, dizziness, and disorientation; degradations in neurovestibular and sensorimotor performance, physical reach, and cognition), potentially for an extended period of time after exposure. Note that rotational acceleration due to cross-coupled rotation can be computed for rotational velocity components represented in any vehicle- or head-referenced coordinate frame. Ideally, rotational velocities should be decomposed into their orthogonal principal components before computing the acceleration due to cross-product terms. For scientific references regarding this subject, see chapter 6, Natural and Induced Environments, of the HIDH.] • [V2 6067] The system shall limit transient (≤0.5 seconds) rotational accelerations in yaw, pitch, or roll to which the crew is exposed and the limit used appropriately scaled for each crewmember size from the 50th percentile male limits of 2,200 rad/s2 for nominal and 3,800 rad/s2 for off-nominal cases. [Rationale: Crewmembers are not expected to be able to tolerate sustained rotational accelerations in excess of 2,200 rad/s2 for nominal and 3,800 rad/s2 for off nominal cases. This could occur as a result of an impact, whereby brief, high-magnitude rotational accelerations are imparted to the crew. These values relate to a risk of 5% or 19% risk of brain injury, respectively, for a 50th percentile male. These values should be appropriately scaled to other crewmember sizes as needed. For additional information scaling these limts, see Petitjean, A., et al. (2015). Normalization and Scaling for Human Response Corridors and Development of Injury Risk Curves. Accidental Injury: Biomechanics and Prevention. N. Yoganadan, A. Nahum and J. Melvin. New York, Springer Science+Business Media: 769-792.]

NASA Office of the Chief Health & Medical Officer (OCHMO) 13 This Technical Brief is derived from NASA-STD-3001 and is for reference only. It does not supersede or waive existing Agency, Program, or Contract requirements. 06/12/2020 NASA-STD-3001 Technical Brief Mishaps During Entry, Descent and Landing Referenced Standards Volume 2

• [V2 6069] The system shall mitigate the risk of injury to crewmembers caused by accelerations during dynamic mission phases per Table 4, Acceptable Injury Risk Due to Dynamic Loads. [Rationale: During dynamic flight phases, there is potential for impact and flail injury, which includes crewmember extremities impacting vehicular surfaces or objects, hyperextending, hyperflexing, hyper-rotating, fracturing, or dislocating if proper restraints and supports are not used. Features such as harnesses, form-fitting seats, and tethers may help maintain the proper position of the crewmember's body and limbs to reduce movement or contact with vehicle surfaces that would produce injury. In addition, the design of spacesuits may contribute to reducing injury to the crew. Preventing the inadvertent contact of extremities with vehicular structure or interior components significantly reduces the likelihood of limb fracture or soft tissue injury during a dynamic flight event. Extremity guards, tethers, garters, and hand holds have been used to reduce injury in other spacecraft, aircraft, and automotive vehicles. Injury classifications are based on the Operationally Relevant Injury Scale defined in NASA/TP-2015- 218578, Final NASA Panel Recommendations for Definition of Acceptable Risk of Injury due to Spaceflight Dynamic Events. Occurrence of dynamic cases identified in Table 4 are based on statistical modeling of possible dynamic events. See NASA/TP-2015-218578 for more information.] • [V2 6081] The maximum alarm signal A-weighted sound level shall not exceed 95 dBA at the operating position of the intended receiver. [Rationale: This allows alarm sound levels to exceed the 85-dBA hazard limit because of the need for alarm audibility. Also, alarms can be silenced at the crew’s discretion.] • [V2 7043] A medical system shall be provided to the crew to meet the medical requirements of NASA-STD-3001, Volume 1, in accordance with Table 15, Medical Care Capabilities. [Rationale: NASA-STD-3001, Volume 1, includes definitions of the levels of medical care required to reduce the risk that exploration missions are impacted by crew medical issues and that long-term astronaut health risks are managed within acceptable limits. The levels of care and associated appendices define the health care, crew protection, and maintenance capability required to support the crew as appropriate for the specific mission destination and duration, as well as for the associated vehicular constraints. As mission duration and complexity increase, the capability required to prevent and manage medical contingencies correspondingly increases. Very short-duration missions, even if outside low Earth orbit (LEO) are considered as Level I capability medical requirements. The ability to provide the designated level of care applies to all flight phases, including during pressurized suited operations.] • [V2 7055] Stowage items shall be accessible in accordance with their use, with the easiest accessibility for mission-critical and most frequently used items. [Rationale: Items should be stowed to promote efficient retrieval and operations.] • [V2 8033] Crew restraints shall be provided to assist in the maintaining of body position and location in reduced gravity conditions or during high accelerations. [Rationale: Maintaining a static position and orientation at a workstation is necessary to ensure that controls can be activated without motion being imparted to the crewmember. Without gravity to hold an individual onto a standing or sitting surface, the body floats or moves in the opposite direction of an applied force. The cognitive and physical work required to maintain body position during a task can interfere with the task performance. Activities that use both hands are not to require handholds to maintain position at a workstation but may require restraints such as foot loops, straps, or harnesses. Restraints/orientation of equipment utilized during crew tasks also need to be considered when designing crew restraints .] • [V2 9053] Protective equipment shall be provided to protect the crew from expected hazards. [Rationale: Analyses are to define anticipated hazards and appropriate protective equipment. Protective equipment might include gloves, respirators, goggles, and pressure suits. The equipment is to fit the full range of crewmembers. This might require adjustable gear or multiple sizes (with consideration of the number of crewmembers that may have to use the equipment at the same time.) Because the gear could be used under emergency conditions, it is to be located so that it is easily accessed and is to be simple to adjust and don.] • [V2 9055] Automation of protective equipment shall be provided when the crew cannot perform assigned tasks. [Rationale: The crew may need to perform tasks to activate protective equipment operation or to activate rescue aids. If these tasks are to be performed under emergency or stressful conditions (where the crewmember is distracted or disabled), then the tasks are to be automated. An example of an automatically activated protective system is the automatic parachute release device. The emergency locator transmitter in an airplane is an example of an automatically activated rescue system.]

NASA Office of the Chief Health & Medical Officer (OCHMO) 14 This Technical Brief is derived from NASA-STD-3001 and is for reference only. It does not supersede or waive existing Agency, Program, or Contract requirements. 06/12/2020 NASA-STD-3001 Technical Brief Mishaps During Entry, Descent and Landing Referenced Standards Volume 2

• [V2 10002] The system shall provide crew interfaces that enable the crew to perform their tasks effectively, e.g., within acceptable error limits and scheduled operating times. [Rationale: For optimal safety and productivity, crew interfaces are to support crew performance effectively with minimal errors. Errors are defined as an action that is not intended or desired by the person or a failure on the part of the person to perform a prescribed action within specified limits of accuracy, sequence, or time that does not produce the expected result and has led or has the potential to lead to an unwanted consequence. Usability errors include missed or incorrect inputs or selections, navigation errors, loss of SA, and inability to complete a task. The usability error rate is to be computed as a percentage and is to be calculated from the ratio of the number of task steps performed erroneously to the number of total task steps. A minimal impact error is defined as an error that does not result in a change to the system state, like vehicle or mission-critical robotics. Each program needs to define acceptable error limits and operating times based on detailed task analysis.] • [V2 10084] The system shall provide the capability to send and receive communication among crewmembers, spacecraft systems, and ground systems to support crew performance, behavioral health, and safety. [Rationale: Communication capabilities are necessary to enable information exchange in order to accomplish tasks efficiently, to maintain crew physical and behavioral health, and to ensure crew safety. The capability to send and receive information among crew (intravehicular activity (IVA) and EVA), Earth-based mission control, orbiting vehicles, planetary habitats, rovers, robotic systems, and other systems is to be supported as required by the task analysis for the particular Design Reference Mission (DRM). Communications can include voice, text, video, telemetry, and other formats, depending on the needs as determined by a task analysis.] • [V2 11001] The system shall accommodate efficient and effective donning and doffing of spacesuits for both nominal and contingency operations. [Rationale: Spacesuit donning and doffing is a non-productive activity. Plus, tedious and difficult tasks are more prone to neglect and human error. Finally, rapid donning can be critical in an emergency. System developers need to consider total system design and human accommodation, including emergency scenarios, assess donning task times, and evaluate features such as unassisted donning.] • [V2 11024] Suits shall provide mobility, dexterity, and tactility to enable the crewmember to accomplish suited tasks within acceptable physical workload and fatigue limits while minimizing the risk of injury] Automation of protective equipment shall be provided when the crew cannot perform assigned tasks. [Rationale: Suited crewmembers are to be able to perform tasks required to meet mission goals and operate human-system interfaces required for use during suited operations. Suits can limit the crew mobility, dexterity, and tactility below that of unsuited crew. Suit pressurization can further reduce crew capabilities.] • [V2 11032] LEA spacesuits shall be capable of a minimum of 40 kPa (5.8 psia) operating pressure to protect against Type II decompression sickness in the event of a cabin depressurization. [Rationale: LEA spacesuits are worn inside spacecraft to protect crewmembers in the event of contingencies such as contamination or depressurization of the spacecraft cabin. Protection against serious life-threatening (Type II) DCS in the event of an unplanned rapid cabin depressurization depends on providing adequate suit pressure to crewmembers because there is no opportunity for oxygen prebreathe or immediate post-event treatment. Based on best available data and computational models, LEA spacesuit pressure of 40 kPa (5.8 psia) will limit the probability of Type II DCS occurrence to less than 15% for a rapid depressurization.]

NASA Office of the Chief Health & Medical Officer (OCHMO) 15 This Technical Brief is derived from NASA-STD-3001 and is for reference only. It does not supersede or waive existing Agency, Program, or Contract requirements. 06/12/2020