NASA Procedures and Guidelines
This Document is Obsolete and Is No Longer Used. Check the NODIS Library to access the current version: http://nodis3.gsfc.nasa.gov
NPR 8705.2B Eff. Date: May 06, 2008 Cancellation Date:	Human-Rating Requirements for Space Systems (w/change 4 dated 8/21/2012)
| TOC | ChangeHistory | Preface | Chapter1 | Chapter2 | Chapter3 | AppendixA | AppendixB | AppendixC | AppendixD | AppendixF | AppendixE | ALL |

Chapter 1. Human-Rating Certification Process

1.1 Introduction

1.1.1 NASA's policy is to protect the health and safety of humans involved in or exposed to space activities, specifically the public, crew, passengers, and ground personnel. This policy is implemented through the application of NASA Directives and Standards. The following abbreviated documentation tree (Figure 1) shows where the health, safety, and engineering directives and standards exist in relationship to Agency Program management directives and standards. (Refer to http://www.hq.nasa.gov/office/codeq/doctree/qdoc.htm for a more extensive documentation tree.) This depiction also corresponds to the overall governance structure that establishes checks and balances between Programs and the three Technical Authorities of Engineering, Health and Medical, and Safety and Mission Assurance. This NPR contains requirements under the collective jurisdiction of the three Technical Authorities; however, for administrative purposes it is located within the Safety and Mission Assurance Directives block of Figure 1.

Figure 1 - Agency Requirements Framework Related to Human Rating

1.1.2 The significant monetary investment for complex space hardware requires all missions to meet high standards of public safety, reliability, and mission success. The purpose of this NPR is to define and implement processes, procedures, and requirements necessary to produce human-rated space systems that protect the safety of crew members and passengers on NASA space missions. Human-rating further requires implementation of requirements contained in NASA directives that are mandatory for any high value/high-priority space flight program or project conducted by or for NASA, as well as those standards designated as mandatory by the Office of the Chief Engineer (https://nen.nasa.gov/web/oce/standards), Office of Safety and Mission Assurance (http://www.hq.nasa.gov/office/codeq/doctree/doctreec.htm), and the Office of the Chief Health and Medical Officer (http://www.nasa.gov/offices/ochmo/policy_stds/index.html). In addition, and as part of the human rating process defined in this NPR, Technical Authorities may impose other standards as appropriate to the design concept and its mission on a case-by-case basis. The following diagram (Figure 2) illustrates how this NPR integrates with other NASA directives to provide direction for the Program Manager.

Figure 2 - Relationship Among Requirements

1.1.3 It is impossible to develop a set of Agency-level technical requirements that will definitively result in the development of safe systems for all human space missions. Compliance with directives and standards can provide the framework for safety; however, the Program Manager is responsible for providing safe and reliable systems for human missions. The Technical Authorities provide the necessary checks and balances to assure safe and reliable systems. Throughout the design and development process, the program management is responsible for making the decisions that assure the system works, is safe, and is affordable. The Technical Authorities challenge the developers to describe the rationale for their design decisions and help identify hazards and safer alternatives. Recognizing that a certain level of risk needs to be accepted to conduct human spaceflight, this process is guided by Administrator-approved safety goals and thresholds defining long-term targeted and maximum tolerable levels of risk (minimum tolerable level of safety). These are specified at the system-level rather than at the local level and are expressed in terms of metrics such as the probability of a loss of crew. Safety goals and thresholds must match the type of mission being conducted and are used in addition to other safety criteria, such as the requirement for the system to be failure tolerant and provide crew escape and survival capabilities, to result in a human-rated system. This NPR contains a Human-Rating Certification process to help the Program Manager and the Technical Authorities maintain the focus of the entire development and operation team on crew safety. This NPR also contains a set of technical requirements that establish a benchmark of capabilities for Human-Rated systems. These technical requirements should not be interpreted as all inclusive or absolute. The Program Manager is expected to evaluate the intent of these technical requirements and use the talents of the development and operation team to design the safest practical system that accomplishes the mission within constraints. By doing so, the program is expected to arrive at an optimal solution that represents the best overall value considering cost, schedule, performance, and safety.

Above all, human-rating is more than a set of requirements, a process, or a certification - it involves a mindset, instilled by leadership, where each person feels personally responsible for their piece of the design and for the safety of the crew.

1.2 Definition of Human-Rating

1.2.1 In order to understand human-rating, the following question must be answered: "What is fundamentally different about developing and certifying systems to take humans into space as compared to a multibillion dollar, one of a kind, robotic payload?"

1.2.2 This question has been answered several times over the last 45 years in the development of Mercury, Gemini, Apollo, Skylab, Space Shuttle, and the ISS systems. Lessons learned from these programs lead to the following definitions of human-rated systems and human-rating for this NPR:

1.2.2.1 Tenet 1 of the definition describes the additional rigor and scrutiny involved in the design, development, certification, and operation of human-rated space systems. Designing a space system, with constraints of mass and volume, often requires compromise to reach a design that can perform the mission, including the safe return of the crew and passengers. In many respects, systems engineering is about managing compromise. The risks associated with each decision must be understood and carefully considered. Throughout the design and development process, the engineering, safety, and health and medical disciplines external to the program must constantly challenge the developers to articulate the rationale for their design decisions. Once the system is developed and deployed, additional rigor and scrutiny are applied at every mission readiness review. Development and operation teams continually look for ways to reduce the potential for uncontrolled hazards by exploring potential risks and uncertainties. Reducing the uncertainties in the design and operations, exploring all safety risks, and recognizing the potential for hazards obscured by system complexity are all part of a human-rating mindset.

1.2.2.2 Tenet 2 of the definition accounts directly for the presence of humans in the spacecraft or space system. In addition to providing for the basic human needs such as environment, food, and water, the astronauts onboard the spacecraft must be given some level of control over the system. This tenet acknowledges two primary reasons for human control of the space system - improving safety and accomplishing the mission.

1.2.2.3 Tenet 3 of the definition recognizes that the human exploration of space involves inherent risk and, despite our best efforts, unanticipated and unexpected hazards may occur. When developing spacecraft to carry humans, the design team incorporates capabilities and safeguards that allow for the safe return of the crew after system failures prevent mission continuation. Additionally, whenever practical, the system provides capabilities for the crew to survive potentially catastrophic hazards, catastrophic events, and emergency situations.

1.3 Overview of the Human-Rating Certification Process

1.3.1 The Human-Rating Certification Process is based on the certification requirements in Chapter 2 of this NPR. These certification requirements lead the Program Manager through specific aspects of human-rating and document the results in a Human-Rating Certification Package (HRCP) that is summarized in Appendix D. The HRCP contains the relevant information for the Human-Rating Certification decision. Since human-rating is a broad topic, the certification requirements were derived from specific aspects of the human-rating definition in paragraph 1.2 of this NPR. The Human-Rating Certification focuses primarily on the integration of the human into the system and preventing catastrophic events during the mission that affect the safety of the crew and passengers. The key certification elements documented in the HRCP are:

a. The definition of reference missions for certification.

b. The incorporation of system capabilities to implement crew survival strategies for each phase of the reference missions.

c. The implementation of capabilities from the applicable technical requirements in Chapter 3 of this NPR.

d. The utilization of safety analyses to influence system development and design.

e. The integration of the human into the system and human error management.

f. The verification, validation, and testing of critical system performance.

g. The flight test program and test objectives.

h. The system configuration management and related maintenance of the Human-Rating Certification.

1.3.2 The Human-Rating Certification Process is linked to five major program milestones : SRR, SDR, PDR, CDR, and ORR. The program's compliance with the human-rating requirements and the contents of the HRCP are endorsed and approved by all three Technical Authorities (Safety, Engineering, and Health and Medical) at each of the five milestones.¹ The Director, Johnson Space Center (JSC) also endorses and approves the HRCP from a crew risk perspective at each of the five milestones. If one or more of the Technical Authorities or the Director, JSC do not approve the contents of the HRCP at a milestone, the difference of opinion is elevated to the NASA Administrator as the authority for human-rating for disposition. Thus, the Program Manager will be able to ensure satisfactory progress toward the Human-Rating Certification. Appendix D contains the detailed listing of the HRCP contents at the five program milestones. After ORR, the Program Manager submits the HRCP and the request for Human-Rating Certification, with the required endorsements, to the NASA Administrator. After system acceptance, and for the life of the program, the Program Manager and Technical Authorities review the human-rating as part of each flight/mission readiness review.

¹ In addition to the review and endorsement of the HRCP at these milestones, a summary of the status of Human-Rating activities is provided at the SIR, highlighting any significant changes that have occurred since CDR.

1.4 Roles and Responsibilities

The following paragraphs define the broad roles and responsibilities related to Human-Rating Certification. Delegation of authority and responsibility outlined in this section is at the discretion of each official. However, in all cases, accountability remains at the highest level.

1.4.1 The NASA Administrator is the authority for human-rating and is responsible for certifying systems as human-rated. In this capacity, the Administrator shall:

a. Establish the Agency's risk tolerance by approving safety goals, safety thresholds, and associated rationale for a specified type of mission at or prior to Program initiation (Requirement).

Note: Agency-level safety goals and thresholds define long-term targeted and maximum tolerable levels of risk to the crew as guidance to developers in evaluating “how safe is safe enough” for a given type of mission. Goals and thresholds are specified at the system-level, rather than at the local (e.g., individual hazard) level, and are expressed in terms of an aggregate measure of risk such as the probability of a loss of crew. Additional goals and thresholds may be set for mission phases, though they should generally be independent of the crewed space system’s architecture. The specification can be qualitative or quantitative (probabilistic) in nature. Qualitative statements take the form of a comparison to known benchmarks such as an existing system (e.g., "better than Space Shuttle") such that they can be more easily communicated to internal and external stakeholders.

Safety thresholds specify the minimum tolerable/allowable level of crew safety (maximum tolerable level of risk) for the design in the context of its design reference mission. Safety thresholds are to be used by the Agency as criteria for program acquisition decisions. Compliance is verified at program milestones and is an input to the programmatic key decision points defined in NPR 7120.5, NASA Space Flight Program and Project Management Requirements. Thresholds are not meant to be used as a flight readiness requirement or as part of a certification of flight readiness for first flight or for engineering or developmental test flights, human-occupied or not. Thresholds are defined for both one-time and repeated missions. Safety goals specify the level of safety that is considered acceptable for repeated missions and serve as the long-term target for proactive safety upgrade and improvement programs (see paragraph 1.4.7.g). The concept of a safety goal and accompanying requirement to implement a safety upgrade and improvement program is motivated by the fact that the level of risk associated with initially flown designs is typically unacceptable in the long term and the fact that human spaceflight programs, informed by flight experience and analysis, can achieve significant reductions of risk over the life of a program.

b. Make the determination to certify a system as human-rated (Requirement 58287).

c. Disposition requests for exceptions and waivers to this NPR that are appealed to the NASA Associate Administrator (Requirement 58288).

1.4.2 The NASA Associate Administrator is the Chair of the Program Management Council and is responsible for making recommendations to the Administrator regarding human-rating. In this capacity, the NASA Associate Administrator shall:

a. Propose, with support from the Chief, Safety and Mission Assurance, the Chief Engineer, the Chief Health and Medical Officer, the responsible Mission Directorate, and the flight crews through the Director, JSC, safety goals, safety thresholds, and associated rationale for approval by the Administrator (Requirement).

b. Revalidate the safety goals, safety thresholds, and associated rationale at PDR and any other time during the acquisition process when changes to mission, environment, or assumptions call for an adjustment of the probabilistic safety requirements at the program level or when a safety goal is met (Requirement).

Rationale: Safety goals and thresholds are revalidated at specific points in the program life cycle to ensure they remain consistent with stakeholders'expectations in light of changing conditions or updated states of knowledge.

c. Endorse requests to certify a system as human-rated.

1.4.3 The Chief, Safety and Mission Assurance, is the Technical Authority for Safety and Mission Assurance and is responsible for assuring the implementation of safety-related aspects of human-rating. The Chief, Safety and Mission Assurance, shall:

a. Prior to SRR, designate the mandatory safety standards and any relevant safety topic areas that require program-level standards (Requirement 58290).

Rationale: It is the Safety and Mission Assurance Technical Authority's responsibility to mandate the standards to be used by the program and approve the additional standards selected for use by the program. It is also incumbent on the Safety and Mission Assurance Technical Authority to inform the program of additional relevant topic areas that require program-level standards. The applicable standards in this NPR are those which the Technical Authorities have deemed mandatory for all human-rated systems. Depending on the type of system being human-rated, it is expected that the Safety and Mission Assurance Technical Authority will mandate additional standards for Human-Rating Certification. Standards may be mandated through NASA directives or other written directives to the program.

b. Obtain the required endorsements and approval of the safety goals, safety thresholds, and associated rationale (Requirement).

c. Determine the acceptability of the system for Human-Rating Certification (Requirement 58292).

Rationale: Designation of acceptability for Human-Rating Certification is accomplished by concurring on the Program Manager's Request for Human-Rating Certification.

d. Determine the acceptability of the individual products documented in the HRCP (Requirement 58294).

Rationale: Designation of acceptability is accomplished by endorsing the HRCP at program milestones.

e. Disposition requests for exceptions and waivers to the requirements in this NPR, subject to concurrence from the Engineering and Health and Medical Technical Authorities (Requirement 58296).

Rationale: The NASA Governance Model emphasizes having a single manager responsible for making and executing decisions, the Chief, Safety and Mission Assurance as the Responsible Office for this NPR dispositions requests for exceptions and waivers. Since many of the requirements within this NPR cross Technical Authority boundaries, dispositions are subject to concurrence by the Engineering and the Health and Medical Technical Authorities as indicated in paragraphs 1.4.4 and 1.4.5.

f. Determine the validity of the Human-Rating Certification for each mission/flight per the certification requirements of this NPR (Requirement 58298).

Rationale: The Human-Rating Certification is reviewed as part of every flight/mission certification. The specific criteria to be reviewed are contained in paragraphs 2.6.3 and 2.6.4. The determination of validity is made by concurring or nonconcurring with flight/mission certification.

a. Prior to SRR, designate the mandatory engineering standards and the relevant engineering topic areas that require program-level standards (Requirement 58301).

Rationale: It is the Engineering Technical Authority's responsibility to mandate the standards to be used by the program and approve the additional standards selected for use by the program. It is also incumbent on the Engineering Technical Authority to inform the program of additional topic areas that require program-level standards. The applicable standards in this NPR are those which the Technical Authorities have deemed mandatory for all human-rated systems. Depending on the type of system being human-rated, it is expected that the Engineering Technical Authority will mandate additional standards for Human-Rating Certification. Standards may be mandated through NASA directives or other written directives to the program.

b. Determine the acceptability of the system for Human-Rating Certification (Requirement 58303).

Rationale: Designation of acceptability for Human-Rating Certification is accomplished by concurring on the Program Manager's Request for Human-Rating Certification.

c. Determine the acceptability of the individual products documented in the HRCP (Requirement 58305).

Rationale: Designation of acceptability is accomplished by endorsing the HRCP at program milestones.

d. Determine the acceptability of requests for exceptions and waivers to the requirements in this NPR (Requirement 58307).

Rationale: Determination of acceptability is made by concurring or nonconcurring on the request.

e. Determine the validity of the Human-Rating Certification for each mission/flight per the Certification Requirements of this NPR (Requirement 58312).

Rationale: The Human-Rating Certification is reviewed as part of every flight/mission certification. Sincd many of the requirements within this NPR cross Technical Authority boundaries, dispositions are subject to concurrence by the Engineering and the Health and Medical Technical Authorities as indicted in paragraphs 1.4.4 and 1.4.5. The determination of validity is made by concurring with flight/mission certification.

1.4.5 The Chief Health and Medical Officer is the Technical Authority for Health and Medical and is responsible for assuring the implementation of health and medical related aspects of human-rating. The Chief Health and Medical Officer shall:

a. Prior to SRR, designate the mandatory health and medical standards and the relevant health and medical topic areas that require 'program level' standards (Requirement 58312).

Rationale: It is the Health and Medical Technical Authority's responsibility to mandate standards to be used by the program and approve the additional standards selected for use by the program. It is also incumbent on the Health and Medical Technical Authority to inform the program of additional topic areas that require program-level standards. The applicable standards in this NPR are those which the Technical Authorities have deemed mandatory for all human-rated systems. Depending on the type of system being human-rated, it is expected that the Health and Medical Technical Authority will mandate additional standards for Human-Rating Certification. Standards may be mandated through NASA directives or other written directives to the program.

b. Determine the acceptability of the system for Human-Rating Certification (Requirement 58314).

Rationale: Designation of acceptability for Human-Rating Certification is accomplished by concurring on the Program Manager's Request for Human-Rating Certification.

c. Determine the acceptability of the individual products documented in the HRCP (Requirement 58316).

Rationale: Designation of acceptability is accomplished by endorsing the HRCP at program milestones.

d. Determine the acceptability of requests for exceptions and waivers to the requirements in this NPR (Requirement 58318).

Rationale: Determination of acceptability is made by concurring or nonconcurring on the request.

e. Determine the validity of the Human-Rating Certification for each mission/flight per the certification requirements of this NPR (Requirement 58320).

Rationale: The Human-Rating Certification is reviewed as part of every flight/mission certification. The specific criteria to be reviewed are contained in the paragraphs 2.6.3 and 2.6.4. The determination of validity is made by concurring with flight/mission certification.

1.4.6 The Associate Administrator for the responsible Mission Directorate shall:

a. Ensure that the Agency-level safety goals, safety thresholds, and associated rationale as approved by the Administrator are documented in the Formulation Authorization Document and Program Commitment Agreement (Requirement).

b. Ensure the inclusion of probabilistic safety requirements derived from the Agency-level safety goals and safety thresholds in the appropriate Program-level documents (Requirement).

c. Provide the Program Manager with resources to sustain a safety upgrade and improvement program for the duration of the program or until the safety goals have been met (Requirement).

Note: See the rationale for the related requirement in paragraph 1.4.7.g.

d. Endorse the HRCP after each designated milestone (Requirement).

e. Provide programmatic concurrence on requests for Human-Rating Certification (Requirement).

1.4.7 The Program Manager is responsible for providing, maintaining, and operating the human-rated system. The Program Manager shall:

a. Develop and maintain, under configuration control, the HRCP with the products defined by the certification requirements in Chapter 2 of this NPR (Requirement 58329).

b. Provide a summary of the status of human-rating activities at the SIR highlighting any significant changes that have occurred since the CDR (Requirement 58330).

Rationale: There can be a significant time period between CDR and ORR. This status summary ensures that human-rating remains visible during this time period, but without requiring a formal update and delivery of the HRCP.

c. Comply with the certification and technical requirements in this NPR (Requirement 58332).

d. Prepare requests for waivers and deviations in accordance with NPR 8715.3, paragraph 1.13 (Requirement 58333).

e. Obtain the Human-Rating Certification per the certification requirements in this NPR (Requirement 58334).

f. Maintain and operate the human-rated system within the Human-Rating Certification per the requirements in this NPR (Requirement 58335).

g. Implement and maintain a safety upgrade and improvement program to address risks to crew safety identified via flight experience and safety analysis for the duration of the program or until the safety goals have been met (Requirement).

Note: The concept of a safety goal and accompanying requirement to implement a safety upgrade and improvement program is motivated by the fact that the level of risk associated with initially flown designs is typically unacceptable in the long term and the fact that human spaceflight programs, informed by flight experience and analysis, can achieve significant reductions of risk over the life of a program.

In cases where a safety goal is met prior to the end of a program, the Agency will revalidate its safety goals (see paragraph 1.4.2.b). At such points, the Agency may choose to relieve the program of its requirement to maintain a continuous investment in safety upgrades and improvements. However, paragraph 2.2.3 requires the program to maintain a safety analysis process to identify, evaluate, and, as appropriate, mitigate risks or deficiencies for the life of the program regardless of the satisfaction of applicable safety goals.

1.4.8 The Director, JSC is responsible for accepting the risk to the crew for spaceflight missions conducted with the human-rated system.

Rationale: The Director, JSC is not part of the programmatic authority nor the technical authority. However, involving humans in spaceflight adds an additional consideration, consenting to take the risks related to the system and the mission. The Director, JSC is part of the supervisory chain for the actual risk takers and serves to formally consent to take the risks associated with the human-rated system. The responsibilities of the Director, JSC at the program level with respect to these human-rating requirements are limited in scope to this crew risk perspective. As described in paragraphs 1.3.2 and 1.5.2.1.3, in the event of disagreement between the Program and the Director, JSC concerning consent to take risk with respect to human-rating, the matter is elevated via the institutional authority chain to the NASA Administrator, as the authority for human-rating, for disposition.

In this capacity, the Director, JSC shall:

a. From a crew risk perspective, determine the acceptability of the progress toward Human-Rating Certification (Requirement 58339).

Rationale: The determination of an acceptable level of risk to the crew at each of these milestones is accomplished by endorsing the HRCP at the program milestones.

b. From a crew risk perspective, determine the acceptability of the system for Human-Rating Certification (Requirement 58341).

Rationale: Designation of acceptability for Human-Rating Certification is accomplished by concurring on the Program Manager's Request for Human-Rating Certification.

c. Determine the acceptability of the risk to the crew for each mission (Requirement 58353).

Rationale: The determination of an acceptable level of risk to the crew is part of each mission or flight certification process, which includes a review of the Human-Rating Certification. Subject to the requirements of any international agreements, this determination also applies to international crew members.

d. Determine from a crew risk perspective the acceptability of residual safety risk associated with requests for exceptions and waivers to the requirements of this NPR (Requirement 58345).

1.4.9 The Agency Standing Review Board for the program, as defined in NPR 7120.5, NASA Space Flight Program and Project Management Requirements, shall review the products described in the certification requirements at the program milestones indicated in the certification requirements (Requirement 58346).

1.5 Human-Rating Certification Summary Timeline

1.5.1 Figure 3 depicts an overview of the process and the participants involved in the Human-Rating Certification.

* Note: The human-rating certification is also reviewed as part of each subsequent Readiness Review

Figure 3 - Human-Rating Certification Process Flow

1.5.2 The following paragraphs provide a summary of the key events at each milestone in the process.

1.5.2.1 At SRR, SDR, PDR, CDR , and ORR:

1.5.2.1.1 The Technical Authorities and the Director, JSC endorse and approve the contents of the HRCP (Appendix D) as part of the review process using the endorsement form (Appendix E). Approval of the HRCP also constitutes approval of formal presentations to the Review Board that were made to satisfy certification requirements. The Director, JSC, evaluating risk to the crew, also endorses the HRCP at each milestone using the Appendix E form.

1.5.2.1.2 After the review is complete, the Associate Administrator for the responsible Mission Directorate reviews, endorses, and approves the HRCP.

1.5.2.1.3 In the event that one or more of the Technical Authorities or the Director, JSC do not approve the contents of the HRCP at a milestone, the HRCP status will be elevated via the institutional authority chain to the NASA Administrator as the authority for human-rating for disposition. If the Associate Administrators do not approve the contents of the HRCP at a milestone, the HRCP status will be elevated via the programmatic authority chain to the NASA Administrator as the authority for human-rating for disposition.

1.5.2.2 After ORR and prior to the Readiness Review for the first crewed flight/mission:

1.5.2.2.1 The Program Manager prepares the Human-Rating Certification (Appendix F), which includes the duration of the certification.

1.5.2.2.2 The Technical Authorities and Director, JSC endorse (concur or non-concur) the Request for Human-Rating Certification.

1.5.2.2.3 The Request for Human-Rating Certification and the HRCP are routed to the Associate Administrator for the responsible Mission Directorate for endorsement.

1.5.2.2.4 The request for Human-Rating Certification and the HRCP are routed to the Associate Administrator for endorsement.

1.5.2.2.5 The request for Human-Rating Certification and the HRCP are submitted to the NASA Administrator, as the authority for human-rating, for disposition. The request for the Human-Rating Certification should be dispositioned prior to, or concurrent with, the Readiness Review for the first crewed flight/mission.

1.5.2.3 As part of each subsequent Readiness Review for the Human-Rated System:

1.5.2.3.1 The Program Manager, the Technical Authorities, and the Director, JSC review the Human-Rating Certification to include the following:

a. Compliance with the Configuration Management and Maintenance Plan.

b. Verification that the human-rated system will be operated within the certified envelope of the reference mission(s).

c. Anomalies from the previous flight/mission that affect the Human-Rating Certification and their resolution.

DISTRIBUTION:
NODIS