Requirements For The Vehicle Application: Fill & Download for Free

The requirements for human-rating are lengthy and detailed and are determined by NASA in conjunction with the FAA (the FAA imposes these requirements on all commercial US space endeavors). Below I will give an overview of some of the high-level requirements. Each of these would have their own detailed criteria and standards. Safety is a complex effort. For every new piece of spacecraft equipment, we go through arduous safety review panels (SRP) where the risks introduced by that equipment are analyzed mathematically, qualitatively, and experientially. I’ve spent many, many days at SRP as we help equipment manufacturers understand how even the seemingly slightest thing they neglected to account for can endanger the crew and/or mission. We look at collision hazards, explosive hazards, shock hazards, and so-on and so-on. We have acceptable levels of risk and we strive to bring the new equipment within those acceptable levels.The vehicle shall provide a safe and habitable environment. That’s a broad requirement with many embedded requirements covering the internal inherent safety/habitability of the vehicle (e.g. no exposed sharp edges) and the ability of the vehicle to protect the crew from external hazards of space (e.g. vacuum and extreme temperatures).The vehicle shall meet probabilistic safety criteria and thresholds. That means that NASA has determined acceptable levels of risk and uncertainty and the vehicle systems need to meet those constraints. Space travel is not a safe thing to do - some risk has to be accepted, but that risk is managed by analysis and limits. For example, vehicles are designed to have a PNP (probability of non-penetration) from orbital debris of 0.99995 over the expected duration of the mission. And, in general, uncrewed spacecraft are designed with a 1.25 factor of safety. With a few exceptions, crewed spacecraft are designed to a 1.4 factor of safety.The vehicle shall provide adequate failure tolerance. We operate with levels of redundancy. A minimum is that a system be two fault tolerant. That means that with a single failure, a system can still complete the planned missions and with a second failure, the system can still safely abort the mission and get the crew to safety. If a system cannot be designed with fault tolerance, it must be designed with very low probability of catastrophic failure. Another mechanism used is operational controls. For example, if the system cannot be designed to protect the crew from electrical hazard risk, during maintenance, then operational steps, such as inhibiting upstream power before maintenance, is taken.The vehicle shall be designed to tolerate human error actions without catastrophic event or system loss. That means no single inadvertent action can jeopardize the health of the crew or integrity of the vehicle. This is managed by various mechanisms such as guarded commands that require confirmation before execution, covered hardware switches, and software inhibits. Systems are designed to meet must work and must not work conditions. If a single action can terminate operation of a subsystem, it must have a redundant subsystem that is present and ready to take over.The vehicle software shall be designed to mitigate hazardous behavior. For example, certain functions that may be needed at some stage but are hazardous at other stages should not be executable or easily accessible during the inappropriate stages.The vehicle shall provide some form of ECW (Emergency caution and warning) functionality that will detect faults and alert the crew of those faults. There are thousands of components that can misbehave in a spacecraft. When that misbehavior occurs, the vehicle control systems need to notice (they need to perform passive and active built-in tests) and need to provide clear indications to the crew of what has happened and how severe the incident is.The vehicle shall provide fault isolation and recovery capabilities. Should a system/subsystem experience a failure, the vehicle should be able to isolate the failed components to prevent further harm and then, if possible, hand over the function to redundant equipment. For example, if a computer starts acting crazy, an external source should be able to disable that computer and bring the backup/standby computer to operational state.The vehicle shall provide the capability for anomaly resolution facilitated by health and status data. That means that there should be telemetry on the performance of each system that the crew can review to determine what went wrong and what potential workarounds are available.The vehicle shall provide the capability for autonomous function for all systems that are required to prevent catastrophic events. Essentially that means that systems can still do their job if we lose communications with the vehicle.The vehicle shall provide reasonable crew access to all equipment required for emergency response. This means things like fire extinguishers and oxygen masks need to be accessible to the crew, even when strapped into their seats.The vehicle shall provide the crew with the capability to monitor and control all systems/subsystems that are essential for mission success, mission safety, and abort functionality. For example, if a component of the vehicle must be jettisoned prior to re-entry, for safe re-entry, the crew need the capability to command that jettison in the event automated systems do not work.The vehicle shall provide crew with the capability to override certain automatic actions. For example, some abort initiations.The vehicle shall provide remote monitoring and control for functions necessary for mission success and safety. Essentially, this means that the flight control team on the ground needs insight and interface to critical vehicle systems.The vehicle must provide some level of capability for crew to manually control the vehicle motion. This level of control must meet level one on the Cooper-Harper scale.The vehicle must provide communication capability for its crew to communicate with vehicles in proximity (e.g. rendezvous).The vehicle must provide emergency egress capability pre-launch and abort capability between launch and orbit and on-orbit (where applicable).

Robert has a great answer but he is also missing one component of the equation—satellites in geostationary orbit.If a satellite wants to "hover" over the exact same spot on earth 100% of the time (useful for various communication and imaging applications), there is only one place it can do that—in geostationary orbit. This is a circular orbit that is approximately 36,000 km above sea level and centered on the equator. At this altitude, the orbital period (amount of time to make one revolution) is precisely the same as a day on earth.The ideal place to launch to geostationary orbit is, obviously, on the equator. Equatorial launches only require the vehicle to bring the payload to orbital speed and do not require inclination changes. For launches that are not on the equator (which is all launch sites except for the SeaLaunch platform), the vehicle must perform a complex adjustment burn in the GTO (geostationary transfer orbit) phase of the mission to bring the vehicle an inclination of 0º.The image below depicts this (pretty much to scale). The vehicle first reaches low earth orbit (green circle), then makes a burn to geostationary transfer orbit (the red ellipse), then makes a second burn to circularize the orbit into geostationary orbit (orange circle). When a vehicle is launched from the equator, the three orbits shown are planar. If the vehicle is launched from a non-equatorial launch site, the green circle and the orange circle are non-planar, thus requiring the red ellipse to bridge the two orbits. This maneuver consumes propellant and thus decreases the payload.That's another reason why equatorial launches (or as close as possible) are preferred.

Brakes are designed to match the service requirements for the vehicle they’re used on. If a vehicle is large and heavy, it gets larger rotors and bigger calipers with more swept area. If a vehicle is used for racing or high-performance use, weight and repeated high-speed stops are a factor, so cooling becomes a big factor. In some commercial and aircraft applications, you may find multiple rotors, multiple calipers or even full-contact multi-plate systems.(In ad above, notice dual-caliper feature on all four wheels…)(Notice the dual calipers on this heavy truck rearend.)(This gorgeous Lambo 6-piston caliper has about 33% of swept area.)(And here’s a Meggitt Systems aerospace brake, typically used on large, heavy jet aircraft. Notice the alternating dry friction plates and discs with splines, similar to a motorcycle clutch.)If you apply too much pad to the surface of a rotor, the amount of heat generated due to friction can get hot enough to melt the rotor, so it can be counterproductive. It can also require too much effort to fully apply the brake to slow down the vehicle.In the case of large aircraft brakes, they’re not used continuously - only upon landing, so while there is a lot of heat buildup, its duration is pretty short, for only less than a minute.Finally, if you’ve ever worked on disc brakes, you know how heavy a caliper can be, especially for a truck application. Imagine one that’s 4–5 times larger than the one currently used, and how that will effect unsprung weight and suspension characteristics? In addition, it would needlessly increase the cost of the brake assembly.The current trend in high performance auto brakes is moving towards dual calipers. These have been popular for drifting for a few years now. You just have to make sure that you have excellent brake cooling and high-quality rotors.(Brembo liquid-cooled caliper…)There are some brake companies currently working on liquid-cooled brakes as well, although I’m not sure if any current application makes the additional complication and expense worth it…