Russian spacecraft, says NASA spokesman John Yembrick, rely heavily on beefier mechanical structures for safety rather than complex backup systems. In the mid-1990s, NASA compared the design and standards for the Russian Soyuz spacecraft to its own and concluded that both NASA and Roscosmos, Russia's space agency, have equivalent safety requirements, though the Russians follow a different path to meet those parameters. NASA's decision to put American astronauts on Soyuz for a ride to the space station was based on the rocket's history of safety and reliability. NASA felt it would have been inappropriate to ask Roscosmos to redesign Soyuz to match NASA's human-rating process.
A sensitive word related to human rating is "tradeoff." It's always possible to build something sturdier and, presumably, safer, but at some point it will be doomed by its own weight or expense. When launching a satellite, businesses will accept a certain amount of risk as a tradeoff for keeping costs down. But the public, and by extension, NASA, will not do the same with people.
"There is a correlation between predicted reliability and cost," says Jeff Ward, vice president of avionics, guidance, and control at SpaceX. "Obviously, in manned spaceflight, we are prepared to pay the cost for very high levels of predicted reliability, because life is at stake. For unmanned missions, customers trade off cost and confidence. They recognize that there is a point of diminishing returns where spending more money doesn't make the vehicle more reliable in practice, and doesn't make sense for their business plans."
But designing launch systems is as much about juggling demands as it is about engineering. "It doesn't matter whether you're doing a rocket, a washing machine, a car, or whatever it is, it's always a balancing act," says Neil Otte, chief engineer of Ares projects at NASA's Marshall Space Flight Center. He compares the undertaking to designing a table—its construction depends on whether it's to be used in a dining room or a workshop. Engineers weigh the risk of failure based on a rocket's uses, and design in immunity to the risk or put backup controls in place.
Astronauts themselves constitute a kind of backup system: They can detect and react to events, as they did on Apollo 13, in a way that mechanical systems cannot, says Harkins. However, the human-rating standards also require a form of backup for astronauts; any manned spacecraft must be designed to guard against human error too.
The way manned spacecraft fail must meet certain standards. NASA's human-rating rules say "it is also highly desirable that the spaceflight system performance degrades in a predictable fashion to allow sufficient time for failure detection and, when possible, system recovery even when experiencing multiple failures." The simplest kind of failure, a hard fault, occurs when, say, a valve or a control panel just breaks. The more challenging kind, a soft fault, happens when hiccups in a monitoring system or computer cause it to misread a situation and conclude that a valve is broken when it isn't, or vice versa. NASA's human-rating rules are not specific about dealing with soft faults. They say that designers should do everything possible to guard against such bugs in the software. SpaceX has hired an expert in the field to design a sophisticated system that polls the computers and decides what's correct.
In its latest human-rating requirements, NASA has shifted away from specific criteria—the 40 percent structural safety margin, for example—and toward the premise that engineers should make launch systems as safe as they possibly can and then test the heck out of them. For the Ares I rocket, specific criteria hold it to the 40 percent margin, but engineers can use a smaller one if tests allow. The shuttle's second-generation external fuel tanks were moved to a 25 percent margin, but only after rigorous testing.
For SpaceX, the only upgrades required for Dragon to carry people are the Apollo-style abort-and-escape system, seats, and a full life support system. It will cost about $300 million to go from transporting cargo to transporting people, most of it for the escape system and the test flights the human-rating rules require. SpaceX has already negotiated the finances of this step with NASA.
Meanwhile, NASA has had to deal with a snag in the progress of its own vehicle. Early analysis of the Ares I solid rocket first stage, derived from the space shuttle's boosters, revealed that it would develop a dangerous thrust oscillation, or pogo effect, in flight. Gases swirling inside the booster would begin to resonate with the whole structure like sound vibrations in an organ pipe. About 115 seconds into the flight, astronauts would suddenly feel like they were on the end of a jackhammer, unable to read the instrument panel or flip switches. Engineers have solved the problem with a spring-and-damper system between the booster and the second-stage rocket, and a set of 16 spring-mounted weights in the skirt at the bottom of the booster.
Other Ares I tests are yielding encouraging results, including recent firings of the Apollo-style launch-abort system in the Utah desert.