4

Risk Management and Post-Landing Approaches to Planetary Protection

Chapter 3 discussed what is known, or can be estimated based on terrestrial experience and models, about conditions for survival, proliferation, and transport of terrestrial biota on Mars. The planet’s surface is characterized by high solar ultraviolet radiation flux (UVC) and exposure to galactic cosmic radiation (GCR), which make the surface largely uninhabitable, but the surface and near-subsurface environments across the planet are also frozen and under low atmospheric pressure, which causes desiccation and freeze-drying that enhance survivability. The combination of these extreme conditions at the Martian surface precludes the proliferation of life as it is currently understood. Martian subsurface environments are shielded from UVC and GCR, may have access to water, and may be habitable. These conclusions minimize planetary protection concerns at the surface of some parts of Mars and shift the focus to the potential for proliferation of microorganisms in the subsurface following aeolian transport or by rover, helicopter, impact cratering, or astronaut activity. Chapter 3 drew on these findings to suggest a set of criteria and regions for which bioburden requirements could be reduced for some landing missions.

NASA and COSPAR planetary protection guidelines for Mars have long recommended specific spacecraft bioburden limits and specific approaches to satisfy those limits. While this policy has been appropriately conservative for avoiding harmful contamination during an era when little was known about the likelihood of potentially habitable regions on Mars, the approach lacks the flexibility to deal with either the growing knowledge base about the habitability of Mars or the expanding types of missions and mission objectives in the future. In particular, NASA’s current Mars planetary protection requirements (NPR 8020_012D Sec 5.3) rely primarily on pre-launch spore count measurements; they do not adequately address the potential presence of extremophiles, and they neglect post-landing bioburden reduction opportunities and mission-unique characteristics that can affect the probable risk of harmful contamination.

This chapter discusses those limits in flexibility and outlines an alternate approach that might be well-suited to achieving planetary protection objectives when some missions go forward with relaxed bioburden requirements.

LACK OF FLEXIBILITY WITH THE CURRENT PLANETARY PROTECTION POLICY

The planetary protection requirements specify spore counts measured at gross levels before launch. The current swab assay techniques, which involve swabbing a small area, determining spore count on the swab, and extrapolating that spore count to a larger area, offer an imprecise estimate of total spores. The policy implicitly assumes a further extrapolation, since the total spore estimate is used as a proxy for a larger total bioburden. The estimate of total bioburden might be improved using alternate measurement techniques and instruments. For several years, NASA has investigated the use of Limulus Amebocyte Lysate (LAL) and Adenosine Triphosphate (ATP) assays as alternative measurement techniques. With sustained funding these methods can be adapted to planetary protection bioburden assessment. Furthermore, the medical and food industries have similar and immediate needs for the identification and

quantification of microorganisms, and their methods could be examined for applicability and efficacy. Environments research also has improved methods for the identification and quantification of microorganisms and would be relevant for improving current techniques and policies on planetary protection. Advancements in this area are likely in the future and deserve thorough consideration as they become available.

The present requirements also do not consider the types of microorganisms sampled. Tests using genetic assays could better characterize microbial populations, including the presence of extremophiles. This genetic information could inform both risk assessments and mitigation techniques that can reduce the risk of harmful contamination.

NPR 8020_012D Sec 5.3 states that “All bioburden constraints are defined with respect to the number of aerobic microorganisms that survive a heat shock of 353 K (80°C) for 15 minutes and are cultured on Trypticase Soy Agar at 305 K (32°C) for 72 hours (hereinafter “spores”).” This reference does not acknowledge recent terrestrial science discoveries, which have identified microbial life with a broad spectrum of adaption techniques and resistance to environmental extremes (e.g., temperature, radiation, desiccation, etc.), nor does it address microorganisms that do not grow in cultures. Extremophile research results are dynamic, and recent trends indicate that what is required to extinguish life continues to be underestimated. Consequently, a policy based only on survival relative to heat shock and culture growth as a proxy for the total bioburden may not be appropriate for the range of mission scenarios, both anticipated and unforeseen, in the future.

In addition, spore count requirements are defined at the time of launch. The Planetary Protection Officer has the discretion to negotiate credit for bioburden reductions during entry and descent. It does not consider natural bioburden reductions that can occur after landing when microorganisms are exposed to the hostile Mars environment (e.g., UVC, low water activity, etc.), either while stationary or during transport by the wind or a mobile platform. The requirements are also unclear as to whether intentional bioburden reduction activities performed on the surface after landing can be used to meet bioburden requirements. For example, this might include in situ cleaning and recontamination prevention of a drill bit prior to boring into the subsurface or ice. These naturally occurring and/or planned surface decontamination events could reduce, or in certain cases eliminate, the need for prelaunch bioburden assessment and reduction activities.

Moreover, the policy does not have the flexibility to consider other mission-unique variations. For example, a mission’s planetary protection requirements might be tailored based on known local or regional characteristics affecting a microorganism’s ability to remain dormant, replicate, or proliferate. This data would be obtained from precursor missions’ instruments, either landed or on-orbit. Both the number and types of missions are expected to significantly increase in the next few decades. As Chapter 1 noted, the types of mission technology, objectives, and participating entities are all expanding. The planetary protection policy needs to be more flexible to accommodate this spectrum of future missions as well as new scientific data.

RISK MANAGEMENT AS AN ALTERNATIVE APPROACH

Established risk management practices may provide an alternative approach to satisfying planetary protection objectives (see Figure 4.1) for future missions. Well-established risk management techniques are used broadly to identify and evaluate risks (defined as the effect of uncertainty on objectives) and the application of resources to minimize such risks, for example in aerospace and healthcare industries.¹ International standards related to risk management are captured in ISO 31000:2018. NASA’s approach to risk management is documented in NPR 8000.4B and the NASA Risk Management Handbook NASA/SP-2011-3422 (Nov. 2011).

___________________

¹ See, for example, ISO 14971:2019.

Using a Risk Management (RM) approach can benefit planetary protection for the following reasons:

• RM provides a formal framework and transparency in managing uncertainty.
• Assessments are primarily performed by the flight project teams, which promotes ownership by those implementing organizations and can increase technical credibility.
• RM is scalable as the number of organizations and missions increase.
• RM facilitates risk prioritization and cost management.
• RM allows use of both existing and new models, tools and methodologies.
• RM can incorporate the latest scientific and mission information as it is discovered.
• RM facilitates communication between the stakeholder and compliance authority through a Continuous Risk Management (CRM) process as risk assessments are performed and reviewed, mitigations are implemented, and risk ratings are updated.

Together, these advantages should increasingly benefit more complex missions now being contemplated, including scientific deep drilling, in situ resource utilization, emplacement of the infrastructure for human exploration, and eventually human missions.

NPR 8000.4B and the NASA Risk Management Handbook provide detailed guidance on the use of two complementary processes: Risk Informed Decision Making (RIDM) and Continuous Risk Management (CRM). Both RIDM and CRM can be adapted to manage planetary protection risks, but such adaptation is beyond the scope of this report. In what follows, the committee provides an example initial framework that can be used to guide a more thorough application of these techniques to planetary protection.

As envisioned, the risk management approach offers an alternate path for flight projects to demonstrate fulfillment of planetary protection objectives after the planetary protection category is selected. For NASA missions, the Office of Planetary Protection establishes the mission categorization. For commercial missions, categorization should be the responsibility of the regulatory agency designated to authorize and continually supervise the space activities of nongovernmental entities in accordance with the Outer Space Treaty.

An Example of a Planetary Protection Risk Management Framework

A simplified Risk Management process includes the following ordered steps:

1. Identify each risk.
2. Assess the likelihood and consequence of each risk.
3. Rank each risk and identify those requiring further mitigation.
4. Re-assess the likelihood and consequence after application of the mitigations.

By comparison, the current planetary protection protocol for Mars missions is based solely on likelihood (without direct consideration of consequence) and is prescriptive as to both the quantification (assays) and the mitigation (pre-launch bioburden reduction). The committee summarizes these steps in Box 4.1.

Step 1: Identifying the Risks

A risk management best practice involves the development of risk statements using a standardized format that imposes rigor and consistency. (See Box 4.2 for the definition of risk used in this report.) The following format is often used:

Given that [CONDITIONS] there is a possibility of [DEVIATIONS] leading to [CONSEQUENCE].

Using this format, Table 4.1 begins to develop a series of risk statement examples that are relevant to the mission’s planetary protection Category. The examples shown are not intended to be comprehensive and should be expanded to include conditions involving unintended impacts and off-nominal landings.

TABLE 4.1 Example Risk Statements

Step 2: Assessing Likelihood and Consequence

For each risk identified, an assessment is made of the likelihood of the risk and the consequence of the risk. Often, qualitative scales are used to rank both Likelihood (e.g., from Very Unlikely to Very Likely) and Consequence (e.g., from Negligible to Severe).

Likelihood and Consequence in the Context of Planetary Protection

For planetary protection, additional clarity can be gained by using more descriptive terms in ranking both the likelihood and consequence of each identified risk, both before and after mitigation. An example² ranking of likelihood levels for planetary protection purposes suggested in a briefing to the committee is

1. Extremely Improbable
2. Improbable
3. Remote
4. Occasional
5. Frequent

For planetary protection, the consequence levels can be significantly more descriptive, as in this example:

1. Harmful contamination of an area of no known interest for prebiotic evolution or the search for evidence of life
2. Harmful contamination of an area of potential interest for prebiotic evolution or the search for evidence of life
3. Harmful contamination of an area of known interest for prebiotic evolution or the search for evidence of life
4. Harmful contamination of a potential special region
5. Harmful contamination of a special region, or that is global³

Once the Likelihood and Consequence are established, each risk can be given a Risk Rating from High to Low by placing the risk in a 5 × 5 matrix such as the example in Figure 4.2. The Risk Rating is the qualitative equivalent of (Likelihood × Consequence). For example, landing a human mission in a special region without any mitigations for cleanliness would be a 5, 5. On the other hand, landing an extremely clean spacecraft with no subsurface operations in an area with no subsurface access point and with no known interest to prebiotic evolution or the search for evidence of life would be a 1, 1.

Step 3: Ranking Risks

Using the risk matrix, a risk level (from low to high) is assigned to each risk before the application of any risk mitigations. For example, the risk level of a lander causing harmful contamination to a special region would be evaluated before any bioburden reduction methods are applied.

___________________

² Suggested by Scott Hubbard in presentation to the committee on March 24, 2021.

³ While global contamination of Mars is acknowledged to be extremely unlikely, this consequence is intentionally written to serve planetary protection needs more broadly, particularly in consideration of the potential global contamination of oceans on Europa and Enceladus.

Step 4: Implementation of Mitigations

Risk mitigations are typically applied to all risks that are ranked above an acceptable threshold (typically either Low or Low Medium). Pre-launch bioburden reduction, alternative landing site selection, and biobarriers to prevent recontamination are examples of mitigations that have been commonly used to mitigate planetary protection risks in the past. For future missions, mitigations might also include in situ bioburden reduction, or designing to take advantage of the natural effects of natural UVC or cosmic radiation at Mars.

Once mitigations are identified that reduce the residual risk to an acceptable level, CRM can be used to track risks throughout program development, implementation, and operations to assure that risk rankings remain contained at acceptable low levels.

Such a risk management approach could be applied to the missions meeting reduced bioburden criteria discussed in Chapter 3 to identify alternative or complementary ways to comply with the planetary protection requirements. It would be prudent to first develop, deploy, and mature the planetary protection risk management process on Category IVa or IVc missions, before expanding its utilization to other planetary protection categories.

Planetary protection is a complex subject, and its successful development, evaluation and implementation requires expertise in a range of disciplines—astrobiology, chemistry, mission planning and navigation, and spacecraft engineering. In order to make effective decisions, the Planetary Protection Officer needs a new standing planetary protection risk management board comprised of subject matter experts in these fields with tactical responsibilities accountable directly to the PPO. The committee envisions that this new board would meet periodically to review the implementation of planetary

protection risk management processes of individual NASA missions and advise the Planetary Protection Officer of such implementations.

To the extent possible, this board will need continuity of support over time and for the breadth of planetary protection-relevant missions. This will facilitate the provision of timely and consistent consultation, as well as the incorporation of lessons learned. This board will need to actively participate in the planetary protection process from a mission’s inception through plan development, implementation, and final reports. The board can also provide leadership in establishing and communicating best practices to flight project planetary protection practitioners both inside and outside of NASA.

The establishment of such a board will become increasingly important as space exploration increases in the next decade. The number of missions, types of missions, and regions visited are expected to grow significantly. The science data return from these missions will be dynamic and should continue to inform policy. The introduction of commercial entrants into space exploration will also present new planetary protection approaches and challenges in the implementation of planetary protection policies. A risk management board can greatly assist the Planetary Protection Officer during the period of transition.

IN SITU BIOBURDEN REDUCTION

In both the scientific and commercial communities, there is increased interest in developing missions to conduct subsurface operations. Today, such missions are categorized as Category IVc and subject to the most stringent cleaning requirements if they target caves and voids, the subsurface below 5 m, deposits of water ice, or other potential Special Regions. To date, all cleaning requirements (e.g., on the Phoenix and Perseverance missions) have been met prior to launch.

For future missions, it may be practical and cost-effective to consider in situ bioburden reduction as an alternative, or supplement, to pre-launch bioburden reduction methods. This could involve either the use of an on-board bioburden reduction apparatus, for example using hydrogen peroxide vapor, or taking advantage of natural bioburden reduction processes, particularly UVC radiation. Based on the current understanding of the biocidal effects of UVC at the Martian surface, it may be possible, for example, to clean drill bits through simple exposure. This approach might be particularly well-suited to the cleaning of robotic drills and other equipment used during human exploration.

In using an in situ process, the limitations of the method used will need special care. For example, in using naturally available UVC, the potential hidden surfaces that cannot be accessed will be important. Furthermore, a level of conservatism will be appropriate in cases in which the predicted reduction in bioburden reduction cannot be verified.

PLANETARY PROTECTION DURING SURFACE OPERATIONS

Prior to the landing of Curiosity on Mars, planetary protection requirements for all planetary missions were addressed prior to launch. Planetary protection plans focused on pre-launch activities such as (1) documenting organic inventories, (2) selecting mission trajectories to reduce the probability of unintended impact on planetary bodies, (3) cleaning of landed spacecraft during assembly to reduce bioburden to acceptable levels, (4) implementing procedures to avoid recontamination prior to launch, and (5) assays to document the level of cleanliness achieved.

Beginning with Curiosity, the mission team began to consider planetary protection issues during daily landed operations. Curiosity, which landed in 2012, is a Category IVa mission, based on a pre-launch

landing site review of Gale Crater that concluded that the location was too dry to contain Special Regions. In 2014, the mission team found a geological feature which was identified as possible evidence for contemporary water flow. It was later interpreted as a miniature sand avalanche. The team also detected localized methane spikes, which may or may not have been evidence of biological activity. These events led the team to adjust surface operations to respond to new in situ measurements that may indicate areas of astrobiological interest unknown at the time of launch.

In January 2016, the Curiosity team began using a newly developed protocol in daily rover operations to formally ensure that the rover complies with its planetary protection categorization. The protocol involves efforts to identify gullies, bright streaks associated with gullies, and other features associated with the potential presence of water. If a potential special region is identified, robotic arm and surface activities are suspended until a team is convened to assess the feature of interest.⁴ By June 2016, there had been four instances in which a report had been made of a feature of interest, but after consideration, no potential Special Regions had been identified and no activities had been precluded.

Given the possibility that a lander mission could discover evidence for biologically relevant features or activity that was not anticipated when the mission’s planetary protection plan was developed and approved, there is a need to update planetary protection policy to incorporate planetary protection in the planning and execution of daily Mars surface operations for both scientific and commercial missions. However, current planetary protection policies do not include any provisions for assessing or adjusting surface operations to react to observations after landing.

___________________

⁴ A more detailed discussion of this protocol and its early implementation is provided in NAC PPS minutes, June 1-2, 2016.