Planetary Protection

Planetary protection is a hard constraint on a robot before it is a policy about a planet. It sets how long hardware is baked and at what temperature, which materials survive that bake, how much of assembly and test schedule is spent waiting on assays, and what a mobility or sampling system is allowed to touch. The difficulty is that the quantity the policy is written against, the probability that a released organism survives and proliferates on another body, cannot be measured on the hardware that matters: nobody can fly a spacecraft to Mars, wait a generation, and check whether it started an ecosystem. Every number downstream of that gap is either a specification a vehicle must meet or a bioburden accounted on a vehicle that flew, and the two must not be read the same way.

The requirement was a probability before it was a bake schedule

The forward-contamination requirement began as a probability budget, not a hardware spec. The Space Science Board’s 1964 to 1965 exobiology study adopted a sterilization goal for a Mars lander of no more than a 1 in 10,000 chance of carrying a single viable organism aboard, starting from an assumed pre-sterilization bioburden of 100 million organisms and a dry heat cycle of 135 C for 24 hours to bring it down [1]. COSPAR adopted the same 1e-4 figure in 1964, together with a 3e-5 limit on the probability of an unsterilized flyby or orbiter accidentally impacting the planet [2]. When two 1967 papers in Science argued that both organism release and organism survival on Mars were negligible and that the standards should be relaxed, Sagan, Levinthal and Lederberg replied that every probability in the chain was uncertain by two orders of magnitude or more, that the burden of proof sat with whoever wanted to relax the standard, and that a compound risk near 1e-2 is not zero when the stakes are the biological exploration of a planet [2].

The model behind that reply, m times Pg, where m is the expected number of organisms released and Pg the probability that one released organism survives and proliferates, was itself challenged on structural rather than numerical grounds in 1973 [3]. Harrison and North showed the formula depends on two independence assumptions, that separate organisms’ fates are independent given the number released and that one organism’s survival odds do not depend on how many were released, and argued both are false because a large release implies a hard landing, which implies an uncertain landing site, which changes any single organism’s chances, and their proposed replacement was a three-stage landing, biorelease and proliferation model in which the landing model is made detailed enough that the independence assumptions hold given its output [3]. That three-stage structure is the ancestor of the category and special-region system used today.

Sterilization as engineering practice predates the probability framework it later answered to. Viking’s terminal sterilization bake was 111.7 C for 30 hours as flown, timed from when the coldest point on the lander reached temperature, against contemporary NASA specifications that ranged 104 to 125 C [4][5]. The one Viking hardware failure the program history records from that era was unrelated to heat: the surface sampler arm snagged on the holder of a magnet cleaning brush during a pre-flight system demonstration, fixed with a minor hardware change and a mission rule against magnet cleaning until all biology samples were taken [4].

The bakeout specification moved by a factor of seventeen

Dry heat microbial reduction is credited against time at temperature. These are requirements from the current specification, not measured survival curves:

Credit	Condition	Exposure
4-log, exposed surface	126 C	85.98 h
4-log, encapsulated	126 C	429.91 h
6-log, encapsulated	126 C	1289.74 h
6-log, encapsulated	155 C	71.45 h

Source: [5].

The superseded specification allowed 5 hours at 125 C exposed and 25 hours at 125 C encapsulated, so encapsulated hardware must now survive more than seventeen times the thermal exposure once assumed [5]. The revision followed the isolation of heat-resistant bacteria from spacecraft assembly cleanrooms. Its governing input is an assumption rather than a measurement: the fraction of spores that are super-tolerant to heat is stated as unknown and assumed at 1 in 1000, and that assumed frequency is what caps the credit any dry heat process can be given [5]. The same revision removed the previously required vacuum of at least 1e-4 torr and the dry humidity control.

The trade a designer makes is bake duration against material temperature limit, and the 155 C option buys an eighteenfold reduction in duration for 29 C less margin on every material and part inside the bake [5]. MER’s own pre-launch estimate used the same 125 C class of bakeout for hardware that could tolerate it, choosing wipe or HEPA isolation for what could not [8]. Vapor hydrogen peroxide is the alternative where heat is not survivable, and it is also specified rather than measured: a D-value of 200 (mg/L)s at 0.5 to 1.1 mg/L peroxide for a 2 to 6 order of magnitude reduction, and a Ct value of at least 14000 (mg/L)s at 6 to 8.6 mg/L for an overkill process [5]. Material compatibility for it has been measured, more than 100 materials evaluated at JPL at a six-log condition repeated four times to cover rework and requalification, most showing little or no property change and some changing by more than 15 percent [5].

What was achieved on flight vehicles, and which requirement bound

Vehicle	Total bioburden	Total limit	Density	Density limit
MSL flight system at launch	278,000 spores	500,000	22 spores/m2	300 spores/m2
MER-A landed hardware	101,000 spores	300,000	74 spores/m2	300 spores/m2
MER-B landed hardware	209,000 spores	300,000	74 spores/m2	300 spores/m2

Sources: MSL [5], MER [6]. Limits are Category IV-A requirements. Both vehicles were Category IV-A, with no life detection instrument and no access to a special region, so none of these allowances transfers to a mission that has either; a mission that does, such as a Europa lander, is scoped under the same category system to a different, far stricter set of numbers still being worked out at the concept stage [7].

Both MER vehicles came in at the same 74 spores/m2, about a quarter of the density allowance, while MER-B used 70 percent of its total-count allowance [6]. The binding constraint was total count, not density [6]. An earlier MER estimate, made months before launch, had already flagged total count rather than density as the number to watch [8]. MSL came in at about 7 percent of its allowed density [5].

None of these is a direct count, and the grade matters more here than the value. The MSL figure is an accounting total built from a Planetary Protection Equipment List, with assays at roughly 10 percent sampling at last access and analytic dry heat and entry heating credit taken for the rest [5]. The MER figures are three-sigma worst case estimates whose briefing states no assay method, no sample count and no laboratory, and they exclude bulk and mated bioburden inside the warm electronics box under an exemption, so they are not the total organisms landed [6]. Every number is culturable aerobic endospores only, which says nothing about anaerobes, fungi, unculturable organisms, or dead but chemically detectable material, which is what an organic detection requirement cares about [5][6].

The count is not the whole exposure. The MSL payload fairing interior was cleaned to a measured 4 spores/m2 against a 1000 spores/m2 requirement, but over more than 400 m2 of interior surface, so even a compliant fairing carries a large absolute count and recontamination after encapsulation is a real path [5]. Which reduction method was actually used is a separate question from which is specified: of 721 MER flight hardware line items, 48 percent went through dry heat microbial reduction and 35 percent were isopropyl alcohol wipe or rinse only [6]. That is counted by line item and explicitly not by surface area or bioburden allocation, so it says nothing about which hardware carried the burden [6].

Cleanliness and structural qualification share a schedule, not a chamber

Bioburden control competes for the same assembly, test and launch operations calendar as environmental qualification, and the MER program’s own accounting shows the two loads are comparable in size. Of 3,355 problem failure reports raised across MER development, 294 came out of environmental testing alone, with a per-test failure rate ranging from 0 percent for acoustics to 78 percent for EMC [9]; the same spacecraft went through 164 assemblies, 802 assembly and subsystem tests, 47 re-tests and 86 analyses before the bakeout and assay counts above were ever taken [9]. The environmental test laboratory campaign that produced those numbers ran flight-acceptance random vibration at 5.5 to 8.0 Grms, protoflight vibration and acoustic testing at 145 dB, and ten days of continuous solar-thermal-vacuum cruise simulation in the 1e-6 torr range, all before the vehicles that later returned the 101,000 and 209,000 spore totals were accepted for flight [10]. Bakeout and assay windows are scheduled around that qualification sequence, not instead of it.

Cleaning methods are characterized on coupons

Method	Result	Article
Laser induced plasma shockwave	40 nm particles removed, up to 6-log spore reduction	coupons
Liquid boundary layer disruption	better than 4-log reduction at 99.9 percent confidence	coupons inoculated with 1e5 spores

Source: [5]. Both were measured at JPL. Neither has been demonstrated on flight hardware geometry, and laser plasma shockwave cleaning is not universally approved by the Planetary Protection Officer. Liquid boundary layer disruption removes microbes rather than killing them, which is the property that matters when the science requirement is organic detection at parts per billion.

Assay turnaround is a schedule driver

The NASA Standard Assay takes more than 72 hours: sonication to dislodge, heat shock at 80 C for 15 minutes to select endospores, then plating on trypticase soy agar and 72 hours of incubation at 32 C [5][11]. Swabs cover 25 cm2 and polyester wipes about 1 m2 [5]. That turnaround is what makes assays a schedule driver during assembly, test and launch operations, because hardware waits on a result before the next access closes.

Faster methods exist with narrower coverage. A modified membrane filtration assay with ATP bioluminescence returns in under 8 hours at sensitivity measured as equivalent to the standard assay, both detecting one colony forming unit [5]. A Limulus amoebocyte lysate proxy returns in under an hour but detects only Gram-negative endotoxin and beta-glucan, about half the assembly-environment burden [5].

The assay is also a filter on what is known about the organisms themselves. JPL holds over 8000 strains isolated from missions carrying planetary protection requirements; 1249 of 1418 archived isolates revived within 72 hours in 2019, and 191 were sequenced across six missions from 1975 to 2012 [11]. Those 191 were selected for abundance and apparent novelty rather than at random, and anything unculturable under the standard assay is absent by construction [11]. An earlier pass over 188 archived MER isolates found the same skew toward two genera, Bacillus at 73.7 percent and Paenibacillus at 14.0 percent of the population, with 5 of 171 sequenced isolates falling below 97 percent homology to any known species [12]. Neither study reports a survival or resistance finding; both report what the culture-based assay happens to catch.

Cleanroom class does not order the airborne load

Real-time optical bioaerosol monitoring across five JPL assembly cleanrooms [13]:

Room	ISO class	Volume	Bioaerosols
Facility 3	7	93 m3	9,940,800 /m3
Facility 5	6	117 m3	46,728 /m3
Facility 6	6	98 m3	0 /m3
Facility 1	8	417 m3	1,722 /m3
Facility 2	8	3,780 m3	396 /m3

Source: [13]. Averages over triplicate 6 hour intervals at 28.3 L/min.

The ISO 7 room ran two to three orders of magnitude above every other room, including both ISO 6 rooms, and it was the smallest and the most crowded: 5 operators and a cumulative 23 plus or minus 6 operator-hours [13]. Operator activity tracks the load better than class does. In that room the biological share of total particle count ran 55 to 80 percent while work was underway and under 10 percent at rest, the only difference the study tested statistically, at p = 0.0264 with no correction for multiple comparisons [13]. About 91 percent of bioaerosols during work sat in the 0.5 and 1 um bins, which is where a conventional particle counter cannot separate biological from inert [13].

Two limits on reading that table. The counts are optically inferred from intrinsic fluorescence, not cultured organisms, so they are not colony forming units and not the spore bioburden requirements are written against. The ISO 6 zero is the instrument’s detection floor rather than a measurement, and with two rooms per class and three intervals per condition the study cannot separate class from room, volume or headcount [13]. Airborne count is also one step removed from what settles compliance, which is surface bioburden.

Sample return moves the requirement from forward to back contamination

Everything above is a forward contamination requirement: keeping Earth life off another body. A mission that brings material back adds a second, harder requirement running the other way, and the design responses look different because the failure mode does.

Mars Sample Return’s science baseline once called for more than 500 g of returned sample, at least 1 km of surface mobility, sampling from at least 2 meters depth and at least 50 kg of lander science instruments; when the Mars Exploration Program’s budget was capped in 2001 to 2002, a science steering group deleted mobility, the drill, sample segregation and the in-situ science package to reach a floor-level stationary lander with a scoop, sieve and context camera [14]. Planetary protection requirements were part of what forced that descope, because a mission that returns unsterilized material must hold the probability of releasing a single viable organism to Earth’s biosphere below about 1e-6, several orders of magnitude tighter than the forward requirements above [14].

Mars 2020’s caching hardware shows what meeting a return requirement costs in hardware rather than in schedule. Sample-intimate surfaces are combustion cleaned at 350 C, coated in titanium nitride or gold, and protected by fluid mechanical particle barriers and molecular absorbers, with compliance argued through end-to-end particulate and molecular transport modeling rather than an end-to-end test, because no test article can be certified clean enough to stand in for the flight hardware [15]. The dominant contamination path the project modeled was not the caching hardware itself, which measured essentially zero on assay, a single colony forming unit on one hermetic seal and zero spore counts on the drill bits, but the rover as a whole: particles lofted by ambient Mars wind and redeposited where a sample is later taken [16]. The project’s conservative estimate for the probability of a single viable Earth organism riding home in a sample beat the requirement by more than an order of magnitude and its own best estimate by more than two [16].

What is not established

Every dry heat and vapor hydrogen peroxide credit in the current specification rests on an assumed, not measured, fraction of heat-super-tolerant spores, stated as unknown and possibly varying with location, season and activity [5]. Mission bioburden totals for MSL and MER are accounting or worst-case estimates built from partial sampling and analytic credit, not direct counts, and every count above is culturable aerobic endospores by design, which bounds nothing about anaerobes, fungi, unculturable organisms, or the dead-but-chemically-detectable material an organic detection requirement is written against [5][6][11]. The 1973 critique of the underlying contamination probability model was never fully absorbed into a validated replacement; the category and special-region system that followed is a structural response to it, not a resolution of its statistics [3]. Novel cleaning methods are characterized on coupons at JPL, not on flight hardware geometry, and one of the two described here is not universally approved for flight use [5]. The bioaerosol monitoring behind the cleanroom table is a single-instrument, single-occasion measurement per facility, so facility, ISO class, room volume and operator count are confounded rather than separated [13]. And the sample-return contamination estimates for Mars 2020 are end-to-end models validated against near-zero hardware measurements, not against a returned sample, because no such sample yet exists to check them against [16].