Planetary Protection

Planetary protection is a hard constraint on a robot before it is a policy about a planet. It sets how long hardware is baked and at what temperature, which materials survive that bake, how much of assembly and test schedule is spent waiting on assays, and what a mobility or sampling system is allowed to touch. The numbers below separate into two kinds that must not be read the same way: requirements written into a specification, and bioburdens accounted on vehicles that flew.

The bakeout specification moved by a factor of seventeen

Dry heat microbial reduction is credited against time at temperature. These are requirements from the current specification, not measured survival curves:

Credit	Condition	Exposure
4-log, exposed surface	126 C	85.98 h
4-log, encapsulated	126 C	429.91 h
6-log, encapsulated	126 C	1289.74 h
6-log, encapsulated	155 C	71.45 h

Source: [1].

The superseded specification allowed 5 hours at 125 C exposed and 25 hours at 125 C encapsulated, so encapsulated hardware must now survive more than seventeen times the thermal exposure once assumed [1]. The revision followed the isolation of heat-resistant bacteria from spacecraft assembly cleanrooms. Its governing input is an assumption rather than a measurement: the fraction of spores that are super-tolerant to heat is stated as unknown and assumed at 1 in 1000, and that assumed frequency is what caps the credit any dry heat process can be given [1]. The same revision removed the previously required vacuum of at least 1e-4 torr and the dry humidity control.

The trade a designer makes is bake duration against material temperature limit, and the 155 C option buys an eighteenfold reduction in duration for 29 C less margin on every material and part inside the bake [1]. Viking’s terminal sterilization, for comparison, was 111.7 C for 30 hours as flown, timed from when the coldest point on the lander reached temperature, against NASA specifications that then ranged 104 to 125 C.

Vapor hydrogen peroxide is the alternative where heat is not survivable, and it is also specified rather than measured: a D-value of 200 (mg/L)s at 0.5 to 1.1 mg/L peroxide for a 2 to 6 order of magnitude reduction, and a Ct value of at least 14000 (mg/L)s at 6 to 8.6 mg/L for an overkill process [1]. Material compatibility for it has been measured: more than 100 materials were evaluated at JPL at a six-log condition repeated four times to cover rework and requalification, most showing little or no property change and some changing by more than 15 percent.

What was achieved on flight vehicles, and which requirement bound

Vehicle	Total bioburden	Total limit	Density	Density limit
MSL flight system at launch	278,000 spores	500,000	22 spores/m2	300 spores/m2
MER-A landed hardware	101,000 spores	300,000	74 spores/m2	300 spores/m2
MER-B landed hardware	209,000 spores	300,000	74 spores/m2	300 spores/m2

Sources: MSL [1], MER [2]. Limits are Category IV-A requirements. Both vehicles were Category IV-A, with no life detection instrument and no access to a special region, so none of these allowances transfers to a mission that has either.

Both MER vehicles came in at the same 74 spores/m2, about a quarter of the density allowance, while MER-B used 70 percent of its total-count allowance [2]. The binding constraint was total count, not density [2]. MSL came in at about 7 percent of its allowed density [1].

None of these is a direct count, and the grade matters more here than the value. The MSL figure is an accounting total built from a Planetary Protection Equipment List, with assays at roughly 10 percent sampling at last access and analytic dry heat and entry heating credit taken for the rest [1]. The MER figures are three-sigma worst case estimates whose briefing states no assay method, no sample count and no laboratory, and they exclude bulk and mated bioburden inside the warm electronics box under an exemption, so they are not the total organisms landed [2]. Every number is culturable aerobic endospores only, which says nothing about anaerobes, fungi, unculturable organisms, or dead but chemically detectable material, which is what an organic detection requirement cares about [1].

The count is not the whole exposure. The MSL payload fairing interior was cleaned to a measured 4 spores/m2 against a 1000 spores/m2 requirement, but over more than 400 m2 of interior surface, so even a compliant fairing carries a large absolute count and recontamination after encapsulation is a real path [1].

Which reduction method was actually used is a separate question from which is specified. Of 721 MER flight hardware line items, 48 percent went through dry heat microbial reduction and 35 percent were isopropyl alcohol wipe or rinse only [2]. That is counted by line item and explicitly not by surface area or bioburden allocation, so it says nothing about which hardware carried the burden [2].

Cleaning methods are characterized on coupons

Method	Result	Article
Laser induced plasma shockwave	40 nm particles removed, up to 6-log spore reduction	coupons
Liquid boundary layer disruption	better than 4-log reduction at 99.9 percent confidence	coupons inoculated with 1e5 spores

Source: [1]. Both were measured at JPL. Neither has been demonstrated on flight hardware geometry, and laser plasma shockwave cleaning is not universally approved by the Planetary Protection Officer. Liquid boundary layer disruption removes microbes rather than killing them, which is the property that matters when the science requirement is organic detection at parts per billion.

Assay turnaround is a schedule driver

The NASA Standard Assay takes more than 72 hours: sonication to dislodge, heat shock at 80 C for 15 minutes to select endospores, then plating on trypticase soy agar and 72 hours of incubation at 32 C [1][4]. Swabs cover 25 cm2 and polyester wipes about 1 m2 [1]. That turnaround is what makes assays a schedule driver during assembly, test and launch operations, because hardware waits on a result before the next access closes.

Faster methods exist with narrower coverage. A modified membrane filtration assay with ATP bioluminescence returns in under 8 hours at sensitivity measured as equivalent to the standard assay, both detecting one colony forming unit [1]. A Limulus amoebocyte lysate proxy returns in under an hour but detects only Gram-negative endotoxin and beta-glucan, about half the assembly-environment burden [1].

The assay is also a filter on what is known about the organisms themselves. JPL holds over 8000 strains isolated from missions carrying planetary protection requirements; 1249 of 1418 archived isolates revived within 72 hours in 2019, and 191 were sequenced across six missions from 1975 to 2012 [4]. Those 191 were selected for abundance and apparent novelty rather than at random, and anything unculturable under the standard assay is absent by construction [4].

Cleanroom class does not order the airborne load

Real-time optical bioaerosol monitoring across five JPL assembly cleanrooms [3]:

Room	ISO class	Volume	Bioaerosols
Facility 3	7	93 m3	9,940,800 /m3
Facility 5	6	117 m3	46,728 /m3
Facility 6	6	98 m3	0 /m3
Facility 1	8	417 m3	1,722 /m3
Facility 2	8	3,780 m3	396 /m3

Source: [3]. Averages over triplicate 6 hour intervals at 28.3 L/min.

The ISO 7 room ran two to three orders of magnitude above every other room, including both ISO 6 rooms, and it was the smallest and the most crowded: 5 operators and a cumulative 23 plus or minus 6 operator-hours [3]. Operator activity tracks the load better than class does. In that room the biological share of total particle count ran 55 to 80 percent while work was underway and under 10 percent at rest, the only difference the study tested statistically, at p = 0.0264 with no correction for multiple comparisons [3]. About 91 percent of bioaerosols during work sat in the 0.5 and 1 um bins, which is where a conventional particle counter cannot separate biological from inert [3].

Two limits on reading that table. The counts are optically inferred from intrinsic fluorescence, not cultured organisms, so they are not colony forming units and not the spore bioburden requirements are written against. The ISO 6 zero is the instrument’s detection floor rather than a measurement, and with two rooms per class and three intervals per condition the study cannot separate class from room, volume or headcount [3]. Airborne count is also one step removed from what settles compliance, which is surface bioburden.