Abstract
Introduction
A key objective of the NASA Artemis program is to establish a sustained human presence on the Moon, along with its international and commercial partners. NASA aims to establish a lunar economy, increasing the need for infrastructure to support human habitation and facilitate growth. In-space manufacturing (ISM) coupled with in situ resource utilization (ISRU) can reduce launch mass and reduce the dependency on Earth resupply for long-term habitation, enabling rapid expansion. However, the space environment introduces unique challenges compared to Earth, such as the absence of an atmosphere, reduced gravity levels, and high consequences of human-machine interactions given the barrier to evacuating an astronaut injured in a manufacturing accident on the Moon, necessitating new safety standards for ISM processes.
Methods
This study proposes the application of a modified analytical hierarchy process (AHP) to identify high-risk aspects of crew procedures in molten regolith electrolysis (MRE) for both Earth-based analog testing and lunar production.
Results
The modified AHP assists in pinpointing areas needing hazard mitigation to protect crew members, enabling the improvement of safety standards for MRE in both environments.
Conclusion
Findings will inform the development of robust safety protocols for ISM, crucial for the success of NASA's Artemis missions and the broader goal of sustained human presence on the Moon and Mars.
Keywords
Introduction
Establishing a sustained human presence on the Moon is a target of NASA's Artemis program and Moon to Mars objectives. 1 By 2028, NASA, along with its international and commercial partners, plans to establish a permanent presence at the lunar south pole as part of the Artemis missions. 2 The Artemis Base Camp will serve as a hub for partnerships under the Artemis Accords with the goal of kickstarting a lunar economy. As this lunar economy grows, there will be an increased need for transporting people and goods. This requires infrastructure to be built to support humans, as well as the ability to repair and build more infrastructure for growth. 3 Parts can be manufactured on Earth and sent to space; however, this comes with high launch costs to send each necessary component to its destination.
One attractive way to reduce the launch mass for sustained long-term development is to utilize in-space manufacturing (ISM). ISM enables the manufacturing of components and critical solutions that are not constrained in the same ways as Earth-supplied parts. 4 This also adds the benefit of production flexibility and mission robustness, as raw materials and manufacturing capabilities remain on site to build parts according to the changing needs of a mission. In situ resource utilization (ISRU) enables further reductions in launch mass and allows for rapid habitat growth when establishing a human presence on the Moon and Mars.5-8 For example, NASA and its collaborators are expected to have a rising long-term demand for metals produced from Lunar regolith, utilizing in situ resources.9-11 These metals will be essential for manufacturing various products on the Moon, including large pressure vessels needed for habitats and industrial storage and operations. 12
ISM and ISRU are widely acknowledged as enabling technologies for a sustained lunar and martian presence. However, much is unknown about the operating procedures and safety standards that will be needed for ISM processes. Conditions under which ISM processes may be performed in exploration environments are very different from conditions on Earth; critical differences in crew operations and procedures can arise as a result of the absence of an atmosphere, reduced gravity levels, dust, and a higher prevalence of human-machine interactions due to spacesuit-based operations on the lunar surface. Changes in light levels can also impact lunar surface operations; however, the lighting conditions are heavily dependent on the landing site, ranging from long periods of light exposure to low-light or permanently shadowed regions. Notably, while the main focus of production on Earth is reducing cost, it often occurs at the expense of increasing human interaction with machines, adding consumables that are abundantly available on Earth, and using low-cost parts requiring frequent maintenance and repairs. However, for ISM in microgravity or on the Moon and Mars, astronaut time is tightly constrained and expensive. This drives requirements for minimal maintenance and repair and higher process automation for ISM implementation in space. Additional requirements stem from the necessity of either performing all crew operations in an extravehicular activity (EVA) suit if the system is outside of the habitable areas or adding life support infrastructure to enclose the ISM systems for shirtsleeve operations; many manufacturing systems are designed for EVA maintenance. 5
The space environment and spaceflight-specific manufacturing requirements can pose an increased risk to humans involved in the manufacturing process. As such, safety standards for ISM need to be clearly defined. Current United States safety standards in commercial manufacturing are determined by the Occupational Safety and Health Administration (OSHA). 13 These safety standards protect the workers from environmental hazards due to the operating conditions in factories on Earth. While there are several sets of guidelines governing health risk posture in space travel,14-16 they emphasize the general space environment—for example, focusing on limits to space radiation exposure. Sections 2.2.5 and 2.5.2 of the FAA's Recommended Practices for Human Space Flight Occupant Safety provide a set of recommendations for crew protection against mechanical hazards and EVA system environment hazards, respectively, with key recommendations shown in Table 1. 14 However, there is an unmet need to define safety standards for ISM-specific operations.
FAA mechanical hazards and EVA system environment protection recommendations for crew operations. 14
We propose the analysis of crew involvement in ISM processes through a modified analytical hierarchy process (AHP) to identify the highest-risk aspects. This method enables the identification of areas in need of hazard mitigation efforts to protect the crew and to establish improved standards for astronaut involvement in ISM operations. Here, we apply the modified AHP to crew safety in molten regolith electrolysis (MRE) for both on-Earth analog testing and the proposed lunar production pipeline. This then allows us to modify crew procedures and safety guidelines to improve safety in analog testing (Earth MRE) and on the Moon (lunar MRE).
Methods
The use of AHP to aid in multiple criteria decision analysis has been extensively reviewed and applied since first described by Saaty.17-22 In AHP, pairwise comparisons are used to assign a relative importance to a set of decision criteria; these are then applied to the possible outcomes. Variants of AHP have been used to evaluate risk in manufacturing technology selection 23 and paired with subjective probability estimation for spaceflight technology selection. 24 The AHP method implemented by Farooq et al 23 uses two separate AHPs for benefits and risks, respectively, then applies a strategic assessment model 25 to incorporate a risk aversion factor in the final technology rankings. Here, we adapt this method to directly include a risk aversion factor as the ranking criteria in the standard AHP model. This creates a dynamic model that highlights the astronaut procedures and operations that incur the highest risk in ISM. These could then be conducted less frequently (administrative controls), or additional engineering and design work could be undertaken to further mitigate hazards (engineering controls). As it is dynamic, it allows for changes in the risks to be counted as mitigations are put in place, showing the resulting safety progression.
This model aims to identify the highest-risk crew procedures in ISM methods and to highlight areas for additional safety measures. As such, we focus on only risk factors as decision criteria in this AHP. A failure mode analysis is shown in Figure 1, which highlights the most prominent hazards to be encountered by the crew during maintenance operations. Resulting risk factor categories used in the case study include: pinch points, fire, electrocution, burn, sharps, heavy lifting, and material contact.14,15,26 Based on the procedures for crew intervention and corresponding risk analyses, a number was tallied for each risk of a given category encountered during the procedure. Our modified AHP with risk aversion factors is then used to calculate the relative risk associated with each crew operation. The procedures with the highest weighted score are therefore those that pose the most risk to crew safety.

Failure mode analysis with maintenance approach for the MRE process.
This dynamic AHP model includes the following assumptions:
All risks are mitigated to the extent possible, such that reasonable hazard elimination, engineering controls, administrative controls, and personal protective equipment are all in use in the post-mitigation analyses. The in-space maintenance operations occur on EVA, requiring full EVA gear (spacesuits, etc) unless otherwise noted. Each procedure requiring crew intervention has been deemed to be sufficiently necessary to justify the risk of EVA and operation. These procedures are all assumed to occur equally infrequently, on a repair-only basis as opposed to a regular, recurring component of the manufacturing process.
These assumptions are set to best represent the expected operational environment. However, these are not set requirements and instead represent adjustable input parameters in the AHP model. The impact of this set of assumptions is evaluated in the Proposed Lunar Surface Production Process case study.
Each hazard is assigned a quantitative value1-3 based on evaluation of the likelihood and consequence of encountering each hazard after applying mitigation techniques. Risk-aversion estimates are shown in Table 2. Following the pairwise comparison process used in AHP, we apply the relative weights shown in Table 3 to each of the hazard categories. In each environment, the number of hazards encountered in each category is tallied. The standard AHP process is then applied to calculate the relative risk of each operation.
Relative risk-aversion estimates based on post-mitigation likelihood and consequence (LxC) scores. Hazards are assigned a value from 1–3, with 3 being the least acceptable risk.
Relative weights assigned to each hazard based on pairwise comparisons and the risk-aversion estimates shown in Table 2.
Case Study: ISRU Steel Production via Molten Regolith Electrolysis on the Lunar Surface
To design and demonstrate a method of metal extraction, in particular steel, from lunar regolith, an MRE reactor is designed and built on Earth with subsystem demonstrations. Shown in Figure 2, this process extracts iron and produces various steel alloys and other metal products from lunar regolith, with the additional benefit of generating oxygen as a byproduct while minimizing consumables to reduce launch mass. However, the use of some consumables is unavoidable in the current state-of-the-art MRE process; for example, electrodes need frequent replacement due to accumulation of damage throughout the reaction. As such, there is an inherent need to develop safe maintenance procedures for electrode replacement. Further, these maintenance procedures, like all high-risk operations, benefit from iterative tests in relevant operational environments; this motivates the need to test high-risk maintenance operations in analogs on Earth prior to spaceflight integration. An electrolysis reactor for analog testing in Earth MRE is designed, along with auxiliary processes that allow the addition of alloying elements to create molten steel from beneficiated lunar regolith simulant. This design aims to contribute to creating a sustainable and self-sufficient lunar infrastructure by utilizing local resources to produce essential materials. 27

The proposed lunar surface metal production process involving molten regolith electrolysis.
Here, we (1) describe the crew procedures needed for maintenance and standard operation and (2) apply the modified AHP method described previously to identify hazards in crew operations. This is done for both the lunar MRE process and Earth analog testing. Categories for procedures that could have possible crew tasks are described in Table 4, with the recommended safety features described in Table 1 applied for the procedure in each environment.
Hazards and risks to crew safety in maintenance of the MRE pipeline, both in the Earth analog and on the lunar surface. All risks and safety procedures noted for the Earth analog categories also apply to the lunar surface unless otherwise noted.
Proposed Lunar Surface Production Process
The production process for ISRU metal production on the Moon is shown in Figure 2. The process begins with the collection of lunar regolith. This is followed by beneficiation to increase the iron content in the regolith hence increasing the efficiency of the production. Beneficiation increases the content of process-specific important compounds through physical or chemical processing; hence, for MRE, the iron content in regolith is increased by electrostatic separation followed by sulfidation.27,28 The beneficiated regolith is then fed into the MRE reactor for metal extraction, producing iron as the main product and oxygen and slag as useful byproducts. The iron is alloyed to make steel. Following this, the steel will undergo one of several processing methods such as casting to make final metal products or rolling to make sheets like those needed for pressure vessels. 27
Crew Hazard Assessment in Lunar MRE
To evaluate the safety of critical maintenance operations that would necessitate crew EVAs on the lunar surface, the number of risks in each hazard category were tallied based on the procedures summarized in the lunar surface columns in Table 4. Standard risk mitigation strategies were applied. Table 5 includes weighted risk assessments for each crew procedure, with unclogging the regolith feeder showing the highest risk. Notably, the argon system is not expected to be necessary for operation in the lunar environment; as such, the associated maintenance procedure incurs no risk.
Lunar MRE hazard identification after adding standard mitigation strategies, following recommendations provided in Table 1. The relative risk assessment of each hazard depends on the operational environment.
Table 5 shows the risk assessment for maintenance under EVA and intravehicular activity (IVA) conditions to demonstrate the role of assumptions on the model results. In this case, the primary changes to the AHP structure are a reduction in pinch point consequence and material contact frequency in the IVA condition; other parameters vary slightly. Pinch points are a concern in EVA operations because they can lead to spacesuit depressurization, which is not an issue in IVA procedures. Material contact frequency tallies include Lunar dust in EVA procedures, which is assumed to be less prevalent in IVA. The resulting relative risk assessment across the two sets of assumptions demonstrates the utility of this method, as input parameters and assumptions can be adjusted to best represent the operational conditions. The output reflects the highest-risk procedures given the relevant environmental considerations. As mentioned in Methods, the maintenance operations are assumed to be conducted in EVA; the EVA model inputs are therefore used for the remaining AHP calculations.
Earth-Based Analog MRE
Analog testing is needed for crew procedures in the proposed lunar surface MRE process to enable successful maintenance operations while ensuring crew safety. Here, we describe the design of the analog, Earth MRE reactor, followed by weighted risk calculations before and after including mitigations. This shows the progression in crew safety resulting from application of this AHP method.
Earth MRE Reactor Design
The MRE reactor is designed to produce steel in batches to enable large-scale steel production from simulant regolith feedstock while ensuring safety. The reactor design features two alumina tubes, each capped with large endcaps, housed in a Carbolite vertical tube furnace that maintains temperatures exceeding 1600 °C. The inner tube of the reactor holds the regolith before and during its molten state, while the outer tube serves as a secondary containment to protect against potential ruptures of the inner tube. The endcaps are equipped with O-rings to maintain an inert argon atmosphere, a liquid cooling loop, and various mounts for system components such as the anode and gas inlet and outlet. These are made from solid aluminum for analog testing and intended to be stainless steel for lunar use. Additionally, the endcaps connect the alumina tubes to the supportive mount, ensuring structural stability. 27
Analog Lunar Environment Testing of MRE Components
To test the designed and prototyped system, the subsystems of the Earth MRE reactor are operated in four phases: (1) loading, (2) heating, (3) operation of extraction, and (4) cooling. Here, we describe the components of each phase that are relevant to the maintenance operations and, therefore, that are considered in the AHP calculations.
Loading: During the loading phase, the inner tube is filled with powdered regolith simulant, representing a post-beneficiation composition of 33% FeO and 67% regolith.27,28 The regolith is supported by a large electrolytic iron rod at the bottom of the reactor, which also functions as the cathode for electrolysis. The reactor is purged using a vacuum pump, followed by an inflow of argon gas, repeated at least three times. The Earth MRE process is run in an inert argon gas environment to prevent the effect of Earth's atmosphere on the MRE process. This can also be tested in a vacuum. Once a suitable argon atmosphere is established, the furnace is powered on. Heating: The furnace autonomously increases the temperature at a rate of 120–180 °C per hour during the heating phase. Operation: When the furnace reaches 1550–1600 °C, the operation stage begins. A molybdenum rod with iridium wire tips, serving as the anode, is slowly lowered into the molten regolith. Once electrical contact is made, electrolysis occurs at a voltage of approximately 1–3 V and a current of 50–70 A. Oxygen gas produced during electrolysis is carried by the flowing argon into the exhaust system. The iron separated through electrolysis deposits on the iron electrode. As the iron rod grows, the distance between the cathode and anode varies. To address this, the distance is maintained using the extraction rod (ER), enabling autonomous operation with minimal active participation, thus prioritizing safety and astronaut time. Cooling: After about an hour of operation, the furnace cools down to solidify the produced iron and slag. An automatic collection system slices the solid slag and iron off the electrode using the slag and iron slicer, extraction rod (SIS + ER), and the back rod opposer (BRO). This iron is then fed into the rest of the lunar steel pipeline.
Crew Hazard Assessment in Analog Testing
The analog testing procedures were evaluated using AHP based on the failure mode analysis shown in Figure 1. This shows a quantifiable risk reduction associated with mitigation techniques on all crew procedures, shown in Table 6.
Quantifiable risk reduction achieved through the addition of standard mitigation strategies following those recommended by FAA guidelines. 14 Risk rankings are calculated for the Earth MRE process with and without mitigation strategies.
Discussion
There is an unmet need to define acceptable risk limits and associated hazard guidelines for ISM procedures. This paper provides a method to assess which procedures incur the highest risk in human operations to inform mitigation efforts. The dynamic AHP model could be applied to assess the risk reduction associated with a mitigation strategy or combination of mitigation strategies. It also can identify high-risk procedures for additional engineering or administrative controls. This can be applied to planetary surface operations and to analog testing of new technologies to ensure crew safety by enabling the development of improved safety standards. Improvements to the dynamic AHP model could be made to address the assumptions listed in the Methods section. For example, the frequency of crew operation could be considered to mimic the standard risk assessment matrix parameters. Although the procedures are all expected to be infrequent, some could be more likely to occur than others. Frequency of operation can therefore be reflected in the weighted scores, such that procedures more likely to require frequent crew maintenance are scored higher. When applying this method to systems with detailed failure mode analyses, metrics like a comparative mean time between failures can be incorporated into the AHP pairwise comparisons to give those with more frequent failures a higher final score. This would ensure that higher frequency operations receive proportionally more attention for additional mitigation measures.
Risk in astronaut EVA operations must be sufficiently addressed prior to risk acceptance; this can occur through effective safety standards to reduce the likelihood of encountering a risk or through increasing reactive capability through medical care or evacuation procedures to reduce the consequence of each risk. Design-based and procedural mitigations are the approach investigated here to reduce the likelihood and consequence of sustaining an injury to the crew. An alternative approach is to ensure sufficient surface medical capabilities to enable medical care if the processes do result in astronaut injuries. This is reactive rather than preventative and can have additional operational impacts beyond the success of the maintenance operation. For example, other crew capabilities may be constrained by the changes in mobility, cognition, or any human health and performance metric that result from the injury. Mitigation via medical care requires additional mass and resource allocations for the necessary equipment and consumables. The identification of specific medical equipment to accomplish this goal and a trade study comparing reactive medical care to standard-based preventative mitigations is beyond the scope of this paper and an area for future research.
Footnotes
Acknowledgments
ARTEMIS Steelworks
27
was an MIT student project developed in response to the 2023 NASA BIG Idea Challenge, in which the team was selected as a finalist and won the “Big Picture” award. This team of 19 undergraduate and graduate students was led by Palak Patel and Jose Soto and co-advised by Dr George Lordos, Dr Jeffrey Hoffman, Dr Antoine Allanore, Dr Martin Culpepper, and Dr Olivier de Weck. The authors would like to thank the ARTEMIS Steelworks team for their detailed and groundbreaking design for Lunar ISRU steel production that served as the basis of this analysis. The authors would like to acknowledge the NASA 2023 BIG Idea Challenge for funding the work done on ARTEMIS Steelworks. Website:
uploads/MIT-Technical-Paper.pdf
Author Contribution(s)
Funding
The authors received no financial support for the research, authorship, and/or publication of this article.
