WIA-SPACE-009 protects astronauts and spacecraft from radiation across every phase of a mission: low Earth orbit (LEO) operations, lunar missions and surface work, Mars expeditions and deep space travel, extravehicular activity (EVA), and emergency radiation events. Its scope runs from radiation sources through health effects and risk assessment, passive and active shielding, monitoring systems, operational procedures, and medical countermeasures to mission planning. The standard sits on established references: ICRP publications, NASA STD-3001 (the Space Flight Human System Standard), ISO 15390 for galactic cosmic rays, and the NCRP reports on space radiation.
Phase 1 turns that scope into a wire-format contract made of six record types, called envelopes. Each one answers a different question that a radiation-protection program must be able to document.
| Envelope | Question it answers |
|---|---|
| Radiation-source record | What is the radiation, how is it distributed in energy, time, and space? |
| Dose record | What did a specific crew member receive, measured by what, with what uncertainty? |
| Risk criterion | Which limit table applies, and what risk does it represent? |
| LET spectrum | How is the energy deposition distributed across linear energy transfer? |
| Dosimeter record | What instrument produced the number, how is it calibrated, and where was it placed? |
| Mission radiation budget | What cumulative dose is projected per crew member for each mission segment? |
The envelopes reference one another. A dose record points to the dosimeter record that produced it, and a mission budget draws on source projections and shielding configurations. A reviewer can therefore trace any reported number back to its instrument, its model, and its limit table.
Space radiation differs from terrestrial occupational exposure in two ways. Part of it consists of heavy, highly ionizing particles that terrestrial practice rarely meets, and it cannot be fully shielded at any practical mass. A spacecraft crew therefore does not aim for zero exposure. It manages exposure as a finite resource that is planned before launch, measured during flight, and reconciled afterward.
The governing rule is the ALARA principle: all exposure is kept as low as reasonably achievable through three levers.
The standard's quantities follow the usual dosimetric chain, and the dose-record envelope carries each link explicitly:
| Quantity | Unit | Basis named in the standard |
|---|---|---|
| Absorbed dose | gray (Gy) | ICRU 33 |
| Equivalent dose | sievert (Sv) | ICRP 103 radiation weighting factors w_R |
| Effective dose | sievert (Sv) | ICRP 103 tissue weighting factors w_T |
| Measurement uncertainty | envelope | ISO/IEC Guide 98-3 |
Keeping absorbed, equivalent, and effective dose side by side matters because a single "dose" number hides the weighting choices behind it. Two programs can report different sieverts for the same physical exposure if they weight differently. By recording each step and its basis, the envelope lets a reader see where such a difference arises.
The source-record envelope groups sources by physical mechanism. Each mechanism has its own temporal behavior, which is why the envelope separates steady, event-driven, and orbital time structures.
| Source | Composition and energy | Temporal behavior | Risk and shielding notes |
|---|---|---|---|
| Galactic cosmic rays (GCR) | About 85% protons, 14% helium, 1% HZE particles; hundreds of MeV to hundreds of GeV | Continuous; modulated by the solar cycle (30–50% variation) | High risk on long-duration missions (beyond six months); very hard to shield, since full protection would need meters of material |
| Solar particle events (SPE) | Over 90% protons; tens to hundreds of MeV | Hours to days; correlated with the solar cycle | Very high risk during events; acute radiation syndrome is possible; warning time ranges from 10 minutes to several hours |
| Trapped radiation | Inner belt: high-energy protons. Outer belt: electrons (0.1–10 MeV) | Inner belt very stable; outer belt highly variable | Depends on altitude and inclination |
The inner belt lies at roughly 1,000–6,000 km altitude and the outer belt at roughly 13,000–60,000 km. The South Atlantic Anomaly, near 30°S, 60°W, contributes 70–80% of an ISS astronaut's dose, and the ISS orbit crosses it five to six times a day. The envelope also covers secondary radiation (neutrons and spallation products, treated through HZETRN) and extragalactic gamma-ray bursts.
Each source record carries a source identifier and an energy spectrum, expressed as LET in keV/μm, with a particle-type breakdown and a flux-energy distribution. It also carries a temporal envelope: steady-state for GCR, and for an SPE the onset time, peak time, and duration. The spatial envelope holds heliocentric distance, geomagnetic-cutoff rigidity (per IGRF-13), and shielding-thickness context. Trapped-radiation models are cited as AE-9 and AP-9.
The standard expresses career limits as a 3% risk of exposure-induced death (REID), set per age and sex. The narrative section lists values such as 600 mSv for a 25-year-old female, 1,000 mSv for a 35-year-old male, and 1,200 mSv for a 45-year-old male. The risk-criterion envelope describes the NASA permissible-exposure-limit table as ranging from 0.4 Sv (age 25, female) to 4.0 Sv (age 55, male). Short-term limits are 250 mSv over 30 days and 500 mSv per year. Organ limits appear in two framings. The narrative lists lens at 2,000 mSv career and skin at 6,000 mSv over 30 days. The criterion envelope lists 30-day limits of 250 mGy-eq for blood-forming organs, 1000 for lens, and 1500 for skin, and annual limits of 500, 2000, and 3000.
Because the figures differ by framing, an implementation should not hard-code one number. The practical lesson of the envelope design is that every risk evaluation should cite which limit table it used, drawn from NCRP 132, 153, and 167 and NASA-STD-3001 Vol 1. The envelope also holds the SPE acute-exposure envelope, the central-nervous-system risk envelope (NCRP 153), and the cardiovascular risk envelope (NCRP 167). ICRP 103 career limits differ from NASA's and are cross-referenced explicitly rather than silently merged.
The dose record lists the following, shown here as a descriptive outline (labels are illustrative, not normative field names):
dose identifier ............ UUID v7 (RFC 9562)
crew-member reference ...... privacy-compliant identifier
instrument reference ....... link to the dosimeter record
absorbed dose .............. Gy
equivalent dose ............ Sv (ICRP 103 w_R)
effective dose ............. Sv (ICRP 103 w_T)
organ-dose breakdown ....... lungs, colon, stomach, breast,
gonads, red marrow, thyroid
uncertainty ................ ISO/IEC Guide 98-3
audit ...................... tied to the mission operator
(NASA, ESA, JAXA, CSA, Roscosmos, CNSA)Heavy-ion risk is where models diverge most. The LET-spectrum envelope therefore requires the quality-factor choice to be stated: ICRP 60, ICRP 103, NASA Q(LET), or NCRP-Q. These differ for HZE particles above 100 keV/μm, and the choice must be documented.
Shielding in the standard is expressed as mass-thickness per material, and the budget envelope records it separately for the spacecraft hull, the emergency shelter, and, where used, surface-habitat regolith berming. Passive and active approaches are both in scope. Phase 1 concentrates on how a configuration's effect is recorded, not on the engineering of any one design.
Shielding does not simply reduce dose. For GCR, thick material can fragment heavy primaries into secondary neutrons and spallation products, which is why the source envelope includes secondary radiation. The LET-spectrum envelope makes this visible through its depth-resolved structure, which captures the spectrum at entrance, target, and exit for each shielding configuration. A designer can then see whether added material shifted the LET distribution toward lower values or only changed the particle mix. Particle-type-resolved flux (proton, alpha, HZE) supports the same comparison.
The difficulty ratings in the standard guide the strategy. SPE protons are comparatively tractable, which is why a dedicated emergency shelter with its own recorded mass-thickness is a sensible configuration. GCR is rated very hard to shield completely, so long missions must rely on the other ALARA levers and on a realistic budget rather than on shielding alone. Recording the shelter separately from the hull lets the budget compute a dose for a crew member sheltering during an event and a different dose for normal habitation.
The dosimeter-record envelope catalogs the instruments by operating principle:
The groups complement each other. Passive devices integrate dose over a period without power and are read out afterward. Active devices resolve events over time, which is what an alert needs. Phantoms carry detectors inside tissue-equivalent bodies, giving organ-level estimates that a badge on a suit cannot. Every dosimeter record carries a calibration envelope per ISO/IEC 17025 and a traceability chain to NIST or PTB primary standards. It also carries a deployment-position envelope, stating whether the device sat intra-vehicular, extra-vehicular, or behind shielding.
Position matters because the same instrument reads very differently in a shelter and on an EVA. Without it, a reading cannot be compared with another. The warning-time window for SPEs (from 10 minutes to several hours) also shapes monitoring design. Alerts must be raised and acted on inside that interval, so the active instruments feed the operational triggers in the next section.
Operational practice begins with the mission-radiation-budget envelope, computed before flight for each crew member. It starts from a trajectory: LEO at 400-km altitude, cislunar, lunar surface, Mars transit, or Mars surface. Each trajectory brings its own mix of GCR, SPE, and trapped-radiation context. It then combines three projections with the shielding configuration:
The result is a cumulative-dose envelope per mission segment, which can be compared against the applicable risk criterion before the crew is assigned. Naming the scenario in the budget matters. A reviewer who sees "solar minimum" and "1972 reference event" knows how conservative the projection is, and a later change in the assumption becomes a visible revision rather than a silent shift.
During flight, each measurement becomes a dose record, and each record SHOULD emit a structured log line. The line carries an RFC 3339 timestamp, host and tenant identifiers, the envelope class and identifier, the outcome, and a trace identifier propagated per W3C Trace Context (traceparent). Phase 2 returns that identifier in the X-WIA-Trace-Id response header, so one dose-record operation can be reconstructed across hosts. Dose data are also personal data, so the envelope's privacy rules apply, as described next.
The standard lists medical countermeasures within its scope, but Phase 1 defines no treatment protocols or specific agents. What it supplies is the evidence a flight surgeon needs. Acute radiation syndrome is possible during a large SPE, so rapid access to the dose record, its instrument reference, and the organ-dose breakdown is the starting point for any clinical decision. The listed high-w_T organs (lungs, colon, stomach, breast, gonads, red marrow, thyroid) are those where organ-level estimates matter most for later health follow-up. The uncertainty envelope tells clinicians how much weight a given number can bear.
Long-term risk is handled through the criterion envelopes. The central-nervous-system risk envelope (NCRP 153) and the cardiovascular risk envelope (NCRP 167) tie a crew member's accumulated exposure to the late-effect concerns that follow GCR exposure, alongside the career REID threshold. Countermeasure choices therefore sit next to numbers that were measured and projected under documented assumptions.
Medical use raises privacy obligations. Crew references must use privacy-compliant identifiers under HIPAA and the NASA Privacy Act. Where an envelope carries personal data, the operator's jurisdictional law applies, including the GDPR, UK GDPR, CPRA, LGPD, PIPEDA, Korea's PIPA, Japan's APPI, and Australia's Privacy Act. The principles are data minimisation, purpose limitation, storage limitation, integrity and confidentiality, and accountability. Cross-border transfers must reference the operator's transfer mechanism (SCC, UK IDTA, APEC CBPR, ASEAN MCC) in the audit record. Subject-rights handling (access, rectification, erasure, portability, restriction, objection) is delegated to WIA-OMNI-API and is not reimplemented per standard.
The mission profiles the standard names (lunar surface work, Mars transit, Mars surface) all increase the weight of GCR and shrink the margin for error, since GCR is continuous, hard to shield, and most uncertain for HZE particles. The open questions are already visible in the data format. The Q-factor choice is documented because models disagree above 100 keV/μm. The central-nervous-system and cardiovascular envelopes exist because those risks are still being characterized. Budgets require a stated solar-modulation scenario and a stated confidence percentile because projections depend on assumptions that future measurements will refine. Richer LET spectra (100 or more log-spaced bins rather than the minimum five boundaries) and more phantom data are the natural way to reduce those uncertainties.
One paragraph on evolution of the specification itself. Within the 1.x line, hosts may add optional fields and envelopes but must not remove existing ones, and breaking changes need a major version with a 12-month deprecation window. A host may advertise optional capabilities at /.well-known/wia-space-radiation-capabilities. Clients treat unadvertised capabilities as absent, and a client that needs one raises a clear configuration error rather than degrading silently. A public conformance suite and a reference container with mock data let integrators test this contract before connecting real instruments.
This chapter followed one chain of reasoning from physics to records. Sources differ in composition and timing: GCR is continuous and modulated by the solar cycle, SPEs are event-driven with warning times of minutes to hours, and trapped radiation depends on orbit and the South Atlantic Anomaly. Their effects are expressed through absorbed, equivalent, and effective dose, judged against career, 30-day, annual, and organ limits, and moderated by shielding whose effect is visible in depth-resolved LET spectra. Instruments report with calibration, traceability, and position. A pre-mission budget, built on stated scenarios, is checked against the chosen risk criterion. The six envelopes (source, dose, risk criterion, LET spectrum, dosimeter, mission budget) each hold one link of that chain and reference the others.
Two cautions carry forward. Limit values appear in differing framings across the standard, so records should cite their limit table instead of assuming one. Dose records about identifiable crew members are personal data and are handled as such. The next chapter moves from the envelope shapes to the HTTPS surface that exposes them: how a flight-operations client retrieves a dose record, submits a measurement, and subscribes to warnings, with the trace identifier introduced here following each request.