Designing for Observable Autonomy

A Gastronaut capability report

A cultivation system can hold a set point and still consume crew attention. Autonomy becomes answerable when the operating record shows what the system performed, when a person intervened locally or remotely, which fault prompted the intervention, and whether service returned. Gastronaut can make that record part of ORCA’s ground development, giving later teams continuity between what was designed, observed, and changed.

The claim remains bounded. ORCA has no flight or lunar operating history and has not demonstrated autonomous operation in either environment. It is a ground-stage system at approximately TRL 3 to 4. Observable autonomy is a design objective and a validation method, turning intervention, maintenance, support, and recovery into evidence that NASA and investors can assess. Product maturity and evidence maturity must remain aligned.

Why observability matters

Food-system engineering studies discuss workload more often than they measure it. Gastronaut’s frozen evidence version identified 3,407 unique records, assessed 291, and analyzed 151. Among the 151 analyzed abstracts, 23 named crew time or workload as an outcome. Three reported a number. None of 14 human-spaceflight records quantified what the food system cost to fly. These counts apply to the analyzed abstracts. That version retrieved no full texts; a screening defect also excluded at least 19 records containing “equivalent system mass” before review.

Correcting the intervention coding left the FSY T4-versus-T2 comparison null (Fisher p = 0.100). The review does not show a significant tier collapse (Gastronaut).

This gap proves neither that cultivation requires too much labor nor that automation removes it. It shows why the work needs a definition.

EDEN ISS offers a measured example. During its 2019 experiment phase in Antarctica, the facility recorded 694.5 crew-member hours and reported 6.31 crew-member hours per kilogram of edible biomass. On-site operator time was about four times remote support time (Zeidler et al.). The analog makes the support boundary visible. It does not establish a flight workload, and a lunar system may change task duration, fault frequency, communications, maintenance access, and acceptable delay.

Another record on robotic habitat technologies states that logistics, repair, and maintenance can consume a large share of crew time in International Space Station operations. In this report, the finding identifies a category of burden. The source does not support assigning its stated percentage to cultivation hardware or ORCA (Broemmelsiek et al.).

Confidence is high that ground analogs can measure food-system labor and workload. Confidence is low in any ORCA flight-workload estimate because the platform has no flight record and the relevant operating configuration remains untested.

From an automation label to an operating record

The word “automation” can compress several operating states into one label. A device may maintain a set point while requiring frequent inspection. A controller may respond to a known fault yet leave recovery to the crew. Operations may look autonomous at the hardware boundary while remote specialists guide them. Cleaning, sanitation, crop handling, food preparation, and consumables may remain beyond the control system even though the service still depends on them.

Observable autonomy separates these states. That distinction is where a responsible autonomy claim begins and where its limits remain visible.

For each operating interval, ORCA’s proposed record can identify commanded mode, environmental state, crop stage, sensor and actuator health, scheduled tasks, unscheduled intervention, operator and remote-support roles, duration, fault classification, response, recovery criterion, and effect on edible output. Automated and human actions would share a timeline without being treated as equivalent.

Three patterns of labor change then become visible.

Avoided work requires a baseline task, comparable operating conditions, and a stated allocation among system, crew, and ground support.

Shifted work stays inside the architecture. A local task moved to remote specialists still carries communications, staffing, and mission-support cost. Maintenance deferred until failure may reduce routine labor while increasing recovery risk.

New work often gathers at the measurement boundary. Instrumentation, cleaning, calibration, sampling, documentation, and science operations may add labor while improving safety or evidence quality. A complete account keeps that burden beside the service it supports, so a later decision does not inherit an unexplained cost.

Fault recovery is part of autonomy

Fault recovery is the moment when a crew needs the system to explain itself. That moment defines a decision-grade test. Airflow loss, carbon-dioxide excursion, sensor drift, root-zone flow interruption, lighting failure, contaminant-control degradation, or a crop condition that changes atmosphere demand can each expose a control boundary.

An injection would begin at a declared detection threshold and end at a recovery criterion. The record would capture time to detection and safe state, automated, crew, and remote actions, consumables used, biological material retained or lost, and time to restored service.

An unfavorable result can still carry value. A configuration requiring repeated expert intervention can be redesigned on the ground. An ambiguous fault can prompt another sensor or a narrower operating range. If recovery preserves the crop but exceeds the crew-time allowance, the record exposes an interface problem rather than hiding it inside a success label. That candor is part of responsible progression.

What NASA and investors can decide

NASA needs an operating record for workload allocation and human-system integration. A ground demonstration can reveal whether task definitions, alarms, safe states, and recovery evidence are ready for a more constrained analog. It cannot establish a lunar workload directly.

Investor diligence asks whether a campaign removed a named technical dependency. A milestone may show that a recurrent intervention was automated, a fault class became observable, recovery no longer required specialist support, or the upper tail of task duration moved within a declared band. The next capital decision can then consider a measured reduction in burden rather than a general autonomy narrative.

Gastronaut gains a product record that persists across configurations. The same schema can compare software revisions, crop protocols, sensors, actuators, and support concepts without erasing what changed between tests. Continuity then becomes a property of the evidence as well as the product.

The capability to earn

Gastronaut can begin with a ground workload baseline and a bounded fault-injection campaign. The deliverable would include task definitions, event logs, intervention distributions, local-to-remote support ratios, recovery evidence, edible output, and the assumptions needed for a mission analog.

Observable autonomy does not ask NASA or investors to assume that ORCA will need less attention. It reveals how much attention the system requires, when that attention is called for, and what becomes possible as the burden falls. In a crewed mission, saved time matters. The first duty is to understand it.

References

Broemmelsiek, Rachel, et al. “Robotic Habitat Technologies for Minimizing Crew Maintenance Requirements.” University Libraries, University of Maryland, 2020, doi:10.13016/o8o0-4nsw.

Gastronaut. Food System Engineering and Logistics: Evidence Synthesis. Report GAS-B4-FSY-20260822, evidence version 22 Aug. 2026. Research synthesis.

Zeidler, Conrad, et al. “Crew Time and Workload in the EDEN ISS Greenhouse in Antarctica.” Life Sciences in Space Research, 2021, doi:10.1016/j.lssr.2021.06.003.