Gaganyaan Panel Design

Role

Product Design

Industry

Aerospace

Duration

6 Months

AIM

To design a hard-panel button interface for a spacecraft that, under a defined set of worst-case scenarios, enables the crew to safely deorbit and complete splashdown while executing all essential functions required throughout the entire transition from orbit to splashdown.

System Philosophy

Worst Case Scenario

Hard buttons on the panel are designed to catering worst case Scenario

Single-crew operation.
Both touchscreen displays non-functional.
Communication failure (Mission Control Center unavailable).
Cabin depressurized, with crew inside an inflated spacesuit and strapped into the seat.
Accelerated flight phase.

System Philosophy

Objective of the Design

Purpose of this panel:

To support safe, intuitive, and error-proof crew interaction.
To enable critical spacecraft operations across all mission phases.
To minimize human error under stress.
To ensure compatibility with gloved operation (including inflated condition)

System-Level Philosophy & Architecture

The spacecraft hard control panel is designed as a crew-centric, safety-critical subsystem, independent of software-driven interfaces, with the following governing principles:

The hard panel shall be physically and electrically independent of all display and touchscreen systems.
The hard panel shall enable crew survival in the event of total software failure.
No hard panel control shall require touchscreen confirmation; all critical actions shall be completed through direct physical interaction.
The hard panel shall support both safe abort and safe mission continuation.
Crew intent shall always override automation, with the panel designed assuming the crew as an intelligent subsystem, not a passive operator.
No single failure shall disable all hard controls, ensuring fault tolerance and survivability.
The panel philosophy follows a Soyuz-inspired gradual automation approach, where automation assists but manual control remains continuously available.

Mission Phases Considered

Pre Flight
Ascent
Orbital
Descent
Atmospheric entry
Parachute phase
Post splashdown
Buttons are designed and placed based on phase of use, criticality, and frequency of interaction.

Hard-Panel Emergency HMI - Design Philosophy (Blind Phase)

Core Principle:-

Hard panels are not backups - they are the last survivability interface.

They must function when light, vision, cognition, and dexterity are degraded
(0 lux, smoke/visor fog, high stress, gloved or one-handed operation).

Why Hard Panels Still Matter:-

Smoke and fire make displays and touchscreens unreliable
Stress collapses menu navigation ability
Gloves defeat capacitive interfaces
Survivability demands mechanical truth

Function Exclusivity (Blind Phase):-

One hard control = one irreversible emergency function
(e.g., Mask ON, Emergency Light ON, Fire Suppression DISCHARGE)
No multi-function buttons
No mode-dependent reassignment

Guarding & Interlocks (Blind Phase):-

Guarding is selective, not universal
Critical interlocks are mechanical, not software-based
(e.g., Guard lift + push to discharge fire suppression)

Body-Referenced Placement:-

Controls are placed relative to the crew body, not panel symmetry
Oxygen → closest to head/torso
Fire controls → along translation path

Tactile Identification (Blind Phase):-

Every emergency control identifiable by touch alone

Passive Visibility (Blind Phase):-

Photoluminescent material on button edges and switch bases
Must remain visible >30 minutes after total light loss
No reliance on powered backlighting alone

Cross-Panel Consistency:-

Identical layout, orientation, and tactile coding across panels
Crew must never ask: “Which emergency panel am I at?”

Interaction Philosophy

Interaction Rules:-

Critical ≠ Fast
Critical ≠ Easy
Intentional > Convenient
Physical confirmation > software dialog
Only time-critical commands require immediate action (e.g., Abort)
Some critical commands are not time-critical
(e.g., Depress), but must still support rapid, deliberate interaction

Crew Reach & Authority:-

Either hand
One-handed operation
Control stick assistance
Panel interaction is designed to be possible using

External Control Peripherals (Joystick & Roll Controller)

To provide a software-independent, physical attitude control interface usable during orbital, descent, separation, and future docking operations.

Control Hardware Overview:-

Single Joystick
1. Used for Orbital and Descent phases.
2. Same joystick used across multiple mission phases.
Roll Control Handle
1. Two dedicated roll control buttons.
2. Additional 4 spare buttons reserved for future functionality.

Operational Use Cases:-

Orbital Phase
1. Used for manual attitude control
2. Supports pitch and yaw control
3. Roll handled via roll control buttons
Orbital Phase
1. Used for manual attitude control
2. Supports pitch and yaw control
3. Roll handled via roll control buttons

Joystick Control Mapping:-

Forward / Backward: Pitch control
Left / Right: Yaw control

Joystick Location & Ergonomics:-

The joystick is located below the main panel and remains stowed when not in use; when required, it can be pulled toward the crew, allowing comfortable operation while restrained and wearing a spacesuit with gloved hand

Critical Case:-

CM–SM Separation

If onboard computer fails to achieve correct attitude:

Crew uses joystick to achieve desired attitude

Joystick remains active during separation Control authority transitions:

From SM thrusters
To CM thrusters, as required

Prevents recontact or collision between CM and SM after separation

Future Docking Operations (Planned):-

Same joystick will be used for docking

Pitch
Yaw
Roll

Thruster firing:

Left / Right
Up / Down

Enables orbital maneuvering without introducing new hardware

Critical Buttons

Abort & Depress

ABORT - Critical Crew Survival Control
Visual & Tactile Differentiation

Abort control shall be:

Visually distinct from all other controls
Physically distinct by shape and motion
No other control shall share similar form or interaction pattern

Iterations

Function & Priority

Active Phase

Pre-launch
Ascent

Priority Level

Highest-priority crew survival function
Time-critical

System Characteristics

Hardwired and electrically independent
Bypasses NGC and mission computer
Remains available during ascent blackout

Interaction & Performance Requirements

Abort shall be executed within ≤ 1 second human reaction time

Interaction shall prioritize minimum latency

*Activation feedback shall be:

Physical (lever movement, detent)
Visual (indicator / annunciation)

Control Philosophy

A dedicated single-action abort control shall exist
Abort is time-critical, unlike most other critical controls.

Design follows one command, two physical steps to:

Prevent accidental activation
Minimize execution time once intent is declared

Selected Control Type (Final Direction)

Control Type

Lever-based abort control

Rationale

Allows activation with gloved, inflated hands
Provides unambiguous physical state change
Faster than multi-button or menu-based actions

Directional & Ergonomic Logic

Lever direction shall be opposed to the acceleration vector
Prevents inadvertent activation due to inertial forces

Final Design

Control Type

Dedicated Abort Lever with integrated activation button and light within the grab handle. When the light “Manually” will turn on indicating that auto abort is not happening and crew should manually abort.

Usage Sequence

Press and hold the button located at the bottom of the lever handle
Grasp the lever handle firmly with a gloved hand
Pull the lever downward to execute Abort

Condition of Use

During the ascent phase, while the crew is strapped into their seats under accelerated flight conditions, the lever should be sized to be operable while wearing gloves, including accommodation for the inflated glove condition.

DEPRESS - Button Design

Philosophy

Critical but not time-critical
Must be executed fast once intent is confirmed
Multi-step interaction prevents accidental activation

Function

Manual cabin depressurization

Use cases:

Fire / smoke mitigation
Heavy smoke condition
Toxic cabin atmosphere

Button & Light Philosophy

Philosophy

Buttons will be flushed inside the panel to prevent accidental press in higher G force.
Buttons will be grouped with their phases, except critical buttons.
General function requiring two step philosophy will have blue labeled button which will execute the action after crew pressed the execute button.

Philosophy

There will be a caution and warning lights panel on the top.
All the lights will be categorized based on their function and criticality.
Lights which are supposed to show a trend or value will have 5 light under it which will change its color when the value reaches a particular threshold for that function.

Green: Nominal
Amber: Off-Nominal/ Caution / Degrading
Red: Critical
Blinking Red: Immediate crew awareness required
Blue: Execute action (Only used in buttons)

ASCENT PHASE - Buttons Philosophy
Button Philosophy by Mission Phase

Enable button with guarding in OM-LV separation is there to prevent inadvertent or accidental operation.
A two-button, three-second press philosophy is implemented to ensure conscious intent during the execution stage.
In addition, an interlock mechanism is provided that prevents activation of this button in any other mission phase.
The Enable button will remain disabled and will only become active during the last 30 seconds of the upper stage before insertion.

ORBITAL PHASE
Philosophy

Orbital phase grouping will have Manual Attitude control which is a two step enable and execute action which will unlock the 4 attitude states and the orbital joystick which will turn on Joystick light.
When the Attitude shift will happen in module manually or automatically, RCS light will turn green.
There will a button for Gyro inertial hold, Solar array Deployment if didn’t happened automatically.
A separate button to Reset SM Power which is placed away from rest with a warning strip to visually tell the crew that this button should not be pressed until needed critically.
There will also be an interlock with SM Low voltage light. When the light will turn red then only this button will get enabled when pressed

Manual Deboost
Philosophy

Manual Deboost will be used when LAM will not burn automatically.
Crew will get to know LAM has turned on by the green light. If it is off when needed, crew will manually press LAM burn and Start.
RCS Burn will be used as backup if the LAM light is red indicating there is some fault in the engine.
When RCS burn is enabled, RCS Deboost light will turn on.

Descent & Re-entry
Philosophy

Descent and reentry will have buttons for SM-CM Separation which when enabled will turn on the Separation Enabled light and when Executed will turn on the SM-CM light.
It will also have manual reentry light to enable descent joystick. When clicked enabled Manual Reentry light will turn on.
On the bottom there will be 3 lights to activate parachute manually if they not got deployed automatically.

Post Splashdown
Philosophy

Post Splashdown button will have functions which will be used after capsule is landed on Earth. All the function will be enabled after the Splash light is turned on.

POWER BUS 1,2,3

Each Power Bus represents an independent electrical distribution path

Allows crew to:

Isolate faulty electrical paths

CIS ARM

Arms the Crew Intervention System
Grants crew authority to intervene in automated control
Does not execute thrust or sequencing by itself

CIS THRUST

Enables crew-commanded thrust intervention
Active only when CIS is armed

CIS SEQ

Enables or steps through manual command sequencing
Used when automated sequencing fails or is unavailable

TC Absent

This light indicated the loss of communication from ground in a decided time.
After a particular time duration if the link is not formed then Amber light will start glowing.
It tell the crew to take autonomous decision.

Volume Knob
When we rotate the knob it will change the PTT volume and if we press the button in the knob and then rotate it will change the intercom volume.
TX / RX Selector (Knob)
Used for communication checks
Allows verification of audio routing and signal flow

Cabin Light Selector (3-Position)

Dedicated Abort Lever with

OFF: No cabin lighting

DOME: General ambient illumination
SPOT: Focused task lighting

Rotary enables quick, intuitive selection

HEX Fan

Provides internal cabin air circulation
Modes

ALPHA 1 / ALPHA 2
BRAVO 1 / BRAVO 2

ARS Scrubber System

ARS Scrubber 1 / 2

Removes CO₂ and contaminants from cabin air

Regenerator
- Restores scrubber capacity after saturation

The buttons which needs two steps because of critical nature will executed by execute button

STATUS DISPLAYS & INDICATORS
Philosophy

Awareness over interaction
No decision should depend on menus
Information must be glance-readable

Time

IST (Indian Standard Time)
UTC (Universal Coordinated Time)
Supports crew - ground synchronization
Time display includes Start, Stop, and Reset buttons to control and monitor running time

G-force meter

A mechanical G-meter is provided so that acceleration can be monitored even if electrical power is unavailable.

Color & Behavior Hierarchy (Global Rule)

Green: Positive state

Amber: Caution / Degrading

Red: Critical

Blinking Red: Immediate crew awareness required

Blue: Execute action

Philosophy

Lights inform, they do not command

Color communicates state instantly

They must work when:

Displays are unavailable
Crew attention is limited
Cognitive load is high

Battery Status Light Logic
Battery Operating Modes

Charging
Discharging

Indication

Green: Battery charging
Amber: Battery discharging

Solar Array Status Light Logic

Primary Solar States

Facing the Sun
Not Facing the Sun

Indication

Facing sun & charging : Green
Not facing sun / not charging : Ambe

Solar Energy Generation Sublights

Five sublights indicate relative power generation level
More lights illuminated = higher energy generation

Life Support & Thermal

Appendix

Interface design iterations

We created first iteration of display HMI by categorizing the center canvas into 2 parts. So the crew can view 2 separate details of spacecraft at any moment