CHANGE RECORDS ISSUE DATE CHANGE RECORDS AUTHOR

Transcription

1

2 ISSUE : 01 Page : 2/31 CHANGE RECORDS ISSUE DATE CHANGE RECORDS AUTHOR 01 Initial issue for MTG based on Standard Safety Product Assurance Requirements Part 2 - Detailed Technical Safety Requirements for Flight Hardware and Ground Support Equipment, Doc H-10 Replace MTG-TAF-SA-RS-0310 D. STORTO

3 ISSUE : 01 Page : 3/31 1 INTRODUCTION 1.1 Background The flight systems and its ground support equipment is developed with the overall objective to be free of conditions, both in design and operations (assembly and tests at the launch site), that could produce uncontrolled safety hazards for: - first the ground personnel and general public, - then the launch vehicle, associated payloads, launch site ground support equipment, public and private property, and the environment, in case of launch from contractual launch sites. 1.2 Purpose The MTG safety programme is divided in two applicable documents : - Product Assurance requirements for sub-contractors and suppliers Safety section Doc. MTG-TAF-SA-RS Detailed Technical Safety Requirements for Flight Hardware and Ground Support Equipment Doc. MTG-TAF-SA-RS-0310 (this standard). Doc. MTG-TAF-SA-RS-0309 Safety section defines the safety programme and main safety requirements that have to be implemented, including methodology to conduct safety analyses. Doc. MTG-TAF-SA-RS-0310 (this standard) defines the detailed technical safety requirements that have to be implemented by all Suppliers. In this document the term "Supplier" applies to the Prime and all Contractors, Co-contractors, Subcontractors and lower levels Subcontractors involved in the project. This document is an envelop of launch sites safety regulations, focuses on main requirements and provides also requirements coming from lessons learned from previous projects. 2 DOCUMENTS 2.1 Applicable documents Generic Requirements Product Assurance requirements for sub-contractors and suppliers Safety section Doc. MTG-TAF-SA-RS Launcher Agencies Documentation Launcher User's Manual called in the contract and/or the SOW at their last issue.

4 ISSUE : 01 Page : 4/ Range Safety Regulations CSG Safety Regulations General Rules Volume 1 CSG-RS-10A-CN Edition 5 Rev. 5 CSG Safety Regulations Specific Rules Ground Installations Volume 2 Part 1 CSG-RS-21A-CN Edition 5 Rev 5 CSG Safety Regulations Specific Rules Spacecraft Volume 2 Part 2 CSG-RS-22A-CN Edition 5 Rev. 6 Eastern and Western Range Safety User Requirements Manual VOLUME 3 - LAUNCH VEHICLES, PAYLOADS, AND GROUND SUPPORT SYSTEMS REQUIREMENTS AFSPCMAN VOLUME 3 dated 1 JULY 2004 Proton Launch Operations Safety Plan LKET Issue 1 Revision 4 STARSEM at Baïkonur Safety Regulations General Rules Volume 1 RDS-001 Issue 01 STARSEM at Baïkonur Safety Regulations Spacecraft Specific Rules Volume 2 RDS-002 Issue 01 STARSEM at Baïkonur Safety Regulations Ground Installations Specific Rules Volume 3 RDS-003 Issue 01 Land Launch Safety Requirements TBD Other Documentation Electro-Explosive Subsystems Safety Requirements and Tests Methods for Space Systems MIL-STD-1576 notice 1 dated 04/09/1992 Guidelines for the selection of metallic materials for Stress Corrosion Cracking resistance in Sodium Chloride environments MSFC-STD-3029 May 2000

5 ISSUE : 01 Page : 5/31 Material Selection for Controlling Stress Corrosion Cracking ECSS-Q-ST-70-36C Fracture Control ECSS-E-ST-32-01C Rev 1 Standard General Requirements for Safe Design and Operation of Pressurized Missile and Space Systems MIL-STD-1522 A Notice 3 dated 04/09/92 Interpretations of the Design, Test and Ground Processing of flight Graphite Epoxy Composite over wrapped pressure vessels USAF Letter dated 25 April 1994 Interim safety requirements for Design, Test and Ground Processing of flight Graphite Epoxy Composite over wrapped pressure vessel at KSC, CCAFS and VAFB USAF letter dated 23 November 1993 Interim policy for Li Ion batteries US letter dated 01 May 2005 IATA Dangerous Goods Regulations Pressure equalization requirements for aircraft and shipping containers IATA ULD 80/2 DOT CFR 49 Human exposure to electromagnetic fields high frequency (10 KHz to 300 GHz) ENV (NF C ) International Council on Non-Ionizing Radiation Protection (ICNIRP) standard 2.2 Reference documents (for information only) Safety Policy and Requirements for Payloads using the Space Transportation System NSTS Space Transportation System Payload Ground Safety Handbook KHB System Safety Guidelines for Hazard Identification and Control

6 ISSUE : 01 Page : 6/31 JSC Non Metallic Materials Design Guidelines and Test Data Handbook JSC Flammability, Odor, and Offgassing Requirements and Test Procedures for Materials in Environments That Support Combustion NHB GENERAL ASPECTS OF SAFETY REQUIREMENTS [STD-SAF2-REQ-001 ] This document is only applicable for unmanned missions during ground operations up to the satellite separation from the launcher. Safety requirements are derived from launchers user's manuals and ranges safety regulations. When necessary or required, specific safety requirements have been specified. [STD-SAF2-REQ-002 ] [STD-SAF2-REQ-003 ] All requirements contained in the ranges safety regulations apply. Compliance with requirements and criteria shall be verified by safety analytical process and documented in "Payload Hazard Reports" (Refer to the Product Assurance requirements for sub-contractors and suppliers Safety section: Doc. MTG-TAF-SA-RS-0309). [STD-SAF2-REQ-004 ] Those safety requirements have been established at system level and shall be applied for all Safety subsystems as structural, materials... It is the Supplier responsibility to transmit these safety requirements in their entirety or only relevant requirements to lower levels Suppliers. The safety responsible (at each level) shall ensure that the safety requirements are included in the relevant functional and subsystem specifications. NOTE: A "safety subsystem" shall be defined as the set of subsystems, equipment, components that presents common hazard in term of "form of energy" (e.g., electrical subsystem covers all electrical boxes and harnesses of a satellite); and not as the "physical subsystems". [STD-SAF2-REQ-005 ] Each Supplier shall also identify additional safety requirements through : - the use of lessons learned from previous project, - safety analyses performed during the project. [STD-SAF2-REQ-006 ] [STD-SAF2-REQ-007 ] [STD-SAF2-REQ-008 ] The user shall be aware that above regulations (stated in 2.1) reference other documents that further detail requirements for design and operations. In addition policy letters issued by the controlling organisations supplements launch bases safety requirements. Policy letters change, clarify, or add to existing regulations between formal revisions and have the same applicability as the regulation. Compliance with the safety requirements defined herein in no way relieves the Supplier from compliance with national or international safety regulations. In case of conflict between this document and an applicable document or the Range Safety regulations, any discrepancy shall be notified to the attention of the Prime for clarification and resolution.

7 ISSUE : 01 Page : 7/31 [STD-SAF2-REQ-009 ] A compliance matrix shall be provided by the Supplier for Customer approval to identify possible deviations to the present document MTG-TAF-SA-RS FLIGHT HARDWARE DESIGN SAFETY REQUIREMENTS [STD-SAF2-REQ-010 ] [STD-SAF2-REQ-011 ] The design shall be reviewed in light of the compliance with the safety requirements. Non compliance shall be identified and submitted to the Prime for approval. The following is a presentation of main safety requirements applicable to the system, subsystems and equipment. 4.1 General [STD-SAF2-REQ-012 ] Requirements apply under worst case natural and induced environments. 4.2 Failure tolerance [STD-SAF2-REQ-013 ] Failure tolerance is one of the basic safety requirements that are used to control hazards. An applicable number of credible failures and/or operator errors shall be tolerated by the design for hazardous functions depending on hazard level: - No single failure or operator error shall have critical (or catastrophic) consequences - No combination of: - two failures, or - two operator errors, or - one failure and one operator error shall have catastrophic consequences. Refer to the Product Assurance requirements for sub-contractors and suppliers Safety section: Doc. MTG-TAF-SA-RS-0309 for hazard level classification. 4.3 Control of hazardous functions NOTE: The below requirements apply in their entirety only when the hazardous function is under the responsibility of one subsystem or unit. In the other cases the distribution of the inhibits and monitors shall be made at upper level, respectively system or subsystem. [STD-SAF2-REQ-014 ] [STD-SAF2-REQ-015 ] [STD-SAF2-REQ-016 ] [STD-SAF2-REQ-017 ] A power failure in the circuits of an interruption device (inhibit) shall not cause it to change state. That means the inhibit shall remain in the safe state. The method to control at least one of the inhibits shall be independent of the computer system. For a catastrophic hazard the independence of the remaining two controls (i.e. performed by the computer system) shall be adequately demonstrated. This requirement is applicable during ground operations up to the satellite separation from the launcher. Implementation of an automatic sequence (time tag generation...) shall not violate the fault tolerance principle. In particular the inhibits commands independence shall be respected.

8 ISSUE : 01 Page : 8/31 Design of such automatism shall be notified to the Prime Safety Manager for approval before implementation System control of functions resulting in critical hazards: [STD-SAF2-REQ-018 ] [STD-SAF2-REQ-019 ] [STD-SAF2-REQ-020 ] Two independent inhibits shall be implemented. At least one inhibit shall be monitored. Return to a safe condition shall be implemented System control of functions resulting in catastrophic hazards : [STD-SAF2-REQ-021 ] [STD-SAF2-REQ-022 ] [STD-SAF2-REQ-023 ] [STD-SAF2-REQ-024 ] Three independent inhibits shall be implemented. Monitor of at least two of three inhibits shall be implemented. Specific monitoring and safing requirements for identified catastrophic hazards based on planned operations shall be implemented. Return to a safe condition shall be implemented Liquid Propellant Propulsion Subsystem [STD-SAF2-REQ-025 ] [STD-SAF2-REQ-026 ] [STD-SAF2-REQ-027 ] [STD-SAF2-REQ-028 ] [STD-SAF2-REQ-029 ] [STD-SAF2-REQ-030 ] [STD-SAF2-REQ-031 ] [STD-SAF2-REQ-032 ] [STD-SAF2-REQ-033 ] [STD-SAF2-REQ-034 ] [STD-SAF2-REQ-035 ] Minimum of three mechanically independent flow control devices (inhibits) in series are required for catastrophic hazards. Flow control devices shall be used to isolate tanks from distribution system Opening of any flow control device shall not result in adiabatic detonation, which is a catastrophic hazard (only for monopropellant systems using hydrazine). The internal and external leakage rate of valves shall be specified (case by case analysis) Electrical controls, monitoring and safing requirements shall be function of planned operations. Requirements are specified in paragraphs and Flow control devices which isolate the propellant tanks from the remainder of the distribution system (i.e. which are inhibits) shall not be opened on ground. Components commands that are capable of heating propellant sufficiently to create a catastrophic hazard (e.g. heaters, valve coils...) shall be two failures tolerant for heating the propellant. When propellant may be entrapped upstream valve shall be equipped with a back pressure relief capability. If that valve is closed on ground, entrapping propellant in a closed portion of tubing, this back pressure relief capability shall be failure tolerant with regards to the no opening failure case. All hazardous pressure systems shall be properly grounded and bonded to the spacecraft metallic structure. The subsystem shall be designed so that depressurisation and full offloading is possible with the satellite in vertical position on the launcher.

9 ISSUE : 01 Page : 9/ Non Ionising Radiation Subsystems (undesired emission) [STD-SAF2-REQ-036 ] No inhibit is required for exposure level lower than those specified in the Table [STD-SAF2-REQ-037 ] Three independent inhibits to radiation are required if exposure level is greater than those specified in the Table (from ENV and ICNIRP). Frequency (MHz) Density of equivalent power flat wave (W/m²) Frequency / (from ICNRP) Table : Allowed RF exposure levels 4.4 Failure propagation [STD-SAF2-REQ-038 ] [STD-SAF2-REQ-039 ] All safety controls shall be designed with the intent of precluding failure propagation from one to another control in series. Design shall also minimise propagation of failures from other subsystems to the environment outside the subsystems. 4.5 Redundancy separation [STD-SAF2-REQ-040 ] Safety critical redundant subsystems shall be arranged so that propagation of failure from main to redundant or vice versa is minimised. 4.6 Structural subsystems Structural Design [STD-SAF2-REQ-041 ] [STD-SAF2-REQ-042 ] Ultimate factors of safety required by the launcher user s manuals shall be taken into account in design of the structures. Primary structures shall be designed to withstand the environmental loads induced by the vertical to horizontal tilting (and vice versa) and the horizontal spacecraft transportation to the launch pad with an ultimate safety factor greater than 1.5 or 2 according to the launcher user s manual. The spacecraft is filled during these phases (e.g. Proton, Soyouz, Land Launch... processing). [STD-SAF2-REQ-044 ] Lifting points shall be designed with an ultimate safety factor greater than 2.

10 ISSUE : 01 Page : 10/31 [STD-SAF2-REQ-045 ] [STD-SAF2-REQ-046 ] Satellite lifting points shall be capable of accepting an additional mass consisting of flight adapter + flight clampband + MGSE if any. The lifted mass = the filled satellite mass + adapter mass + clampband mass + MGSE if any. The design limit load (used for calculation) = (lifted mass x handling acceleration) x safety factor. The design of lifting points used to lift hazardous loads (e.g. fuelled satellite...) should respect a Fail Safe concept (The loss of one point will not result in the drop of the load.). Remark : Fail Safe or Safe Life choice impacts the MGSE design. Refer to [STD-SAF2-REQ-047 ] [STD-SAF2-REQ-048 ] [STD-SAF2-REQ-049 ] In the Fail Safe case, the shock induced by a lifting point failure shall be taken into account in the non single failure point analysis. In the Fail Safe case, flight hardware lifting points used to lift hazardous loads (e.g. fuelled satellite...) shall be acceptance load tested to 100 % of rated load (i.e. the maximum mass to be lifted at the range, including the additional mass) as an integral part of structural load testing. In the Safe Life case, lifting points used to lift hazardous loads (e.g. fuelled satellite...) shall be proof tested with a safety factor of 1.5 (in worst environmental conditions). After load test, volumetric and surface NDI shall be performed Stress Corrosion [STD-SAF2-REQ-050 ] For safety critical parts such as pressure vessels, lifting points, launcher interface frame... metallic materials shall comply with the Table 1 of MSFC-STD-3029 or the Table 1 of ECSS-Q-ST Pressure Vessels and Batteries Pressure vessels [STD-SAF2-REQ-051 ] [STD-SAF2-REQ-052 ] [STD-SAF2-REQ-053 ] [STD-SAF2-REQ-054 ] [STD-SAF2-REQ-055 ] [STD-SAF2-REQ-056 ] The tanks shall be compliant with the MIL-STD-1522 A, Approach A (i.e. burst safety factor equal to 1.5 or greater) requirements. If the tank is not actually burst tested a Request for Waiver shall be submitted to the Prime for approval. At minimum the tank shall be pressure tested to the calculated burst pressure. Constraints (railway vibrations...) due to horizontal transportation by rail (Proton, Soyouz, Land Launch...) in filled configuration shall be taken into account. A detailed Design Verification Matrix with regards to the following documents shall be provided: - MIL-STD-1522 A, Approach A, - Graphite Epoxy Overwrapped Pressure Vessels 29/11/93 US letter. Analyses concerning pressure variation on propellant tanks versus temperature (tank filled and temperature lower than 40 C) shall be performed (Ground concern only). Vessels, which are designed to MIL-STD-1522A, Approach A and exhibit a brittle fracture or hazardous leak before burst failure mode, shall maintain a minimum

11 ISSUE : 01 Page : 11/31 safety factor of 2:1 (design burst to range pressure) during transport or ground handling operations at the range. Please note that for monopropellant systems the design safety factor is, in general, at minimum 2 (range pressure = in orbit pressure). [STD-SAF2-REQ-057 ] [STD-SAF2-REQ-058 ] Safe operating limits shall be established for each pressure vessel based on the appropriate analysis and testing used in its design and qualification. The desired information shall include, but not be limited to, such data as operational cycles limits (number, duration...), temperature limits, operational, testing and cleaning fluids. Those data shall also be provided in the logbook, which must accompany the vessel and trace all events (number of cycles, fluids used...) Graphite Epoxy Composite Overwrapped Pressure Vessels shall respect US letter dated 23 November 1993 requirements Batteries [STD-SAF2-REQ-059 ] [STD-SAF2-REQ-060 ] [STD-SAF2-REQ-061 ] [STD-SAF2-REQ-062 ] [STD-SAF2-REQ-063 ] [STD-SAF2-REQ-064 ] [STD-SAF2-REQ-065 ] [STD-SAF2-REQ-066 ] [STD-SAF2-REQ-067 ] Battery / cell case shall be designed to a minimum of 3:1 ultimate safety factor with respect to worst case pressure build up for normal operations. Batteries that have chemically limited pressure (such as Nickel Hydrogen chemistries) and whose battery/cell case can be designed to withstand worst case pressure build up in abnormal conditions such as direct short circuit and extreme temperatures, can reduce the safety factor to 2:1 ultimate. Sealed batteries shall have pressure relief capability unless the battery case is designed to a safety factor of at least 3:1 based on worst case internal pressure. Pressure relief devices shall be set to operate at a maximum of 1.5 times the operating pressure and sized so that the resulting maximum stress of the case does not exceed the yield strength of the case material. A burst test shall be performed on one cell for each manufacturing lot to demonstrate the ultimate safety factor. A proof test at 1.5 x MEOP shall be performed on each cell. If a pressure relief capability is provided the test pressure shall be 1.25 x MEOP. The proof test is not usually required for Nickel Cadmium and Lithium Ion cells. In addition, the following tests shall be performed prior to the use or storage of lithium batteries at the Ranges, according to the AFSPCMAN Vol : - Lithium battery constant current discharge and reversal test, - Lithium battery short circuit test, - Lithium battery drop Test. An external short circuit test shall be performed on Nickel Hydrogen battery and/or cell case to prove they can withstand worst case pressure build up in abnormal conditions (such as direct short circuit and extreme temperature). Nickel Hydrogen battery and/or cells that are proven by test to withstand worst case pressure build up in abnormal conditions (such as direct short circuit and extreme temperature that can be experienced) are not required to have pressure relief capability. For Nickel Hydrogen cells, following tests shall be performed on two cells for each manufacturing lot: - On one cell: a cycling test at the maximum operating pressure for a number of cycles equal to 4 times those performed throughout the ground service life and a burst test to the actual burst pressure; - On the other cell: a burst test to the actual burst pressure.

12 ISSUE : 01 Page : 12/31 [STD-SAF2-REQ-173 ] Li Ion batteries shall respect US letter Interim policy for Li Ion batteries dated 01 May 2005 requirements Pressurised Lines, Fittings and Other Components (including fluid loops...) [STD-SAF2-REQ-068 ] [STD-SAF2-REQ-069 ] Fittings and lines shall have an ultimate factor of safety greater than or equal to: - 4 for diameter lower than 1.5 inch (38 mm), for diameter greater than or equal to 1.5 inch (38mm). Other components (e.g. valves, filters, regulators, sensors, sterling coolers, etc.), except pressure transducer used in chemical propulsion systems, and their internal parts (e.g. bellows, diaphragms, etc.) which are exposed to system pressure shall have an ultimate safety greater than or equal to 2.5. [STD-SAF2-REQ-070 ] Pressure transducer used with hazardous fluid (e.g. hydrazine, hypergolic propellants...) shall have an ultimate safety factor greater than or equal to 4. [STD-SAF2-REQ-071 ] [STD-SAF2-REQ-072 ] [STD-SAF2-REQ-073 ] All hazardous pressure system components other than pressure vessels shall be designed for safe endurance against hazardous failure modes for not less than 400 % of total number of expected pre launch cycles. Screwed joints shall not be used in hazardous pressure systems and propellant system piping and tubing. Screwed joints which are not of the National Pipe Thread (NPT) type may be used for connecting thruster valves if those connections are isolated from propellants with pyrotechnic normally closed valves. The design and configuration of the fill and drain valves, the ground half couplings, the leak test caps and the by pass tubes shall be sufficient to avoid cross connection: - Between two or more incompatible media, - Between two or more pressurised sections with incompatible safety factors (e.g. between low and high pressure sections), - Between fill and vent outputs of a propellant tank. If several propulsion subsystems exist (plasmic, chemical,...) the keying, sizing, location... of all fill and drain valves shall take into account both subsystems Pressure Systems (including fluid loops...) NOTE 1: GMEOP here refers to the Ground Maximum Expected Operating Pressure that personnel are exposed to (during integration tests, system tests and range operations). NOTE 2: Reader shall be aware that pressure relief capability shall be taken into account for the GMEOP identification. NOTE 3: For hydrazine systems, due to the presence of pressure relief capability proof test and range leak test implementation shall be carefully taken into account in the design. NOTE 4: Reader shall be aware that US letter dated 23 November 1993 (Graphite Epoxy Composite Overwrapped Pressure Vessels) requires intensive analysis effort, testing and data submittal. In particular, logbooks to trace time when tanks are not protected, pressure cycles history... [STD-SAF2-REQ-074 ] All pressure systems shall be proof tested at 1.5 GMEOP (limited to 1.25 MEOP, for the tank section, if the tank burst safety factor is 1.5 w.r.t. MEOP) prior to the first use. For welded systems only, exceptions may be granted but will require specific Prime System Safety approval.

13 ISSUE : 01 Page : 13/31 A modified or repaired pressure system shall be retested at proof pressure prior to its normal use. [STD-SAF2-REQ-075 ] [STD-SAF2-REQ-076 ] [STD-SAF2-REQ-077 ] All pressure systems shall be leak tested at the GMEOP prior to the first use. A modified or repaired pressure system shall be leak tested again at the system GMEOP prior to its normal use. The leak test shall be performed after the proof test. Hazardous pressure systems shall be leak tested again at the launch site at the RANGE GMEOP prior to the normal use. At the launch site, prior to any propellant loading or pressurisation, Graphite Epoxy Composite Overwrapped Pressure Vessels shall be pressure tested to 1.1 times RANGE GMEOP during 10 min. minimum Heat Pipes [STD-SAF2-REQ-079 ] Heat-pipes shall have an ultimate factor of safety greater than or equal to 4. [STD-SAF2-REQ-080 ] Heat-pipes shall be proof tested to 1.5 MAWP after filling and pinching off. 4.7 Hazardous materials [STD-SAF2-REQ-081 ] Hazardous materials shall not be used, released or ejected. Please find hereafter a non exhaustive list of hazardous materials: Barium, Beryllium, Cadmium, Mercury, Carboxy Nitroso Rubber, Polyvinyl Chloride (PVC), Acetic Silicone... Beryllium Oxyde may be used if located inside sealed units and if covered with a conformal coating or potting. [STD-SAF2-REQ-082 ] Material Safety Data Sheet shall be provided for all hazardous products used (Propulsion, Batteries, Heat pipes...). 4.8 Materials used in hazardous fluid systems (propulsion, batteries, heat-pipes, fluid loops...) [STD-SAF2-REQ-083 ] [STD-SAF2-REQ-084 ] [STD-SAF2-REQ-085 ] [STD-SAF2-REQ-086 ] Materials shall be compatible with identified fluids (manufacturing, cleaning, tests (including dye penetrant), operating,...) at the MEOP and maximum temperature. The compatibility is required for all components wet on ground or to be nominally wet in orbit (i.e. inadvertently wet on ground). For components leak failures tolerant such as fill and drain valves,... the compatibility is also required for portions which are wet after barriers failure. Fluid compatibility versus material data shall be provided. 4.9 Flammable materials Good practices are required as far as possible: minimise usage of flammable materials,

14 ISSUE : 01 Page : 14/31 separate flammable materials to prevent flame propagation, separate flammable materials from ignition sources to maximum extent practicable. NOTE 1: Materials that meet NHB (tests n 1) to be considered as non flammable NOTE 2: JSC and JSC provide test data, material selection lists, and guidelines Pyrotechnics [STD-SAF2-REQ-087 ] All pyrotechnical subsystems and devices shall meet Launch Agencies (refer to paragraph 2.1.3) and MIL-STD-1576 paragraphs 4.4, 5.1 to 5.11, 5.13 requirements. [STD-SAF2-REQ-088 ] [STD-SAF2-REQ-089 ] [STD-SAF2-REQ-090 ] [STD-SAF2-REQ-091 ] [STD-SAF2-REQ-092 ] [STD-SAF2-REQ-093 ] [STD-SAF2-REQ-094 ] Electroexplosive devices shall be of 1A / 1W / 5mn no fire type. Electroexplosive devices shall be capable of withstanding a 25 kv discharge (pin to pin mode with a 5 kilohms resistor in series and pin to case mode without a series resistor) from a 500 pf capacitor. Safe and arm plugs in accordance with Launch Agencies safety regulations shall be implemented (short circuits, grounding, colours and streamers). The firing circuit shielding shall be designed to limit RF power at each EED (produced by S/C, Range and launch vehicle transmitters): - to a level at least 20 db below the pin to pin DC no fire power of the EED and, - to have a positive margin w.r.t. the RF no fire power of the EED. Easy access for plugs installation or removal through the fairing shall be ensured. Arm connectors (e.g. Flight connectors) shall be electrically connected after satellite installation on the launcher and electrical interfaces verification completed. Exceptions require specific Launch Site Safety Office approval. Hazard classification of ordnance items (in accordance with DOD, IATA dangerous goods regulations and UN/NATO) shall be provided Electromechanical Initiating Devices and Systems [STD-SAF2-REQ-095 ] [STD-SAF2-REQ-096 ] Electromechanical initiating devices and systems (including pyro mechanisms), such as deployment or actuation release mechanisms shall not release or eject debris when activated (nominally or inadvertently). Electromechanical initiating devices shall be evaluated to determine the severity of the hazard (critical or catastrophic) Radiation subsystems Non ionising radiation: [STD-SAF2-REQ-097 ] [STD-SAF2-REQ-098 ] Subsystems shall not emit electromagnetic radiation (including X-Rays) that presents a hazard (not applicable for TTC and Payload subsystems, except for X-Rays). During tests, RF hazard area (exposure level greater than those specified in the Table ) shall be identified, posted and controlled to prevent unnecessary

15 ISSUE : 01 Page : 15/31 personnel exposure (applicable for TTC, Payload subsystems...) Ionising radiation: [STD-SAF2-REQ-100 ] Radioactive sources shall respect requirements of CSG Safety Regulations Volume 2 Part 2 paragraphs and Laser radiation: [STD-SAF2-REQ-101 ] Laser devices shall respect requirements of CSG Safety Regulations Volume 2 Part 2 paragraph Electrical subsystems [STD-SAF2-REQ-102 ] [STD-SAF2-REQ-103 ] [STD-SAF2-REQ-104 ] [STD-SAF2-REQ-105 ] [STD-SAF2-REQ-106 ] [STD-SAF2-REQ-107 ] [STD-SAF2-REQ-108 ] [STD-SAF2-REQ-109 ] Double insulation shall be implemented for all the unprotected circuits (harness including umbilical wires and electrical boxes circuits) directly connected to the main power bus, the batteries and the battery pyrotechnic bus until the first protection. This double insulation should be verifiable after equipment integration. If not possible, verification methods performed before equipment closure shall be detailed and submitted to the Prime for approval. Electrical power distribution shall be designed (i.e. protected) so that faults internal to subsystem: - do not damage launcher circuits; - do not create ignition sources for satellite material. Electrical lines between satellite subsystems and EGSE shall be protected by a fuse or a current limiter located either in the satellite or in the EGSE. Otherwise a double insulation on lines located inside the satellite and the EGSE is required. The protection shall be close to the power source. (Refer to paragraph for EGSE requirements). The relation between wire sizes, wire current capacities, wire maximum temperature (satellite power lines) and the ultimate trip limit current value of the protection device (fuse or current limiter) located upstream (in EGSE or satellite circuits) shall be stated (on ground safety concern only, no derating required) (Refer to paragraph for EGSE requirements). Heater temperature shall be studied in case of failed "ON" heater (during the ground phase, risk of heating pressure vessels containing hazardous or cryogenic fluids : batteries, tanks, heat pipes,...). If bending a pin is possible in a connector required to be double insulated, controls shall be implemented to avoid a short circuit between pins or pin to structure (for exemple : pins location, distance between pins, insulation of connector from structure...). If a hazardous condition can be created by mismating or reverse polarity, connectors shall have alignment pins, keyway arrangements, or other means to make it impossible to incorrectly mate Verification requirements [STD-SAF2-REQ-110 ] [STD-SAF2-REQ-111 ] Safety aspects (control provisions, design criteria...) of hazardous subsystem equipment shall be satisfactorily verified. Analysis, test, and inspection are common and valid techniques for verification of design features used to control hazards.

16 ISSUE : 01 Page : 16/31 [STD-SAF2-REQ-112 ] [STD-SAF2-REQ-113 ] Safety verification methods shall be documented in time for Safety Reviews. At the final Safety review, results of verification shall be adequately documented with documentation references and summary of results provided Hazardous procedures [STD-SAF2-REQ-114 ] [STD-SAF2-REQ-115 ] [STD-SAF2-REQ-116 ] [STD-SAF2-REQ-117 ] [STD-SAF2-REQ-118 ] Operating procedures shall be prepared for assembly, tests and operations. Operating procedures shall be prepared to safely off-load hazardous satellite propellants (fuel and oxidizer) at any point after pressurisation or loading, including the ability to offload at the launch pad without demating the spacecraft from the launch vehicle. All the procedures shall be reviewed and when a hazard is identified, the procedures shall be classified as "Hazardous procedure". That analysis is to be performed for every facility. Concerning the launch base, in addition to the classification (hazardous or not), the content of the hazardous procedures is reviewed by the launch agency safety services. Typical items that are to be checked in procedures are: - Cover page properly marked as hazardous - Identification of operating area - Specific hazard involved - List of support elements / facilities required - List of tools, equipment, and clothing required - Identification of major and local hazardous control areas - Applicable safety rules and regulations - Safety controls (if applicable) - Essential personnel list for controlled area - Essential personnel list and location - Warning / Note located prior and following hazardous sequence - Identification of hazardous steps - Control area properly identified - Procedural step to clear non essential personnel - Procedural step requesting Quality Assurance or Safety concurrence to proceed with hazardous steps

17 ISSUE : 01 Page : 17/31 - Procedural step requesting Quality Assurance or Safety concurrence to open a control area - Identification of inhibits and verification step to verify that inhibits are in place - Adequate Emergency / Contingency steps - Identification of necessary operations to return to a safe configuration. - etc. [STD-SAF2-REQ-119 ] [STD-SAF2-REQ-120 ] It is mandatory that technical operating procedures be approved by Supplier safety authorities. Procedures shall be verified to demonstrate control of the hazard (including human errors) Flammable atmospheres [STD-SAF2-REQ-121 ] During ground operations normal subsystems functions shall not cause ignition of a flammable atmosphere, which may result from leakage of fluids. This flammable atmosphere may exist from satellite filling with propellants up to... Possible ignition sources may be divided in two categories: - Electrical discharges including sparks caused by short circuits, relays contacts - Hot surfaces [STD-SAF2-REQ-122 ] [STD-SAF2-REQ-123 ] Relays and other similar ignition sources shall be sealed. No sparks generator shall be allowed during and after filling activities. All parts which can generate electrostatic discharge shall be grounded. [STD-SAF2-REQ-124 ] Current through umbilical connectors during lift-off shall be lower than 100 ma and voltage lower than 150 V and maximum power limitation of 3 W (Ariane 5 requirement which covers other launchers). [STD-SAF2-REQ-125 ] [STD-SAF2-REQ-126 ] [STD-SAF2-REQ-127 ] Any exposed surfaces including heaters shall have temperatures lower than 180, if not they shall be identified (ground operations) and failure tolerance requirement implemented. The satellite must be OFF during filling activities. All remaining powered lines (battery power lines upstream the switching off device, battery cells voltage monitoring lines ) shall respect the double insulation requirement including electrical boxes inside circuits or shall be current limited to 5mA (short circuit value). In addition after one failure in electrical boxes inside circuits, exposed surfaces shall have a temperature lower than 180 C. The satellite shall be designed to be rapidly and safely (e.g. without creating ignition of flammable atmosphere) switched OFF on request in case of flammable fluid leakage. If it is not possible all remaining powered lines shall respect previous requirement.

18 ISSUE : 01 Page : 18/31 [STD-SAF2-REQ-128 ] The current of all umbilical lines which cannot be switched off at the power source (at EGSE level or S/C level), shall be limited to 5mA (short circuit current value)(during and after filling operations) Optical systems [STD-SAF2-REQ-129 ] Care shall be exercised when designing those systems, to protect eyesight against emissions which are hazardous due to their intensity, or outside of the visible spectrum (infrared or ultraviolet) Cryogenic Systems [STD-SAF2-REQ-130 ] Requirements will be specified on a case by case basis. 5 GROUND SUPPORT EQUIPMENT AND OPERATIONS SAFETY REQUIREMENTS [STD-SAF2-REQ-131 ] Ground equipment to be used and operations to be performed on the launch site shall be compliant with the Ranges regulations, in particular Proton Safety Plan paragraphs1.3 and CSG Safety Regulations Volume 2 Part 2 paragraphs 3.2 and 4.2. [STD-SAF2-REQ-132 ] All Ground Support Equipment shall be : - Designed to comply with the requirements of all applicable European directives (machinery, low voltage, EMC, electrical equipment for explosive atmosphere...); - Assessed for compliance to all applicable directives; - Supplied with a CE mark and supporting Declaration of conformity. In particular, the following points shall be taken into account. This chapter focuses on some specific points whereas general requirements are addressed in the Range specifications. 5.1 Design requirements General [STD-SAF2-REQ-133 ] [STD-SAF2-REQ-134 ] [STD-SAF2-REQ-135 ] Ground Support Equipment shall be designed avoiding sharp corners and edges Possibility of grounding every piece of equipment shall exist. GSE including EGSE shall remain stable under any maximum combination of applicable design loads. The maximum stand to tilt coefficient shall be 1.2 for stationary items and 1.3 for slow moving items Mechanical Ground Support Equipment [STD-SAF2-REQ-136 ] Lifting and handling structure shall be designed with the following safety factors: Ultimate = 5.0 if Yield limit/ultimate limit of material used if Yield limit/ultimate limit of material used < 0.85

19 ISSUE : 01 Page : 19/31 Yield = 3.0 Others (slings, shackles, weighing cells ) Ultimate = 5.0 Yield = 3.0 On a case by case basis, lower safety factors, in compliance with specific launch sites safety regulation and/or National law, may be defined. Approval shall be gained from the Prime. [STD-SAF2-REQ-137 ] Maximum safe working loads shall be posted on all lifting, hoisting and handling equipment and fixtures. [STD-SAF2-REQ-138 ] Lifting devices used for encapsulation process at the range shall be designed to accept an additional mass (refer to paragraph 4.6.1). [STD-SAF2-REQ-139 ] [STD-SAF2-REQ-140 ] [STD-SAF2-REQ-141 ] [STD-SAF2-REQ-142 ] [STD-SAF2-REQ-143 ] [STD-SAF2-REQ-144 ] Load bearing, hooks, shackles, eyebolts and welds constituting a single point of failure have to be identified. Critical welds shall be eliminated where possible. All single point of failure and critical welds shall be inspected by NDI for cracks. MGSE used to lift hazardous loads (e.g. satellite filled with propellants on launch site) shall respect a fail safe concept if the flight hardware lifting points are designed with the Fail Safe concept (The loss of one point will not result in the dropping of the load.). Slings or MGSE which have components that are normally disassembled shall be either marked, coded, or tethered to assure proper assembly of verified hardware. Use of synthetic ropes shall be avoided. If use of such ropes if needed they shall be inspected prior each utilisation and shall have a safety factor of 7. The safety factor shall be 10 if used at Land Launch or at Baikenour for a Proton launch. Aircraft transport containers shall fulfil IATA/ULD Standard Specification 80/2, which adress pressure equalization requirements for containers. MGSE pressure systems shall have an ultimate safety factor of 4 and shall be proof pressure tested at 1.5 MAWP Electrical Ground Support Equipment (including electrical parts of all GSE) [STD-SAF2-REQ-145 ] [STD-SAF2-REQ-146 ] [STD-SAF2-REQ-147 ] Inhibition of orders activating hazardous functions shall be implemented. EGSE electrical lines between EGSE and satellite subsystems shall be protected by a fuse or a current limiter located in the EGSE. Otherwise a double insulation on EGSE lines is required (Refer to paragraph 4.13 for satellite requirements). The relation between wire sizes, wire capacities, wire maximum temperature (EGSE power wires and wires between EGSE and satellite) and the ultimate trip limit current value of the protection device (fuse or current limiter) located upstream shall be stated.

20 ISSUE : 01 Page : 20/31 [STD-SAF2-REQ-148 ] [STD-SAF2-REQ-149 ] All electrical GSE (including electrical parts of TGSE, MGSE, OGSE...) used in potentially hazardous (explosive) atmosphere locations (a location is hazardous when propellants, MMH for example, are present, in the satellite or in a container for example) shall meet the applicable Range Safety regulations and European Explosive Atmosphere directive. If a hazardous condition can be created by mismating or reverse polarity, connectors shall have alignment pins, keyway arrangements, or other means to make it impossible to incorrectly mate Tanking Ground Support Equipment [STD-SAF2-REQ-151 ] [STD-SAF2-REQ-152 ] [STD-SAF2-REQ-153 ] Equipment to safely off-load hazardous satellite propellants (fuel and oxidizer) are required. Drums shall comply with US DOT CFR Title 49 regulation paragraph (US and Russian launches). Drums shall comply with international regulations for transportation of dangerous goods Optical Ground Support Equipment (including lasers,...) [STD-SAF2-REQ-154 ] OGSE shall respect requirements of CSG Safety Regulations part Test requirements Mechanical Ground Support Equipment [STD-SAF2-REQ-155 ] Tests of lifting equipment (including load cell and hydraset) and handling (manipulating, supporting) equipment shall be performed, by an approved organisation, at twice the maximum allowable load prior to first operational use or after modification/repair... On a case by case basis, proof safety factor of 1.5, in compliance with specific launch sites safety regulation and/or National law, may be used. Approval shall be gained from the Prime. [STD-SAF2-REQ-156 ] If any, the fail safe configuration shall be initially proof tested with a safety factor of 1.5. This requirement is only applicable to MGSE used to lift hazardous loads (e.g. satellite filled with propellants on launch site). [STD-SAF2-REQ-157 ] For MGSE to be used at launch pads other than CSG: - Lifting and handling equipment shall be periodically proof tested at twice the maximum allowable load; - Load cell and hydraset shall be periodically proof tested at 1.25 the maximum allowable load; - Critical lifting (including load call and hydraset) and handling equipment shall be tested within 1 year before end of campaign; Critical definition is: - Critical: any hazardous or safety critical equipment or system, non hazardous high value hardware owned by range user may be identified as critical or non critical by the range user; The MGSE s classification shall be approved by the Prime Safety Manager.

21 ISSUE : 01 Page : 21/31 [STD-SAF2-REQ-158 ] [STD-SAF2-REQ-159 ] [STD-SAF2-REQ-160 ] Lifting and handling (manipulating, supporting) equipment shall be inspected every year by an approved organisation. After load test, NDI inspection for cracks (dye penetrant, X rays...) shall be performed on parts that are single points of failure and on critical welds (safety aspects only). Critical welds: welds which are considered as single failure point. Results of inspections and testing shall be provided Electrical Ground Support Equipment (including electrical parts of all GSE) [STD-SAF2-REQ-161 ] [STD-SAF2-REQ-162 ] [STD-SAF2-REQ-163 ] Verification of hazardous orders inhibition shall be performed. Certificate of conformity for electrical equipment used in flammable atmosphere (EEx certificate) shall be provided. Certificate of conformity for electrical systems (several electrical items interconnected) used in flammable atmosphere (EEx certificate) shall be obtained by an approved organisation and provided Tanking Ground Support Equipment [STD-SAF2-REQ-164 ] [STD-SAF2-REQ-165 ] [STD-SAF2-REQ-166 ] [STD-SAF2-REQ-167 ] They shall be proof tested to 1.5 times MAWP, initially and after dismounting, reparation, modification... Flex hoses shall be proof tested to 1.5 times their MAWP once a year. They shall be always validated at the range (including leak tests at MEOP, relief valves set-up ) prior to use. Hypergolic including hydrazine TGSE s shall have a system validation test at MAWP prior to first operational use and using a test fluid media. 5.3 Ground operations requirements Hazardous Materials [STD-SAF2-REQ-168 ] Material Safety Data Sheets shall be provided for all chemicals brought inside the range Hazardous procedures [STD-SAF2-REQ-169 ] [STD-SAF2-REQ-170 ] Hazardous procedures shall be validated before first use. Hazardous procedures shall be approved by the safety manager. 6 SAFETY DATA REQUIREMENTS [STD-SAF2-REQ-171 ] As minimum following data shall be incorporated into safety analyses or hazard reports. These data shall be provided by all Suppliers (including the prime if applicable) performing a safety analysis. 6.1 Control of hazardous functions

22 ISSUE : 01 Page : 22/31 Schematic diagram presented in a clear and easily readable form. Identification of hardware and electrical inhibits. Fault tree if necessary. Analysis about inhibits independence. Identification of monitoring circuits and analysis to prove independence from inhibits control circuits (in order not to compromise the safety of the inhibits). Procedures reference. Thermal analysis safety oriented Sketch of the hoisting points Analysis about: Fail safe design of the hoisting points Safety factor of the hoisting points Lifting points single failure point analysis Safety factor of the structure for vertical to horizontal tilting and transportation in horizontal configuration Metallic material choice versus stress corrosion cracking Qualification and acceptance plans and test results 6.2 Pressure vessels Detailed Design Verification Matrix to the MIL-STD-1522A, Approach A and to the Graphite Epoxy Overwrapped Pressure Vessels US letter. Metallic material choice versus stress corrosion cracking Qualification and acceptance plans and test results Analysis showing pressure variation versus temperature on ground LBB demonstration test result for vessels having a non hazardous leak before burst failure mode Material compatibility data as required in paragraph 6.5 including overwrap Provide for pressure vessels the same data as requested in the paragraph 6.3 Safe operating limits

23 ISSUE : 01 Page : 23/31 Log books 6.3 Pressurised lines, fittings, and other components Identify for each component: Maximum Allowable Working Pressure Maximum Expected Operating Pressure or Maximum Design Pressure External and internal leak rates Burst safety factor and qualification test reports Material compatibility data as required in paragraph 6.5 Cross sectional drawing showing seats, input and output ports, flow sense, barriers against fluids... Materials used including soft goods Manufacturer's name, model number, part number,... Proof safety factor and acceptance test reports for proof and leak tests Fluids used during manufacturing, tests and operations Type of connections 6.4 Heat-pipes Material compatibility data as required in paragraph 6.5. Burst safety factor and qualification test reports including burst and cycling tests. Acceptance test reports for proof and leak tests. 6.5 Hazardous materials Fluid compatibility versus material data for materials used in hazardous fluid systems such as propulsion, batteries, heat-pipes... Fluids list shall include manufacturing, cleaning, and test (including dye penetrant) fluids. Listing and quantities of all hazardous materials, liquids and gases (including inert gases) used in the flight system or during the ground operations at the range. Material Safety Data Sheet for all of those chemicals. 6.6 Pyrotechnics

24 ISSUE : 01 Page : 24/31 Detailed Design Verification Matrix to the MIL-STD-1576 Qualification and acceptance test results for EED in particular to prove: 1A/1W/5mn no fire 25 kv/500 pf requirement Sketch showing physical location of EED DOD classification for EED IATA classification for EED UN/NATO classification for EED Manufacturer reference and part number for EED and pyromechanisms. Pyromechanisms, EED and boosters drawings and cross sectional sketches Chemical composition and characteristics, net explosive weight Description of functions initiated by the pyrotechnic devices Drawings and analysis to demonstrate no debris generation. Drawings showing safe and arm plugs location Mechanical and electrical drawings of safe and arm plugs Firing, control and monitor circuits schematics Sequence of events which leads to ordnance activation Analysis about independence of commands, controls and monitor circuits Analysis about EMC/RF protection against EED premature firing including: 360 optical coverage, particularly at connectors levels Type of shields used RF susceptibility analysis to demonstrate 20 db attenuation Electromechanical Initiating Devices

25 ISSUE : 01 Page : 25/31 Drawings and analysis to demonstrate no debris generation. 6.8 Radiation S/S Non Ionising Radiation exposure level versus distance ==> hazardous areas identification transmitter peak power type and size of antennas antenna gain and illumination operating frequency polarisation of transmitter waves description of inhibits and other safety features which prevent inadvertent exposures Ionising Radiation Data requested by the paragraph Laser Radiation Data requested by the paragraph Electrical system Power sources Description of power sources (batteries,...) Description of battery double insulation implementation. Cell chemistry and physical construction Cell vent parameters Toxic chemical emission of cells and evaluation of hazard DOT classification of battery Physical and electrical integration of cells to form the battery