![[NASA Logo]](../Images/nasaball.gif) |
NASA Procedures and Guidelines |
||||
This Document is Obsolete and Is No Longer Used.
|
|||||
|
|
|||||
|
|
||||
| | TOC | Preface | Chapter1 | Chapter2 | Chapter3 | AppendixA | AppendixB | ALL | | |||||
Range safety considerations include the three elements of range safety analysis, range safety systems, and operational requirements. This chapter provides a basic description of these elements and related concepts and provides the associated requirements. This chapter also provides requirements that apply to the qualification and training of personnel who perform range safety functions.
3.2.1 Each range operation shall undergo a range safety analysis to establish any design or operational constraints needed to control risk to persons and property (Requirement 42745).
3.2.2 A range safety organization that is independent of the vehicle program shall review and approve the range safety analysis (Requirement 42746).
3.2.3 A range safety analysis shall incorporate the elements of risk management, risk assessment, containment, and risk mitigation (Requirement 42747).
Note: Containment for the purposes of range safety is defined in Appendix A and related requirements are in paragraph 3.2.9 of this NPR.
3.2.4 Risk Management Process.
3.2.4.1 A Center's or vehicle program's risk management process shall include assessment of the risk to the public, workforce, and property in accordance with paragraph 3.2.5 of this NPR (Requirement 42749).
3.2.4.2 A vehicle program's risk management process shall incorporate the applicable requirements of any range, launch site, or landing site that supports the program's range operations (Requirement 42750).
3.2.4.3 Within the risk management process, the vehicle program, the range safety organization(s), and the authority responsible for the range, launch site, or landing site shall coordinate to:
a. Mitigate the risk to members of the public and the workforce (Requirement 42752).
b. Identify any property in the vicinity of the flight that requires protection from potential debris impact, identify the potential damage of concern, and mitigate the associated risk (Requirement 42753).
Note: In general, the requirements for managing risk to the public and workforce (i.e., people) also provide appropriate protection for property. However, local authorities may have risk management requirements that apply to certain property, or there may be specific property for which the program requires risk management due to its proximity to the flight and the consequences associated with a potential debris impact.
c. Quantify and document any risk through the conduct of a formal risk assessment (Requirement 42754).
d. Make risk acceptance/disposition decisions that integrate concerns for public risk, workforce risk, risk to any property identified under paragraph 3.2.4.3.b, mission risk, including the risk to the safety of any flight crew, and mission constraints (Requirement 42755).
e. Make operational decisions needed to control risk prior to initiation of flight or each phase of flight (Requirement 42756):
(1) For an orbital RLV or vehicle that operates continuously for extended periods, the responsible organization(s) may make operational decisions, including the implementation of applicable per flight risk criteria, independently for each phase of flight (e.g., launch, entry, ascent, cruise, or descent) if all three of the following are satisfied:
(a) Each decision is based on a risk assessment that is conducted or validated just prior to each phase of flight.
(b) The assessment or validation accounts for updated vehicle status and updated predictions of flight conditions.
(c) The vehicle has sufficient controllability to allow for risk management as a prerequisite to beginning each phase of flight.
(2) For a mission that involves the operation of more than one vehicle simultaneously, the responsible organization(s) may make operational decisions, including the use of applicable per flight risk criteria, independently for each vehicle if each vehicle has sufficient independent controllability to allow the management of risk individually for the flight of each vehicle.
f. Document decisions concerning approval of operations, acceptance/disposition of safety risk including justification, and the application of any additional safety controls or constraints based on safety evaluations (Requirement 42762).
g. Inform operational personnel of the hazards and safety risk associated with the conduct of any range operation (Requirement 42763).
h. Inform on-site public/visitors of hazards and safety risk associated with viewing a range operation from NASA-controlled property (Requirement 42764).
3.2.4.4 Range Safety Risk Management Plan (RSRMP). The RSRMP shall be a formal written document that details a vehicle program's risk management process (Requirement 42765).
a. The RSRMP shall demonstrate how the vehicle program satisfies the risk criteria of paragraph 3.2.4.5 (Requirement 42766).
b. The RSRMP shall incorporate any acceptance of risk that exceeds the criteria of paragraph 3.2.4.5 (Requirement 42767).
c. The RSRMP shall incorporate the risk management requirements and processes of any other organization that supports the program, such as the range, launch site, or landing site (Requirement 42768).
Note: Approval of the RSRMP constitutes NASA acceptance of any range safety risks documented in the RSRMP. Paragraph 1.3.7.p of this NPR identifies the approval authorities.
3.2.4.5 Risk Criteria. Each range operation shall satisfy the following criteria for assessed risk unless higher risk levels are specifically authorized for the operation (Requirement 42770).
Note: These criteria are consistent with those used throughout the government and commercial range community and consistent with other industries' standards addressing operations that are potentially hazardous to the public and the workforce. In general, these criteria define a level of assessed risk to the public, workforce, and property that the Agency accepts for all range operations without higher management review. If a range operation is to exceed any of these criteria, the variance process and associated requirements outlined in section 1.4 of this NPR apply.
a. Individual Risk.
(1) Probability of casualty (Pc) < 1 x 10-6 for individual people who are not mission essential, applied separately for each hazard, each flight (Requirement 42772).
(2) Pc < x 10-6 for mission essential personnel, applied separately for each hazard, each flight (Requirement 42773).
Note: For purposes of consistency with DoD and FAA range safety policy, the specific hazards considered in a range safety risk assessment are defined in paragraph 3.2.5.6 of this NPR.
b. Property Impact Probability. Probability of debris impact < 1 x 10-3 for any property identified under paragraph 3.2.4.3.b that could result in the damage of concern identified under paragraph 3.2.4.3.b, applied for each flight (Requirement 42774).
c. Collective Risk.
(1) Collective Risk Criterion for Center Essential Personnel. Expectation of Casualty (Ec) < 300 x 10-6 casualties per flight, applied separately for each hazard, each flight (Requirement 42776).
Note: Center essential personnel include mission essential personnel.
(2) Collective Public Risk Criteria for all Flights other than Controlled Entry (Requirement 42777).
(a) Ec < 30 x 10-6 casualties per flight, applied separately for each hazard; OR
Note: Public includes all people who are not Center essential or mission essential and are on land, on waterborne vessels, and in aircraft. Range safety implementation of the EC criteria often includes the use of impact probability criteria, which ensure that any people on waterborne vessels or in aircraft do not contribute significantly to the overall public collective risk.
(b) Ec < 1 x 10-3 casualties per year, applied separately for each hazard, for each individual range or launch site.
Note: The 1 x 10-3 per year (i.e., one casualty in a thousand years) public risk criterion is a historical basis for the widely accepted 30 in a million launch risk criterion. (1 ? 10-3 casualties per year divided by an average of 33 launches per year from a given launch site yields the risk criterion of 30 casualties in a million launches.) NASA has adopted the per-year criterion as an acceptable option for both launch and entry. This approach allows some flexibility for addressing the operation of new or unique vehicles while remaining consistent with widely recognized criteria for acceptable risk to the public.
(i) When applying this option, the flight rate shall be no less than one flight per year (Requirement 42780).
(ii) When applying this option, the Ec for public outside NASA-controlled property shall not exceed 30 < 10-6 casualties per flight, applied separately for each hazard (Requirement 42781).
Note: The per-flight risk to public outside NASA-controlled property shall be accounted for as part of the annual public risk; not in addition to the annual risk.
(iii) Each vehicle program shall coordinate with the official(s) responsible for the range/site to establish the flight specific risk criteria and any other constraints needed to ensure that the range/site satisfies the annual criterion (Requirement 42782).
(iv) Each vehicle program's RSRMP shall document all associated criteria and constraints, including justification for the flight rate (Requirement 42783).
(3) Collective Public Risk Criteria for Controlled Entry (Requirement 42784): [For Space Shuttle entry operations, see paragraph 3.2.4.5.c.(4)]:
(a) Ec < 100 x 10-6 casualties per controlled entry, applied for a combination of all hazards; OR
Note: Ec < 100 x 10-6 casualties per entry is NASA's established and internationally accepted public risk criterion for uncontrolled entry of space hardware and is now adopted as an acceptable criterion for controlled entry operations. This criterion represents a total Ec for all hazards, unlike the Ec ? 30 x 10-6 launch criterion, which applies per hazard.
(b) Ec < 1 x 10-3 casualties per year, applied for a combination of all hazards, for each individual landing site.(i) When applying this option, the entry rate shall be no less than one entry per year (Requirement 42786).
(ii) Each entry vehicle program shall coordinate with the official(s) responsible for the landing site to establish the entry specific risk criteria and any other constraints needed to ensure that the site satisfies the annual criterion (Requirement 42787).
(iii) Each vehicle program's RSRMP shall document all associated criteria and constraints, including justification for the flight rate (Requirement 42788).
(4) Collective Public Risk for Space Shuttle Entry:
(a) The assessed collective public risk for Space Shuttle entries shall not exceed the highest risk associated with the ascending entry trajectories into Kennedy Space Center (KSC) from the International Space Station orbit inclination of 51.6 degrees except as described in paragraph 3.2.4.5.c(4)(b) (Requirement 42791).
(b) If an entry must take place under off-nominal conditions or when critical crew safety factors (e.g. landing site weather, Orbiter consumables, crew health and duty day) require the consideration of alternate landing site opportunities, the Space Shuttle Program shall balance the mitigation of public and crew risk in selecting the entry opportunity and landing site (Requirement 42792).
Note: This provision is necessary due to the Space Shuttle's established design and operational constraints. Any significant alterations to Space Shuttle entry operations would have the potential for negative effects on crew and mission. This provision allows the Space Shuttle Program to continue to use KSC as its primary landing site, with Edwards Air Force Base and White Sands Missile Range as backups. The Shuttle Program, in coordination with NASA Headquarters, has quantified and thoroughly evaluated the risks associated with this provision. The public collective risk associated with this provision is acceptable for the remaining Space Shuttle missions.
3.2.5 Range Safety Risk Assessment.
3.2.5.1 A range safety risk assessment shall be a formal documented analysis that identifies and quantifies risk for input to the risk management process (Requirement 42794).
3.2.5.2 The risk assessment shall provide a best estimate of the risks and include an evaluation of uncertainty bounds or sensitivities to inputs (Requirement 42795).
3.2.5.3 The assessment documentation shall identify all assumptions made (Requirement 42796).
3.2.5.4 The risk assessment shall account for variability associated with the following:
a. Each source of hazard, including any associated with a payload, during flight (Requirement 42798).
b. Normal flight and each appropriate foreseeable failure response mode of the vehicle for each flight phase (Requirement 42799).
c. Each appropriate foreseeable external and internal vehicle flight environment (Requirement 42800).
d. Public and worker population potentially exposed to the flight (Requirement 42801).
e. Population growth rates in order to remain valid if a risk assessment will apply to a number of flights over a number of years (Requirement 42802).
f. The performance of any range safety system, control, or constraint including all associated time delays (Requirement 42803).
3.2.5.5 Input data used for the range safety risk assessment shall include:
a. Quantitative assessment of vehicle reliability unless the vehicle will operate under full containment where any associated hazard cannot reach persons and property (Requirement 42805).
b. Proposed trajectories (nominal, preplanned contingency, abort. and malfunction trajectories) (Requirement 42806).
c. Description of any landing sites and/or flight paths (Requirement 42807).
d. Description of credible failure modes and their probability of occurrence resulting in a hazard to public safety (Requirement 42808).
e. Reliability of any range safety system (Requirement 42809).
f. All hazard controls and mitigation strategies (Requirement 42810).
g. Pertinent vehicle information, such as size, weight, propellant types and amounts, and any explosives, toxic materials, or radionuclides (Requirement 42811).
h. Other relevant data required for analysis in support of specific mission objectives, including related payload information (Requirement 42812).
3.2.5.6 There are typically three types of hazards considered in a range safety risk assessment. These include debris, far-field blast overpressure, and toxic material release (see paragraphs 3.2.6, 3.2.7, and 3.2.8 respectively of this NPR).
a. A risk assessment shall account for the risk due to each hazard where applicable for each flight unless the hazard is fully contained (Requirement 42814).
Note: Containment for the purposes of range safety is defined in Appendix A and related requirements are in paragraph 3.2.9 of this NPR.
b. Other hazards may exist based on specific mission requirements, and these hazards shall be included in the assessment on a case-by-case basis (Requirement 42815).
3.2.6 Debris Risk Assessment.
3.2.6.1 A range safety analysis shall assess any risk due to debris for input to the risk management process (Requirement 42817). For a launch, these requirements apply to any debris that does not achieve orbit. For an entry operation, these requirements apply to any debris that might be generated, intentionally or not, after the deorbit burn or sample return capsule release. Any orbital debris is subject to the requirements of NPD 8710.3, NASA Policy for Limiting Orbital Debris Generation.
3.2.6.2 An assessment of risk to the public and workforce due to debris shall account for each of the following as a function of flight-time or loss-of-control-time:
a. All potential debris, generated intentionally or not, that could cause a casualty, including debris that could affect someone on the ground or on a waterborne vessel, or cause an aircraft accident (Requirement 42819).
Note: Casualty models used in range safety risk assessments typically evaluate certain impact parameters, such as kinetic energy, and incorporate thresholds on those parameters that define when a debris impact has the potential to cause a casualty or down an aircraft. These thresholds may change as our knowledge of human vulnerability/aircraft vulnerability evolves. Sources of the latest casualty and aircraft impact thresholds developed for use by the range safety community include RCC 321, Common Risk Criteria for National Test Ranges: Inert Debris, and AFSPCMAN 91-710, Range Safety User Requirements Manual.
b. All populated areas in the overflight area that could be impacted by the debris (Requirement 42820).
c. The probability of the debris impacting each populated area, which accounts for the probability of vehicle failure (Requirement 42821).
d. The effective casualty area of the impacting debris, which accounts for the cross-sectional area of the debris, average size of a person, and the effects of any overpressure due to any explosive debris (debris that would explode on or after impact) (Requirement 42822).
e. The population density of each populated area (Requirement 42823).The assessment should consider any risk mitigation factors associated with each population, such as sheltering and time of day of the flight.
f. Debris variability, including size, shape, aerodynamic properties, weight, and potential to survive to impact (Requirement 42824).
g. The sources of debris variability, including breakup conditions (Requirement 42825).
h. The uncertainties in the state vector at the instant of jettison or destruct and any correlations used (Requirement 42826).
i. Any velocity imparted to the debris fragments during jettison, destruct, or breakup (Requirement 42827).
j. The influence of atmospheric variability, including winds (Requirement 42828).
3.2.6.3 A debris risk assessment for any property identified under paragraph 3.2.4.3.b shall account for:
a. All potential debris (intentionally or unintentionally generated) that could cause property damage, which accounts for the specific nature of the property (Requirement 42830).
b. The cross-sectional area of the debris and the effects of any overpressure due to any explosive debris (debris that would explode on or after impact) (Requirement 42831).
c. Debris variability, including size, shape, aerodynamic properties, weight, and potential to survive to impact (Requirement 42832).
d. The sources of debris variability, including breakup conditio , ns (Requirement 42833).
e. The uncertainties in the state vector at the instant of jettison or destruct and any correlations used (Requirement 42834).
f. Any velocity imparted to the debris fragments during jettison, destruct, or breakup (Requirement 42835).
g. The influence of atmospheric variability, including winds (Requirement 42836).
h. The probability of the debris impacting the property which accounts for the probability of vehicle failure and the location, size, and shape of the property (Requirement 42837).
3.2.6.4 A range safety analysis shall establish flight commit criteria and operational constraints, such as hazard areas and impact limit lines, needed to control any risk due to debris impacts (Requirement 42838).
3.2.6.5 A range safety analysis shall establish hazard areas needed to control risk due to debris including aircraft and ship hazard areas for notices to mariners and notices to airmen (Requirement 42839).
3.2.7 Far-Field Blast Overpressure Effects Risk Assessment.
3.2.7.1 A range safety analysis shall characterize the risk to the public and the workforce due to any far-field blast overpressure from potential explosions during vehicle operations for input to the risk management process (Requirement 42841).
3.2.7.2 The analysis shall establish flight commit criteria to control risk due to potential distance focus overpressure effects (Requirement 42842).
3.2.7.3 A far-field blast overpressure analysis shall account for:
The potential for distance focus overpressure or overpressure enhancement given current meteorological conditions and terrain characteristics (Requirement 42843).
a. The potential for broken windows and related casualties (Requirement 42844).
b. Characteristics of the potentially affected windows, including their size, location, orientation, glazing material, and condition (Requirement 42845).
c. The hazard characteristics of the potential glass shards, such as falling from upper building stories or being propelled into or out of a shelter toward potentially occupied spaces (Requirement 42846).
d. The explosive capability of the vehicle at or after impact and at altitude and potential explosions resulting from debris impacts, including the potential for mixing of liquid propellants (Requirement 42847).
e. Characteristics of the v , ehicle flight and the surroundings that would affect the population's susceptibility to injury, for example, shelter types and time of day of the proposed activity (Requirement 42848).
3.2.8 Toxic Hazard Risk Assessment.
3.2.8.1 In the case of a catastrophic failure of a vehicle in flight, rocket fuel and oxidizer residues (e.g., aerozine-50, nitrogen tetroxide, hydrogen chloride from solid rocket motors, and their combustion products) may be present. Under certain meteorological conditions, high concentrations of these materials may drift over populated areas at levels greater than emergency health standards permit. As a result, NASA shall protect the public and workforce from toxic hazards using either hazard containment or a risk mitigation approach (Requirement 42850).This paragraph does not apply to any potential release of radioactive materials. (See paragraph 3.3.7.3.)
3.2.8.2 A range safety analysis shall establish flight commit criteria to control any risk due to potential toxic material release (Requirement 42851).
a. The analysis shall assess any residual risk due to potential toxic material release not fully contained or mitigated for input to the program's risk management process (Requirement 42852).
b. The analysis shall account for:
(1) Any foreseeable toxic material release during the proposed flight or in the event of a mishap (Requirement 42854).
(2) Any operational constraints and emergency procedures that provide protection from toxic material release (Requirement 42855).
(3) All populations potentially exposed to any toxic material release, including all members of the public and workforce on land and on any waterborne vessels and aircraft (Requirement 42856).
(4) Potential emissions from both nominal range operations and catastrophic events to ensure response actions are designed to prevent or mitigate possible exposures (Requirement 42857).
3.2.8.3 The American Industrial Hygiene Association - Emergency Response Planning Guidelines (ERPG) - sha , ll be used for determining the need and requirements for emergency response action plans (Requirement 42858).
3.2.9 Containment.
3.2.9.1 When controlling risk through containment, the range safety analysis shall provide the basis for establishing the geographical areas from which people and any property identified under paragraph 3.2.4.3.b shall be excluded during flight (Requirement 42860).
3.2.9.2 The analysis shall determine any operational controls needed to isolate each hazard and prevent/mitigate the risk due to the hazard (Requirement 42861).
3.2.9.3 The cognizant range safety organization, in conjunction with the program, shall establish the containment criteria for normal and malfunctioning veh , icle flight (Requirement 42862).
3.2.9.4 Any residual risk due to any hazard not fully contained shall undergo the risk management process of paragraph 3.2.4 (Requirement 42863).
3.2.10 Risk Mitigation.
3.2.10.1 When controlling risk through mitigation, , a range safety analysis shall establish the operational constraints that negate the risk or reduce it to a level that is acceptable with appropriate management approval (Requirement 42865).
3.2.10.2 Any residual risk not fully mitigated shall undergo the risk management process of paragraph 3.2.4 (Requirement 42866).
3.3.1 Flight Termination System (FTS).
An FTS provides for hazard mitigation during vehicle flight and may be a major component of a vehicle program's risk management approach.
3.3.1.1 Any vehicle, stage, or payload with propulsive capability that poses elevated risk to the public shall have an FTS as needed to satisfy the range safety analysis requirements of paragraph 3.2 of this NPR (Requirement 42869). Note: Based on a case-by-case assessment, an inhabited vehicle might incorporate an FTS only on certain components and not on the inhabited portion of the vehicle. NPR 8705.2, Human-Rating Requirements for Space Systems, contains requirements that apply when an FTS is used on any component of an inhabited vehicle.
3.3.1.2 When designing future inhabited aerospace vehicles, NASA shall consider designs that provide controllability and high reliability, fuels and materials that are of low toxicity, and trajectories for launch and entry that limit exposure of hazards to popula , tions to negate the need for an FTS (Requirement 42870).
3.3.1.3 When an FTS is used, the termination action shall inhibit further deviation in the instantaneous impact point of the vehicle, including any payload, and disperse any hazardous propellant in a predictable manner (Requirement 42871).This serves to limit further exposure of population to hazards associated with an errant vehicle.
3.3.1.4 The FTS shall satisfy the design and test requirements of AFSPCMAN 91-710, Range Safety User Requirements Manual, RCC 313, Test Standards for Flight Termination Receiver/Decoders, or RCC 319, Flight Termination Systems-Commonality Standard (Requirement 42872).
3.3.1.5 When an FTS is used for a NASA or NASA-sponsored vehicle, the vehicle program shall implement a secure FTS in accordance with NPR 2810.1, Security of Information Technology (Requirement 42873).
3.3.1.6 The configuration of an installed, approved FTS shall be controlled using a standard configuration control management process (Requirement 42874).
3.3.1.7 Criteria for activation of the FTS for uninhabited vehicles shall include conditions for when:
a. Valid data shows the vehicle violating a flight termination boundary, unless other documented mitigations are in effect (Requirement 42786).
b. Vehicle performance or location is unknown, the vehicle is capable of violating a flight termination boundary, and terminating flight would mitigate the risk (Requirement 42877).
c. There is a gross trajectory deviation or obvious erratic flight rendering the vehicle uncontrollable (Requirement 42878).
d. Other mission-specific conditions present rationale for additional criteria (Requirement 42879).
3.3.1.8 When an inhabited vehicle or its launch systems require an FTS, the range safety organization and the program shall coordinate to develop the flight termination activation criteria (Requirement 42880).NPR 8705.2, Human-Rating Requirements for Space Systems, applies.
3.3.2 Recovery Systems.
3.3.2.1 Recovery systems intended to save or preserve the flight vehicle in the event of a malfunction shall not be considered an FTS (Requirement 42882).A recovery system may be considered as risk mitigation and factor into the range safety risk assessment for the range operation where applicable.
3.3.2.2 Activation of a recovery system shall not increase the risk to people or property (Requirement 42883).).
3.3.3 Contingency Management System (CMS).
3.3.3.1 A CMS may use a set of elements within the vehicle, including but not limited to manual control, autonomous control, and recovery capability.
3.3.3.2 A CMS shall not be considered an FTS (Requirement 42886).
3.3.3.3 Activation of a CMS shall not increase the risk to people or property (Requirement 42887).
3.3.3.4 A CMS may be considered as risk mitigation and factor into the range safety risk assessment for the range operation where applicable.
3.3.4 Vehicle Tracking.
3.3.4.1 For a vehicle that is flown with an FTS:
a. The range safety systems used to support a flight termination decision shall include at least two sources of vehicle tracking data; where the two sources are independent of each other and one of the sources is independent of the vehicle guidance system (Requirement 42891).
b. The tracking data shall be of sufficient quality to determine the vehicle's real time position and instantaneous impact point throughout the entire period of time that the FTS is used to contain the hazard and make range safety decisions (Requirement 42892).
Note: This tracking time period includes launch through orbital insertion for orbital vehicles, throughout the mission for suborbital or aeronautical vehicles, and upon entry through landing for entry vehicles.
3.3.4.2 For the flight of an uninhabited vehicle that is flown without an FTS, the range safety system shall include tracking or other data sources sufficient to determine the impact footprint of all vehicle components (Requirement 42893).
3.3.5 Telemetry.
3.3.5.1 All data systems that provide information used to evaluate range safety requirements shall undergo validation to ensure operational readiness prior to initiating any phase of flight such as launch or entry (Requirement 42895).
3.3.5.2 The range safety telemetry system shall provide continuous, accurate data during preflight operations and during flight (Requirement 42896).
3.3.5.3 The vehicle program shall coordinate with the responsible range safety organization to identify the safety data required for each flight (Requirement 42897).
3.3.5.4 For a vehicle that uses an FTS, the telemetry data shall include parameters that describe the health and status of the FTS and the vehicle needed to support a flight termination decision (Requirement 42898).These parameters may include:
a. FTS:
(1) Receiver signal strength, command, and pilot tone or check channel status.
(2) Safe/arm status.
(3) Battery voltage.
(4) Battery temperature.
b. Navigation system parameters such as position, velocity, and acceleration.
c. Guidance commands including nozzle deflections in the pitch and yaw axes.
d. Vehicle attitude data including pitch, yaw, and roll angles and rates.
e. Motor chamber pressures.
f. Indicators of separation and/or jettison events.
g. Global positioning system positional and velocity data, when used for range safety , purposes.
3.3.6 FTS Command System.
3.3.6.1 An FTS command system used to support missions that require an FTS shall incorporate fully redundant and independent command paths (Requirement 42911).
3.3.6.2 An FTS command system shall undergo validation to ensure operational readiness prior to every mission (Requirement 42912).
3.3.6.3 FTS command systems shall be under configuration control (Requirement 42913).
3.3.7 Radiation Systems.
3.3.7.1 NASA programs shall control radiation sources during all operational phases to ensure the protection of people, environment, facilities, and equipment and compliance with applicable Federal, State, and local regulations and NASA requirements (Requirement 42915).
Note: Such radiation sources include radio-frequency/microwave emitters, radioactive materials, X-ray devices, lasers, and optical emitters.
3.3.7.2 Nonionizing Radio Frequency (RF) Radiation Controls - All operations involving the use of RF transmitters (including FTS) shall be licensed, scheduled, and coordinated through the range and conform to the standards and regulations specified in IEEE C95.1-1991, American National Standard Safety Levels with Respect to Human Exposure to Radio Frequency Electromagnetic Fields, 30 KHz to 100 GHz., and regulations of the range involved in the operation (Requirement 42916).
3.3.7.3 Ionizing Radiation Controls - All operations involving the use of radioactive sources shall conform to the standards and regulations of the Nuclear Regulatory Commission and regulations of the range involved in the operation (Requirement 42917).
Note: Policies and guidance for handling, use, and storage of radioactive material, including the approvals required, are contained in directives under the purview of NASA occupational health organizations (see NPD 1800.2, NASA Occupational Health Program). NPR 8715.3, NASA Safety Manual, Chapter 5, contains requirements and guidance applicable to launch of any radioactive materials.
3.3.7.4 Laser Hazard Controls
3.3.7.4.1 All operations involving the use of lasers shall comply with ANSI Z136.1, American National Standard for the Safe Use of Lasers (Requirement 42919).
3.3.7.4.2 All operations involving the use of lasers outdoors shall comply with ANSI Z136.6-2000, American National Standard for the Safe Use of Lasers Outdoors (Requirement 42920), which includes the following:
a. Lasers entering the National Airspace shall have an FAA letter of nonobjection (Requirement 42921).
b. Programs that use a laser with potential to strike orbiting satellites shall coordinate its operations with the DoD Laser Safety Clearinghouse (Requirement 42922).
3.3.8 Safety Critical Software.
3.3.8.1 Range safety systems that incorporate safety critical software that are used to support NASA missions shall have an independent verification and validation plan in accordance with NPD 8730.4, Software Independent Verification and Validation (IV&V) Policy (Requirement 42924).
3.3.8.2 NASA safety-critical software shall be developed in accordance with NPR 7150.2, NASA Software Engineering Requirements, and NASA STD 8719.13, Software Safety (Requirement 42925).
3.4.1 Flight Commit Criteria.
3.4.1.1 The flight commit criteria for a range operation shall identify the conditions that must be met to initiate each flight or phase of flight (see paragraph 3.2.4.3.e.1 for requirements that apply to phases of flight) (Requirement 42928).
3.4.1.2 The flight commit criteria shall provide for:
a. Assurance that the collision avoidance requirements of paragraph 3.4.3 are satisfied for any launch or entry (Requirement 42930).
b. Surveillance of any established hazard areas (Requirement 42931).
c. Verification that all range safety systems are available and operational (Requirement 42932).
d. Verification that the meteorological conditions, such as wind, lightning, and visibility, are within the limits defined by the range safety analysis (Requirement 42933).
3.4.1.3 Implementation of the flight commit criteria shall include documenting the actual conditions at the time of flight or time of each phase of flight where applicable to verify that the flight commit criteria have been met (Requirement 42934).
3.4.2 Entry Operations.
For an entry operation, the vehicle program and the receiving landing site have responsibility for range safety risk management. In this regime, range safety responsibility begins with concurrence with the decision to send the final command that initiates the entry and landing sequence.
3.4.2.1 Commit to entry and landing shall be initiated (enabled) by vehicle operator control(Requirement 42936).
3.4.2.2 Entry and landing shall not be initiated until all conditions critical to safety have been confirmed (Requirement 42937).
3.4.2.3 The reliability of the vehicle to achieve controlled entry to the targeted landing site or debris footprint shall be at least 0.99 with 50 percent confidence (Requirement 42938).
Note: The intent is to provide appropriate assurance that the vehicle will be deorbited in a predictable manner (i.e., avoid skip out) and allow for appropriate risk management during the entry operation in accordance with paragraph 3.2.4.
3.4.3 Collision Avoidance (COLA).
3.4.3.1 A space vehicle program, in coordination with the responsible range safety organization, shall ensure that the vehicle, any jettisoned component, or payload does not pass closer than 200 kilometers to an orbiting inhabited or inhabitable spacecraft (Requirement 42940).
Note: This applies throughout suborbital flight to landing or final impact. For orbital flight, this applies during ascent to initial orbital insertion and through at least one complete orbit. For an entry operation, this applies from the point that the commit to deorbit is initiated through landing or final impact.
3.4.3.2 The vehicle program or responsible range safety organization shall:
a. Inform the United States Strategic Command of an upcoming launch or entry operation at least 15 days before the operation (Requirement 42942).
b. Notify the United States Strategic Command immediately of any change in the planned launch or entry operations that occurs after the initial notification (Requirement 42943).
c. Obtain a COLA analysis from the United States Strategic Command or perform an equivalent analysis needed to satisfy paragraph 3.4.3.1 of this NPR (Requirement , 42944).
d. Implement any constraints needed to satisfy paragraph 3.4.3.1 of this NPR (Requirement 42945).
3.4.4 Uninhabited Aerial Vehicles Operations.
3.4.4.1 The RCC 323, Range Safety Criteria for Unmanned Air Vehicles, shall be used for guidance when operating, hosting, or sponsoring a UAV operation (Requirement 42947).
3.4.4.2 Lead range safety responsibility for a UAV flight shall default to the initiating Center or range (where takeoff occurs) (Requirement 42948).
Note: Each takeoff initiates a distinct range operation. Unless other agreements are made between the ranges involved, if a UAV lands at a site that has a different authority than the original takeoff site, lead range safety responsibility for future takeoff and subsequent flight from the new site transfers to the new range authority.
3.5.1 Qualifications for personnel who perform a range safety function (including RSOs and personnel responsible for range safety systems and range safety analysis) shall include:
a. Successful completion of knowledge-based training (self-study and/or classroom) applicable to the range safety function (Requirement 42951).
b. Successful completion of instructor-led, hands-on training on how to perform the range safety function followed by satisfactory on-the-job performance as a trainee, as applicable (Requirement 42952).
c. Proficiency demonstrated to a qualified range safety professional during simulation scenarios that exercise hands-on operations of range safety systems and use of safety decision-making tools or processes, as applicable (Requirement 42953).
d. Proficiency demonstrated to a qualified range safety professional during exercises of nominal and contingency actions, as applicable (Requirement 42954).
3.5.2 The training program for range safety personnel shall:
a. Provide qualified personnel to support nominal and contingency range operations (Requirement 42956).
b. Include a recurring training process to ensure personnel retain their qualifications (Requirement 42957).
c. Include a requalification process for personnel who lose qualification status, such as, someone who exhibits substandard performance or has temporary health problems (Requirement 42958).
d. Include a documentation process that captures the qualification, recurring training, and requalification status of all range safety personnel (Requirement 42959).
| TOC | Preface | Chapter1 | Chapter2 | Chapter3 | AppendixA | AppendixB | ALL | |
| | NODIS Library | Program Management(8000s) | Search | |