GSFC-STD-8009T-SRPO WFF Range Safety Manual Rev B.pdf

GSFC-STD-8009T-SRPO

GODDARD TECHNICAL

STANDARD

Revision B

Goddard Space Flight Center Approved: May 20, 2021 Greenbelt, MD 20771 Revalidation Date:

Goddard Space Flight Center (GSFC)

Wallops Flight Facility Range Safety Manual (RSM)

Tailoring for Sounding Rocket Program Office (SRPO)

Measurement System Identification:

METRIC/SI (ENGLISH)

THIS STANDARD HAS BEEN REVIEWED FOR EXPORT CONTROL RESTRICTIONS;

APPROVED FOR PUBLIC RELEASE

DISTRIBUTION IS UNLIMITED

NOTE: This document applies to all standard vehicles in the Sounding Rocket Program. If a different vehicle is developed or utilized that does not conform to this document retailoring and Safety Office approval will be required.

Submitted By:

Sounding Rockets Program Office Chief Wallops Flight Facility

Approved By:

Safety Office Chief Engineer Wallops Flight Facility

DOCUMENT HISTORY LOG

Status Document Revision

Approval Date

Description

Baseline - May 5, 2020 Initial Release – This GSFC Tailored Standard is specific to the Sounding Rocket Program

1st Update A May 14, 2020 Corrected text box formatting. Added tailoring for small batteries remaining on during arming (section 4.2.1.2.5).

2nd Update B May 20, 2021 Removed “Battery Charging” from ii Power Switching definition example (section 3.2)

FOREWORD

This standard is published by the Goddard Space Flight Center (GSFC) Wallops Flight Facility (WFF) to serve as the Range Safety Manual (RSM) for GSFC WFF range flight operations. It provides uniform engineering and technical requirements for ground and flight hardware processes, procedures, practices, and methods that have been endorsed as standard for NASA range flight operations, including requirements for selection, application, and design criteria of an item.

This standard establishes the Range Safety Program for protecting the public, workforce, and property for GSFC WFF. It implements NASA Procedural Requirements (NPR) 8715.5, Range Flight Safety Program, NASA-STD-8719.25, Range Flight Safety Requirements, and sections of NPR 8715.3, NASA General Safety Program Requirements that address range safety concerns. It also contains safety policy and requirements that are specific to GSFC’s WFF and is designed to address unique safety concerns associated with WFF range operations and programs/operations conducted under the cognizance of WFF at other launch/landing sites.

This standard serves as a companion to 800-PG-8715.5.1, Range Safety Process for Programs and Projects which identifies roles and activities that are key to safe and successful range operations.

Requests for information, corrections, or additions to this standard should be submitted via “Contact Us” on the GSFC Technical Standards website at http://standards.gsfc.nasa.gov.

http://standards.gsfc.nasa.gov/

Table of Contents Goddard Space Flight Center (GSFC)

Wallops Flight Facility Range Safety Manual (RSM)

Tailoring for Sounding Rocket Program Office (SRPO)

DOCUMENT HISTORY LOG

FOREWORD

1. SCOPE

1.1 Purpose

1.2 Applicability

2. APPLICABLE DOCUMENTS

2.1 Government Documents

2.2 Non-Government Documents

2.3 Order of Precedence

3. ACRONYMS AND DEFINITIONS

3.1 Acronyms and Abbreviations

3.2 Definitions

4. REQUIREMENTS

4.1 Responsibilities and Range Safety Requirements Tailoring

4.1.1 Range User and Tenant Requirements

4.1.2 Range Safety Requirements Tailoring

4.2. Ground Safety Requirements

4.2.1 Hazardous System Requirements

4.2.1.1 Hazardous System Categorization

4.2.1.2 Operational Design Requirements

4.2.1.3 Category 1 Hazardous Circuit Design Requirements

4.2.1.4 Category 2 Hazardous Circuit Design Requirements

4.2.1.5 Ground Support Equipment (GSE) Requirements

4.2.1.6 Radiation Systems

4.2.1.7 Chemical Systems

4.2.1.8 Pressure Vessels and Pressurized Systems

4.2.1.9 Cryogenic Systems

4.2.1.11 Battery Systems and High Voltage

4.2.2 Operations Controls and Procedures

4.2.2.1 General Operational Controls

4.2.2.2 Exposure and Personnel Limits

4.2.2.3 Radio Frequency (RF) Controls

4.2.2.4 Restrictions for Tour Groups and Official Visitors

4.2.2.5 Personal Protective Equipment (PPE)

4.2.2.6 Electrostatic Discharge Protocols

4.2.2.7 Electrical Storm Protocols

4.2.2.8 Hazardous Operations Training and Certification Requirements

4.2.2.9 Nominal Recovery or Planned Land Impacts Procedures

4.2.2.10 Emergency Procedures

4.3 Flight Safety Requirements

4.3.1 Risk Criteria, Application, and Assessment Process

4.3.1.1 Public and Mission Essential Risk Criteria

4.3.1.2 Application of Risk Criteria

4.3.1.3 Risk Assessment Process

4.3.1.4 Collision Avoidance (COLA)

4.3.2 Flight Safety Systems

4.3.2.4 Flight Termination System Requirements

4.3.2.7 Command and Control Systems

4.3.2.8 Range Safety Tracking, Data Processing, and Display Systems

4.3.2.9 Range Surveillance Systems

4.3.3 Operational Requirements

4.3.3.1 Hazard Areas and Range Clearance

4.3.3.2 General Flight Commit Criteria

4.3.3.3 Vehicles with Flight Termination Systems

4.3.3.4 Vehicles without Flight Termination Systems

4.4 Safety Critical Systems

4.5 Safety Data Requirements

4.5.1 Vehicle and Payload Ground Safety Data

4.5.2 Vehicle and Payload Processing Procedures

4.5.3 Flight Safety Data Requirements

4.5.3.1 Rocket Flight Safety Data

4.5.4 Telemetry (TM) Data Requirements for Vehicles with Flight Termination

4.5.5 Schedules for Providing Data

1. SCOPE

1.1 Purpose

The purpose of this standard is to identify WFF range requirements to implement safety policies and criteria defined in NPR 8715.5, Range Flight Safety Program, NASA-STD-8719.25 Range Flight Safety Requirements, and sections of NPR 8715.3, NASA General Safety Program Requirements applicable to range safety. The standard defines the technical design requirements, restrictions, operations procedures, and other support requirements. It identifies data requirements and general schedule requirements for WFF to perform appropriate safety analysis per 800-PG-8715.5.1, Range Safety Process for Programs and Projects.

Safety participation early in the planning stages of a program will reduce the possibility of costly engineering changes.

1.2 Applicability

This standard is applicable to all programmatic operations and specific aircraft operations conducted at or managed by WFF. It applies to all NASA personnel, NASA contractors, tenants, experimenters, and range users. NASA WFF Partner Organizations (e.g., commercial partners, other Federal agencies, international parties, and tenants) performing Non-NASA range operations at WFF may invoke Goddard Procedural Requirements (GPR) 8700.11 Safety Program for Non-NASA Operations on Wallops Flight Facility (WFF). In this case, the range user will work with the WFF Safety Office to determine applicable RSM requirements.

Section 4.0 contains range safety requirements that apply to hazardous systems (i.e. vehicles, payloads, instruments, experiments and associated ground support equipment (GSE)) incorporated within or attached to manned aircraft platforms, Unmanned Aircraft System (UAS) operations conducted on NASA property or in support of NASA missions, and any specific aspect of an aircraft operation that exposes the public, workforce, or property to risk greater than that incurred by normal piloted aircraft operations. Aircraft operations also must comply with requirements in NPR 7900.3, Aircraft Operations Management and the associated projects must work with the NASA WFF Aircraft Office (Code 830) to ensure compliance.

For WFF managed operations conducted at other ranges, the requirements established by this document apply as a minimum unless requirements of the host range are more stringent, in which case the more stringent requirements apply. Should the host range waive or accept a variance to a shared requirement, NASA is responsible for ensuring the NASA requirements are still upheld or follow the process defined in 800-PG-8715.5.1, Range Safety Process for Programs and Projects for waivers.

More stringent safety requirements will be considered by WFF if requested by the range users, principle investigators (PIs), or tenants.

NASA payloads involved in uninhabited orbital and uninhabited deep space missions that fly onboard Expendable Launch Vehicles (ELVs) (including aircraft assisted ELVs) under the cognizance of the WFF are subject to NPR 8715.7, ELV Payload Safety Program, NASA-STD-

8719.24, NASA ELV Payload Safety Requirements, and the applicable requirements of this document.

2. APPLICABLE DOCUMENTS

The documents listed in this section contain provisions that constitute requirements of this standard as cited in the text of Section 4. The latest issuances of the cited documents shall be used unless otherwise approved by the Range Safety Chief Engineer, who is vested with Range Safety Technical Authority (TA).

2.1 Government Documents

a. 14 CFR 173.185, Lithium Cells and Batteries

b. 14 CFR Part 101, Moored Balloons, Kites, Unmanned Rockets and Unmanned Free Balloons

c. 14 CFR Part 417, Launch Safety

d. 29 CFR 1910.134, Respiratory Protection

e. 29 CFR 1910.1200, Hazard Communication Standard (HCS)

f. NPD 8710.5, Policy for Pressure Vessels and Pressurized Systems

g. NPR 1800.1, NASA Occupational Health Program Procedures

h. NPR 7150.2, NASA Software Engineering Requirements

i. NPR 7900.3, Aircraft Operations Management

j. NPR8621.1, NASA Procedural Requirements for Mishap and Close Call Reporting, Investigating, and Recordkeeping

k. NPR 8715.3, NASA General Safety Program Requirements

l. NPR 8715.5, Range Flight Safety Program

m. NPR 8715.7, Expendable Launch Vehicle (ELV) Payload Safety Program

n. NASA-SPEC-5022, NASA Manufacturing and Test Requirements for Normally Closed

Pyrovalves for Hazardous Flight Systems Applications.

o. NASA-STD-5005, Standard for the Design and Fabrication of Ground Support Equipment

p. NASA STD-8709.22,

q. NASA-STD-8719.9, Lifting Standard

r. NASA-STD-8719.12, Safety Standard for Explosives, Propellants, and Pyrotechnics

s. NASA-STD-8719.13, NASA Software Safety Standard

t. NASA-STD-8719.17, NASA Requirements for Ground-Based Pressure Vessels and

Pressurized Systems PVS)

u. NASA-STD-8719.24, NASA ELV Payload Safety Requirements

v. NASA-STD-8719.25, Range Flight Safety Requirements

w. NASA-STD-8739.8, NASA Software Assurance Standard

x. NASA-STD-8739.12, Metrology & Calibration

y. NASA-STD-4010, NASA Standard for Lightning Launch Commit Criteria for Space Flight

z. GPR 1700.8, GSFC Hazard Communication Program

aa. GPR 1860.1, Ionizing Radiation Protection

bb. GPR 1860.2, Laser Radiation Protection

cc. GPR 1860.3, Radio Frequency Radiation Protection

dd. GPR 1860.4, Ultraviolet (UV) and High Intensity Light (HIL) Radiation Protection

ee. GPR 8621.4, GSFC Mishap Preparedness and Contingency Plan

ff. GPR 8700.11, Safety Program for Non-NASA Operations on Wallops Flight Facility (WFF)

gg. GPR 8710.3, Certification and Re-certification of Ground Based Pressure Vessels and Pressurized Systems (PVS)

hh. gg. GPR 8710.7, Cryogenic Safety

ii. hh. GPR8719.1, Lifting Devices and Equipment (LDE) Certifications and Operations.

jj. ii. GPR8730.1, Metrology: Control of Measurement and Test Equipment

kk. jj. GSFC-STD-8715.1, Goddard Space and Flight Center (GSFC) Explosive Safety Program

ll. GSFC 23-6R, GSFC Request for Radiation Safety Committee Action Non-Ionizing

Radiation Form

mm. GSFC 23-35RF, RF/EMF Source Personnel Approval Form

nn. GSFC23-28UV-HIL, GSFC Request for Non-Ionizing Radiation Safety Committee Action

oo. UV/HIL Radiation Source Questionnaire

pp. GSFC23-6UV-HIL, GSFC Request for Non-Ionizing Radiation Safety Committee Action

Ultraviolet/High Intensity Light Radiation Source Approval

qq. GSFC23-28L, Laser Radiation Source Questionnaire

rr. GSFC23-6L, Laser Radiation Source Use Approval

ss. GSFC23-35LU, Laser Radiation Source Personnel Approval Form

tt. 360-PG-8710.0.2, High Pressure Systems Operator Certification

uu. 800-PG-1700.1.1, Wallops Flight Facility Personal Protective Equipment Program

vv. 800-PG-7150.4.1, Software Safety and Mission Assurance Process Interface

ww. 800-PG-8710.3.1, Wallops Flight Facility Flex Hose Handling and Installation

xx. 800-PG-8715.0.4, Certification Procedures for Operations Safety Specialists at Wallops

Flight Facility

yy. 800-PG-8715.1.1, Unmanned Roadblocks for Hazardous Operations

zz. 800-PG-8715.5.1, Range Safety Process for Programs and Projects aaa. 803-PG-8715.1.16, Autonomous Flight Termination System (AFTS) Certification bbb. 800-WI-8715.2.1, Severe Weather Notification ccc. 803-WI-7150.4.1, Software Safety and Mission Assurance Process ddd. 830-AOM-0001 Aircraft Operations Manual eee. AFSPCMAN 91-710, Air Force Space Command Manual, Range Safety User

Requirements Manual

2.2 Non-Government Documents

a. RCC 319, Range Commanders Council Flight Termination Systems Commonality Standard

b. RCC 321, Common Risk Criteria Standards for National Test Ranges

c. RCC 323, Range Safety Criteria for Unmanned Aerial Vehicles

d. RCC 324 Range Safety Performance Standards

e. FDSS-21-0182, Launch COLA Operations

f. EWR 127-1, Range Safety Requirements

g. NFPA 497, Recommended Practice for the Classification of Flammable Liquids, Gases, or

Vapors and of Hazardous (Classified) Locations for Electrical Installation in Chemical Process Areas

h. NFPA 2112, Standard on Flame Resistant Garments for Protection of Industrial Personnel Against Flash Fire

i. ANSI Z136.1, Safe Use of Lasers

j. ANSI Z136.6, Safety Use of Lasers Outdoors

k. ANSI Z540.1, Calibration Laboratories and Measuring and Test Equipment – General Requirements

l. ANSI Z540.3, Requirements for the Calibration of Measuring and Test Equipment

m. ANSI/ISEA 107-199, American National Standard for High-Visibility Apparel

n. ANSI/AIAA S-080, Space Systems – Metallic Pressure Vessels, Pressurized Structures, and

Pressure Components

o. ANSI/AIAA S-081, Space Systems – Composite Overwrapped Pressure Vessels (COPVs)

p. IEEE C95.1, Standard for Safety Levels with Respect to Human Exposure to Radio

Frequency Electromagnetic Fields

q. 28 February 2012 AIR FORCE MEMORANUM FOR JFCC Space/J/9, entitled Satellite

Protection Guidance for the Laser Clearinghouse (Appendix G)

r. National Fire Protection Association (NFPA) National Electric Code, Article 500 –

Hazardous Locations

2.3 Order of Precedence

When this standard is applied as a requirement or imposed by contract on a program or project, the technical requirements of this standard take precedence, in the case of conflict, over the technical requirements cited in the above applicable documents or referenced guidance documents.

3. ACRONYMS AND DEFINITIONS

3.1 Acronyms and Abbreviations

AFSRB Airworthiness Flight Safety Review Board AFTS Autonomous Flight Termination System AGC Automatic Gain Control AIAA American Institute of Aeronautics and Astronautics AIS Automatic Identification System ANSI American National Standards Institute AOM Aircraft Operations Manual ASAP As Soon As Possible ASME American Society of Mechanical Engineers ASO Aviation Safety Officer ATC Aircraft Traffic Control AWG American Wire Gauge BPO Balloon Program Office CDI Capacitive Discharge Ignition CM Campaign Manager CMS Contingency Management System COLA Collision Avoidance COPV Composite Overwrapped Pressure Vessel COTS Commercial Off the Shelf DFO Distance Focus Overpressure DoD Department of Defense DoP Dilution of Precision DoT Department of Transportation EBW Exploding Bridgewire Ec Expectation of Casualty EED Electro-Explosive Device

EGSE Electrical Ground Support Equipment ELS Equivalent Level of Safety ELV Expendable Launch Vehicle ESD Electrostatic Discharge ESO Explosive Safety Officer FAA Federal Aviation Administration FMEA Failure Mode and Effects Analysis FSDP Flight Safety Data Package FSP Flight Safety Plan FSS Flight Safety System FTS Flight Termination System FUR Frequency Utilization Request GOTS Government Off the Shelf GPS Global Positioning System GSDP Ground Safety Data Package GSE Ground Support Equipment GSFC Goddard Space Flight Center GSO Ground Safety Officer GSP Ground Safety Plan HERF Hazards of Electromagnetic Radiation to Fuel HERO Hazards of Electromagnetic Radiation to Ordnance HIF High Intensity Light IMU Inertial Measurement Unit INS Inertial Navigation System IRT Interim Response Team LDE Lifting Devices and Equipment LOS Loss of Signal LPM Launch Pad Manager LPS Lightning Protection System LSRB Laser Safety Review Board MARS Mid-Atlantic Regional Spaceport MAWP Maximum Allowable Working Pressure MEOP Maximum Expected Operating Pressure MOC Mission Operations Center MOD Mission Operations Document MOTS Modified Off the Shelf MPCP Mishap Preparedness and Contingency Plan MRSO Mission Range Safety Officer MSDS Material Safety Data Sheet NAS National Airspace System NASA National Aeronautics and Space Administration NCSL National Conference of Standards Laboratories NFPA National Fire Protection Association NOTAMS Notice to Airmen NOTMARS Notice to Mariners NPR NASA Procedural Requirements NPT National Pipe Thread NRC Nuclear Regulatory Commission NSA National Security Agency OSHA Occupational Safety & Health Administration OSS Operations Safety Specialist

PC Probability of Casualty Pi Probability of Impact PIC Pilot in Command PPE Personal Protective Equipment PVS Pressure Vessel System RCC Range Commanders Council RF Radio Frequency RPO Radiation Protection Office RSCE Range Safety Chief Engineer RSG Range Safety Group RSM Range Safety Manual RSP Range Safety Plan S/A Safe Arm SCAPE Self-Contained Atmospheric Protective Ensemble SDS Safety Data Sheet (also known as MSDS) SMA Safety & Mission Assurance TA Technical Authority TD Test Director TM Telemetry TNT Trinitro-toluene UAS Unmanned Aircraft Systems UAV Unmanned Aerial Vehicle UV Ultraviolet VACAPES Virginia Capes VDC Voltage Display Current WFF Wallops Flight Facility

3.2 Definitions

a. A-State – The state of a hazardous system that is defined by the high potential for inadvertent actuation or high likelihood of hazard exposure if a hazardous system is inadvertently actuated. Generally, personnel restrictions are implemented as a result of the Ground Safety Analysis Process and in effect when hazardous systems are in an A-State.

b. B-State – The state of a hazardous system that is defined by the a low or decreased potential for inadvertent actuation or has a low likelihood of hazard exposure if inadvertently actuated.

Personnel restrictions are generally more relaxed and access within the system’s danger area is permitted as long as it is consistent with the operation taking place.

c. Burst Pressure -The pressure at which pressure system components undergoing pressurize-to-burst testing rupture or exhibit an unstable fracture.

d. Burst Factor - This quantity is equal to the Design Burst Pressure divided by the Maximum

Allowable Working Pressure (MAWP).

e. Catastrophic Hazard - A hazard, condition or event that could result in a mishap causing fatal injury to personnel and/or loss of vehicle, payload, or ground facility.

f. Category 1 Hazardous System – A hazardous system whose consequence of inadvertent initiation cannot be physically contained. Reducing the likelihood of inadvertent initiation of a Category 1 system does not change the consequence of the associated hazard.

g. Category 2 Hazardous System – A hazardous system whose consequence of inadvertent initiation is physically contained when personnel would be exposed to the hazard.

Containment of the hazard mitigates the safety consequence of the hazard effects to a negligible level.

h. Collective Risk - The total combined risk to all individuals exposed to one or more particular hazards during a specified period of time or event (a specific phase of flight). Unless otherwise noted, collective risk for a range flight operation is the mean number of casualties expected (Ec) during an established period or event (e.g., a launch) due to the combination of all hazards associated with the operation.

i. Containment – A range safety technique that precludes hazards from reaching the public, the workforce, or property that requires protection.

j. Contingency Management System - A system designed to manage the vehicle throughout the atmospheric flight envelope that provides a controlled response under the full set of circumstances defined by the risk assessment. The system may be comprised of a set of elements within the vehicle, including but not limited to manual control, autonomous control, and recovery capability. It may be used as a risk mitigation factor in the risk assessment when applicable.

k. Critical Hazard – A hazard, condition or event that may cause severe injury or occupational illness, or major property damage.

l. Critical Operations Personnel - Includes persons not essential to the specific operation

(launch, entry, flight) currently being conducted, but who are required to perform safety, security, or other critical tasks at the launch, landing, or flight facility. Critical Operations Personnel are notified of the hazardous operation and either trained in mitigation techniques or accompanied by a properly trained escort. Critical Operations Personnel do not include individuals in training for any job or individuals performing routine activities such as administrative, maintenance, or janitorial. Critical Operations Personnel may occupy safety clearance zones and hazardous areas and need not be evacuated with the public. Critical Operations Personnel are included in the same risk category as Mission Essential Personnel.

m. Danger Area - An area defined by ground and/or flight safety analysis (including impact areas, abort areas, storage areas, or hazard areas) where normal operations or a system malfunction will create impacting objects, debris, blast, toxic release, or other hazards and where access must be restricted or otherwise controlled in order to satisfy established risk criteria.

n. Design Burst Pressure - The pressure is a calculated test pressure that pressurized components shall withstand without rupture to demonstrate its design adequacy in a qualification test. It is equal to the product of the MAWP and a Burst Factor.

o. Electro-Explosive Device - An electric initiator or other component in which electrical energy is used to cause initiation of explosives contained therein.

p. Equivalent Level of Safety (ELS) (determination) - The approval of an alternative approach to satisfying a range safety requirement where the alternative provides an approximately equal level of safety as determined by qualitative or quantitative means.

q. Expectation of Casualty (Ec) - The average number of casualties expected per event, such as vehicle flight, if a large number of events could be carried out under identical circumstances.

This is also referred to as collective risk.

r. Flight Hardware - Any hardware that is flown on or is a part of an aircraft, experimental flight vehicle, satellite, lighter than air vehicle, unmanned aerial vehicle, or space transportation system.

s. Flight Safety - A philosophy and methodology whereby rocket, balloon, drone, Unmanned

Aircraft Systems (UAS) and aircraft flight operations can be performed in a reasonable and prudent manner without undue risk to people or property or embarrassment to NASA or the United States Government.

t. Flight Safety System (FSS) - A system (including any subsystem) whose performance is factored into the Range Safety Analysis and relied upon during flight to mitigate hazards.

These systems include range safety displays, range clearance capability, radar, optic tracking systems, telemetry, tracking display systems (including instantaneous impact predictors), contingency management systems, flight termination systems, and command and control capability for flight termination systems.

u. Ground Safety - Those safety considerations, procedures, and resultant restrictions associated with hazardous systems during storage, handling, prelaunch, launch, and recovery/abort operations, where by operations can be performed in a reasonable and prudent manner without undue risk to people or property or the environment.

v. Hazard - A state or condition that could lead to an undesirable consequence (i.e. casualty or property damage).

w. Impact Area - The operational area within which one or more objects are predicted to impact in the vicinity of each other.

x. Individual Risk - The probability of an individual from a certain group (or subgroup) at a specific location suffering a casualty from exposure to hazards from a given event during a specific period (e.g., a launch). Individual risk is typically stated as a Probability of Casualty (Pc).

y. Inhibit – an independent and verifiable mechanical or electrical device that prevents a hazardous event from occurring: device has direct control and is not the monitor of such a device. An inhibit is a physical interruption or barrier between an energy source and the action or function that would take place if the energy source is released. Examples would be a relay or transistor between a battery and a pyrotechnic initiator, or a latch valve between a pressurized propellant tank and a thruster. Note: An inhibit control is a device or function that operates an inhibit. Controls do not satisfy the inhibit or failure tolerance requirements for hazardous functions.

z. Instantaneous Impact Point - The point at which an object would impact if thrusting were stopped at a given time.

aa. Launch Vehicle - Any rocket, rocket system, or balloon that is used to launch a suborbital or orbital payload, probe, satellite, or other experiment.

bb. Marginal Hazard - A hazard, condition or event that may cause minor injury or minor occupational illness to personnel.

cc. Maximum Allowable Working Pressure (MAWP) - The maximum pressure at which a component or system can continuously operate based on allowable stress values and functional capabilities. This maximum pressure value is most often cited in requirements and standards that address ground based pressure systems, such as the ASME Boiler and Pressure Vessel Code and the NASA Standard on Ground Based Pressure Vessels.

dd. Maximum Expected Operating Pressure (MEOP) – This term is used in requirements and standards that address aerospace pressure vessels, such as AIAA/ANSI S-080, AIAA/ANSI S-081, or Mil-Std-1522. It is the highest pressure that a pressure vessel, pressurized structure, or pressure component is expected to experience during its service life and retain its functionality, in association with its applicable operating environments; synonymous with maximum operating pressure. or maximum design pressure includes the effect of temperature, pressure transients and oscillations, vehicle quai-steady, and dynamic accelerations and relief valve operating variability.

ee. Mission Essential Personnel - Those individuals whose activities contribute directly to the performance of a potentially hazardous operation which is actually under way, and whose presence is mandatory for completion of the operation.

ff. Notice to Airmen (NOTAMS) - An advisory issued to airmen listing restricted or hazardous airspace during certain times.

gg. Notice to Mariners (NOTMARS) - An advisory issued to mariners listing restricted or hazardous areas during certain times.

hh. Operating Pressure - The pressure a system shall be subjected to during static and dynamic conditions (maximum temperature, maximum relief pressures, maximum regulator pressure, and, where applicable, transient pressure excursions).

ii. Power Switching - The changing of the power state of any power system manually, remotely or automatically. Examples include On/Off, Off/On, External/Internal, Internal/External, etc.

jj. Proof Pressure - The test pressure applied to pressure systems or individual components without failure, leakage, or permanent deformation. This pressure is obtained by multiplying MEOP or MAWP by a factor (usually 1.5 based on ASME standards, but can be as low as

1.25 based on AFSPMAN 91-710).

kk. Public - For the purposes of range safety risk management, all people who are not Mission

Essential Personnel or Critical Operations Personnel. Public includes visitors and personnel inside and outside NASA-controlled property who are not Critical Operations Personnel and who may be on land, on waterborne vessels, or in aircraft.

ll. Radio Frequency (RF) avoidance - No radiation from any transmitters capable of producing a potential hazard to any ordnance operation that involves exposing the ordnance side of the initiating circuit within ±20 degrees (azimuth and elevation) of the ordnance site.

mm. Range Safety - Application of safety policies, principles, and techniques to protect the public, workforce, and property from hazards associated with range operations.

nn. Range Safety System - A system used to mitigate risk to the public.

oo. Self-Contained Atmospheric Protective Ensemble (SCAPE) - This is a category of full body and respiratory protection suits with supplied air that is used primarily on hypergolic fuels and oxidizers, such as hydrazine and nitrogen tetroxide.

pp. System Initiator - Any device that initiates the action of a system. This includes but is not limited to Electro-Explosive Devices (EEDs), non-explosive initiators, and exploding bridge wire initiators.

qq. Tailoring - The process where the authorities responsible for range safety requirements and a range user review each requirement and jointly document whether the requirement is applicable to the range user’s planned operations and, if it is applicable, document whether the range user will meet the requirement as written or achieve an equivalent level of safety through an acceptable alternative. Tailoring includes equivalent level of safety (ELS) determinations. Tailoring does not include the approval of Range Safety Waivers, which are addressed by a separate process.

rr. Trinitro-toluene (TNT) Equivalency - The explosive energy per unit mass of the energetic material in question (propellants in our case) divided by the energy per unit mass of Trinitro-toluene (TNT); this number can be expressed as a percentage or a fraction.

ss. Unmanned Aircraft Systems (UAS) - A UAS includes an Unmanned Aerial Vehicle (UAV) or similar vehicle and all the associated support equipment, control station, data links, telemetry, communications and navigation equipment necessary to operate the vehicle.

tt. Unmanned Aerial Vehicle (UAV) - A vehicle that is controlled remotely or autonomously and operates at speeds ranging from subsonic to hypersonic in a manner consistent with a ‘conventional’ aircraft. A UAV may be launched from the ground or dropped from other aerial vehicles, subscale flight test vehicles, or lifting bodies. A UAV may also be referred to using a different name such as Unmanned Air Vehicles, Uninhabited Aerial Vehicles, Remotely Piloted Vehicles, drones and cruise missiles.

uu. Waiver – A variance that authorizes departure from a specific safety requirement where a certain level of risk has been documented and accepted.

4. REQUIREMENTS

Requirements are defined by shall statements and indicate the responsible organization. In most cases, the range user or vehicle program are responsible for meeting the requirement. The term ‘range user’ is typically associated with the flight vehicle provider conducting an operation at a launch range where the WFF Safety Office holds operational responsibility. The term ‘program’ refers to NASA programs and projects conducted under the cognizance of WFF at locations and at other launch ranges (i.e. Balloon Program Office (BPO)). These terms can be used interchangeably in most cases, but should be tailored specifically to the range user or program via the Range Safety Tailoring process.

Some requirements are accompanied by a text box. The information in the text box identifies alternatives in meeting the intent of the requirement and may be used by the range user or vehicle in the Range Safety tailoring. The text box may also provide additional clarifying information, requirement rationale, or recommended practices. For recommended practices, the range user should work with the WFF Safety Office to determine its applicability and enforcement.

4.1 Responsibilities and Range Safety Requirements Tailoring

4.1.1 Range User and Tenant Requirements

4.1.1.1 The range user or program shall obtain WFF Safety Office approval prior to conducting any hazardous operation. See Section 4.2.2, Operations Control and Procedures, for specific requirements.

4.1.1.2 The range user or program shall provide the necessary data to complete the required safety documentation identified in 800-PG-8715.5.1, Range Safety Process for Programs and Projects. See Section 4.5, Safety Data Requirements, for specific data requirements.

4.1.1.3 The range user or program shall define any other safety requirements imposed upon that operation and/or program and provide them to the WFF Safety Office. In most cases, the more stringent requirements will apply.

4.1.1.4 The range user or program shall inform the WFF Safety Office of all meetings and/or reviews pertaining to Range Safety or Safety related issues. The range user or program is encouraged to inform the WFF Safety Office of all mission related meetings/reviews to help gain additional familiarization.

4.1.1.5 The range user or program shall participate in real-time data evaluation for mission control and/or flight termination as identified and required by the WFF Safety Office.

4.1.1.6 The range user or program shall participate in failure and anomaly investigations and provide post flight data as required.

4.1.2 Range Safety Requirements Tailoring

The Range Safety requirements specified in this document have been written to cover all types of range operations. WFF recognizes that not all requirements are applicable to each and every operation, and therefore recommends range users participate in the range safety tailoring process.

The overall intent is to ensure proper interpretation and implementation of the requirements while providing WFF and range users with the authority and flexibility needed to accomplish mission objectives.

NASA-STD-8719.25, Range Flight Safety Requirements, defines tailoring as the process where the authorities responsible for range safety requirements and a range user review each requirement and jointly document whether the requirement is applicable to the range user’s planned operation, and if it is applicable, document whether the range user will meet the requirement as written or achieve an equivalent level of safety (ELS) through an acceptable alternative. Examples of tailoring of range safety requirements include deletion of a requirement, change to a requirement, or documenting an approach that differs from the stated requirement. Tailoring includes ELS determinations. If an ELS determination results in no increased risk, the approval of the tailored requirement shall suffice as the necessary ELS documentation (i.e. no additional ELS form is required). Tailoring does not include the approval of Range Safety Waivers. The process for ELS determinations as well as Range Safety Waivers is documented in 800-PG-8715.5.1 Range Safety Process for Programs and Projects.

4.1.2.1 The range user or vehicle program shall work with the WFF Safety Office to identify and assess compliance with the requirements in this RSM and any other applicable range safety requirements.

4.1.2.2 If the range user/program has government approved tailoring of range safety requirements from another range or range safety standard, the range user shall perform a gap analysis and document any differences between those and this RSM. That gap analysis shall

An example of other applicable range safety requirements is the Range Commander’s Council (RCC) 319, Flight Termination Systems Commonality Standard.

serve as the set of formal WFF tailored requirements for that specific program or range operation.

4.1.2.3 The range user shall compile all requirements, including any tailored requirements (working directly with the WFF Safety Office) into a program or operation specific document.

4.1.2.4 The range user shall ensure that the document containing the tailored range safety requirements identifies any change to a requirement (including any addition or deletion) and includes sufficient rationale for the tailored change.

4.1.2.5 The signatories of each tailored requirements document shall include, but are not limited to, the range user/vehicle program manager (or designee) and the WFF Range Safety Chief Engineer (RSCE) (or designee).

4.1.2.6 The range user shall submit proposed changes to approved tailored requirements as a change request to the WFF Safety Office. The WFF Safety Office will determine if the change requires an ELS or Waiver, and in that case will implement the Relief of Range Safety Requirements Process as defined in 800-PG-8715.5.1, Range Safety Process for Programs and Projects and document the change accordingly. Changes which do not require an ELS or Waiver shall be documented as a change page or equivalent document and approved by the original tailored requirements signatories.

4.1.2.7 If the WFF Safety Office or other range safety authority determines that proposed tailoring of a requirement results in increased safety risk, the vehicle program shall prepare and submit a waiver request following the process defined in 800-PG-8715.5.1, Range Safety Process for Programs and Projects. (The waiver request format and instructions are maintained by the WFF Safety Office and are available on the WFF Safety Office web site and upon request.).

4.1.2.8 In the event that an authority does not concur on any tailored requirement and the issue cannot be resolved with the RSCE (or designee) or any other cognizant Safety and Mission Assurance (SMA) Technical Authority (TA) for Range Safety, the range user/program shall brief their position to the next higher level SMA TA and so on until resolved.

Range Users/Programs should not attempt to self-tailor or interpret range safety requirements without direct assistance from the WFF Safety Office. Attempting to self-tailor may result in misinterpretation of the applicability of requirements and may lead to unnecessary schedule and cost impacts associated with late corrections.

The RSCE approves range safety tailoring and serves as the Range Safety Technical Authority (TA) and GSFCs Range Safety Manager. For additional description of the role of the RSCE, see 800-PG-8715.5.1, Range Safety Process for Programs and Projects.

WFF is an active participant in the RCC’s Range Safety Group (RSG), a national range safety community, in order to ensure commonality in conducting range operations. It is necessary for the tailoring process to be consistent with the approach used at other the national ranges. WFF will participate in joint tailoring with other ranges and the Federal Aviation Administration (FAA) where applicable to help facilitate vehicle programs that operate at multiple ranges. WFF will ensure tailoring is consistent throughout NASA, FAA, and the Department of Defense (DoD).

4.2. Ground Safety Requirements

The overall goal of the ground safety technical requirements is to ensure personnel and property involved in conducting range operations for or at GSFC’s WFF are protected by mitigating hazards and managing associated residual risk. It is a goal that all systems be designed such that it will take a minimum of two independent unlikely failures to occur in order for personnel to be exposed to a hazard.

This RSM addresses those hazards that represent heighted concern which are often not routine throughout industry but are common at a launch range. Unique hazards not addressed by this document are addressed on a case-by-case basis and related mitigations and controls are documented by WFF Safety in a Ground Safety Plan(s) (GSP), Data Package (GSDP) or Range Safety Plan (RSP). The process for developing these documents is in 800-PG-8715.5.1 Range Safety Process for Programs and Projects.

4.2.1 Hazardous System Requirements

4.2.1.1 Hazardous System Categorization

Hazard categories, as defined in this RSM, establish a level of risk associated with the effects of inadvertent initiation/actuation of a hazardous system or other potential hazard scenario. It is then used to determine the applicable requirements for system design and personnel exposure limits. The following terms are used in the determination of a system's category:

a. Hazard - A state or condition that could lead to an undesirable consequence (i.e. casualty or property damage). [NASA-STD-8709.22, Safety and Mission Assurance Acronyms, Abbreviations, and Definitions].

• Catastrophic hazard - a hazard, condition or event that could result in a mishap causing fatal injury to personnel and/or loss of vehicle, payload, or ground facility.

• Critical hazard - a hazard, condition or event that may cause severe injury or occupational illness, or major property damage.

• Marginal hazard - a hazard, condition or event that may cause minor injury or minor occupational illness to personnel.

b. Hazardous system - A system that, by the expenditure of its own energy or because it initiates a chain of events, may result in a catastrophic, critical, or marginal hazard.

c. Hazardous System Categories Hazardous system categories are used to determine the system’s design requirements for personnel safety. Once a system’s category is determined, it does not change throughout the various stages of processing. For example, removing inhibits or safeties in the initiating circuit of the hazardous system does not change the consequence (severity) of hazard exposure.

• Category 1 – A hazardous system whose consequence of inadvertent initiation cannot be physically contained, regardless of hazardous system state. Reducing the likelihood of inadvertent initiation of a Category 1 system (i.e. inhibits) does not change the consequence of the associated hazard.

• Category 2 – A hazardous system whose consequence of inadvertent initiation is physically contained when personnel would be exposed to the hazard. Containment of the hazard mitigates the safety consequence of the hazard effects to a negligible level.

d. Hazardous System States The system’s hazardous state defines the likelihood of hazard exposure, and is used to determine personnel restrictions while working on or within the system’s hazard area.

• A-State – The hazardous system has increased potential for inadvertent actuation or has a high likelihood of hazard exposure if inadvertently actuated. Generally, personnel restrictions (i.e. clearance) are implemented as a result of the Ground Safety Analysis Process and in effect when hazardous systems in an A-State.

• B-State – The hazardous system has decreased potential for inadvertent actuation or has a low likelihood of hazard exposure if inadvertently actuated. Personnel restrictions are generally more relaxed and access within the system’s danger area is permitted as long as it is consistent with the operation taking place.

The removal of inhibits, restraints or other safeties during processing may change the hazardous system from B-State to A-State, and increases the likelihood of inadvertent initiation.

The hazardous system category is paired with the system state and thereby referred to as Category 1A, 1B, 2A, or 2B. The following chart summarizes hazardous system Categories and provides a list of examples.

Table 1: Categorization of Hazardous Systems and Associated States

4.2.1.1.1 All hazardous systems, including electrical, chemical, pressure, etc. shall be categorized as Category 1 or Category 2 based on the definitions in this RSM.

4.2.1.1.2 The range user shall work with the WFF Safety Office to categorize all hazardous systems. The WFF Safety Office has final determination on a system’s category.

Category 1 Systems (ALWAYS Cat 1)

Category 2 System (ALWAYS Cat 2)

Definition

Sufficient energy exists to result in injury, death, or destruction of property and cannot be physically contained.

Ex: Rocket Motor, FTS Ordnance, hazardous chemical release systems, etc.

• Sufficient energy exists to result in injury, death, or destruction of property AND can be physically contained when personnel are within the hazard area.

Ex: Guillotine pyros for De-spin or Boom Release System, Stage Separation System with a mechanical restraint (i.e.V-Band Safety)

Design Requirements

Rigorous design that mitigates the risk of inadvertent actuation. See 4.2.1.3, Category 1 Hazardous Circuit Design Requirements.

Ex: Capacitive Discharge Ignition (CDI) System, electromechanical Safe/ARM devices, two fault tolerate designs, etc.

• Simpler design with min of 2 independent inhibits

• Conversion from B-State to A-State must happen as late as possible

• Containment devices and/or mechanical restraints approved by WFF Safety Office

• See 4.2.1.4, Category 2 Hazardous Circuit Design Requirements.

Ex: Payload Pyro Circuit

A-State

Category 1A – Elevated risk of hazard exposure Ex: Arm plugs installed, Safe/Arm in ARM position

Category 2A – Elevated Risk of hazard exposure when not contained Ex: Stage Separation System w/o V-Band Safety Installed

B- State

Category 1B – Low risk of hazard exposure Ex: safe plugs installed, Safe/Arm in SAFE position, or initiators are not electrically connected

Category 2B –Negligible risk of hazard exposure Ex Stage Separation System w/ V-Band Safety Installed.

*Note, if the system cannot cause injury or death, it’s always 2B. Ex. Guillotine pyros in De-Spin or Boom Release systems.

4.2.1.1.3 The containment device or mechanism design used in Category 2 systems shall be approved by the WFF Safety Office. At a minimum, the containment device or mechanism shall meet all of the following:

(A) Be successfully demonstrated to contain the hazard effects or shown through analysis if demonstration is not feasible/practical.

(B) Reduce the hazard effects to negligible.

4.2.1.1.4 For a hazardous system with the capability to change states, the system design and operational procedures shall ensure the change from B-State to A-State occurs as late as possible in the processing sequence and minimizes personnel exposure to the hazard of inadvertent initiation.

4.2.1.1.5 A hazardous system is in A-state (Category 1A or 2A) until conditions have been met which permit a change to B-state. The following identifies such conditions:

4.2.1.1.5.1 A hazardous system that is installed/integrated in a vehicle is in B-State if it is not connected to its initiating circuit or other source of initiating energy and it is not subject to potential external sources of initiating energy (e.g. an ordnance system, see Paragraph 4.2.1.1.5.2 regarding ordnance systems).

4.2.1.1.5.2 An installed/integrated hazardous ordnance system is in a B-State if it is not connected to its initiating circuit and its Electro-Explosive Devices (EEDs) are shorted, shielded, and grounded. An exception is made for shorting, provided the EED and shielding cap satisfy all of the following:

(A) The EED satisfies the 1 amp, 1 watt no-fire safety standard.

(B) Shielding caps are placed on each EED during shipment, storage, handling, and installation up to the point of electrical connection.

(C) The shielding cap has an outer shell made of conductive material that provides an RF shield and makes electrical contact with the EED case.

(D) No RF gaps exist around the full 360-degree mating surface between the shielding cap and the EED case. This shall be verified by inspection.

(E) The installation of the shielding cap is performed by certified ordnance handlers following written procedures approved by the WFF Safety Office.

(F) The written procedures identify any special tools, specifications (e.g. torque setting) and check points designed to ensure the shielding cap is properly installed and will serve its safety function.

An example of a containment device or mechanism in a Category 2 system is the mechanical restraint that is placed over a Category 2 V-Band system to contain the effects of the V-Band energy after inadvertent initiation. In this case, the V-Band system would be Category 2B with the mechanical restraint installed, and 2A when it is not installed.

4.2.1.1.5.3 EEDs that are not installed are in a B-State when they are shorted, shielded and grounded, or just shielded and grounded if the EEDs and shielding caps meet the caveats listed in Section 4.2.1.1.5.2 above.

4.2.1.1.5.4 An installed/integrated hazardous ordnance system that is connected to its initiating circuit and employs an approved mechanical or electromechanical SAFE/ARM (S/A) device and the S/A is in the SAFE position is in B-state.

4.2.1.1.5.5 An installed/integrated hazardous ordnance system is in a B-State when connected to its initiating circuit if the circuit utilizes a SAFE/ARM continuity jack or plug, and the SAFE plug is installed. The SAFE/ARM continuity jack or plug shall meet all of the following:

(A) Electrically adjacent to the ordnance device.

(B) The wire between the initiator and the SAFE/ARM continuity jack or plug shall be contained inside the vehicle or payload.

(C) The continuity jack or plug shall contain only wires from the ordnance device and the ordnance firing lines.

(D) When the SAFE plug is installed, the ordnance device is electrically isolated from the firing circuit in both the positive and the return lines, each bridge wire is shorted, and the bridge wire is isolated from ground by a static bleed resistor of 10kohms or more.

4.2.1.1.5.6 A hazardous system that has a Two-Fault Tolerant circuit design is in B-State if the requirements identified in Section 4.2.1.3.5 are satisfied and the associated inhibits/safeties are in place.

4.2.1.1.5.7 A Category 2 system is in B state if the approved containment mechanism(s) are installed thus reducing the effects of inadvertent actuation to negligible.

4.2.1.1.5.8 A hazardous chemical system is in B-State when all of the following conditions are satisfied:

(A) The system is closed,

(B) The system contains two independent verifiable safeties in the flow path,

(C) The leak integrity is verified.

4.2.1.1.5.9 A hazardous pressure system is in B-State when the pressure is at steady state (at least 10 minutes after dynamic pressurization) and less than or equal to the…