Space engineering

Explosive subsystems and devices

Foreword

This Standard is one of the series of ECSS Standards intended to be applied together for the management, engineering and product assurance in space projects and applications. ECSS is a cooperative effort of the European Space Agency, national space agencies and European industry associations for the purpose of developing and maintaining common standards. Requirements in this Standard are defined in terms of what shall be accomplished, rather than in terms of how to organize and perform the necessary work. This allows existing organizational structures and methods to be applied where they are effective, and for the structures and methods to evolve as necessary without rewriting the standards.

This Standard has been prepared by the ECSS Executive Secretariat Working Group, reviewed by the ECSS Executive Secretariat and approved by the ECSS Technical Authority.

Disclaimer

ECSS does not provide any warranty whatsoever, whether expressed, implied, or statutory, including, but not limited to, any warranty of merchantability or fitness for a particular purpose or any warranty that the contents of the item are error-free. In no respect shall ECSS incur any liability for any damages, including, but not limited to, direct, indirect, special, or consequential damages arising out of, resulting from, or in any way connected to the use of this Standard, whether or not based upon warranty, business agreement, tort, or otherwise; whether or not injury was sustained by persons or property or otherwise; and whether or not loss was sustained from, or arose out of, the results of, the item, or any services that may be provided by ECSS.

Published by:     ESA Requirements and Standards Division
    ESTEC, P.O. Box 299,
    2200 AG Noordwijk
    The Netherlands
Copyright:     2017 © by the European Space Agency for the members of ECSS

Change log

ECSS-E-30 Part 6A 25 April 2000	First issue
ECSS-E-33-11A 17 April 2008	Second issue Changes to the previous version are: the use of the more accurate term "explosive" rather than "pyrotechnics" in relation to the subject components and systems; the emphasis on reliability coupled with confidence level for performance properties; the inclusion of detailed requirements for the different types of explosive device; and the emphasis on the requirement for properties of components to be agreed with the end user before commitment to purchase.
ECSS-E-33-11B	Never issued
ECSS-E-ST-33-11C 31 July 2008	Third issue - Editorial changes.
ECSS-E-ST-33-11C Rev.1 1 June 2017	Third issue, Revision 1: Changes with respect to the previous version are identified with revision tracking. Main changes are: Implementation of Change Requests and harmonization with ISO Title changed to read "Explosive subsystems and devices" Update of clause 3 "Terms definitions and abbreviated terms"; Nomenclature added Header updated of clause 4.8.1.3, 4.8.1.4, 4.8.2.3, 4.8.2.9, 4.8.2.10; 4.10.7; 4.10.9; 4.14.3.2; 4.14.3.3; 4.17.3 Clause 4.8.1.6 "Mechanical input to ICD" added Clause 4.8.2.14 "Electrical input to ICD" added Clause 4.8.3.3 "Thermal input to ICD" added Recommendation 4.10.1k (recreated from former requirement 4.10.1j) Clause 4.11.2.7 "Through-bulkhead initiators" added Reorganization of clause 4.11 causing renumbering of Tables Annex A (informative) "Component qualification test levels" added Added requirements: 4.8.1.6a; 4.8.2.8f; 4.8.2.14a; 4.8.3.3a; 4.11.2.7a-b and Table 4-9 (recreated from modified requirements 4.11.4.3a and b and former Table 4-11); 4.11.7a-b and Table 4-15 (moved from 4.11.4.4a-b); 4.11.8a-b and Table 4-16 (moved from 4.11.4.5a-b); 4.11.9a-b (moved from 4.11.4.6a-b); 4.11.10a-b and Table 4-18 (moved from 4.11.4.7); 4.15.2i-j. Modified requirements: 4.1.2a and d; 4.2.1c and d; 4.2.2a-c and f-g; 4.2.3a-b; 4.2.5.1a; 4.2.5.2a-e; 4.2.5.3a-b, d-f; 4.2.5.4a; 4.3b NOTE; 4.3c; 4.4a-d and g-j; 4.5.1a-c; 4.5.2.1b-d; 4.5.2.3e; 4.6a-b, e-f; 4.7.3a-b; 4.7.4a-b; 4.8.1.1a; 4.8.1.2a; 4.8.1.3a; 4.8.1.4a-b; 4.8.2.1a-c; 4.8.2.2a; 4.8.2.4a-c; 4.8.2.5a,b and e; 4.8.2.7a-c; 4.8.2.8a-c; 4.8.2.9a; 4.8.2.10a; 4.8.2.11a-b; 4.8.2.12b-c; 4.8.2.13a-b; 4.8.3.1a,d and e; 4.8.3.2a; 4.8.4.1a,c, e, g and h; 4.8.4.2b; 4.9a NOTE; 4.9d-e; 4.9i; 4.10.1b,d,e; 4.10.4a and b; 4.10.6a; 40.10.7a,d and e; 4.10.8c (embedded Note moved to the end); 4.10.9a (and embedded Notes move to the end); 4.10.10a (embedded moved to the end); 4.10.11.1b and e; 4.10.11.2a; 4.10.11.3a; 4.11.1.1b; 4.11.1.2a and d; 4.11.1.3a; Table 4-3; Table 4-4; 4.11.3.2d; 4.11.4.1a-b (reference to Table changed); Table 4-10; 4.11.4.2a-b (reference to Table changed); 4.11.5a; 4.11.6a-b (reference to Table changed); Table 4-12; Table 4-17; 4.12.2d NOTE; 4.13.1d; 4.13.3a; 4.14.1a; 4.14.3.1a-b; 4.14.3.2a; 4.14.3.3a; 4.14.3.5a; 4.14.3.8 (correction of typo); 4.14.3.9b; Table 4-24; 4.14.4.1a; Table 4-25; Table 4-26; 4.15.2a-d; 4.15.3a, b and e; 4.15.4a, b, e and g; 4.17.1b; 4.17.2a, Heading of 4.17.3. Deleted requirements: 4.2.2d and e; 4.2.3c; 4.2.5.2c and g; 4.8.2.1e; 4.8.4.1b; 4.10.1j (recreated as recommendation 4.10.1k); 4.10.11.4b to e; 4.10.11.5b; 4.10.11.7a; 4.11.4.3a-b and Table 4-12 (recreated as 4.11.2.7a-b); 4.11.4.4a-b and Table 4-11 (recreated as 4.11.7a-b); 4.17.1a; 4.17.2a. Editorial corrections: Introduction updated. Normative References and Bibliography updated. term "section" replaced by the term "clause" and "system" by "subsystem" in whole document. The reorganization of clause 4.11 cause a renumbering of the Tables in the following clauses: 4.11.2.7 where former Table 4-11 from clause 4.11.4.3 is now Table 4-9; 4.11.4.1 where former Table 4-9 is now Table 4-10 4.11.4.2 where former Table 4-10 is now Table 4-11 4.11.6 where former Table 4-16 is now Table 4-12 4.11.7 where former Table 4-12 from clause 4.11.4.4 is now Table 4-13 4.11.8 where former Table 4-13 from clause 4.11.4.5 is now Table 4-14 4.11.9 where former Table 4-14 from clause 4.11.4.6 is now Table 4-15 4.11.10 where former Table 4-15 clause 4.11.4.7 is now Table 4-16

Introduction

As any explosive item used for flight can function only once, it can never be fully tested before its crucial mission operation. The required confidence can only be established indirectly by the testing of identical items. Test results and theoretical justification are essential for demonstration of fulfilment of the requirements. The requirement for repeatability shows that product assurance plays a crucial role in support of technical aspects.

The need for statistics requires that the explosive components used in the explosive subsystem be tested and characterized extensively. The variability in components requires that manufacturers prove to customers that delivered items are identical to those qualified.

The failure or unintentional operation of an explosive item can be catastrophic for the whole mission and life threatening. Specific requirements can exist for the items associated with it. As all explosives where ever used are treated similarly, the same requirements, regulations, practices and standards need to be applied to help avoiding human error.

Scope

This Standard defines the requirements for the use of explosives on all spacecraft and other space products including launch vehicles. It addresses the aspects of design, analysis, verification, manufacturing, operations and safety.

This standard may be tailored for the specific characteristics and constraints of a space project in conformance with ECSS-S-ST-00.

Normative references

The following normative documents contain provisions which, through reference in this text, constitute provisions of this ECSS Standard. For dated references, subsequent amendments to, or revision of any of these publications, do not apply. However, parties to agreements based on this ECSS Standard are encouraged to investigate the possibility of applying the more recent editions of the normative documents indicated below. For undated references, the latest edition of the publication referred to applies.

ECSS-S-ST-00-01	ECSS system - Glossary of terms
ECSS-E-ST-10-02	Space engineering - Verification
ECSS-E-ST-10-03	Space engineering - Testing
ECSS-E-ST-20	Space engineering - Electrical and electronic
ECSS-E-ST-20-07	Space engineering – Electromagnetic compatibility
ECSS-E-ST-32-10	Space engineering - Reliability based mechanical factors of safety
ECSS-E-ST-33-01	Space engineering - Mechanisms
ECSS-Q-ST-20	Space product assurance - Quality assurance
ECSS-Q-ST-30	Space product assurance - Dependability
ECSS-Q-ST-40	Space product assurance - Safety
ECSS-Q-ST-70-01	Space product assurance - Contamination and cleanliness control
ECSS-M-ST-40	Space management - Configuration and information management
ST/SG/AC.10/1 latest version (UNECE publication)	Recommendations on the Transport of Dangerous Goods – Model Regulations
Commission Directive 2012/4/EU (22 February 2012)	Commission Directive 2012/4/EU of 22 February 2012 amending Directive 2008/43/EC setting up, pursuant to Council Directive 93/15/EEC, a system for the identification and traceability of explosives for civil uses
Commission Directive 2008/43/EC (4 April 2008)	Commission Directive 2008/43/EC of 4 April 2008 setting up, pursuant to Council Directive 93/15/EEC, a system for the identification and traceability of explosives for civil uses
Council Directive 93/15/EEC (5 April 1993)	Council Directive 93/15/EEC of 5 April 1993 on the harmonization of the provisions relating to the placing on the market and supervision of explosives for civil uses
Dictionary of explosive related terms, 7th Edition, 2016	Groupe de Travail de Pyrotechnie, Dictionnaire de pyrotechnie

For launcher subsystems and Transfer Vehicle programmes, the specific General Specification (SG) or Design Rules (DR) documents are applicable for designing, dimensioning and testing.

Terms, definitions and abbreviated terms

Terms defined in other standards

For the purpose of this Standard, the terms and definitions from ECSSSST0001 apply, in particular for the following terms:
lifetime

Terms specific to the present standard

all fire
stimulus with a probability of functioning equal to or better than 0,999 at 95 % confidence level

arm plug receptacle
connector mounted on the skin of a spacecraft that can be connected to a Safe or Test or Arm plug

armed
status of an explosive subsystem when all the safety devices have been disabled and which can be triggered

[Adapted from Dictionary of explosive related terms]

cartridge
explosive device designed to produce pressure for performing a mechanical function

A cartridge is called an initiator if it is the first or only explosive element in an explosive train (see definition 3.2.14).

charge
explosive loaded in a cartridge, detonator, or separate container for use in an explosive device

component
smallest functional item in an explosive subsystem

deflagration
self-sustaining, exothermic decomposition reaction of an explosive substance, whose apparent velocity is less than the velocity of sound in the substance and greater than the speed of sound in air

It is generally accepted that the energy transmission takes place via a mechanical compression wave. This type of reaction is intermediary between combustion and detonation. It differs from combustion through the presence of a significant compression wave in the surrounding environment.

[Dictionary of explosive related terms]

detonation
exothermic decomposition reaction of an explosive substance self-sustained by a shock wave, whose velocity of propagation is greater than the velocity of sound in the substance

The velocity of propagation is of the order of several thousands of m/s.

[Dictionary of explosive related terms]

detonator
initiator whose function is to transform external energy directly into a shock wave strong enough to detonate a secondary high explosive

External energy can be, for example, mechanical, electrical and thermal.

[Dictionary of explosive related terms]

electro-explosive device
device containing some reaction mixture that is electrically initiated

• 1    The output of the initiation is heat, shock or mechanical action.
• 2    The reaction mixture can be explosive or pyrotechnic.
  [Dictionary of explosive related terms]

end-user
person who or organization that actually uses a product

• 1    The end-user need not to be the owner or buyer.
• 2    In the context of this standard the end user is generally the first level customer.
  energetic material
  material consisting of, or containing, an explosive, oxidizer, fuel, or combination of them, that can undergo, contribute to, or cause rapid exothermic decomposition, combustion, deflagration, or detonation

explosively actuated device
device that converts the products of explosion into useful mechanical work

• 1    The explosion can be combustion, deflagration or detonation.
• 2    Pyromechanisms and linear detonating separation devices are explosively actuated devices.
  explosive train
  series of explosive components including the initiator, explosive transfer assembly and explosively actuated device

explosive component
discrete item containing an explosive substance

explosive function
function that uses energy released from explosive substances for its operation

explosive subsystem
collection of all the explosive trains on the spacecraft or launcher system, and the interface aspects of any on-board computers, launch operation equipment, ground support and test equipment and all software associated with explosive functions

fail operational
mission capable after one failure

Maintaining operational conditions after one failure and safety conditions after a second independent failure is referred to as "Fail operational – Fail safe".

fail safe
design property of a subsystem, or part of it, which remains safe after one failure

Maintaining safety following two independent failures is referred to as "Fail safe – Fail safe".

gas generators
explosive devices that produce a volume of gas or exothermic output or both

E.g. pyrotechnic igniters for solid propulsion applications, gas generator for inflatable structures.

initiator
basic component located upstream of an explosive train, from which originates a transformation of mechanical, electrical or optical energy, the effect produced being a combustion, deflagration or detonation.

• 1    It contains a small quantity of an energetic material.
• 2    Examples: hot bridge wire initiator, exploding bridge wire initiator
  limit testing
  testing to establish the limit of a performance characteristic of a component

lot
group of components produced in homogeneous groups and under uniform conditions

A batch is the same as a lot.

lot acceptance
demonstration by measurement or test that a lot of items meets requirements

no fire
stimulus with a probability of functioning equal to or less than 0,001 at 95 % confidence level

packaged charge
explosive material in a closed container

pyrotechnic device
a basic pyrotechnic object containing explosive substances and intended to perform an initiation (ignition, priming), pyrotechnic effect transmission, amplification or generation function

[Dictionary of explosive related terms]

pyromechanism
device intended to perform one or more mechanical actions, using the energy produced by the reaction of an energetic material

[Dictionary of explosive related terms]

safe
condition that renders the probability of an unwanted event below an agreed limit

secondary characteristic
any characteristic other than the function

sequential firing
application of the firing pulses to initiators separated in time

success
simultaneous achievement by all characteristics of required performance

sympathetic firing
firing of other explosive devices due to the output of any other

transfer line
linear explosive assembly for propagation of deflagration or detonation

through-bulkhead initiator (TBI)
relay which provides transition between the detonation of a transmission line and the combustion of an ignition charge, through a sealed bulkhead

[Dictionary of explosive related terms]

The bulkhead remains tight after functioning under the specified environment, e.g. pressure and temperature.

Abbreviated terms

For the purpose of this Standard, the abbreviated terms from ECSSSST0001 and the following apply:

Abbreviation	Meaning
DC	direct current
DMPL	declared materials and processes list
DSC	differential scanning calorimetry
DR	design rules
DTA	differential thermal analysis
EED	electro-explosive device
EMC	electromagnetic compatibility
EMI	electromagnetic interference
ESD	electrostatic discharge
FOSU	ultimate design factor of safety
FOSY	yield design factor of safety
GDIR	general design and interface requirement
GSE	ground support equipment
GTPS	Groupe de Travail de Pyrotechnie
ICD	interface control document
MEOP	maximum expected operating pressure
N/A	not applicable
NC	normally closed
NO	normally open
RF	radio frequency
SDS	Safety Data Sheet
SG	general specification
SRS	shock response spectrum
TBI	through-bulkhead initiator
TBPM	to be provided by manufacturer
TBPC	to be provided by customer
TBPU	to be provided by user
TGA	thermo gravimetric analysis
UNECE	United Nations Economic Commission for Europe
VTS	vacuum thermal stability

Symbols

@	at
g	standard surface gravity (9,80665 m/s2)
h	drop height (m)
M	mass of drop weight (kg)
σ	standard deviation
A	Ampere
V	Volt

NomenclatureThe following nomenclature apply throughout this document:

The word “shall” is used in this standard to express requirements. All the requirements are expressed with the word “shall”.
The word “should” is used in this standard to express recommendations. All the recommendations are expressed with the word “should”.

It is expected that, during tailoring, all the recommendations in this document are either converted into requirements or tailored out.

The words “may” and “need not” are used in this standard to express positive and negative permissions respectively. All the positive permissions are expressed with the word “may”. All the negative permissions are expressed with the words “need not”.
The word “can” is used in this standard to express capabilities or possibilities, and therefore, if not accompanied by one of the previous words, it implies descriptive text.

In ECSS “may” and “can” have a complete different meaning: “may” is normative (permission) and “can” is descriptive.

The present and past tense are used in this standard to express statement of fact, and therefore they imply descriptive text.

Requirements

General

Overview

Being generally applicable, the requirements stated in this clause apply throughout and are not repeated in the clauses relating to specific topics.

Explosive subsystem and devices use energetic materials (explosives, propellants, powder) initiated by mechanical, electrical, thermal, or optical stimuli, for unique (single shot) functions e.g. solid booster initiation, structure cutting, stage distancing, pressurized venting, stage neutralisation, valve opening or closing, release of solar arrays, antennas, booms, covers and instruments.

The properties of the initiator govern the major part of the behaviour of the subsystem.

The requirements for initiators and their derivatives, such as cartridges and detonators, are defined in specific requirements related to the specific types.

Properties of explosive components and subsystem, which cannot be covered by requirements for the initiators alone, are defined in specific requirements relating to the types of explosively actuated device or pyromechanisms.

Other components of the explosive subsystem, which can be tested and do not need specific requirements, are subject to the general technical and product assurance requirements. Detailed aspects of these components are included where they have a significant influence on the success of the system.

single-shot items can never be tested in advance. Particular care is needed in their development, qualification, procurement and use. Explosive components are not governed by the institutional component control organisations.

The content and phasing of deliverable documents are identified in each of the top level discipline standards of each ECSS branch. A list of deliverable documents specific to this standard is provided in informative Annex B.

Properties

The two states of the properties of the explosive subsystem before firing and after firing shall be identified and listed.
For every explosive component the function, primary stimulus, unwanted stimuli and secondary characteristics shall be identified and quantified.
Only qualified and lot accepted items shall be used in flight systems.
The properties of an explosive subsystem shall remain stable over time before firing and after firing when subject to external loads or environmental conditions, within the qualification values.

Design

General

In case of redundancy, no component shall adversely affect its substitute.
The system lay-out should facilitate the replacement of subsystems or components.
Parts of the explosive subsystem and devices identified as critical on the basis of a RAMS analysis shall be replaceable.
Replaceable parts shall be listed in the User’s Manual of the explosive subsystem and devices.

Reliability and confidence

The explosive subsystem shall achieve the specified properties within the required reliability and confidence level defined at system level.
The reliability demonstration shall be: .

• used to justify design margins including the influence of ageing, temperature and explosive batch,
• justified according to clause 6.4.2 of ECSS-Q-ST-30 or dedicated system specification, and
• stated in a reliability prediction document as per Annex E of ECSS-Q-ST-30.

Dedicated system specifications are, for example, GDIR and SG.

The allocation of the probability and the confidence level of unwanted actuating of an explosive device shall be determined and justified according to clause 7.5 of ECSS-Q-ST-40 or dedicated system specification.

Dedicated system specifications are, for example, GDIR and SG.

<<deleted>>
<<deleted>>
For the reliability demonstration, the customer shall agree which performance characteristics are declared as mean values with associated standard deviation.

The reliability demonstration is used to justify design margins including the influence of ageing, temperature and explosive batch.

The selection of the statistical methods and functional parameters shall be justified and approved by the customer.

Performance

Performances shall be quantified by measurement versus time of initial, transitional, and final values of the specified properties.

Specified properties are listed in clauses 4.11 and 4.12.

The time intervals specified in 4.2.3a shall be measured between a clear reproducible initiation event and the attainment of the performance value.

For example, the initiation event and 90 % of the maximum pressure value in a closed bomb.

<<deleted>>
The basis of the time shall be specified and justified.

Wanted and unwanted response

For wanted response, the response of any component, when subjected to the specified minimum probable stimulus, shall be demonstrated to be more than the specified lower limit agreed between customer and supplier.
For unwanted response, the response of any component, when subjected to the specified maximum possible disturbance, shall be demonstrated to be less than the specified upper limit agreed between customer and supplier.

This applies to safety and failure.

Dimensioning

Strength

The explosive subsystem shall sustain, before, during and after firing:

• the internal loads due to operation and
• the external loads defined by the end-user.

These loads represent the sum of preload, static, dynamic, thermal and any other load seen in service.

Integrity

The explosive subsystem shall maintain its integrity and position during its lifetime.
Components that are intended not to rupture during operation, when installed into their explosive subsystem interfaces, shall be able to withstand the maximum expected operational loads times a FOSU factor.
The FOSU factor shall be in conformance with Tables 4-3 in ECSS-E-ST-32-10 depending on the material used.
Deformation of any component shall not:

• reduce its specified performance,
• affect any part of the subsystem,
• cause leakage more than the specified limit,
• cause debris more than the specified limit. The FOSY factor shall be in conformance with Table 4-3 in ECSS-E-ST-32-10 depending on the material used.

Explosive charge sizing

The methodology for dimensioning the explosive charge of the explosive devices shall be justified and be done by testing or modelling at the worst case conditions.

Worst case conditions include temperature , ageing, radiations effects.

A “margin policy” KMP factor shall be:

• defined,
• justified,
• applied.
• 1    This factor, used to give confidence to the design, covers (not exhaustive list):
• The lack of knowledge on the failure modes and associated criteria.
• The lack of knowledge on the effect of interaction of loadings.
• The non-tested zones.
• 2    Justification can be performed based on relevant historical practice, analytical or experimental means.
• 3    KMP factor can have different values according to the explosive materials or device behaviour in the mission profile.
  <<deleted>>
  When modelling is performed ,KMP shall include the uncertainty of the model:
• defined,
• justified,
• applied during simulations and analysis. Depending of the development phase KMP shall include a “project factor” defined according to the uncertainty in the programme level requirement.

The “project factor” applies during the phase B of the development and becomes equal to 1 after the PDR with the updated technical specification.

KMP shall include an “Explosive factor” for uncertainties on the behaviour of explosive materials in the mission profile and its use configuration.

• 1    The uncertainties can be related to ageing, radiations, temperature influence, batch influence, and chemical compatibility, for example material, gases and humidity.
• 2    Use configuration can be, for example, loading density, confinement and thermal exchanges.
  Table 41 <<deleted>>

<<deleted>>
Figure 41 <<deleted>>

Motorization

When a mechanical force or torque is complementary to the explosive energy to achieve a motion in an explosive device, clause 5.7.5.3 of ECSS-E-ST-33-01 shall apply to dimension the actuation force or torque.

• 1    An example of mechanical force or torque is a spring.
• 2    An example of motion is the separation and release of the nut.

Mission

The use of explosive functions including those for flight termination and range safety during all phases of the mission shall be specified.
The environmental conditions, life cycle and the functions being activated shall be specified.

E.g. ground storage, transport, launcher ignition, staging and safety functions, spacecraft separation, motor ignition, solar array, antenna, boom or cover release, propulsion subsystem branch opening or closing, de-orbiting.

Mission-related requirements placed on the explosive subsystem shall be specified.

Functionality

The firing sequence of each function of the explosive subsystem shall be specified.
The explosive subsystem shall react only to a specified stimulus and be insensitive to all others.

Specified stimulus: e.g. nature, range of values.

The explosive subsystem shall ensure that the correct stimulus arrives at the specified place at the specified time.
The explosive subsystem shall prevent the stimulus reaching the initiator at any other time.
Unwanted function or malfunction shall be prevented.
The firing sequence (simultaneous or sequential) shall cause no anomaly.

This applies to secondary characteristics as well as for explosive functions.

Explosive subsystems shall be single-fault tolerant.
Explosive subsystems shall be two fault tolerant, if premature initiation causes a catastrophic failure.
If loss of function is safety critical or catastrophic, the explosive subsystem shall avoid single-point failures and include at least two initiators.
Provision shall be made within the explosive subsystem to protect its components against unwanted operation or degradation.

Safety

General

The subsystem, including software and procedures, shall be fail safe.
For a catastrophic risk, the explosive subsystem shall be “Fail Safe – Fail Safe” or “Fail-Operational – Fail Safe”.
The response of any explosive device to conditions outside the conditions specified shall be reported by the supplier to the end-user.
The explosive subsystem shall only respond to commands intended for that explosive subsystem.

Prevention of unintentional function

General

The firing pulse shall be prevented from reaching any explosive initiator at any time except the correct instant by means of switchable barriers.

For example:

• Firing pulse: detonating shock, electrical pulse, and light pulse.
• Switchable barriers: electrical, mechanical, plugs, and pins.
  In accordance with the Safety, “Fail Safe - Fail Safe” or “Fail Operational - Fail Safe” and the reliability requirements, provision shall be made to prevent firing or degradation in response to radio frequency, direct and indirect effect of lightning, magnetic field and electrostatic discharge.
  If the explosive subsystem contains two or more barriers then at least two of these barriers shall:
• be independent,
• not be subject to common cause failure,
• each provide disconnection of the firing circuit.

The electrical architecture is designed with the following barriers:

• Arming switch,
• Pulse generator,
• Selection switch, with monitoring of the status,
• for spacecraft, in addition satellite separation and Safe and Arm connector.
  For explosive subsystems involving a potential catastrophic risk, the barrier close to the source of the risk shall be a mechanical barrier.
  The primary and redundant EEDs shall not be activated through the same electrical firing circuit.
  Stray circuits or coupling which can result in unintentional firing shall be avoided.

Safe and arm device pre-arm function

The pre-arm function shall be the fourth last in a sequence of functions.
The pre-arm function shall be independent and respond only to a unique action.
The pre-arm function shall remain in its switched state after operation until the fire function has reverted to its initial state.
The pre-arm function may include the select function.

A safe and arm device is not always included.

Select function

The select function shall be the third last in a sequence of functions.
The select function shall select the explosive devices.
The select function shall be independent and respond only to a unique command.
The select function shall be used to control only one explosive function.
The select function shall revert to its initial state after the fire command within an interval agreed with the customer.

Arm function

The arm function shall be the second-last action in the sequence.
The arm function shall be independent and respond only to a unique command.
The arm function shall be used to control only one explosive function.
The functionality shall be provided to restore its initial disarmed state after the arm command within an interval agreed with the customer.

Fire function

The fire function shall be the last action in the sequence.
The fire function may be used to activate several of explosive devices.
The fire function shall be independent and respond only to a unique command.
The fire function shall revert to its initial state after the firing command within an interval agreed with the customer.

Survival and operational conditions

The explosive subsystem shall survive the specified sequence of conditions without malfunctioning or degrading beyond the specified limits.
The explosive subsystem shall operate between the extremes of the ranges and combinations of specified conditions.
The limits used for the qualification of elements and interfaces shall conform to the specified reliability and confidence.
The end-user shall specify the characteristics of the expected environment.
The end-user shall specify the explosive subsystem constraints.
The explosive subsystem shall limit the mechanical, electrical and thermal effects of its operation within limits agreed with the end-user to avoid disturbance or damage to other sensitive elements on the space vehicle.

• 1    Examples of disturbance are shock, electrical short circuits, and magnetic fields.
• 2    For verification and tests see 4.14.

Interface requirements

Overview

The nature of the interfaces is:

geometry, including the analysis of the dimensions for all phases of life.

E.g. assembly, transport, and flight.

mechanical, including induced loads, static and dynamic;

fluids, including venting;

thermal loads;

electrical, including ensuring electrical continuity and EMC;

materials, including ensuring compatibility.

Functional

Each interface shall

• ensure no assembly errors can be made,
• prevent damage during assembly or dismantling. Whilst separated, protection shall be provided to each interface.

This is to prevent activation or damage by external loads and environmental conditions.

When closed, each interface shall establish stable continuity of properties between the joined elements.

This is to prevent disturbance of or being disturbed by external loads and environmental conditions.

Each interface shall sustain without degradation in both coupled and separated states

• the assembly and dismantling duty-cycle, and
• the operational and environmental conditions of the application.

Internal

Each element in the explosive subsystem shall be compatible with its neighbour.
Each element shall provide outputs at each interface with margins over the input requirements of the next element or the explosive subsystem output requirements.

E.g. electrical, mechanical, thermal, and optical outputs.

External

The explosive subsystem shall be compatible with the requirements of all other subsystems on board, external loading, and environmental conditions.
In case 4.7.4a is not met, it shall either:

• be agreed with the end-user to change the on-board subsystem requirements, or
• be agreed with the end-user to provide protection against the environmental conditions or to reduce the external loads on the explosive subsystem.

Mechanical, electrical, and thermal requirements

Mechanical

Inertial properties

The supplier, in accordance with the reference axis system provided by the customer, shall provide, before and after firing, the customer with the following information of the component:

• the mass,
• the centre of mass,
• the inertial properties, and
• the interface FEM in STEP or IGES format.

Main fixings

Each element of the explosive subsystem shall be provided with an interface compatible with the methods of attachment to the structure or appendage agreed with the customer.

Modularity of the subsystem

The explosive subsystem shall be assembled from modular components.
The capability shall be provided to test the components separately.
It shall be ensured that attachment, installation, repair and replacement can be done without affecting the surrounding equipment.

Avoidance of confusion (only applicable for launch segment)

For launch segment, it shall be ensured that components intended for different applications cannot be confused.
For launch segment, inert components, dummies and test models used for test purposes shall be visibly different from live items with the colour code in Table 42.

This is to prevent confusion and to ensure incorrect items are not used for flight or qualification.

Table 42 Explosive component colour code

Colours related to component behaviour
Detonation	 yellow orange
Deflagration	 brown light
Inert	 red orange bright
Colours related to the state or purpose of component
Arm	 red bright
Safe	 green

Accessibility

Access shall be provided throughout the space vehicle integration

• to the initiators, safe, test, and arm plugs for connection,
• for measurements of properties,
• to all elements for inspection. Access shall be safe and convenient as agreed with the customer.

Mechanical input to ICD

Complementary mechanical requirements before and after firing the explosive device or subsystem may be specified by the customer by tailoring ECSS-E-ST-10-24.

Electrical

General

All explosive devices firing lines shall be initiated via a dedicated module which incorporate the safety inhibits and is mechanically segregated, electrically independent and screened.

Example of an initiation module is a firing unit. Examples of safety inhibits are command inhibit, barriers and switches. Examples of a segregation are different electronic boards for prime and redundant initiation, different routing of harnesses (electrical, optical and explosive).

The explosive subsystem shall provide power pulses to initiators at the times required by the application.
The power pulse, shape, amplitude and duration shall be as specified in the ICD of the initiator manufacturer.
It shall be demonstrated by test that 4.8.2.1c is met.
<<deleted>>

Circuit independence

Each electrical or optical initiator shall be connected to a dedicated electrical or optical firing line.
A separate command shall activate each explosive device for launch vehicles.
In case 4.8.2.2a is not met, the alternative circuit shall be justified and agreed with the customer and suppliers.
The circuits shall be verified by test or analysis to meet the requirements on reliability and on the prevention of unintentional function.

See clauses 4.2.2 and 4.5.2.

Power subsystem overload

The power supply shall ensure that the power subsystem is not overloaded before, during or after the actuation of any explosive device even in case of a single-point failure together with a short circuit (both pin-to-pin and pin-to-ground).

Electromagnetic compatibility (EMC)

The explosive subsystem power, command, and control electrical circuitry shall limit the generation of electromagnetic fields or conducted noise to a level at least 20 dB below the no-fire power rating.
The explosive subsystem shall provide shielding to the same levels specified in 4.8.2.4a when exposed to conducted and radiated susceptibility tests.
Control circuits shall limit the power level at any barrier to at least 20 dB below the no-fire power.

Electrostatic discharge

The explosive subsystem's power, command and control electrical circuitry shall:

• survive,
• not be degraded by specified electrostatic discharges,
• be testable to verify survivability. Protective features shall be provided to
• prevent initiation,
• prevent change of state of the safety barriers,
• prevent parasitic paths,
• be tested to verify effectiveness. Electrostatic discharge to ground through the explosive elements shall be prevented.
  Build-up of electrostatic charges shall be prevented.
  Measures to satisfy requirement 4.8.2.5d shall respect single point grounding implementation.

Single point grounding implementation is described in ECSS-E-HB-20-07 section 6.1.3.

All ESD-sensitive components shall be identified and listed.
Unplanned electrostatic discharges shall be avoided.

Voltage drop

The voltage drop in the electrical circuit shall be incorporated in the provision of the required firing pulse.

Electrical bonding

The resistance between the case of the electro-explosive device and the electrical ground shall not exceed the value specified in ECSS-E-ST-20-07 clause 4.2.11.
The metallic parts of the explosive devices shall be bonded by direct contact.
The shielding of the electrical pigtailed explosive devices shall be bonded at both ends of connector and its explosive device.

Isolation

Every electrical firing circuit and monitoring circuit shall be electrically independent from each other.
The explosive subsystem shall isolate the explosive device to prevent power drain or parasitic paths before and after firing.
Provision shall be made to isolate power lines of the explosive subsystem from electrical ground.

This is to prevent continued drain on the power subsystem after firing when e.g. short circuit to ground can occur. A current can be drained by the structure instead of the electrical harness.

Provisions for redundancy shall not prevent fulfilment of the requirement 4.8.2.8a.
Safe and arm device control and check-out circuits shall

• be independent of the firing circuits,
• use separate non-interchangeable connectors. For launchers only, provision shall be made to isolate power lines and return lines of the explosive subsystem from electrical ground.

Insulation

The explosive subsystem shall neither function nor degrade as a result of the voltage difference between the firing circuits and the shielding or the ground within specified limits.

Leakage

The explosive subsystem shall neither function nor degrade as a result of leakage current of electrical firing circuits to ground.

Sensitivity to RF energy

When exposed to RF conditions, the induced power shall not exceed a level of 20 dB below no-fire power and 20 dB below the RF sensibility threshold.

If no RF-limit is known, the DC-limit can be used.

When exposed to RF conditions, the explosive subsystem shall not be degraded.

Magnetic cleanliness

The maximum level of residual magnetism shall be agreed with the end-user.

Reduced levels can be achieved by the choice of suitable materials.

The supplier shall provide the customer with the magnetic properties of the explosive devices.
The explosive subsystem shall not generate magnetic fields exceeding the “Electromagnetic interference safety margins” defined in clause 6.3.1 of ECSS-E-ST-20.

Lightning

For launch segments, in accordance with the direct and indirect lightning environment provided by the customer, the explosive subsystems shall preclude unwanted firing due to electrical potential differences generated within the explosive subsystem.
Explosive subsystems should preclude degradation by exposure to lightning.

Electrical input to ICD

Complementary electrical requirements before and after firing the explosive device or subsystem may be specified by the customer by tailoring ECSS-E-ST-10-24.

Thermal

Sensitivity

Explosive subsystems and components shall:

• survive to defined thermal loads in terms of intensity, duration and cycling,
• not be degraded by defined thermal loads in terms of intensity, duration and cycling,
• be tested to verify survivability. Protective features shall:
• be provided to prevent unintended initiation,
• be provided to prevent loss of performance,
• be tested to verify effectiveness. Build-up of heat shall be prevented.
  All thermally-sensitive explosive devices shall be shielded or otherwise protected from the environment.
  Explosive devices shall not decompose when exposed to thermal environments that are 30 °C above the maximum predicted temperature and 10 °C below the minimum predicted temperature during worst case service life.

This is to ensure no self-ignition under cook-off test.

Heat generation

The explosive subsystem shall not generate heat causing temperatures which exceed the specified limits.

Thermal input to ICD

Complementary thermal requirements before and after firing the explosive device or subsystem may be specified by the customer by tailoring ECSS-E-ST-10-24.

Status check

General

The explosive subsystem shall provide for

• measurements of electrical or optical properties during the integration of any circuit before and after firing, without inducing firing, unintentional status changes or degradation;
• the indication of at least the status of the Safe and Arm Device during the mission. <<deleted>>
  Check-out circuits shall not allow current flow or electrostatic discharge causing unintentional effects in the explosive subsystem.

This applies also after any single failure.

Any checking out of the status of electrical initiators shall limit the check-out current to 10-2 × the “no-fire” × current on the bridge wire.
Any checking-out of the status of optical initiators shall limit check-out power to: 10-4 (TBPU) × the “no-fire” power at the fire wavelength on the optical interface if the fire wavelength is used.
The checking-out power or current or optical wavelength or frequency shall cause no unintentional effects or hazards, also after any single failure.
Any checking-out of the insulation resistance of the explosive subsystem shall limit the voltage to 50 V DC to prevent performance degradation.

Degradation of performance is commonly known as dudding.

Provision shall be made for an immediate warning signal to be given for any unplanned change of status of any explosive subsystem control or check-out device.

E.g. thermal control requirements or material temperature limits.

Initiator status

Provision shall be made for on-ground checking the status of initiators.
Provision shall be made for accessing the arm plug receptacle during AIV.
Requirements for access shall be communicated to the end-user and facilities authorities.

Range safety sometimes prohibits use of these features.

Materials

All materials, including explosive substances, shall be compatible with those materials with which they can come into contact.

• 1    Outgassing can occur during e.g. polymerization, degradation of polymers.
• 2    Selection of materials and processes are done in conformance with ECSS-E-ST-32-08, ECSSQ-ST70, and ECSS-Q-ST-70-71.
• 3    Explosive subsystems use materials (e.g. explosives, propellants, powder, binders, cleaning agents, cements) that can be toxic, corrosive, highly reactive, flammable, and dangerous with direct contact.
  Continued exposure to the expected environmental conditions shall not cause degradation or increased sensitivity in excess of agreed limits.
  Any sealing system used to prevent degradation shall be demonstrated to be effective.
  No cracking shall be allowed due to thermal mechanical shock loads.

Materials can become brittle at low temperatures.

Age-sensitive materials shall only be used where degradation causes no loss of explosive subsystem performance beyond limits agreed with the end-user.
The nature and condition of age-sensitive materials shall be identified and documented in the DMPL.
The nature and condition of explosive materials shall be identified and documented in the DMPL.
Explosives that can react in response to normal environmental stimuli shall only be used in agreement with the end-user.
The properties of the explosives shall be reported and be compared with the mission requirements.
Degradation of the explosives shall not exceed agreed limits.
Degradation of explosive characteristics shall be determined by test.

Test methods can be DTA, DSC, TGA, VTS.

Non-explosive components and equipment

Connectors

There shall be only one connection per pin.
The requirements of clause 4.7.2 shall apply to the connectors of non-explosive components and equipment.
Mis-mating of connectors shall be impossible.

E.g. by geometry, lay-out, dimensions, or harness length.

The insert polarization and contact arrangement of the connectors used in the explosive subsystem shall not be used elsewhere on the space vehicle.
Initiator connector shall be terminated by male contacts.
Spare or un-terminated contacts shall not exist.
Prime and redundant circuits for the same function shall not pass through the same connector.
Electrical connectors shall provide continuous shielding in all directions.
Electrical connectors shall provide continuous shielding during

• engagement before the pins connect,
• disengagement after the pins disconnect. <<deleted, recreated as recommendation 4.10.1k>>.
  Connector-savers should be used.

This is to prevent the receptacle and contacts from wear and damage.

Wiring

Electrical supply for each initiator, optical source and Safe and arm device shall be by a separate shielded, twisted-pair line or coaxial cable.
All connections between conductors shall be made by soldering, crimping or connectors.

For soldering see ECSS-Q-ST-70-08.

For crimping ECSS-Q-ST-70-26.

For connectors see clause 4.10.1.

Shielding

The firing circuit including the initiator shall be shielded.
Isolators shall provide 20 dB attenuation at the specified electromagnetic frequencies.
Cable shielding shall provide  90 % optical coverage.
Double layer cable shielding should be used.
For all other elements shielding, there should be shielding at 100 % optical coverage.

For example, no gaps or discontinuities, full shielding at the back faces of the connectors, no apertures in any container housing elements of the firing circuit.

Shields shall not be used for current carrying.

Shields can be multiple-point grounded to the structure.

Faraday cap

Faraday caps shall be used at the input interface of the explosive devices.
The Faraday cap shall prevent EEDs being initiated or damaged by electromagnetic interferences.

Safety cap

Safety caps shall be used.
The safety cap shall contain the products of initiation of an explosive device.
It shall not be possible to install an explosive device with the safety cap mounted.

Power

The explosive subsystem shall make use of the available voltage and current supplies from the power subsystem to produce power pulses of suitable size, duration and firing sequence for each of the functions.
The firing pulse requirements in Table 44 row 5 and Table 46 row 1 shall apply for EEDs and laser initiators respectively.
The power provided at the power distribution points shall be such that the requirements of 4.8.2.6 allowing for losses are met.

Arm plug receptacle

A connector shall be provided on the exterior surface of the space vehicle for use with manually inserted plugs to enable:

• isolation,
• coupling of any explosive subsystem,
• testing of any explosive subsystem.

This connector is referred to as arm plug receptacle.

Provision shall be made for access to the interface.
Requirements for access shall be communicated to the customer and facilities authorities.
The arm plug receptacle shall be visibly identifiable.
The arm plug receptacle shall be qualified for the number of specified connection cycles.

E.g. to cover integration, test and use.

The receptacle shall meet the requirements of clause 4.10.1.

Sub-D connector, self-locking bayonet or triple start thread type can be used.

A connector-saver shall be used.

This is to prevent the receptacle and contacts from wear and damage.

Safe plug

For electrical initiators, the safe plug shall

• short circuit each initiator,
• ground each shorted initiator circuit,
• short-circuit each firing circuit,
• ground each firing circuit. For optical initiators, the safe plug shall be capable of absorbing or redirecting n times the maximum power the laser can generate, with n defined by the end-user.
  The safe plug shall be
• compatible with the safe and arm connector receptacle,
• suitable for use with flight hardware,
• suitable for the number of connection cycles necessary to cover integration, test and use,
• scoop proof,
• lockable,
• visibly identified,
• carrying a “Remove before Flight” banner.

Examples of lockable safe plugs are sub-D connector, bayonet or triple-start thread types.

Arm plug

The arm plug shall:

• provide electrical continuity between the supply and firing circuits with electrical properties in any line agreed with the customer,
• be compatible with the safe and arm connector,
• be scoop-proof,
• be lockable,
• be visibly identified.
• 1    Electrical properties include resistance, isolation, bonding, and Faraday protection.
• 2    Examples of lockable arming plugs are sub-D connector, bayonet or triple-start thread types.

Test plug

The test plug shall:

• provide electrical access to the firing circuits with electrical properties in any line agreed with the end-user,
• be compatible with the safe and arm connector,
• not carry any potential or current at the time of insertion or removal,
• be suitable for the number of connection cycles necessary to cover integration, test and use,
• be suitable for use with flight hardware,
• be scoop-proof,
• be lockable.
• 1    Electrical properties include resistance, isolation, bonding, and Faraday protection.
• 2    Examples of lockable test plugs are sub-D connector, bayonet or triple-start thread type.

Safe and arm device

General

Electrically actuated safe and arm devices should be used.
A safe and arm device shall

• be used in applications where unplanned initiation of the explosive subsystem can cause injury, death, or severe damage to property,
• prevent the mounting of initiators in armed position,
• provide means of remote arming,
• provide means of remote safing,
• provide safing without passing through the armed position,
• prevent manual arming,
• provide manual safing and prevent unwanted return to arm,
• remain in the selected position under all conditions except when intentionally activated,
• prevent remaining in any state between ‘safe’ and ‘arm’,
• arm within a time interval agreed with the end-user,
• not require a force or torque to safe, exceeding a value agreed with the customer,
• if actuated remotely, safe within a time interval agreed with the end-user. It shall not be possible to arm the safe and arm device in case an initiator has been activated with the safe and arm device in safe position.
  The safe and arm device shall be capable of being manually positioned to “safe” during any phase of this cyclic life.
  The protection shall be removed by either:
• removing the barrier, or
• having a reconnection allowing propagation, "Armed condition", when commanded. Remote operation and status indication shall be provided.
  Local visible unambiguous status indication shall be provided.
  All additional blocks shall be flagged “Remove before flight”.

Safe and arm devices can use initiator-simulator resistors.

Electrically actuated

The electrically actuated safe and arm devices shall be designed to withstand repeated cycling from Arm to Safe for at least five times the expected number of cycles, without any malfunction, failure, or degradation in performance;
The electrically actuated safe and arm device shall have a demonstrated cyclic life of 1000 safe-to-arm-to-safe transitions, or five times the number of transitions predicted during its lifetime, whichever is greater, without failure or degraded performance.

Mechanically actuated

The mechanically actuated safe and arm devices shall be designed to withstand repeated cycling from Arm to Safe for at least five times the expected number of cycles, without any malfunction, failure, or deterioration in performance.

Safing

Safing shall prevent detonation or initiation transfer by

• the placement of a barrier between the initiator and next explosive element, or
• misalignment of the initiator and the next explosive element. <<deleted>>
  <<deleted>>
  <<deleted>>
  <<deleted>>

Arming

Arming shall enable detonation or initiation transfer by

• the removal of a barrier between the initiator and next explosive element, or
• alignment of the initiator and the next explosive element. <<deleted>>
  During transition from “safe” to “arm” each electrical switch shall disconnect before connecting to the next circuit.

Clause 4.1.2. applies.

Status indicators

The device shall:

• provide remote status indications,
• provide local status indications,
• indicate “Arm” status with a black “A” on a red background or a red “A”,
• indicate a “Safe” status with a white “S” on a green background or a green “S”. The status indications shall be unambiguous.
  Visibility of the status indicators when installed on the spacecraft or launcher shall be ensured.

<<deleted>>

<<deleted>>

Initiator harness connector

The initiator harness connector shall conform to the interface requirements of the integral connector of the initiator.
The initiator harness connector shall not be used for other purposes on the space vehicle.

Initiator test substitute

Any initiator test substitute shall be representative with respect to properties which affect the results of the test.

Explosive components

General

Applicability

Clauses from 4.11.1.2 until 4.11.6 shall apply to explosive components, which cannot be fully tested before flight.
For other elements of the subsystem, which can be fully tested before flight, the equipment environmental test conditions of the end-user shall apply.

The requirements for explosive components are given below as measurements to be made after specific preconditioning and under survival and operational conditions identified in 4.6.

Identification

Identification marking shall be in conformance with ECSS-M-ST-40, clause 5.3.1.5.
For launchers colour coding shall be used on components to indicate behaviour.
Each component containing explosives shall be visibly and permanently marked with:

• a unique identification,
• coding to indicate behaviour. Identification should include Manufacturer, Part number, Lot number, Serial number, Manufacturing date stating month and year.
  Colour coding should be in conformance with Table 42.

Contamination

The following types of contamination shall be prevented:

• from the environment to the components;
• from components to the environment;
• related to the failure of innocuousness of a component during and after functioning.

Contamination can be prevented e.g. by the use of approved materials in conformance with ECSS-Q-ST-70-71 and by design to contain products of the operation of explosive components.

In case clause 4.11.1.3a cannot be met, a component shall not be accepted unless the limits of the amount and type of contamination are identified by the manufacturer and agreed with the end-user.

After functioning

After functioning, no explosive component shall cause

• any disturbance beyond limits agreed with the end-user,
• contamination beyond limits agreed with the end-user.

Initiators, cartridges, detonators, and packaged charges

General

The properties of initiators given in Table 43 shall be quantified and conform to the figures where shown.
Under the conditions in column E of Table 43, the properties in column A, expressed in the units specified in column B, shall be between the values in column C (maximum) and column D (minimum).
Table 43 Common requirements for initiator, cartridge, detonator, and packaged charge properties

#	A	B	C	D	E	F
	Property	Unit	Maximum value	Minimum value	Condition	Notes
1	AC leakage current	mA	TBPM	TBPM
2	Bonding resistance	m	10	N/A	To next level assembly
3	Thermal response	V/t	TBPM	TBPM
4	Leak rate	scc He/s	10-6	N/A	@ p= 0,1 MPa before and after firing
5	Structural integrity	MPa		TBPM		in conformance with ECCS-E-32-10 applies on MEOP
6	Temperatures/Humidity :
(a)	Auto-ignition	°C	N/A	TBPM
(b)	Non-operating	°C/HR%	TBPM	TBPM
(c)	Operating	°C/HR%	TBPM	TBPM	Duration TBPM
(d)	Storage	°C/HR%	TBPM	TBPM	Duration TBPM
(e)	Transport	°C/HR%	TBPM	TBPM	Duration TBPM
(d)	Verification Tests	°C/HR%	TBPM	TBPM	Number TBPM
7	Generated:
(a)	Pressure	MPa	TBPM	TBPM	TBPM	Only the known and relevant output parameter are provided
(b)	Heat	J	TBPM	TBPM	TBPM	Only the known and relevant output parameter are provided
(c)	Light	lm	TBPM	TBPM	TBPM	Only the known and relevant output parameter are provided
(d)	Shock pressure	GPa	TBPM	TBPM	TBPM	Only the known and relevant output parameter are provided
8	Probability of ignition of a reference charge			99,8 %	95 % confidence
9	Nr of mating/ de-mating cycles		TBPM	TBPC	With / without change of seals
10	Lifetime	Year	TBPM	N/A	For transport, storage and operation

1W / 1A No-Fire initiators

The minimum no-fire rating shall be 1A (current) or 1W (power) for five minutes.
The firing probability when subjected to the no-fire current or no-fire power for five minutes shall be less than 0,001 at 95 % confidence level.
After exposure to the no-fire current or no-fire power, the EED shall be capable to function in conformance with its requirements.
The properties of the 1W / 1A NoFire initiator given in Table 44 shall be quantified and conform to the figures where shown.
Under the conditions in column E of Table 44, the properties in column A, expressed in the units specified in column B, shall be between the values in column C (maximum) and column D (minimum).
Table 44 Requirements for low voltage initiator properties

#	A	B	C	D	E	F
	Property	Unit	Maximum value	Minimum value	Condition	Notes
1	DC insulation resistance	M	N/A	2	@ 250 V (DC) or 500 V (DC), 60 s	Applicable to manufacturer only during manufacturing
2	Breakdown voltage	kV	11	N/A
3	ESD survival	kV	N/A	25	@ 500 pF and 5000 ohms for pin to pin test @ 500 pF and 0 ohm for pin to case test
4	Dielectric strength	A	500	N/A	@ 200 V (AC) 60 s	Applicable to manufacturer only during manufacturing
5	All fire current	A	TBPM	TBPM	99,9 % of the units function with a confidence level of 95 % @ specified conditions.
6	All fire power	W	TBPM	TBPM	99,9 % of the units function with a confidence level of 95 % @ specified conditions.
7	Response time	ms	TBPM	N/A	for ‘all fire’ current or power
8	‘No fire’ current	A	N/A	1	≤ 0,1 % of the units function with a confidence level of 95 % @ 5 minutes, at specified conditions.
9	‘No fire’ power	W	N/A	1	≤ 0,1 % of the units function with a confidence level of 95 % @ 5 minutes, at specified conditions.
10	Bridge wire resistance		TBPM	TBPM	@ 10 mA, ≤ 60 s Number of applications TBPM

High voltage initiators

The properties of the high voltage initiator given in Table 45 shall be quantified and conform to the figures where shown.
Under the conditions in column E of Table 45, the properties in column A, expressed in the units specified in column B, shall be between the values in column C (maximum) and column D (minimum).
Table 45 Requirements for high voltage initiator properties

#	A	B	C	D	E	F
	Property	Unit	Maximum value	Minimum value	Condition	Notes
1	All fire voltage	V	TBPM	TBPM	99,9 % of the units function with a confidence level of 95 %
2	No fire voltage	V	TBPM	TBPM	≤ 0,1 % of the units function with a confidence level of 95 % @ 5 minutes, test temperature TBPM
3	Operating voltage	V		> 500

Laser initiators

The properties of the laser initiator given in Table 46 shall be quantified and conform to the figures where shown.
Under the conditions in column E of Table 46, the properties in column A, expressed in the units specified in column B, shall be between the values in column C (maximum) and column D (minimum).
Table 46 Requirements for laser initiator properties

#	A	B	C	D	E	F
	Property	Unit	Maximum value	Minimum value	Condition	Notes
1	All fire power density	W/mm2	TBPM	TBPM	99,9 % of the units function with a confidence level of 95 %
2	No fire power density	W/mm2	TBPM	TBPC	≤ 0,1 % of the units function with a confidence level of 95 % @ 5 minutes, at specified conditions (wavelength TBPM)	Factor of safety for spurious lights (TBPC)
3	Pulse width	ms	N/A	TBPM
4	Wave length	nm	TBPM	TBPM		Depending on optical source: solid laser, laser diode

Mechanical initiators

The properties of the mechanical initiator given in Table 47 shall be quantified and conform to the figures where shown.
Under the conditions in column E of Table 47, the properties in column A, expressed in the units specified in column B, shall be between the values in column C (maximum) and column D (minimum).
Table 47 Requirements for mechanical initiator properties

#	A	B	C	D	E	F
	Property	Unit	Maximum value	Minimum value	Condition	Notes
1	All fire energy	J	TBPM	TBPM	99,9 % of the units function with a confidence level of 95 %
2	No fire energy	J	≤ 0,1× minimum all fire energy	TBPM	0,1 % of the units function with a confidence level of 95 %
3	Test energy	J	N/A	TBPM

Packaged charges

The properties of the packaged charge shall conform to the requirements of Table 48, with the exception of the structural integrity requirements, and Table 47, and be quantified.
Under the conditions in column E of Table 48, the properties in column A, expressed in the units specified in column B, shall be between the values in column C (maximum) and column D (minimum).
Table 48 Requirements for packaged charge properties

#	A	B	C	D	E	F
	Property	Unit	Maximum value	Minimum value	Condition	Notes
1	Structural integrity		N/A	N/A	handling and transport loads
2	Detonation? Yes / No		TBPM	N/A	Intended operational mode
3	Deflagration? Yes / No		TBPM	N/A	Intended operational mode

Through-bulkhead initiators

The properties of through-bulkhead initiators given in Table 49 shall be quantified and conform to the figures where shown.
Under the conditions in column E of Table 49, the properties in column A, expressed in the units specified in column B, shall be between the values in column C (maximum) and column D (minimum).
Table 49 Requirements for through-bulkhead initiators properties

#	A	B	C	D	E	F
	Property	Unit	Maximum value	Minimum value	Condition	Notes
1	Output
(a)	Pressure	MPa	TBPM	TBPM	In TBPM cm3 at 20 °C
(b)	Energy	J	TBPM	TBPM	TBPM
(c)	Leak rate	scc He/s	10-6	N/A	@ p= 0,1 MPa before firing
2	Barrier tightness leak rate	scc He/s	10-5	N/A	@ p= 0,1 MPa before firing
3	Barrier tightness leak rate	scc He/s	10-3	N/A	@ p= 0,1 MPa after firing
4	Structural integrity	MPa	TBPM	TBPM		(barrier resistance after firing).

Integral initiator connectors

General

The configuration of the connector shall be used only for initiators.

This is the integral (upper) part of the initiator.

The interface shall allow for sealing.

Electrical initiator connector

The connector thread or closing mechanism shall be self locking.
The connection shall have electrical continuity with a resistance < 10 m
The connector shall be able to undergo 50 mating-demating cycles without degradation.
The connection shall be able to undergo specified thermal and mechanical environments without degradation.

Laser initiator connector

The initiator shall incorporate an interface to match the interfaces on the fibre optic connector and the adapter which is used to join the two items.
The connector interface shall not be used for any purpose other than explosive devices.
The connector thread or closing mechanism shall be self locking.
The connection shall have electrical continuity with a resistance < 10 m
The connector shall be able to undergo 50 mating / de-mating cycles while meeting its requirements.

Transfer devices

General

The properties of transfer devices shall conform to the general requirements of Table 410 and be quantified.
Under the conditions in column E of Table 410, the properties in column A, expressed in the units specified in column B, shall be between the values in column C (maximum) and column D (minimum).
Table 410 General requirements for transfer device properties

#	A	B	C	D	E	F
	Property	Unit	Maximum value	Minimum value	Condition	Notes
1	Critical diameter	mm	N/A	TBPM		information about explosive to be provided
2	Temperatures/ Humidity:
(a)	Auto-ignition	°C/HR%	N/A	TBPM
(b)	Non-operating	°C/HR%	TBPM	TBPM
(c)	Operating	°C/HR%	TBPM	TBPM	Duration TBPM
(d)	Storage	°C/HR%	TBPM	TBPM	Duration TBPM
(e)	Transport	°C/HR%	TBPM	TBPM	Duration TBPM
3	Probability of Ignition of a reference charge			99,8 %	95 % confidence
4	Nr of mating/de-mating cycles	--	TPBM	TBPC	With/without change of seals
5	Lifetime	Year	N/A	TBPC	For transport, storage and operation

Transfer line assembly

The properties of transfer line assembly given in Table 411 shall be quantified and conform to the figures where shown.
Under the conditions in column E of Table 411, the properties in column A, expressed in the units specified in column B, shall be between the values in column C (maximum) and column D (minimum).
Table 411 Requirements for transfer line assembly properties

#	A	B	C	D	E	F
	Property	Unit	Maximum value	Minimum value	Condition	Notes
1	Propagation velocity	m/s	TBPM	TBPM
2	Deflagrating lines
(a)	Pressure	MPa	TBPM	TBPM
(b)	Heat	J	TBPM	TBPM
3	Detonating lines
(a)	Shock transmission capability	GPa	TBPM	TBPM	Standard material
(b)	Flyer characteristics	mm	TBPM	TBPM	Flyer thickness, diameter, material, and jitter
(c)	Flyer velocity	m/s	TBPM	TBPM	Best estimate
(d)	Ignition gap	mm	TBPM	TBPM	By initiator type : TBPM
4	End-to-end transmission gap	mm	TBPM	TBPM
5	Electrical continuity	m	TBPM	N/A	From end to end
6	Leak rate (together with interfaces)	scc He/s	10-6	N/A	@ p= 0,1 MPa before firing
7	Leak tightness (together with interfaces)	scc He/s	10-3	N/A	@ p= 0,1 MPa after firing (ends implemented in the specified interface) + No debris
8	Organic contamination of surfaces	mg/m²	2	N/A	See ECSS-Q-ST-70-01.
9	Radius of curvature	m	N/A	TBPM	Bending
10	Nr. Of times one can bend	--	TBPM	TBPC	Bending
11	Twist angle	rad/m	TBPM	N/A
12	Tension	daN	TBPM	N/A
13	Overall mass	g/m	TBPM	N/A	Linear mass of flexible part (g/m) + ends (g)
14	Explosive mass	g/m	TBPM	N/A	Linear mass of flexible part (g/m) + ends (g)

<<deleted, modified and recreated in 4.11.2.7>>

<<deleted, modified and recreated in 4.11.2.7a>>
<<deleted, modified and recreated in 4.11.2.7b>>

<<deleted and moved to 4.11.7>>

<<deleted, requirement moved to 4.11.7a.>>
<<deleted, requirement moved to 4.11.7b. and referred Table modified>>

<<deleted and moved to 4.11.8>>

<<deleted and moved to 4.11.8a.>>
<<deleted and moved to 4.11.8b. and referred Table modified>>

<<deleted and moved to 4.11.9>>

<<deleted, requirement moved to 4.11.9a.>>
<<deleted, requirement moved to 4.11.9b. and referred Table modified>>

<<deleted and moved to 4.11.10>>

<<deleted, requirement moved to 4.11.10a.>>
<<deleted, requirement moved to 4.11.10b. and referred Table modified>>

Safe and arm devices containing explosive

All requirements for safe and arm devices of Clause 4.10.11 shall apply.
Only secondary explosive with less or equal sensitivity to Hexogen shall be used.

Gas generators

The properties of gas generators given in Table 412 shall be quantified and conform to the figures where shown.
Under the conditions in column E of Table 412, the properties in column A, expressed in the units specified in column B, shall be between the values in column C (maximum) and column D (minimum).
Table 412 Common requirements for gas generator

#	A	B	C	D	E	F
	Property	Unit	Maximum value	Minimum value	Condition	Notes
1	Bonding resistance	m	10	N/A	To next level assembly
2	Leak rate	scc He/s	10-6	N/A	@ p= 0,1 MPa before and after firing at initiator interface
3	Structural integrity	MPa		TBPM	in conformance with ECCS E 32-10 applies on MEOP
4	Temperatures /Humidity:
(a)	Auto ignition	°C	N/A	TBPM
(b)	Non operating	°C/HR%	TBPM	TBPM
(c)	Operating	°C/ HR%	TBPM	TBPM	Duration TBPM
(d)	Storage	°C/ HR%	TBPM	TBPM	Duration TBPM
(e)	Transport	°C/ HR%	TBPM	TBPM	Duration TBPM
5	Generated:
(a)	Pressure	MPa	TBPM	TBPM		Only the known and relevant output parameter is provided
(b)	Heat	J	TBPM	TBPM		Only the known and relevant output parameter is provided
(c)	Nr of mating./ de-mating cycles		TBPM	TBPC	With / without change of seals
(d)	Generated Shock	“g”/ms	TBPM	N/A	Time history and TBPC sampling rate. Test configuration TBPC
6	Lifetime	Year	TBPM	N/A	For transport, storage and operation

Shaped charges

The properties of shaped charges given in Table 413 shall be quantified and conform to the figures where shown.
Under the conditions in column E of Table 413, the property in column A in the units in column B shall be between the values in column C (maximum) and column D (minimum).
Table 413 Requirements for shaped charge properties

#	A	B	C	D	E	F
	Property	Unit	Maximum value	Minimum value	Condition	Notes
1	Cutting capabilities
(a)	Structure thickness	mm	TBPM	N/A	associated with material properties
(b)	Structure loads	MPa	TBPM	TBPM
(c)	Cutting delay	ms	TBPM	TBPM
(d)	Type of impulse	N s	TBPM
(e)	Generated shock	“g”/ms	TBPM	N/A	Time history and TBPC sampling rate. Test configuration TBPC
3	Redundancy				TBPM
4	Debris/contamination/induced					Side effects to be specified
5	Temperatures /Humidity :
(a)	Auto-ignition	°C
(b)	Survival Non-operating	°C/HR%	TBPM	TBPM
(c)	Operating	°C/HR%	TBPM	TBPM
(d)	Storage	°C/HR%	TBPM	TBPM
(e)	Transport	°C/HR%	TBPM	TBPM
6	Lifetime	Year	TBPM	N/A	during transport, storage and mission
7	Explosive charge Nature Linear mass	TBPM g/m
8	Initiation mode	TBPM				Axial or radial

Expanding tube devices

The properties of expanding tube devices given in Table 414 shall be quantified and conform to the figures where shown.

These devices include separation systems based on:

• detonation (shock and deformation),
• inflation (pressure generated),
• combination of the above.
  Under the conditions in column E of Table 414, the properties in column A, expressed in the units specified in column B, shall be between the values in column C (maximum) and column D (minimum).
  Table 414 Requirements for expanding tube device properties

#	A	B	C	D	E	F
	Property	Unit	Maximum value	Minimum value	Condition	Notes
1	Cutting capabilities:
(a)	Structure thicknesses, position of the cutting area	TBPM	TBPM	TBPM	Associated with material properties (e.g. : ductility, elongation, strain rate)
(b)	Structure loads	MPa	TBPM	TBPM
(c)	Cut Structure loads during cutting	kN	TBPC	TBPC	Associated with material properties (e.g. : ductility, elongation, strain rate, plasticity)
(d)	Type of impulse	N s	TBPM	TBPC	Radial or axial
2	Explosives Quantity and type	g	TBPM	TBPM	Associated with tube materials properties
3	Redundancy				TBPM
4	Expanding tube unsupported length	m	TBPM	N/A	Number and size of windows for the expanding tube assembly
5	Cutting conditions:
(a)	Response time	ms	TBPM	TBPM	Between first input and completion of cutting
(b)	Generated Shock	“g”/ms	TBPM	N/A	Time history and TBPC sampling rate. Test configuration TBPC
6	Device leak rate	scc He/s	10-6	N/A	@ p= 0,1 MPa before firing
7	Device leak rate	scc He/s	10-3	N/A	@ p= 0,1 MPa after firing
8	Particle generation		TBPC	N/A	Test method TBPC
9	Temperatures /Humidity:
(a)	Auto ignition	°C/	N/A	TBPM
(b)	Non-operating	°C//HR%	TBPM	TBPM
(c)	Operational	°C//HR%	TBPM	TBPM
(d)	Storage	°C//HR%	TBPM	TBPM
(e)	Transport	°C//HR%	TBPM	TBPM
10	Lifetime	Year	TBPM	N/A

Distribution boxes

The properties of distribution boxes given in Table 415 shall be quantified and conform to the figures where shown.
Under the conditions in column E of Table 415, the properties in column A, expressed in the units specified in column B, shall be between the values in column C (maximum) and column D (minimum).
Table 415 Requirements for distribution box properties

#	A	B	C	D	E	F
	Property	Unit	Maximum value	Minimum value	Condition	Notes
1	Input/Output:
(a)	Number		TBPM	TBPM
(b)	Interface type		TBPM	TBPM	Design TBPM
2	Explosives
(a)	Quantity and type	g	TBPM	TBPM
(b)	Response		TBPM	TBPM	e.g. : detonating, deflagrating,
3	Redundancy				TBPM
4	Response time	ms	TBPM	TBPM	Between first input and all outputs
(a)	Generated Shock	“g”/ms	TBPM	N/A	Time history and TBPC sampling rate. Test configuration TBPC
(b)	Device leak rate	scc He/s	10-6	N/A	@ p= 0,1 MPa before firing
(c)	Device leak rate	scc He/s	10-3	N/A	@ p= 0,1 MPa after firing
5	Temperatures :
(a)	Auto ignition	°C	TBPM	TBPM
(b)	Non-operating	°C//HR%	TBPM	TBPM
(c)	Operating	°C//HR%	TBPM	TBPM
(d)	Storage	°C//HR%	TBPM	TBPM
(e)	Transport	°C//HR%	TBPM	TBPM
6	Lifetime	Year	TBPM	N/A	During transport, storage and mission

Explosive delays

The properties of explosive delays given in Table 416 shall be quantified and conform to the figures where shown.
Under the conditions in column E of Table 416, the properties in column A, expressed in the units specified in column B, shall be between the values in column C (maximum) and column D (minimum).
Table 416 Requirements for explosive delay properties

#	A	B	C	D	E	F
	Property	Unit	Maximum value	Minimum value	Condition	Notes
1	Delay type		TBPM	TBPM		With or without gas generation
2	Delay time	ms	TBPM	TBPM	Mean value, standard deviation at temperatures
3	Temperature sensitivity	% /°C	TBPM	TBPM	Temperature range to be provided
4	Initiation		TBPM	TBPM	To be provided: mechanical (e.g. percussion), electrical, thermal, detonation
5	Output		TBPM	TBPM	To be provided: pressure versus time, calorific energy, detonation
6	Leak rate	scc He/s	10-6	TBPM	@ p= 0,1 MPa before firing
7	Leak rate	scc He/s	TBPM	N/A	@ p= 0,1 MPa after firing
8	Temperatures /Humidity:
(a)	Auto ignition	°C	TBPM	TBPM
(b)	Non-operating	°C/HR%	TBPM	TBPM
(c)	Operating	°C/ HR%	TBPM	TBPM
(d)	Storage	°C/ HR%	TBPM	TBPM
(e)	Transport	°C/ HR%	TBPM	TBPM
9	Lifetime	Year	TBPM	N/A	During transport, storage and mission

Explosively actuated devices

General

For any explosively actuated device which incorporates initiation and explosive charges the requirements of Clause 4.11 shall apply.
No released part shall cause damage.
The requirements of Table 417 shall apply.
Under the conditions in column E of Table 417, the properties in column A, expressed in the units specified in column B, shall be between the values in column C (maximum) and column D (minimum).
Table 417 General requirements for explosively actuated device properties

#	A	B	C	D	E	F
	Property	Unit	Maximum value	Minimum value	Condition	Notes
1	Leak rate	scc He/s	TBPC	N/A	At p= 0,1 MPa before firing
2	Leak rate for spacecraft in a vacuum chamber	Number of moles of pyrotechnic leaking gases	2 x 10-5 moles	N/A	at 10-2 Pa minimum during firing	When firing tests are performed in closed thermal (temperature T) vacuum chambers of volume V, measure of the pressure increase for a sufficient duration to get an asymptotic pressure curve (e.g. 80s). The Number of moles of leaking gases is given by:
3	Leak rate	scc He/s	TBPC	N/A	At p= 0,1 MPa after firing
4	Temperatures/ Humidity:
(a)	Non-operating	°C/HR%
(b)	Operating	°C/HR%	TBPM	TBPM	duration TBPM
(c)	Storage	°C/ HR%	TBPM	TBPM	duration TBPM
(d)	Transport	°C/ HR%	TBPM	TBPM	duration TBPM
5	Functional delay	ms	TBPM	TBPM
6	Nr of assemblies / disassemblies	--	TBPM TBPM	TBPC TBPC	To the maximum load of the device attachments
7	Generated Shock	“g”/ms	TBPM	N/A	Time history and TBPC sampling rate. Test configuration TBPC
8	Life time	Year	TBPM	N/A	During, transport, storage and mission

Separation nuts and separation bolts

The properties of the separation nut and bolt given in Table 418 shall be quantified and conform to the figures where shown.
Re-settable separation nuts shall include a means of verifying that the nut is properly reset before and after its mating bolt or stud installation and torquing.
The pre-load shall be specified.
The pre-load shall exceed the maximum expected amplitude of the dynamic tension in the bolt and effects of thermal variations.

The safety margin on the pre-load is positive under mechanical and thermal environment.

Under the conditions in column E of Table 418, the properties in column A, expressed in the units specified in column B, shall be between the values in column C (maximum) and column D (minimum).
Table 418 Requirements for separation nut and separation bolt properties

#	A	B	C	D	E	F
	Property	Unit	Maximum value	Minimum value	Condition	Notes
1	Screw pre-load tension				Screw properties to be provided
(a)	By Pure tension	kN	TBPM	TBPM
(b)	By torque	kN	TBPM	TBPM
2	Load capabilities				Worst case temperatures
(a)	Axial load	kN	TBPM	TBPM
(b)	Transverse load	kN	TBPM	TBPM
(c)	Bending moment	Nm	TBPM	TBPM
(d)	Torsion	Nm	TBPM	TBPM
3	Stiffness				Worst case temperatures
(a)	Axial	N/m	TBPM	TBPM
(b)	Transverse	N/m	TBPM	TBPM
(c)	Bending moment	Nm/rad	TBPM	TBPM
(d)	Torsion	Nm/rad		TBPM

Pullers

The properties of the puller given in Table 419 shall be quantified and conform to the figures where shown.
The puller shall be capable to withdraw the pin under maximum shear and bending loads.
The retractable pin shall not rebound.
Under the conditions in column E of Table 419, the properties in column A, expressed in the units specified in column B, shall be between the values in column C (maximum) and column D (minimum).
Table 419 Requirements for puller properties

	A	B	C	D	E	F
	Property	Unit	Maximum value	Minimum value	Condition	Notes
1	Pin Preloads:			N/A
(a)	Axial	N	TBPM	N/A
(b)	Shear	N	TBPM	N/A
(c)	Bending moment	Nm	TBPM	N/A
2	Traction force	N	TBPM	TBPM	Minimum at end of stroke
3	Pulling stroke	mm	TBPM	TBPM

Pusher

The properties of the pusher given in Table 420 shall be quantified and conform to the figures where shown.
Pushers shall be able to withstand the expected loads during operation.

These loads comprise e.g. compression and shear and bending moment.

Under the conditions in column E of Table 420, the properties in column A, expressed in the units specified in column B, shall be between the values in column C (maximum) and column D (minimum).
Table 420 Requirements for pusher properties

#	A	B	C	D	E	F
	Property	Unit	Maximum value	Minimum value	Condition	Notes
1	Rod axial load	kN	TBPM	N/A
2	Push force	N	TBPM	TBPM	Minimum at end of stroke
3	Pushing stroke	mm	TBPM	TBPM

Cutters

The properties of the cutter given in Table 421 shall be quantified and conform to the figures where shown.
Under the conditions in column E of Table 421, the properties in column A, expressed in the units specified in column B, shall be between the values in column C (maximum) and column D (minimum).
Table 421 Requirements for cutter properties

#	A	B	C	D	E	F
	Property	Unit	Maximum value	Minimum value	Condition	Notes
1	Cutting capabilities				At worst case temperatures
(a)	dimensions	mm	TBPM	N/A	associated with material properties
(b)	ultimate strength	MPa	TBPM	TBPM
(c)	tension load	kN	N/A	TBPM
2	Mass of generated particles	mg	TBPM	N/A		Total mass associated with load and load carrier properties
3	Dimensions of generated particles	mm	TBPM	TBPM		Range of size associated with load and load carrier properties

Valves

The properties of the valve given in Table 422 shall be quantified and conform to the figures where shown.
After firing the valve piston shall remain in its actuated position.
The type of valve NO or NC shall be marked on the device.
The flow direction shall be marked on the device.
Under the conditions in column E of Table 422, the properties in column A, expressed in the units specified in column B, shall be between the values in column C (maximum) and column D (minimum).
Table 422 Requirements for valve properties

#	A	B	C	D	E	F
	Property	Unit	Maximum value	Minimum value	Condition	Notes
1	Valve capabilities				Associated with fluid properties
(a)	MEOP	MPa	TBPM	TBPM	in fluid circuit
(b)	Pressure drop	MPa	TBPM	TBPM	in fluid circuit
(c)	Valve passage diameter	mm	TBPM		in fluid circuit, nominal
(d)	Fluid circuit leak rate	scc He/s	10-6	TBPM	At p= 0,1 MPa before and after firing	Before and after functioning
(e)	Internal leak rate (Blow by)	scc He/s	TBPC	TBPM	TBPM	During functioning
2	Mass of generated particles	mg	TBPM	N/A	in fluid circuit
3	Dimensions of generated particles	mm	TBPM	TBPM	in fluid circuit

Items external to the flight equipment

GSE

Verification of GSE shall be performed in conformance with ECSSEST1002.
Ground support equipment shall provide support and protection within specified limits including ESD and EMI.
Test equipment shall be energy limited in conformance with 4.8.4.

E.g. electrical, optical.

Prior to any test and verification, the status indication of the explosive subsystem shall be provided to the AIT team.
Changes in the status indications shall be provided.
Status and status changes shall be recorded.

Test equipment

Integration and test facilities and equipment shall be in accordance with ECSS-E-ST-10-02.
Uncontrolled modifications to equipment or procedures shall be prohibited.

Launch site

The launch site shall provide specified transport, handling and storage facilities for explosive components and subsystems.
The status of explosive safety barriers shall be monitored when the space vehicle induces a catastrophic risk.

The space vehicle comprises e.g. the launcher, satellite, spacecraft.

Provisions shall be made to make visible the status of explosive safety barriers.
Any indicators used to show the status of the explosive devices and the barriers shall be clear and unambiguous.
Periods of sensitivity to external environment shall be notified to the authorities.

Example of external environment is EMI.

Provisions shall be made for access to safe and arm devices for manual disarming.

Verification

General

Following exposure to the conditions specified in Clause 4.14.3, explosive devices and subsystems shall meet the performance requirements specified in the appropriate Clauses 4.10, 4.11 and 4.12 when measured in conformance with the requirements of Clause 4.14.3.

Inspection

Inspection shall be performed in conformance with ECSS-Q-ST-20.
Non-destructive inspection shall be used to demonstrate specified assembly and condition of every explosive component.

E.g. X-Ray or N-Ray.

Resolution shall be better than the dimension of the smallest feature to be checked.

To be able to detect e.g. micro-cracks.

It shall be demonstrated by inspection of all fired components that the internal dimensions, surfaces and material properties have not been degraded beyond specified limits.

Erosion, corrosion and burning due to the functioning can cause failure or leakage.

Tests

Test specification

Test specification (TSPE) shall be in conformance with the DRD in Annex B of ECSSEST1003.
The test conditions for explosive components and subsystems shall be derived from the operational conditions and constraints.

E.g. ground, flight, in orbit.

Qualification and lot acceptance tests shall be in conformance with clause 4.14.4.
Acceptance tests shall be done at identical limit conditions and levels, whatever the application, to ensure valid reference to previous results and to reduce the numbers of tested items.

Test procedure

Test procedure (TPRO) shall be in conformance with the DRD in Annex C of ECSS-E-ST-10-03.

Test reports

Test report shall be in conformance with the DRD in Annex C of ECSS-E-ST-10-02.

Essential confirmation

For every test, connection to the correct initiator shall be checked and recorded.

Routing tests

It shall be verified by test that the correct stimulus arrives at the correct initiator and no other.
Records shall be kept of the routing test.

End-to-end tests

Functional tests shall be performed in conformance with ECSSEST1003.
Only planned and approved activities shall be performed, in conformance with approved procedures.
Firing tests shall not be performed until a successful rehearsal has been completed.

Safety tests

Safety tests shall be performed on unpacked articles in conformance with Table 423.
Table 423 Safety tests

Reference tests	TEST Method	Recommended sequence
		Launcher	Spacecraft
Slow cook-off	UNO “Manual of tests and criteria” test 7 (h)	R	N/A
External Fire	UNO “Manual of tests and criteria” test 7 (g)	R	N/A
Handling Drop test (e.g. 2 m height)	TBPC	R	O
12 m Drop test	UNO “Manual of tests and criteria” test 4(b)	R	N/A
Mechanical Shock	TBPC	O	N/A
Lightning	ECSS-E-ST-20-07, clause “Lightning environment – Requirements for the space system”	O	N/A
R : Required            O : Optional            N/A : Not Applicable

Lifetime demonstration

Lifetime tests or analysis shall be done to establish changes over time in performance and susceptibility.
If accelerated ageing is used, it shall be justified.

Reliability tests

For any component performances shall be declared in terms of reliability, confidence level, test, and analysis methods.
The supplier shall justify the selected method used for the reliability demonstration.

The methods in Table 424 are given for information. (refer to www.gtps.fr website).

Table 424 Reliability methods

Component	Method
Initiator	GTPS 11C- Bruceton or GTPS11B - One Shot or Neyer or CABOUM method
Cutter / Release nut /Valve/Pusher/Puller	GTPS11F : Severe method
TBI	GTPS11F Severe method
Shaped charge	GTPS11A Probit or GTPS11F severe method
Expanding tube	GTPS11A Probit or GTPS11F severe method
Transmission lines	GTPS11C Bruceton or GTPS11B - One Shot Neyer or GTPS11F Severe method or CABOUM method

Qualification and lot acceptance

General

Qualification and acceptance of explosive components and subsystems shall be in conformance with ECSS-Q-ST-20.
For qualification, each device shall meet the requirements specified in the appropriate table of clauses 4.11 and 4.12 after exposure to the complete sequence of conditions specified in Table 425.
For lot acceptance, each device shall meet the requirements specified in the appropriate table of clauses 4.11 and 4.12 after exposure to the selected conditions specified in Table 426.
For lifetime, each device shall meet the requirements specified in the appropriate table of clauses 4.11 and 4.12 after exposure to the complete sequence of conditions specified in Table 425.
Dynamic leak measurement shall be made under vacuum.

Qualification tests

Qualification tests shall be performed in conformance with Table 425.

Typical values are given in Annex A.

Table 425 Qualification tests

Qualification test (see Note 3)	ECSS-E-ST-10-03 reference	ECSS-E-ST-10-03 sequence	Spacecraft component	Launcher component
no-fire stimulus	NO	additional	R	R
physical properties (measurement)	YES	1	R	R
secondary characteristics measurement	NO	additional	R	R
functional and performance (measurement)	YES	See Note 1	N/A	N/A
no-damage drop	NO	additional	O	R
Salt fog	NO	additional	N/A	R
rain	NO	additional	N/A	R
humidity	YES	2	O	R
leakage test	YES	3,5,10,13	O	O
generated shock	NO	None	R	O
pressure	YES	4	N/A	N/A
acceleration	YES	6	O	R
sinusoidal vibration	YES	7	R	R
random vibration	YES	8	R	R
acoustic	YES	8	N/A	R
shock	YES	9	R	R
corona and arcing	YES	11	N/A	N/A
thermal vacuum	YES	12	O	O
thermal cycling	YES	12	R	R
EMC/ESD (for initiator only)	YES	14	R	R
life	YES	15	O
microgravity	YES	16	N/A	N/A
audible noise	YES	17	N/A	N/A
radiation	NO	additional	O	N/A
functional and performance (measurement)	YES	See Note 2	R	R
destructive physical analysis	NO	additional	R	R
YES : requirement specified in ECSS-E-ST-10-03 No : requirement not specified in ECSS-E-ST-10-03 : to be specified by the user or the manufacturer R : Required O : Optional N/A : Not Applicable
Note 1: Only possible at the end of the qualification sequence. Note 2: See 4.14.4.1e. Note 3: See Table for ‘Qualification test’ in ECSS-E-ST-10-03.

Acceptance tests

Lot acceptance tests shall be performed.
Acceptance tests shall be in conformance with Table 426.
Lot acceptance tests results shall confirm that the hardware conforms to the qualified product.
Table 426 Acceptance tests

Acceptance test (see Note 3)	ECSS-E-ST-10-03 reference	ECSS-E-ST-10-03 sequence	Spacecraft component	Launcher component
physical properties	YES	1	R	R
Secondary characteristics	NO	additional	R	R
functional and performance	YES	See Note 1	N/A	N/A
leak	YES	2,4,7,10	R	R
pressure	YES	3	N/A	N/A
random vibration	YES	5	O	O
acoustic	YES	5	N/A	N/A
generated shock	YES	6	N/A	N/A
thermal vacuum	YES	8	O	N/A
thermal cycling	YES	8	O	N/A
burn-in	YES	9	N/A	N/A
microgravity	YES	11	N/A	N/A
audible noise	YES	12	N/A	N/A
functional and performance	YES	See Note 2	O	O
destructive physical analysis	NO	additional	O	O
YES : requirement specified in ECSS-E-ST-10-03 No : requirement not specified in ECSS-E-ST-10-03 : to be specified by the user or the manufacturer R : Required O : Optional N/A : Not Applicable
Note 1: Only possible at the end of the acceptance sequence. Note 2: See 4.14.4.1 e. Note 3: See Table for ‘Acceptance test’ in ECSS-E-ST-10-03.

Transport, facilities, handling and storage

General

Specified transport, handling, and facilities for explosive subsystems and devices shall be provided.

Transport

Explosives devices shall be transported in conformance with the latest version of UNECE regulations ST/SG/AC.10/1.
If it is not possible to exclude explosive devices of class 1, according to UNECE regulations ST/SG/AC.10/1, Chapter 2.1 par. 2.1.3.6, the explosive devices are assigned to Class 1 and the required transport classification should be 1.4 S.
The containers shall protect the component from the transport and storage mission profile.
Definition of containers shall be in conformance with the latest version of UNECE regulations ST/SG/AC.10/1 .

It is good practice to pack explosive components individually to prevent changes in humidity and electrostatic charge.

Containers shall not be exposed to environments exceeding those specified.

It is good practice to use thermal and shock sensors.

Identification label shall be marked before delivery in a permanent way on each deliverable.
Containers shall be marked with the following information:

• Equipment name and part number
• Contents and quantity
• Mass (gross and net) in kilograms
• Contract number
• Supplier name and address
• EXPLOSIVE label with Hazard and compatibility classifications
• Following label : “Open only in clean-room area by qualified operators” if necessary Container shall indicate the orientation to be kept maintained.
  Application of the directives CE93/15/EEC, 2008/43/EC and 2012/4/EU shall be analysed by the manufacturer and applied if relevant.
  A Safety Data Sheet (SDS) of the explosive device shall be provided in English and French languages.

A template of SDS is provided in informative Annex C.

Facilities

Explosive devices shall be stored in dedicated storages according to the national regulations applicable for safety and security.
The nature of and precautions required for all explosive devices and subsystems shall be communicated to the facility designer.
Storage of explosive devices shall be performed in conformance with ECSS-Q-ST-20.
All explosive devices shall be stored in temperature and humidity controlled secure storage areas except when required for controlled spacecraft activities.
Records of all environmental conditions in locations where explosive components or subsystems are stored or handled shall be maintained and be available for review.

E.g. environmental conditions such as thermal, humidity.

The location of every live or fired explosive component or subsystem shall be known and identifiable at any time.

Handling

All handling shall be done by certified personnel according to the national regulations and in conformance with ECSS-Q-ST-20.

Handling includes testing, measuring, installing.

All handling shall be done in conformance with specified procedures and the specified Personal Protective Equipment.
Personnel and equipment shall be grounded to a common ground.
Only approved tools, aids and test equipment shall be used for explosive devices.
Consistent, coherent and complete records shall be maintained of components or subsystems which have a direct effect upon the subsystem, including test activities and measurements during any upon the break-in activities.
Restoration of the original accepted condition shall be required.
The correctness of all connections shall be confirmed and a record of all connections be maintained.
Site safety regulations, provisions and procedures shall be checked for adequacy for explosive activities.

In-service

Information feedback

Checks shall be made to assure the consistency of information between different equipment at different stages in the launch preparation.
Results of the checks specified in 4.16.2a shall be recorded.
Information shall be provided of hardware and software provisions for the monitoring and command of explosive functions, and show changes from one stage to the next.
RF links, wiring, connectors and pin functions shall be specified to check the source and destination.
Diagrams or photographs of consoles and installations shall be provided.
Confirmation shall be provided that no unwanted responses or drifts have occurred.

Launch site procedures

Only planned and approved activities which follow approved procedures shall be undertaken.
The activities specified in 4.16.2a shall include contingency actions.
Rehearsals shall be performed.

Monitoring

Confirmation of operation shall be made available immediately.

Product assurance

General

<<deleted>>
ECSS-Q-ST-10-04 shall be applied for all explosive devices identified as critical items.

Dependability

The explosive subsystem shall be in conformance with all dependability requirements ECSS-Q-ST-30 Clauses 6, 7, 8 and 9.
Age-sensitive parts and materials shall be identified.

Assembly, integration and test

The properties of the subsystem and all activities shall meet the safety requirements defined in ECSS-Q-ST-40.
Immediately before every electrical or optical connection and disconnection, it shall be confirmed that no conductor is live and that no power can flow or be interrupted across the interfaces.
Immediately before every connection and disconnection it shall be confirmed that operator and parts are grounded to a common ground.

ANNEX(informative)Component qualification test levels

Table A-1 provides test levels that can be used for the qualification of components.

Table A-2 provides the pyroshock that can be used for launchers and satellites.

TableComponent qualification test levels

Environment	Ariane 5 ESC (see A5-SG-1-X-40 (Section Number))	Satellite
Cold	-80°C / 10 hours (5.2)*	-120°C / 48 hours
Dry heat	+110°C / 5 hours (5.3)*	+120°C / 48 hours
Damp heat	2 x 24h 20°C to 35°C _100 % RH (5.4)*	N/A
Thermal cycles in damp air	40 x (21°C (1h) to 33°C (1h)) 100 % RH	N/A
Thermal Vacuum	0,1 MPa to 10-6 MPa in 30 s at -80°C	N/A
Rain	Equipment sprinkled 50mm/h, 30’/face	N/A
Salt Fog	24h with salt fog + 24h without (5.9)*	N/A
Sine Vibrations	4 min/axis (6.2)* Per axis5 Hz – 16 Hz:    10 mm peak to peak 16 Hz – 30 Hz:    10 g peak (1/3 oct/min) 30 Hz – 70 Hz:    22,5 g peak 70 Hz - 200 Hz:    50g peak (2 oct/min) 200 Hz - 2000 Hz:     22,5g peak Test temperature: -80°C / +110°C	3 axis - 1 sweep Per axis5 Hz - 25Hz:     11 mm 25 Hz - 100Hz:     25 g peak (2 oct/min) Test temperature: ambient
Random Vibrations	4 min/axis (6.9)* 20 Hz:    0,0913 g2/Hz 20 Hz -150Hz:    +6 dB/oct 150 Hz:    4 g2/Hz 350 Hz:    4 g2/Hz 350 Hz - 700 Hz:    tbd dB/oct 700 Hz:    3 g2/Hz 700 Hz - 2000 Hz:    -10,7 dB/oct 2000 Hz:    0,1 g2/Hz Test temperature: -80°C / +110°C	6 min/axis - 3 axes 20 Hz - 50 Hz:    +3 dB/oct 50 Hz - 600 Hz :     2 g2/Hz 600 Hz - 2000 Hz:    -3 dB/oct Test temperature: ambient
Medium shocks	½ sinus 50g, 11ms Test temperature: ambient (6.5)*	½ sinus 50g, 11ms Test temperature: ambient
Pyroshocks	SRS _ Z1 level : Appendix Test temperature: ambient (6.6)*	SRS _ Z4 level : Test temperature: ambient
Radiations	N/A	30 krad Test temperature: ambient
Firing Tests conditions	-80 °C and +110 °C	-120 °C and +120 °C
* Note that the information within the brackets refers to the section number within A5-SG-1-X-40.

TablePyroshocks for launcher and satellites

Severity code	Z1	Z4
Amplitude at 1 000 Hz	9 000	300
Amplitude at 2 000 Hz	17 500	1 000
Amplitude at 3 000 Hz	35 000	1 750
Amplitude at 3 500 Hz	35 000	2 300
Amplitude at 4 000 Hz	35 000	3 000
Amplitude at 25 000 Hz	35 000	3 000
Tolerances for the amplitudes are: + 40 % and – 50 %

ANNEX(informative)List of deliverable documents

TableList of deliverable documents to be used in context of this standard

Management and development Plan		Design justification file
Risk assessment report Risk management plan		Verification matrix
Progress reports		Verification control document (Design, reliability, qualification plan )
Audit reports		Verification report (Design, reliability, qualification justification reports )
Inspection reports		User manual
Non-conformance reports (minor)		Test procedure
Non-conformance reports (major)		Production tree
Verification matrix		Acceptance test plan
Declared materials listDeclared mechanical part listDeclared processes list		Configuration Item data list
Qualification list		As-built configuration list
FMECA		Test reports
Request for deviation		Logbook
Request for waiver		End-item data package (EIDP)
Functional and technical specifications		Certificate of conformity
Mechanical, thermal, electrical ICDs

ANNEX(informative)Safety Data Sheet (example courtesy of GICAT)

Bibliography

ECSS-S-ST-00	ECSS system — Description, implementation and general requirements
ECSS-E-HB-20-07	Electromagnetic compatibility handbook
ECSS-E-ST-32-08	Space engineering — Materials
ECSS-Q-ST-70-08	Space product assurance — Manual soldering of highreliability electrical connections
ECSS-Q-ST-70-26	Space product assurance — Crimping of highreliability electrical connections
ECSS-Q-ST-70-71	Space product assurance — Data for selection of space materials and processes
GICAT Safety– Transport Working Group	www.gicat.com