GeneralJERG-2-026（E）

SAFETY STANDARDFOR ON-ORBIT SERVICING MISSIONSMarch 30, 2020

Japan Aerospace Exploration Agencyi

JERG-2-026（E）

This is an English translation of JERG-2-026, “SAFETY STANDARDFOR ON-ORBIT SERVICING MISSIONS,” and does not constitute itself.
Whenever this document conflicts with the original document in Japanese, theoriginal document takes precedence.

ii

JERG-2-026（E）

Table of Content
1. Purpose

12. Scope

1

3. Definition of terms

1

4. Applicable and Reference documents

4

4.1. Applicable documents

44.2. Reference documents

45. Safety requirements

45.1. Basic requirements

45.2. Specific requirements

45.2.1. Collision caused by improper orbit and attitude control

45.2.2. Failure caused by electromagnetic or optical interference

55.2.3. Collision caused by improper robotics operations.

55.2.4. Structural failure

65.2.5. Failure caused by electrostatic discharge

65.2.6. Failure caused by thermal incompatibility

65.2.7. Failure caused by thruster plume and propellant leak

75.2.8. Inability of separation from or release a client spacecraft

75.3. Compliance with interface requirements

8

6. Review of compliance with these standards and approval

8iii

JERG-2-026（E）

1.

PurposeThis standard provides basic requirements for on-orbit servicing to be operated underliability of the Japan Aerospace Exploration Agency (hereinafter referred to as "JAXA").
On-orbit servicing described herein includes Rendezvous and Proximity Operation(hereinafter referred to as “RPO”), physical contact and docking with a client
spacecraft/target debris (collectively, hereinafter referred to as "target") by a servicing
spacecraft.
This standard intends to avoid any accidents that could potentially give harmful effect on
the operation of the unrelated spacecraft due to subsequent orbital environment (e.g.
serious space debris generation by a collision).
The requirements and standards referred in the Space Debris Mitigation Standard(JMR-003) shall be applied as far as no duplication, for safety and sustainable orbital
environment (including the mitigation of space debris).
2.

Scope

This standard shall be applied to on-orbit servicing in order to prevent:(1) generation of space debris caused by a collision between a servicing spacecraft
and a target; and(2) loss of major functions that are required for a servicing spacecraft and client
spacecraft to mitigate the generation of space debris (as referred to "debris
mitigation functions" such as necessary functions for post mission disposal).
Interferences and interactions between a servicing spacecraft and a client
spacecraft could be a major cause.
A loss of mission for both or either spacecraft is out of scope of this standard.
3.

Definition of terms

Space debris:

Refer to the definition set out in Space Debris Mitigation Standard(JMR-003).
[Non-functional artificial objects existing on orbit, including
components and parts separated from a space system, fragments
generated from break-up thereof, and a space system after end oflife.]

ServicingSpacecraft providing on-orbit servicing to the other active / inactive

spacecraft:spacecraft or space debris.

Client spacecraft:

Active or inactive spacecraft for which a servicing spacecraft
provides on-orbit servicing.
1

JERG-2-026（E）

Target debris:

Unrecoverable out-of-service spacecraft and space debris for which
a servicing spacecraft approaches to give on-orbit servicing.

On-orbit service:

Intentional interference by a servicing spacecraft with a client
spacecraftforrefueling,resupplying,adding

orreplacing

functionalities and assisting post mission disposal.
Active debris removal (ADR) for inactive spacecraft / target debris
and transportation to/from a space station is also a part of on-orbit
servicing.
Keep-out(KOZ):zone

A zone restricting unintended entry by a servicing spacecraft
approaching a target. A keep-out zone is to be defined toencompass a target considering variances on-orbit and attitude
determination by available data.
【Keep Out Zone】 *KOZ can take various forms.
Keep-out zone

Keep-out zone

Approaching

A path predefined to prevent a servicing spacecraft from colliding

path:with a target upon making an intentional entry into KOZ to approach
the target. An approaching path must not interfere with a protectedarea (an area involving the risk of collision) in light of the structureof a target.

2JERG-2-026（E）○ Keep-out zone and approaching path

Zone to be protected in light of structure
Keep-out zone

A servicing satellite makingan intended approach to atarget enters KOZ throughthe approaching path.
Approaching path

3JERG-2-026（E）

4.

Applicable and Reference documents

4.1. Applicable documents
The following documents shall be applied to the extent that they are referred to in thisstandard. The latest edition of the applicable documents shall be used.
(1) JMR-001 System Safety Standard(2) JMR-003 Space Debris Mitigation Standard(3) Rule No. 16-3 Safety Review Committee Rule4.2. Reference documents(1) JERG-2-241 EMC Design Standard(2) JERG-2-320 Structure Design Standard(3) JERG-2-330 Mechanisms Design Standard
5.

Safety requirements

5.1.

Basic requirements

The following measures shall be taken in accordance with 4.1(1).
(1) Unintended generation of debris caused by a collision upon RPO, physical contact
and docking with a target as well as the loss of debris mitigation functions aredefined as a critical hazard (e.g. serious effect on environment).
(2) Conduct a hazard analysis of the entire system integrating a servicing spacecraft,target and ground system, and take safety measures to address the identified
hazards and hazard causes based on fault tolerance.
(3) Additional fault tolerance or equivalent measures are considered when a collision
could lead to a catastrophic consequence such as serious threat to the manned
spacecraft because of its size, orbit and/or payload properties.
5.2.

Specific requirements

Identify hazards and hazard causes taking into consideration the failure modes at least
described in the following subparagraphs, but not limited to.
5.2.1. Collision caused by improper orbit and attitude control
In case there is a false detection of trajectory or attitude, or an over/under burn on
single or both spacecraft upon final approaching operation, that failure could lead tocollision or a loss of debris mitigation functions.

4

JERG-2-026（E）(1) A KOZ shall be defined to determine minimum safety clearance around a target,
considering for errors in orbital information, then ensure that the planned
trajectory of a servicing spacecraft does not interfere with KOZ, unless it isintentionally planned for final approach.
A servicing spacecraft shall not deviate a predefined approaching path which isdesigned for intentional entry into the KOZ upon final approaching to a target.
(For an example of a KOZ and approaching path, see Appendix B.)(2) Single fault tolerance shall be required to prevent an inadvertent entry into theKOZ and deviation from approaching path caused by a false detection oftrajectory or attitude, or over/under burn.
(3) In case operational control is necessary for risk mitigation, determine decision
making points, process and go/no go criteria. Proper documentation is requiredso as to execute safety measures in operation (for an example of operational
procedures, see Appendix C.)
5.2.2. Failure caused by electromagnetic or optical interferenceElectromagnetic or optical interference between a servicing spacecraft and client
spacecraft may cause the loss of functions associated with a collision avoidance or aloss of debris mitigation function.
(1) Design in accordance with JAXA’s EMC design standard (4.2(1)) or appropriate
alternative standards so as to minimize the risk of anomalies due toelectromagnetic interference between a servicing spacecraft and client spacecraft.
(2) Conduct an impact assessment if a star tracker and/or sun sensor on a servicing
spacecraft and client spacecraft may be degraded by application of a laser on asubsystem like an active light wave sensor.

Design a servicing spacecraft tominimize the risk of anomalies due to optical interference if any.
5.2.3. Collision caused by improper robotics operations.
A malfunction or an improper robotics operation may cause a collision or loss of debris
mitigation functions while servicing.
(1) Any single fault in electrical or mechanical function during robotics operation shallnot cause a collision or a serious impact. Or design to withstand an impact load
under a single fault condition to prevent hazardous structural deformation andbreakups.

5

JERG-2-026（E）(2) Prior to go for capture a target, examine if all conditions are met such that relative
trajectory and attitude are within allowable tolerance.

And any single error orfalse indication of a sensor shall not cause improper engagement between aservicing spacecraft and a target.
(3) Design to withstand maximum load induce by robotics operation with a single fault
condition. Or design in accordance with JAXA’s mechanisms design standard(4.2(3)) or an appropriate alternative standard.
5.2.4. Structural failure
An inappropriate structural design and/or manufacturing with loads applied upon aservicing spacecraft's capturing, holding, or docking with a target, or a subsequent of thedocking, may cause structural failure of the servicing spacecraft and target, resulting ina collision and the loss of debris mitigation functions.
(1) Ensure appropriate structure design and manufacturing of a servicing spacecraftwith loads applied upon on-orbit servicing or docking, in accordance with theJAXA’s structure design standard (4.2(2)) or an appropriate alternative standard.
(2) For those parts which are incapable of withstanding applicable loads, identify thepart as a load sensitive item and operate the spacecraft to avoid contacting thepart.
5.2.5. Failure caused by electrostatic discharge
Surface of servicing spacecraft and target are charged by exposure to the spaceenvironment. Potential difference between both objects could generate Electrostatic
discharge (ESD) upon physical contact and it could cause loss of function of servicing
and/or target spacecraft that may lead to a collision and/or the loss of debris mitigation
functions.
(1) A risk of functional failure by ESD upon contact between a servicing spacecraft
and a target shall be assessed, and the assessment shall be reflected in thedesign of a servicing spacecraft to minimize a risk on ESD.
5.2.6. Failure caused by thermal incompatibility
Excessive temperature difference between a servicing spacecraft and a target may
cause damage or loss of important functions on either or both objects upon contact.
That may result in a collision and/or the loss of debris mitigation functions.

6JERG-2-026（E）(1) Conduct a thermal risk assessment considering the expected maximum
temperature difference between a servicing spacecraft and a target. Minimize
the risk of failure on sensitive items in case the worst heat transfer may damage
them upon contact of the servicing spacecraft and client spacecraft.

The

assessment shall also consider that the high-temperature or low-temperature may
be induced by an anomaly on the electrical system or on a false indication.
(2) For those parts which are incapable of withstanding applicable heat load per
assessment, identify the part as a heat sensitive item and operate the spacecraft
to avoid contacting the part.
5.2.7. Failure caused by thruster plume and propellant leak
Leaking propellant and/or thruster plume from a servicing spacecraft may contaminate
sensors that are necessary for space debris mitigation functions of a client spacecraft.
In addition, excessive heat and unintended load given by thruster plume from a servicing
spacecraft and/or a client spacecraft to the other may cause serious damage to either orboth spacecraft that could lead to generation of space debris as a consequence.
(1) Any single fault in electrical or mechanical function shall not cause an excessive
propellant leak and/or irregular firing so as to prevent the pre mentioned
consequences.
(2) Design to minimize the risk on a servicing spacecraft and a client spacecraft withrespect to contamination on sensors, heat load and other unintended loads
induced by thruster plumes.
5.2.8. Inability of separation from or release a client spacecraft
In the event that a servicing spacecraft is unable to separate from or release a client
spacecraft, an engaged spacecraft may not keep proper trajectory and attitude control insubsequent operation, including loss of debris mitigation functions such as collision
avoidance capability against debris.
(1) Any single fault in electrical system shall not lose power supply to separation orrelease mechanisms.
(2) Design in accordance with JAXA’s Mechanisms Design Standard (4.2(3)) to show
equivalency to single fault tolerance or appropriate alternative standards so as tominimize the risk of mechanical failure that disables separation or release function.

7JERG-2-026（E）

5.3. Compliance with interface requirements
In addition to the compliance with the requirements in 5.1, ensure the compliance withinterface requirements between a servicing spacecraft and client spacecraft/target debris.
6.

Review of compliance with these standards and approval
Compliance with these standards is to be reviewed and approved by the Safety

Review Committee referred to in 4.1(3).

8