BY ORDER OF THE SECRETARY

OF THE AIR FORCE AIR FORCE INSTRUCTION 91

- 217

18 FEBRUARY 2010

Safety

SPACE SAFETY AND MIS HAP
PREVENTION PROGRAM

COMPLIANCE WITH THIS PUBLICATION IS MANDA TORY

ACCESSIBILITY: Publications and forms are ava ilable on the e

- Publishing website at

www.e - publishing.af.mil for downloading or ordering.

RELEASABILITY: There are no releasability restrictions on this publication.

OPR: HQ AFSC/SES Certifi ed by: AF/SED (William C. Redmond)

Pages: 92

This instruction implements Air Force Policy Directive (AFPD) 91

- 2, Safety Programs , and the relevant safety portions of Department of Defense Directive (DoDD) 3100.1 0, Space Policy

, DoDD 3200.11, Major Range and Test Facility Base , DoD Instruction (DoDI) 3100.12, Space Support , and in conjunction with Air Force Instruction (AFI) 91

- 202, The US Air Force Mishap Prevention Program , provides guidance for implemen ting a space safety mishap prevention program. It provides guidance to develop comprehensive space safety mishap prevention programs for existing and future space systems. This instruction also contains the minimum risk probability parameters required fo r safe space operations and testing. It applies to all Active Duty, Air Force Reserve and Air National Guard units that design, develop, modify, evaluate, test or operate existing and future Air Force (AF) space systems (operational, test and experimental ), AF space support systems, or use or operate AF launch facilities or ranges. Ensure that all records created as a result of processes prescribed in this publication are
maintained in accordance with AFMAN 33

- 363, Management of Records , and disposed of in accordance with the Air Force Records Disposition Schedule (RDS) located at https://www.my.af.mil/gcss

- af61a/afrims/afrims / . The use of the name or mark of any specific manufacturer, com mercial product, commodity, or service in this publication does not imply endorsement by the Air Force. Any organization may supplement this publication which must be reviewed and approved by the Office of Primary Responsibility (OPR). Major commands (MAJ COMs), field operating agencies (FOAs) and direct reporting units (DRUs) must send one copy of their proposed supplement to the OPR at HQ Air Force Safety Center, Space Safety Division (AFSC/SES). Other organizations send one copy of each proposed supple ment to the next higher headquarters. Refer recommended changes and questions about this publication to the OPR using the AF Form 847, Recommendation for Change of Publication; route AF Form2 AFI91

- 217 18 FEBRUARY 2010

847s from the field through the appropriate chain of command to HQ AFSC/SES, 9700 G Street SE, Bldg 24499, Kirtland AFB NM 87117

- 5670 or AFSC.CSS

. pubfmmgt@kirtland.af.mil.

Chapter 1

— SPACE SAFETY PROGRAM 5

1.1. Scope.

................................ ................................ ................................ ..................... 5

Chapter 2

— - SPACE SYSTEM SAFETY, RISK ACCEPTANCE, AND WAIVER AUTHORITY 15

2.1. System Safety.

................................ ................................ ................................ ....... 15

2.2. Life Cycle Phases.

................................ ................................ ................................ .. 15

2.3. Program Manager and Operator Roles and Responsibilities.

................................ 18

2.4. Ri sk Acceptance, Non

- Compliances and Waiver Authority.

................................ 18

2.5. Waivers

................................ ................................ ................................ .................. 19

Chapter 3

— SYSTEM DEVELOPMENT 21

3.1. Development Risk.

................................ ................................ ................................ . 21

3.2. Waiver and Approval Authority.

................................ ................................ ........... 21

3.3. General Design Considerations.

................................ ................................ ............. 22

3.4. Integrated Space Effects.

................................ ................................ ....................... 23

3.5. Testing.

................................ ................................ ................................ .................. 24

3.6. Configuration Control and Management.

................................ .............................. 25

3.7. System Safety Management Plan and the Software Safety Plan.

.......................... 25

3.8. Software and Hardware Installations.

................................ ................................ .... 26

3.9. Test/Operational Perf ormance Reviews.

................................ ............................... 26

Chapter 4

— LAUNCH, SYSTEM DEPLO YMENT, AND REENTRY 27

4.1. System Deployment.

................................ ................................ .............................. 27

4.2. Safety Responsibilities.

................................ ................................ .......................... 27

4.3. Transportation.

................................ ................................ ................................ ....... 27

4.4. Ground Based Equipment Assembly and Checkout.

................................ ............. 27

4.5. Pre

- launch Safety.

................................ ................................ ................................ .. 28

4.6. Launch Safety.

................................ ................................ ................................ ....... 28

4.7. Launch Vehicle EOL Requirements

................................ ................................ ...... 31

4.8. Reentry Safety

................................ ................................ ................................ ........ 32

4.9. Waiver and Approval Authority.

................................ ................................ ........... 34

4.10. Additional Range, Launch, and RV Guidance.

................................ ...................... 35AFI91

- 217 18 FEBRUARY 2010 3

Chapter 5

— - ORBITAL SAFETY 36

5.1. Orbital Safety Program.

................................ ................................ ......................... 36

5.2. On

- Orbit Risk.

................................ ................................ ................................ ....... 37

5.3. Waiver and Approval Authority.

................................ ................................ ........... 38

5.4. Orbital Mishaps and Anomalies.

................................ ................................ ............ 38

5.5. Orbital Mishap Prevention.

................................ ................................ .................... 39

5.6. Orbits.

................................ ................................ ................................ .................... 40

Figure 5.1. High Interest Earth Orbits

................................ ................................ ...................... 40

5.7. Space Environmental Hazards.

................................ ................................ .............. 41

Figure 5.2. Van Allen Belts relative to GPS and GEO orbits

................................ .................. 42

5.8. Space Debris.

................................ ................................ ................................ ......... 42

5.9. Conjunction Ass essment.

................................ ................................ ....................... 49

5.10. Collision Avoidance.

................................ ................................ ............................. 49

5.11. End

- of

- Life Actions.

................................ ................................ .............................. 51

Figure 5.3. Operat ing, Storage and Disposal Regions/Orbits.

................................ ................. 53

5.12. Recovery Procedures.

................................ ................................ ............................ 57

5.13. Near Earth Objects.

................................ ................................ ................................ 57

Chapter 6

— - SAFETY OF SPACE CONT ROL SYSTEMS 59

6.1. Space Control Systems.

................................ ................................ ......................... 59

6.2. Safety Program.

................................ ................................ ................................ ..... 59

6.3. Other Space Systems.

................................ ................................ ............................ 59

6.4. Risk Responsibility Phases.

................................ ................................ ................... 59

6.5. Waiver and Approval Authority.

................................ ................................ ........... 60

Chapter 7

— HIGH ALTITUDE OPERAT IONS SAFETY 62

7.1. High Altitude Operations.

................................ ................................ ...................... 62

7.2. Platforms.

................................ ................................ ................................ ............... 62

7.3. Payloads.

................................ ................................ ................................ ................ 62

7.4. High Altitude Environment.

................................ ................................ ................... 62

Chapter 8

— - SAFETY OF DIRECTED E NERGY/KINETIC SYSTEM S 63

8.1. Directed Energy Systems.

................................ ................................ ...................... 63

8.2. Kinetic Energy Systems.

................................ ................................ ........................ 63

Chapter 9

—

FUTURE FOR SPACE SAF ETY PROGRAMS 644 AFI91

- 217 18 FEBRUARY 2010

9.1. Updates.

................................ ................................ ................................ ................. 64

9.2. Forms

................................ ................................ ................................ ..................... 64

Attachment 1

— GLOSSARY OF REFERENC ES AND SUPPO RTING INFORMATION 65

Attachment 2

— SPACE DEBRIS ASSESSM ENT REPORT 83

Attachment 3

— END

- OF

- LIFE PLAN 89AFI91

- 217 18 FEBRUARY 2010 5

Chapter 1

SPACE SAFETY PROGRAM

1.1. Scope. This document implements space safety, mishap prevention and mission effectiveness guidance for AF space systems. More specifically, Chapter 1 is applicable to all space systems a nd through all system life cycle phases.

1.1.1. Purpose. The Air Force operates responsibly with due regard for the safety of the general public, AF personnel, space support personnel and public (non

- commercial launch system operator

- owned) resou rces. This document provides overarching space safety, mishap prevention and mission effectiveness guidance for acquisition, testing, and operations of terrestrial, launch, orbital and kinetic/directed energy space systems.

1.1.2. Applicability. This instruction is applicable to all AF organizations and personnel that develop, test, or operate any space system or who provide launch/range services for space systems. This includes space systems under development, research and development systems, experimental systems, systems undergoing testing, and operational systems. Personnel assigned to non

- AF organizations are exempt, except as stated through other agreements. This instruction is applicable to the entire mission if the Air
Force is the lead , launching, manufacturing or operating agency, or if the Air Force is providing funding for the mission without regard to the method of procurement or agreement.

1.1.2.1. Mission Partner Responsibilities. When partnered with non

- AF organizations (for personnel, funding or resources in

- kind), AF organizations and personnel will ensure their activities are compatible with AF space safety guidance. Prior to embarking upon a mission partnership, Memorandums of Agreement (MOAs) will be
established bet ween all participating organizations outlining each organization‘s responsibilities and requirements with regards to space safety.

1.1.3. Terminology. The term "appropriate wing commander" is used throughout this instruction since risk responsibi lities may overlap different organizations and is the responsibility of all involved organizations to ensure adequate protection to the general public, manned spacecraft and active spacecraft. Therefore, MAJCOMs will identify the specific "appropriate win g commander" in their supplements to this instruction and will specify when safety responsibility transfers between organizations.

1.2. Space Safety . Space Safety is a dynamic process designed to improve operational effectiveness by preventing close calls, mishaps, and provide for mission assurance throughout the life cycle of a space system. It also includes launch/range safety, orbital safety, space control safety, System Safety, integrated effects of combined systems, software safety, risk m anagement, and mishap investigations and reporting. The goal is to enhance mission effectiveness and success by proactively preventing mishaps and close calls.

1.2.1. Space Mishaps. Space mishaps are any unplanned events involving space systems that result in personnel injury, system damage/destruction or mission capability loss/delay. Note: For reporting purposes, it also includes near misses, close calls and high accident potential (HAP) events. See AFI 91

- 204, Safety Investigations and R eports6 AFI91

- 217 18 FEBRUARY 2010

or AFMAN 91

- 222, Space Safety Investigations and Reports for specific reporting requirements.

1.2.2. Mission Assurance and Space Safety. Space safety provides for mission assurance by appropriately managing risks and increasing system a vailability. Note: Space safety is only one aspect of mission assurance for space systems. There are other aspects of mission assurance that are beyond the scope of space safety and this document.

1.2.3. Space Mishap Prevention. Space mishap prevention is a continuous process that begins at the initiation of the concept development phase of the program and continues through the program's end

- of

- life (EOL), and includes reentry and recovery activities for applicable programs. Risk management will be practiced throughout all phases of a space system‘s lifetime.

1.2.3.1. Consistent with national security requirements and in accordance with (IAW) DoDD 3100.10, ―All DoD activities to, in, through, or from space, or aimed
above the horizon with the potential to inadvertently and adversely affect satellites or humans in space, shall be conducted in a safe and responsible manner that protects space systems, their mission effectiveness, and humans in space, consistent with U.S. Space Command, as appropriate, for predictive avoidance or deconfliction with U.S., friendly, and other space operations.‖ Note: ―All DoD activities‖ is construed to include all operations on a DoD range, to include commercial and civil operations.
All deconfliction activities that affect space systems will be coordinated with the Joint Space Operations Center (JSpOC).

1.2.3.2. Readiness and Mishap Prevention. A readiness process should be employed to measure the effectiveness of prevention steps with suppo rting metrics. This process should determine if the appropriate steps have been taken to provide a reasonable expectation of preventing mishaps. This includes the establishment of System Safety Groups IAW AFI 91

- 202, The US Air Force Mishap Prevention
P rogram , ensuring maximum safety training level and availability, and outlining the qualifications of space safety investigators.

1.2.4. System Safety. System Safety is the application of engineering and management principles, criteria and techni ques throughout all phases of the system life cycle to optimize safety within the constraints of operational effectiveness, time and cost. System Safety enhances the utility and effectiveness of space systems. It is thus critical that System Safety be em ployed throughout the space system‘s life cycle.

1.2.5. Reporting. The cornerstone of mishap prevention is understanding failures and close calls, and taking action to prevent future occurrences. In order to prevent future mishaps and close call s, it is in the Air Force‘s interest to document and share lessons learned in a timely fashion with other DoD, federal, and commercial space entities. Pursuant to AF and federal regulations, and consistent with handling procedures for
classified material and contractor proprietary data, lessons learned will be shared in order to enhance safety in all aspects of space operations. Note: Due to the limitations on the use of proprietary data, personnel involved in safety investigations should ensure that
i nformation is indeed proprietary as this limits the use of lessons learned. The Air Force Safety Automated System (AFSAS) is authorized to contain proprietary information.AFI91

- 217 18 FEBRUARY 2010 7

1.2.5.1. All mishaps/events, close calls, near

- misses, and HAP events meet ing reporting requirements of AFI 91

- 204 and AFMAN 91

- 222 will be reported using AFSAS. Contact MAJCOM/SE and HQ AFSC/SES for documenting classified space mishaps.

1.2.5.2. MAJCOMs will forward lessons learned to HQ AFSC/SES for tracking.
When l essons

- learned module for AFSAS is implemented, the MAJCOMs will enter lessons learned directly. The data will be shared within DoD safety channels and with other federal safety organizations pursuant to DoDI 6055.07, Accident Investigation, Reporting, a nd Record Keeping and other interagency agreements

. 1.3. Space Safety Council (SSC) . The SSC will assist the AF Chief of Safety (CoS) in fulfilling oversight responsibilities through effective governance and management. The SSC
shall: recom mend DoD/federal and commercial space safety policy, prepare and monitor DoD/federal and commercial space safety directives or instructions concerning safety issues; promote space safety initiatives for both DoD/federal and commercial space flight; maximiz e collaboration with organizational Safety Offices; discuss space safety related System Safety issues; and provide for an independent assessment of overall program safety. This council,

co

- chaired by HQ AFSC/SES and HQ AFSPC/SEC, is composed of the Chiefs of Safety, or their representatives, from each MAJCOM HQ, appropriate Wings and Centers (including the Space and Missile System Center (SMC)), and other military/civil space agencies (NRO, AFRL, NASA, FAA). The SSC will be held bi

- annually.

1.4. Space Safety Training. Assigned space safety personnel will be trained in all aspects of space safety to ensure mission effectiveness appropriate for the duties and missions of their assigned organization. HQ AFSC has several training courses that fal l into two categories, prevention and investigation. MAJCOMs and wings will add other courses as appropriate for the mission and personnel assigned.

1.4.1. MAJCOM safety offices will help subordinate units develop space mishap prevention and inve stigation training courses as appropriate for assigned missions. This training should be tailored at the wing level and below for greater detail, hands

- on

training, and exercises.

1.4.2. Space Mishap Prevention Training. Mishap prevention course s shall address methods for mishap prevention in all phases of a system's life cycle (from initial concept development, design, acquisition, testing, integration, operations, through EOL). Although there are currently no mishap prevention courses tailored specifically for space safety, relevant courses include the CoS and System Safety courses offered by HQ
AFSC.

1.4.2.1. The following topics should be covered during any space safety/mishap prevention training/course: the System Safety process; r isk management; acquisition; testing; Command and Control (C2) of space forces; space situational awareness; safety of space control systems; launch safety; space environment; orbital safety; Conjunction Assessments (CA); Collision Avoidance (COLA); missio n assurance for space systems; current and future space systems; high altitude operations relevant to space related topics; tactics, techniques and procedures; AF, DoD, and US government policies; and international laws and guidelines. The following areas should also be emphasized due to increased relevance in space safety: organizational8 AFI91

- 217 18 FEBRUARY 2010

roles and responsibilities; Commander's intent; human factors; and mishap prevention/mission preservation metrics and normalizing procedures.

1.4.2.2. The follo wing space

- relevant mishap prevention courses are available:

1.4.2.2.1. Chief of Safety course. This course is used to teach personnel how to be an organizational Chief of Safety. This course covers Ground, Aviation, Weapons and Space Safety and is open to any current and newly assigned Chiefs of Safety. The HQ AFSC Space Safety Division provides space specific training during this course.

1.4.2.2.2. System Safety course. This course teaches safety aspects of system integration with em phasis on the design and development portion of a system‘s lifetime. This course is highly recommended for all space safety personnel. The relevant System Safety Management and/or System Safety Analysis course is mandatory for key (as determined by Numbe red AF (NAF)/center/SE) System Safety personnel.

1.4.3. Investigation Training. Investigation courses concentrate on how to conduct a mishap investigation and how to produce required mishap reports. The Board Presidents Course (BPC), Mishap Inv estigation Non

- Aviation (MINA) course and the Aviation Mishap Investigation Course (AMIC) are offered by HQ AFSC.

1.4.3.1. Space Mishap Investigation. The following topics should be covered during any space mishap investigation course: preservat ion of mishap data and material; System Safety; indemnification; International Traffic of Arms Regulation (ITAR); other treaties/international laws and guidelines; roles/responsibilities; Federal Aviation Administration (FAA) / Federal Communications Commi ssion (FCC) / National Aeronautics and Space Administration (NASA) / National Transportation Safety Board MOAs/Memorandums of Understanding (MOU); purpose and processes of the Engineering Analysis Group; Engineering Review Board; timelines; pre

launch, lau nch, orbital and CA/COLA processes; anomaly investigations; space environment; AFMAN 91

- 222; safety of space control systems; and C2 for space forces. Additional emphasis will be placed upon the following topics due to the relevance to space investigation s: ownership; mishap accountability; AF interest; contractor operations; high

- visibility mishaps; proprietary information; Interim Safety Board (ISB) process; human factors; subsystems; data sources; impounded data; frozen ground system configurations/faci lities; summary review of past space mishaps and varying investigation processes (e.g., telemetry only vs. hardware and telemetry). The following space

- relevant investigation courses are available:

1.4.3.1.1. Board Presidents Course. The BPC is a course used to teach senior leaders how to be a Safety Investigation Board (SIB) President. The class is open to other personnel and ranks on a space available basis. This is a required course for assignment as Board President to a SIB. The HQ AFSC Sp ace Safety Division provides space specific training during this course.

1.4.3.1.2. Mishap Investigation Non

- Aviation course (or equivalent). The MINA course is used to train safety personnel the aspects of investigating mishaps. This is a requi red course for assignment to a SIB as the Investigating Officer or as aAFI91

- 217 18 FEBRUARY 2010 9

Single Investigating Officer.

1.4.3.1.3. Aviation Mishap Investigation Course (or equivalent). AMIC is used to train safety personnel the aspects of investigating mishaps. T his course may be used as a supplement or replacement for the MINA or equivalent courses.

1.4.4. Space Safety Training for Space Safety Personnel. The following requirements apply to all space safety personnel. Unless otherwise noted, waivers to these requirements must be approved and documented by the MAJCOM Safety Office.

1.4.4.1. Each organization will ensure that assigned space safety personnel receive either formal training (i.e. course taught at HQ AFSC, under contract, or at anoth er institution; e.g. MINA) or local training (i.e. training conducted at the Wing or lower level) in mishap prevention (a safety program management course or equivalent with space safety tailored material) and mishap investigation (MINA or equivalent cours e with space safety tailored material).

1.4.4.1.1. The MAJCOM Safety Office will determine if existing training at subordinate units is sufficient to meet the space safety local training requirements outlined in this document. The MAJCOM safety o ffice is the waiver authority for formal training requirements.

1.4.4.1.2. The NAF/Center Safety Office will determine which space safety positions (other than the CoS) require formal training versus local training. Personnel assigned to a CoS po sition require formal training. Unless otherwise determined by the NAF/Center Safety Office, Wing level space safety personnel should be formally trained.

1.4.4.2. Supplemental training should be provided and tailored to local space safety requir ements for greater applicability to the assigned missions.

1.4.4.3. Formal training will be accomplished within 120 days (or first available course(s)) of assignment to a space safety position and annually thereafter. Local training is sufficient for annual refresher training.

1.4.4.4. Local training will be accomplished within 120 days (or first available course(s)) of assignment to a space safety position and annually thereafter.

1.4.4.5. The following Space Safety positions/du ties are required for organizations acquiring, testing or operating space systems:

1.4.4.5.1. Chief of Safety. A Chief of Safety is required for wing

- level organizations that conduct operational space or space test missions. MAJCOM safety office s will determine which of their wing

- level organizations (other than organizations that conduct operational space or space test missions) require a
CoS.

1.4.4.5.2. Space Safety Officer (SSO). These positions include System Safety Manager, Space C ontrol Safety Officer, Launch Safety Officer (LSO) and Orbital Safety Officer (OSO). These individuals will be trained in System Safety, and space mishap prevention and investigation within 120 days (or first available course).10 AFI91

- 217 18 FEBRUARY 2010

1.4.4.5.2.1. The M INA course or equivalent is a suitable mishap investigation course. AMIC is recommended for LSOs with some knowledge of aircraft. NASA courses may be substituted for greater applicability if basic mishap prevention and investigation material is covered. As a general rule, System Wings not performing operations or operational test missions will require a System Safety Manager instead of a Chief of Safety. Note : These positions may include personnel assigned to pre

- existing space safety positions.

1.4.4.5.2.2. As appropriate for the assigned mission, each wing (or equivalent) will have at least one SSO for each program. These individuals may be assigned to subordinate units. With approval from the NAF/Center Safety Office, these positions may be assigned as an additional duty. Multiple programs may be covered by the same SSO.

1.4.5. Space Safety Training for Operations Personnel. All space personnel, to include military, government civilians and contractors (required via Performance Work Statement/ Statement of Work or provided via government representative), will receive local initial (prior to operational certification) and annual space safety training (as outlined in sections 1.4.1 and 1.4.2) tailored for their assigned tasks and position.

1.4.5.1. Training for operations personnel should be provided by space safety personnel (e.g. unit SSO) or certified instructors familiar with the training material.

1.4.6. Units will establish risk management derived procedures to prevent mishaps while training on live operational systems.

1.5. Safety Office Responsibilities

. 1.5.1. MAJCOM Responsibilities. Each MAJCOM will develop and administer a space safety program as appropriate to that MAJCOMs involvem ent with space systems. As a minimum, the MAJCOM Safety Office will:

1.5.1.1. Keep the MAJCOM/CC apprised of all issues related to space safety.

1.5.1.2. Implement mishap prevention policies, standards and procedures. The
MAJCOM/SE will analyze all mishap reports to ensure proper safety investigations are accomplished in a timely manner per MAJCOM/CC direction, corrective actions are fully implemented, and that lessons learned are shared between the MAJCOMs
and their subordinate units.

1.5.1.3. Develop metrics to measure the success of the mishap prevention program. This may consist of tracking anomalies or space safety related launch delays by likely causes, such as human error or equipment failure.

1.5.1.4. Assist sub ordinate units in developing local space safety programs and related training. Ensure that relevant training material is cross flowed between similar units and make training available to outside organizations and personnel, as appropriate.

1.5.1.4.1. Determine if existing training at subordinate units is sufficient to meet the space safety training requirements outlined in this document or if existing training should be supplemented.AFI91

- 217 18 FEBRUARY 2010 11

1.5.1.5. Evaluate NAF/center/wing space safety programs

. 1.5.1.6. Ensure a sufficient number of personnel (MAJCOM and below) are trained in space mishap prevention and space mishap investigation. At a minimum, each program will have a trained SSO. Each NAF/Center Safety Office will have at least

one trained SSO, consistent with their assigned mission.

1.5.1.7. Identify and document individuals who are SIB trained and assignable for Class A mishaps.

1.5.1.8. By 1 April each year, update HQ AFSC/SES of all MAJCOM/CC approved
and activ e waivers.

1.5.1.9. Establish MOAs with or on the behalf of non

- AF organizations to ensure the needs, requirements, and policies of both organizations are understood and implemented. MOAs should also address which space safety policy will be used by AF personnel assigned to non

- AF organizations.

1.5.1.10. For space systems on foreign soil, establish MOAs to address organizational roles and responsibilities in the event of a mishap. This will include, at a minimum, who will lead or partic ipate in the investigation and their roles and responsibilities. The MOA will specify the information that (obtained by the investigation) can be shared for lessons learned purposes per the laws of the country owning the space asset. Follow the procedure s of AFI 51

- 701, Negotiating, Concluding, Reporting, and Maintaining International Agreements , when preparing a
MOA.

1.5.1.11. Testing. Ensure subordinate units develop and implement risk management

- based processes for use throughout the system ‘s testing life cycle. MAJCOMs will ensure test procedures for use on operational equipment are reviewed and approved at the appropriate level prior to test initiation.

1.5.1.12. Determine which operationally related safety issues need to be coor dinated with Joint Functional Component Command for Space (JFCC

- SPACE), 14 AF/SE
and/or 14 AF/CC.

1.5.1.13. Assist the NAF/center in determining the scope of the duties for NAF/center assigned SSOs.

1.5.1.14. Establish ISB requirements.

1.5.1.15. ( For MAJCOMs that test space systems ) Develop and implement risk management based processes for use throughout the testing life cycle.

1.5.2. NAF/Center Responsibilities. Each NAF/center that develops, tests, or operates

spac e systems will develop and administer local space safety guidance appropriate/specific for their organization. At a minimum, the NAF/Center Safety Office
will:

1.5.2.1. Keep the NAF/center commander and the CDR JFCC

- SPACE (coordinate
with 14 AF/D irector of Safety, as appropriate) apprised of all issues related to space safety.12 AFI91

- 217 18 FEBRUARY 2010

1.5.2.2. Identify and document individuals who are SIB or Single Investigating Officer trained and assignable for mishap investigation duties.

1.5.2.3. Ass ist subordinate units in developing and tailoring space safety programs, procedures and training for greater applicability to their assigned missions.

1.5.2.4. Ensure subordinate units employ the appropriate level/authority of risk acceptance for all space safety related risk decisions.

1.5.2.5. Assist subordinate units in determining the appropriate number, scope of duties, and training for SSOs.

1.5.2.6. Ensure subordinate units standardize space safety related procedures, as

ap propriate for different programs. For example, COLA procedures for low thrust, high efficiency thrusters (e.g. Hall Effect thrusters) would most likely not be the same as higher thrust, lower efficiency thrusters (e.g. hydrazine thrusters on Defense
Sat ellite Communications System III satellites). Standardized procedures only where appropriate for operational efficiency and mission effectiveness.

1.5.3. Acquisition Organization Responsibilities. Organizations that acquire or upgrade space syst ems will coordinate with the NAF/Center Safety Office to implement a space safety program appropriate for their organization. At a minimum, the acquisition organization will ensure that:

1.5.3.1. The MAJCOM Safety Office and Headquarters Air Forc e Safety Center/Space Division (HQ AFSC/SES) are invited to participate in all System Safety Group meetings for each space program.

1.5.3.2. System Safety Managers are provided the opportunity to ensure space safety requirements are included in ap propriate systems requirements documents for all space system acquisitions and upgrades.

1.5.4. Space Wing/Group and Test and Evaluation Wing/Group Safety Office Responsibilities. Organizations that test or operate space systems will implement a space safety program appropriate for their organization. At a minimum, the Safety Office will:

1.5.4.1. In coordination with the NAF/Center Safety Office, determine the number and scope of duties for assigned SSOs. Each program will have at leas t one trained SSO. With approval from the NAF/Center Safety Office, multiple programs may be covered by the same SSO.

1.5.4.1.1. Coordinate with the acquisition Center‘s Safety Office in determining the number and duties of System Safety Manager s. Justify and document any System Safety Manager positions that are part time or an additional duty.

1.5.4.2. Supervise local space safety programs and training to ensure compliance with this and appropriate subordinate instructions.

1.5.4. 3. Identify and document individuals who are ISB or Single Investigating Officer trained and assignable for Class C, D mishaps and E HAPs/events.

1.5.4.4. Ensure assigned units develop and implement risk management procedures to prevent mishap s while training on operational systems.AFI91

- 217 18 FEBRUARY 2010 13

1.5.4.5. Ensure that assigned SSOs have unhindered access to the CoS or Wing CC/CV for reporting potential safety issues.

1.5.4.6. Approve, as applicable, CA/COLA processes used for all on

- orbit as sets that the wing has Tactical Control (TACON) over.

1.5.4.7. Manage the Range Safety Program for the Wing/Group Commander.

1.5.5. Air Force organizations should ensure that all appropriate reporting requirements (e.g. those required by AFI 10

- series) as well as contractual mechanisms are outlined in agreements between the Air Force organization and mission partners.

1.6. Tenant and Geographically Separated Units (GSU) . Tenant units and GSUs will have an established space safe ty program IAW the requirements of their parent organization and this document. Mishap reporting is the responsibility of the owning organization (organization that incurred the mishap) and wing or equivalent safety office. The host unit can provide assi stance with reporting requirements.

1.7. Joint / DoD / Non

- DoD Space Safety Guidelines. Organizations operating in a joint
environment or with non

- DoD agencies will develop MOAs/MOUs that specify the space safety guidelines to be used. It is t he responsibility of the participating organizations to determine the lead agency and proper approval authority. Consult with NAF and MAJCOM/SE, as appropriate.

1.7.1. In the event that non

- AF guidelines will be followed, a waiver of the pertinen t AF guidelines is required from the appropriate OPR prior to development and operation of the space system.

1.7.2. Title 14, Code of Federal Regulations (CFR), Part 417, Launch Safety , delineates safety requirements for commercial launch operat ors, established by the FAA in conjunction with the DoD, that are fully compatible with DoD space safety guidance. It is the responsibility of the participating organizations‘ commanders to determine lead agency and proper approval authority. Consult wit h NAF and MAJCOM/SE as appropriate.

1.8. Human Factors . The proliferation of highly automated systems, increasingly complex weapon systems and rising demands for rapid and accurate responses to dynamic mission environment introduces significant changes in the role of humans and task demands imposed upon operators. The ability of the Air Force to successfully cope with these challenges carries important implications for safety and mission effectiveness. Consistent Human Systems Integration (HSI ), which incorporates human factors engineering, manpower, safety and personnel to name a few considerations, is a necessary answer to the challenges of developing and fielding usable, effective and safe systems. The institution of a formal HSI program, I AW DoDI 5000.02, Operation of the Defense Acquisition System , and Under Secretary of Defense (AT&L) guidance, based upon operator usability requirements is necessary and can positively impact critical operational concerns such as mishap reduction,
missio n management and command and control decision support. Reference AFI 63

- 1201, Life Cycle Systems Engineering for specific requirements.

1.9. Personnel and Resource Protection. Consistent with Commercial Space Operations Support Agreements an d other local agreements, space safety programs will be designed to14 AFI91

- 217 18 FEBRUARY 2010

protect AF personnel and the general public from accidental death, injury or occupational illness and protect AF systems, equipment, material and facilities in the launch area from damage or delayed operation as a result of space related operations.

1.9.1. Air Force personnel shall not enter into the safety clear zone of hazardous pre

launch operations, if a contractor is responsible for the conduct of the operation, unless special dispensation has been granted by the Wing Commander (or equivalent) or by the Chief of Safety, if so delegated.

1.9.2. When the Air Force enters into a contract or written agreement transferring use of a facility to another organization, the resp onsibility for personnel and resource protection is simultaneously transferred.

1.10. Mission Readiness . Due to the inherent hazards of rockets and launch operations, the

pre

- launch campaign will be conducted in a deliberate fashion, with forma l milestones and reviews to ensure mission readiness and that adequate launch safety processes have been employed for the protection of the public and government resources. These include, at a minimum, dress rehearsals (consistent with contractual require ments), Flight Readiness Reviews (FRR), and Launch Readiness Reviews (LRR).

1.10.1. EOL disposal planning will be accomplished for all test, experimental, or operational orbital space systems that are not expected to immediately reenter after
miss ion completion. See paragraph 5.8.2.3.2 for specific requirements.

1.10.2. Spacecraft at end of mission but with useful life will be placed in a mode of operation that minimizes the risk of debris generation, interference with other active

spacec raft, and the inability to perform reentry or disposal maneuvers until such time that the spacecraft is reactivated or permanently disposed of.

1.10.3. At the end of the pre

- launch phase and before initiating final countdown, a LRR
will be conduct ed so that the Space Launch Commander is assured of the safety of the launch and the readiness of all personnel and systems involved.

1.11. Radiological Material. All space systems with radiological material, will comply
with AFI 91

- 110, Nucle ar Safety Review and Launch Approval for Space or Missile Use of Radioactive Material and Nuclear Systems , for specific mishap prevention requirements.
Non

- DoD systems with radiological material are subject to the Interagency Nuclear Safety
Review Panel process.AFI91

- 217 18 FEBRUARY 2010 15

Chapter 2

- SPACE SYSTEM SAFETY, RISK ACCEPTANCE, AND WAIVER AUTHORITY

2.1. System Safety. System Safety will be incorporated throughout all life cycle phases of space systems. Program managers will employ current government and military standard practices to establish their System Safety program, including the development and implementation of a System Engineering Plan (SEP), in all developmental and sustaining engineering activities. Reference AFI 63

- 1201 for further inform ation.

2.1.1. Apply the System Safety process at all system levels and throughout each and every phase of the space system life cycle for space systems. Space systems or other elements or subsystems, will be designed and operated safely along wit h their internal and external interfaces. Since mishaps may occur or be caused in any phase of the system life cycle, each and every phase of the system life cycle, including orbital phase and EOL as well as launch, must be addressed using the System Safe ty process to eliminate or control hazards and manage mishap risks. Objectives of the System Safety process shall include preservation of mission capability, space systems, assets and forces. Losses of systems, mission degradation, cost and schedule impac ts shall be considered. The intent is not to duplicate work performed by related or other functional disciplines, but to ensure it is done in a systematic manner that addresses and manages mishap risk.

2.1.2. The term System Safety is used to refe r not only to a process, but to a system attribute or attributes (analogous to quality, reliability, performance, or life cycle cost) that varies inversely with mishap risk.

2.1.3. Consistent with acquisition guidance, System Safety Managers shoul d ensure that:

2.1.3.1. System Safety is incorporated into the design of space systems, subsystems, and components.

2.1.3.2. Each phase of the system life cycle consider and manage hazard and mishap risk potential.

2.1.3.3. Per N SSAP 03

- 01 and other DoD directives and instructions, every acquisition strategy will include a Programmatic Environmental, Safety, and Health Evaluation (PESHE) for all space system acquisitions.

2.1.3.4. Application of safety fundamentals must b egin with concept inception, and must cover all efforts across all lifecycle phases, to include sustainment and disposal, for all Air Force products and systems. These systems must exhibit and preserve attributes of operational safety, suitability, and ef fectiveness and mission assurance throughout their operational life.

2.1.4. The intent is not to duplicate work performed by related or other functional disciplines, but to ensure safety is considered and applied in a systematic and dedicated

mann er to manage hazard and mishap risk potential.

2.2. Life Cycle Phases. For the purposes of this instruction, space system life cycle phases are described below and are organized under system development, deployment and operations. This
instr uction uses and expands on the NSSAP phases. However, the NSSAP  ̳Build and16 AFI91

- 217 18 FEBRUARY 2010

Operations‘ phase is broken down into sub

- phases due to the large number of space safety considerations. During each phase, the system will be reviewed by AF System Safety experts to ensure that adequate System Safety requirements and processes are incorporated into all
documentation and activities in accordance with AFI 91

- 202, Mil

- Std 882 and the Program's
SEP.

2.2.1. System Development. System development begins with i nitial concept studies, includes many of the key acquisition processes and ends after production.

2.2.1.1. Concept Development Phase. Includes concept studies, trade studies, system architecture development, assessment of vulnerability and protec tion mitigation measures, technology development and maturity assessments, risk reduction, requirements development, preliminary system safety program plan and Test and Evaluation Master Plan development. Events that occur during the Concept Development P hase include the System Requirements Review and the System Design Review. During this phase, baseline development is mature enough to enter the formal acquisition process.

2.2.1.2. Preliminary Design Phase. The Preliminary Design phase includes activities to increase the confidence in system alternatives by assessing risk levels and projected performance at a detailed engineering level. During this phase, system alternatives are assessed for risk levels and projected performance at a detailed en gineering level. Activities include efforts to mature technology, and baseline management and program definition. The acquisition/development agency will design systems to minimize hazards (including the generation of debris) during development, operatio ns, and disposal of the system. This phase culminate in a Preliminary Design Review.

2.2.1.3. Complete Design Phase. This phase includes a baseline design and support concept of sufficient detail to support the Critical Design Review and Capabilit y Production Document development.

2.2.1.4. Build Phase. (Part of the NSSAP build and Operations phase.) During the Build Phase, components are fabricated, tested and assembled into subsystems and systems which are tested as required. Testing f or safety

- critical components may include initial qualification and production acceptance tests. The products from this phase are systems and components ready for deployment.

2.2.2. Deployment. Deployment includes transportation of systems from the factory to operational units and assembly, checkout and certification of the system. Deployment contains the following sub

- phases which fall under the NSSAP  ̳Build and Operations‘ phase:

Note: It is understood that the term  ̳deployment‘ when used in the context of operational systems (i.e. mobile systems) and spacecraft mechanisms (e.g. solar array deployment) have a different meaning than that used here. For the purposes of this document,  ̳deployment‘, as used in this chapter, is defined as abov e.

2.2.2.1. Transportation Phase. The Transportation Phase is initiated when the system is loaded onto the first transportation equipment and ends when it has been unloaded from the last transportation equipment (not to include launch vehicles) . Programs developing critical hardware and high value systems will produce transportation plans that address safety concerns.AFI91

- 217 18 FEBRUARY 2010 17

2.2.2.2. Pre

- Launch Phase (for systems operating to, through or from space). During the
Pre

- Launch Phase, ground syste ms are assembled and tested per established procedures and milestones. The appropriate commander or equivalent will review the results of assembly and test and certify the system for operation. The appropriate Wing Commander or equivalent will certify sy stem (spacecraft, launch vehicle, and ground support systems) readiness for launch. The appropriate launch and/or test range Wing Commanders or equivalent will certify range and public safety readiness for launch.

2.2.2.3. Launch (for systems ope rating to, through or from space) Phase. The Launch Phase will not be initiated until after system and range readiness has been declared. Launch is initiated with the final manual command to launch (usually initiation of the final automated countdown seq uence) and ends when the satellite or payload separates from all launch vehicle and upper stage components.

2.2.2.4. Early

- Orbit Deployment and Checkout (for systems operating to, through or from space) Phase. This Phase is also known as Test and Checkout.

2.2.2.4.1. This phase is initiated when the last launch vehicle or upper stage component separates from the spacecraft or payload and ends when the in

- space system is declared operational and Tactical Control (TACON) is transferred to t he operational Space Wing.

2.2.2.4.2. Activities in this phase include orbit and attitude adjustments, satellite/payload reconfiguration for operations (e.g. deployment of solar panels and protective covers), and bus and payload system checkouts. This phase ends with operational readiness certification by the appropriate authority.

2.2.2.5. Assembly, Check

- out and Verification of Space Ground Systems phase. This phase applies to space ground support systems such as ground command and tel emetry antennas/equipment, space surveillance radars and optical systems. This encompasses
the on

- site assembly, subsystem and system testing and verification that the completed and installed system performs and meets its specifications. This phase may i nclude Operational Test and Verification. This phase ends upon declaration that the installed system is operational.

2.2.3. Operations. Operations begins after operational readiness has been declared by the appropriate authority and normal syste m operations may begin. Operations ends when the system is permanently removed from space for systems that operate to, through or from space. Operations may last indefinitely depending on the disposal/end of life mode. Operations contains the following p hases which fall under the NSSAP  ̳Build and Operations‘ phase:

2.2.3.1. Mission phase. The mission phase begins after operational readiness is declared. The operating entity may be different from the deployment entity. This phase ends when
the system is no longer capable of adequately performing its intended or other assigned missions, as determined by the appropriate authority. For systems operating to, through or from space, this may occur when the minimum commodity quantities needed for

appr oved disposal are reached.

2.2.3.2. Disposal/EOL Phase. The Disposal/EOL phase is initiated after the appropriate authority determines that the system no longer adequately performs its intended mission.18 AFI91

- 217 18 FEBRUARY 2010

Disposal/EOL for ground systems may includ e disassembly and removal, salvage,
caretaker status or abandonment

- in

- place. In

- space systems will be disposed of via reentry, other means of removal from space or moved to a sparsely populated disposal orbit and safed so that the disposed system minimiz es the generation of debris and other hazards (see Chapter 5). The system operator is responsible for minimizing the residual hazards the system may subsequently pose.

2.3. Program Manager and Operator Roles and Responsibilities. Program Man agers and Operators will apply System Safety during all system life cycle phases.

2.3.1. The appropriate Wing Commander or equivalent will ensure system safety be included and applied in all product or service contractual arrangements.

2.3.2. The appropriate Wing Commander or equivalent has the primary responsibility for ensuring System Safety is integral to the systems engineering process and will identify a government lead System Safety Manager to execute or oversee the system safety pro gram.

2.3.3. Every space program, or group of small space programs, will develop a Programmatic Environmental, Safety, and Health Evaluation (PESHE) for Key Decision Point assessments
IAW NSSAP 03

- 01. Program Managers will prepare a PESHE which i dentifies System Safety, environmental and occupational health risks, how these risks will be eliminated or managed, and how compliance will be achieved and maintained throughout the system life cycle.

2.3.4. Space systems and system upgrades that have completed their System Requirements Review prior to the implementation of this instruction will be exempt from those new requirements outlined in this document that cannot be met within the existing design.
Consistent with cost effectiveness and mis sion requirements, any aspect of this instruction that can be met without a significant design change will be adhered to.

2.3.4.1. System Safety Managers will ensure that the space safety requirements outlined
in this instruction are included in a ll system requirements documents. It is understood that mission requirements and cost effectiveness may result in non

- compliance with parts
of this instruction.

2.3.4.1.1. Prior to the next Key Decision Point of any system acquisition or upgrade

, the PM will ensure that the acquisition safety office and operational Wing Commander (or equivalent) are provided with justifications for non

- compliance with the space safety requirements in this instruction.

2.3.4.2. Acquisition and Operations personnel should consider Tactics, Techniques and Procedures (TTPs) in order to meet safety and mishap prevention requirements outlined
in this document.

2.4. Risk Acceptance, Non

- Compliances and Waiver Authority. The risk criteria discussed in this section applies to the relevant system safety or public safety addressed in subsequent chapters. ( Reference AFI 91

- 202, Range Commanders Council Standards, and MAJCOM instructions/manuals for additional guidance on risk criteria.)

2.4.1. The organization‘s commander or equivalent is responsible for those risks that are within their authority and capability to mitigate or otherwise control. However, at all times and through all phases, a Wing Commander or equivalent will be assigned risk responsibilityAFI91

- 217 18 FEBRUARY 2010 19

for a mission program. At no time during the system‘s life cycle phases will a program not have an organization designated as the risk responsible organization.

2.4.1.1. A Risk Responsibility Transition Plan will be developed by t he acquisition organization and will be used to identify milestones or decision points in the transfer of risk responsibility from one organizational commander (or equivalent) to another. Risk responsibility should be clearly delineated prior to launch (s ystem deployment for ground systems) to clearly outline each organization commander‘s (or equivalent) risk management responsibility. This plan must be approved by all applicable commanders (or equivalent) prior to implementation.

2.4.1.1.1. Each MAJCOM will determine the timing, required content and format for Risk Responsibility Transition Plans. As a minimum, the plan will delineate the risk responsible commander or equivalent for all life cycle phases to include overlapping responsibility, if appropriate. It should also include the risks associated with program versus flight.

2.4.2. Development. The System Wing Commander or equivalent and the acquisition chain of command (per AFI 91

- 202) are the approval authorities for all risk ana lyses that meet approved system safety risk management processes for space systems that have not been transferred to an operational wing commander or operational/test organization. System wing commanders or equivalent and operational wing commanders share approval authority for similar risk analyses for all follow

- on operational support.

2.4.2.1. Risks to the public and personnel involved with a space system development will not exceed appropriate Occupational Safety and Health Administration and Air Force Occupational Safety, Fire Protection and Health standards.

2.4.3. Deployment/Launch. The operational Space Wing CC or his/her designee is the risk acceptance authority for all risk analyses that meet public and launch essential personne l safety risk criteria during launch. Public and launch essential personnel safety ends when the launch vehicle has achieved orbit (see Chapter 4).

2.4.3.1. Prior to launch (t = 0), all hazardous spacecraft, launch vehicle components, or systems will be sited IAW DoD 6055.09

- STD, DoD Ammunition and Explosives Safety Standards, AFMAN 91

- 201, Explosives Safety Standards , Unified Facilities Criteria (UFC) 1

- 200

- 01, General Building Requirements , and UFC 3

- 600

- 01, Fire Protection Engineering fo r Facilities

. 2.4.4. Operations/Disposal/End

- of

- Life. The appropriate space wing commander (or equivalent) is the approval authority for all risk analyses that meet system safety risk criteria. The NAF/CC or Center CC or equivalent is the appro val authority for constellation management/EOL disposal decisions.

2.4.4.1. The lead organization‘s commander, or equivalent, for follow

- on support activities (e.g. operational tests) is responsible for risk management of those activities.

2.5. Waivers

2.5.1. Reference subsequent chapters for waiver approval authorities.20 AFI91

- 217 18 FEBRUARY 2010

2.5.2. Each safety office (MAJCOM, NAF, Center, Wing, etc.) will brief previously approved and active waivers to incoming commanders and Chiefs of Safe ty within 30 days of assignment.AFI91

- 217 18 FEBRUARY 2010 21

Chapter 3

SYSTEM DEVELOPMENT

3.1. Development Risk. The following outlines risk responsibility for the development life cycle phases associated with launch, orbital and other space systems. Risk respo nsibility only applies to risks that are within the control of a particular agency/authority. During each of a program‘s life cycle phases, a program will have an organization designated as the risk responsible organization by that organization‘s commande r. Because of overlapping responsibilities, responsibility for life cycle phases may overlap organizations. Risk measures and associated criteria will be developed by the organizational authority responsible for the assigned life cycle phase, but should be consistent with operational requirements, DoD, AF, RCC and standard practices in related industries. Use of RCC and industry standards is subject to the approval of the appropriate Wing Commander (or equivalent).

3.1.1. When accepting design r isks, the acquiring organization will consider the impact to all aspects of a space system‘s life cycle. Design decisions...impact the operational safety of a system. Therefore, the acquisition organization will assess the impact (with the goal of
minimizi ng the risk) to the operational (pre

- launch, launch, on

- orbit, reentry, and disposal/EOL) safety risk in each of the program‘s life cycle phases. Acquisition organizations will comply with all safety standards that address these ―downstream‖ risks,
and wi ll include the operational commander or equivalent receiving the system in all design risk acceptance decisions. The acquisition organization is also responsible for all of its
follow

- on support activities.

3.1.2. Standards for acceptable risks t o personnel involved with space system development and operations will meet or exceed appropriate Occupational Safety and Health Administration and/or Air Force Occupational Safety, Fire Protection and Health standards.

3.1.3. Prior to constructio n and/or facility utilization, all facilities including launch pads housing spacecraft, launch vehicle components or systems that present an explosive hazard will be sited IAW Defense Federal Acquisition Regulation Supplement (DFARS) 252.223

- 7002, Safety Precautions for Ammunition and Explosives

, DoD 4145.26

- M, DoD Contractor’s Safety Manual for Ammunition and Explosives , DoD 6055.09

- STD, DoD Ammunition and Explosives Safety Standards , and AFMAN 91

- 201.

3.1.4. Local System Safety Manage rs must be included, at a minimum, during all Key Decision Points to effectively manage the risks in each program for the appropriate Wing Commander or equivalent.

3.2. Waiver and Approval Authority. Consistent with AFI 91

- 202, MAJCOM guidanc e, and other agreements, the risk acceptance authorities are outlined below.

3.2.1. Normal Risk Approval.

3.2.1.1. The acquisition organization‘s commander or equivalent is responsible for risk management and acceptance involving design a nd operation of a space system throughout its life cycle when hazards causing the risks are controlled by engineering
technical documentation.22 AFI91

- 217 18 FEBRUARY 2010

3.2.1.2. The Air Force Civil Engineering Support Agency (AFCESA) is the waiver authority for all facilit y changes that do not meet the minimum requirements of UFC 1

- 200

- 01 and UFC 3

- 600

- 01.

3.2.2. Approval for Exceeding Normal Risk Criteria. Consistent with MAJCOM guidance and other agreements, the wing commander is the waiver approval authority fo r risks exceeding normal risk criteria.

3.2.2.1. During any life cycle phase up through system deployment in the Build And Operations Phase , the Center Commander and 14 AF/CC (via 14 AF Director of Safety, if appropriate) will be notified of ris ks that exceed normal risk criteria by more than one order of magnitude (e.g., one in one million vs. ten in one million).

3.2.2.2. Risks exceeding normal risk criteria by two or more orders of magnitude (e.g.,
one in a one million vs. one hundred in one million) require NAF/CC and MAJCOM/CC approval.

3.2.2.3. The wing CoS will review all waiver requests requiring wing commander approval. The wing will document risk management decisions that exceed the accepted
risk criteria. Subordinate units (wings, centers, NAFs, etc.) will provide the MAJCOM/SE copies of all waiver requests and approvals.

3.3. General Design Considerations. Consistent with National Space Policy and DoDD 3100.10, System Safety Managers will ensure that th e following considerations are included in all appropriate systems requirements documents:

3.3.1. Minimize space system vulnerability to space debris and other effects of the space environment, such as meteoroids, solar radiation, spacecraft charg ing, high energy cosmic radiation, solar flares and man

- made debris.

3.3.2. Minimize generation of space debris. Note: The terms orbital debris and space debris are often used interchangeably. For the purposes of this document, orbital debris is space debris in orbit around another object. Debris mitigation guidelines are required for orbital space systems and recommended for space systems and launch vehicle components in deep space (i.e. not in orbit around a planet). Space debris generated in orbit (i.e. orbital debris) presents a far greater risk than debris generated in deep space.

3.3.2.1. All test, operational and failure modes will be designed to minimize non

- mission debris generation. Spacecraft will be designed to minimize, contain or otherwise limit the size and number of generated debris that separates from a spacecraft. See section 5.8 for specific details.

3.3.3. Minimize the possibility of catastrophic loss or mission degradation due to collisions
with debris.

3.3.3.1. Consistent with cost

- effectiveness and mission requirements, spacecraft and launch vehicle mitigation measures will include: reduce the cross

- sectional area of the space system or components, protect critical subsystems through shielding/ positioning within the spacecraft, improve system reliability, use the least risky redundancy/single

string arrangement and plan for individual component failure modes that maximize remaining mission capability.AFI91

- 217 18 FEBRUARY 2010 23

3.3.4. Minimize functional, electro

- magnetic/optical or physical interference with other systems or personnel.

3.3.5. Programs will assess and limit the collision hazard posed by tether systems on other users of space and on the near

- Earth environment.

3.3.6. Plan for disp osal procedures (passivation) for launch vehicle components, upper stages, spacecraft and other payloads at the EOL to minimize the impact on future operations. See section 5.11.3 for specific details.

3.3.6.1. Minimize the possibility of acciden tal explosions by depleting stored energy sources during passivation.

3.3.6.2. Space systems will be designed to minimize or produce a predictable orbit perturbation from passivation activities.

3.3.6.3. Consistent with mission requiremen ts and cost effectiveness, add grapple points to all spacecraft, kick motors and launch vehicle components to allow for post

- mission orbit disposal or repositioning by spacecraft with grappling and orbit change capability.

3.3.7. Establish clear d ecision authorities for configuration control and management. Ensure configuration management plans in contracts are followed and effective for systems under development/upgrade.

3.3.8. Conduct tests of hardware components in as close to operatio nal conditions as possible.

3.3.8.1. It is critical that the various interfaces between different components be tested thoroughly. The fully integrated spacecraft will be ground tested in an environment that most closely simulates its actual oper ating environment.

3.3.9. Document all high risk acceptance decisions, consistent with AF electronic records management processes.

3.3.10. Safety catastrophic systems will be designed to be dual

- fault tolerant for catastrophic
hazards. E xceptions to these requirements will be justified to the appropriate commanders (i.e., system and operational receiving wings) or equivalent by designing to minimum risk (using the System Safety order of precedence) using rigorous quantitative risk methods . All safety catastrophic systems will be designed to avoid:

3.3.10.1. Single component failure, common mode failure, human error, or design features which would cause a mishap of catastrophic severity.

3.3.10.2. Dual independent compone nt failures, dual human errors, or a combination of a component failure and a human error involving safety catastrophic command and control functions, which could cause a mishap of catastrophic severity.

3.3.10.3. All systems determined to be safe ty catastrophic will be approved by the appropriate Wing.

3.4. Integrated Space Effects. Individual space systems and capabilities can be integrated to significantly increase their overall effectiveness.

3.4.1. Space forces, includin g acquisition strategies, need to mitigate the hazards/risks of fully integrated space capabilities on friendly space assets as well as to the user. Whether or24 AFI91

- 217 18 FEBRUARY 2010

not systems were originally designed to be integrated, integrating them may produce
unintended c onsequences. Design to control and manage hazard and their associated risks due to integration.

3.4.2. Acquisition and operational strategies need to mitigate the hazards/risks of fully integrated space capabilities on friendly space assets. The consequences and risks of integrated space systems will be analyzed, controlled and accepted by the appropriate risk commanders or equivalent prior to implementation. Note: Space capabilities can deny, degrade, disrupt or destroy the enemy (intentional /unintentional) and friendly forces (unintentional).

3.4.3. Space Safety Offices should be included in planning to help manage risks and mishap prevention, tactics, techniques and procedures to properly advise their commanders (or equivalent) on r isk acceptance.

3.5. Testing. The following requirements apply to both developmental and operational test and evaluation. MAJCOMs that test space systems will develop and implement risk management based processes for use throughout the testi ng life cycle. MAJCOMs will ensure test procedures intended for use on operational equipment are reviewed and approved prior to test initiation. MAJCOMs will ensure changes to test plans are approved at the proper level of authority.

3.5.1. Test ing organizations will comply with the safety requirements specified in AFI 99

- 103, Capabilities Based Test and Evaluation . Integrated testing is the preferred approach unless it can be shown that it adds unacceptable costs, delays, or technical risk. Safety review processes will not be compromised.

3.5.2. Conduct tests of hardware components in operationally relevant environments without compromising engineering integrity, safety, or security. It is critical that the various
interfaces betwee n different components be tested thoroughly. The fully integrated spacecraft will be tested on the ground in an environment that most clearly approximates the spacecraft‘s on

- orbit operating environment. Launch vehicle/booster components shall be
tested to demonstrate their capability to perform in their intended operating environments.

3.5.3. Document all test risk decisions, consistent with AF electronic records management

processes.

3.5.4. Integrated Technical and Safety Reviews. Ind ependent government technical and safety personnel will examine the technical and safety aspects of test and evaluation (T&E) plans that involve government resources prior to commencement of test activities. All test organizations must establish procedure s for when and how these reviews will be accomplished.

3.5.4.1. Safety Review Board (SRB). The SRB assesses whether the T&E project's safety plan has identified and mitigated all health and safety hazards according to AFI 91

- 301, Air Force Occup ational and Environmental Safety, Fire Protection and Health (AFOSH) Program . SRB members must be technically qualified and independent of the test program. At the recommendation of the SRB, the Single Manager and all test organizations will accept (at the appropriate level established by the organizational commander or equivalent), eliminate or mitigate identified hazards. All test organizations will set up procedures for controlling and supervising tests consistent with the risk involved and according to local range safety criteria (see AFI 91

- 202). MishapAFI91

- 217 18 FEBRUARY 2010 25

accountability must be clearly established according to AFI 91

- 204

, prior to conducting tests. The SRB will review and assess the impact of hazards to other critical/high

- value resources and oper ations.

3.6. Configuration Control and Management. Configuration Management (CM) is a management process for establishing and maintaining consistency of a product‘s performance, function, and physical attributes with its requirements, design, and operational information throughout its life cycle. Reference AFI 63

- 1201 for detailed guidance.

3.6.1. As part of the CM process, the system safety manager will review proposed changes to a product throughout the product's life cycle to iden tify changes to the product's overall safety baseline (this includes Engineering Change Proposals, requests for deviation, etc.). The proposed changes will be evaluated by identifying possible outcomes from where the proposed change is to be inserted into the system/program, and comparing the outcomes to previous analyses conducted during the original baseline design work.

3.6.2. The system safety manager will be a member of the Configuration Control Board (CCB) in order to monitor the configurati on of the product and to capture configuration
control lessons learned.

3.6.3. The system safety manager, as a member of the CCB, will identify and report risks associated with the proposed implementation of changes to the product‘s baseline to th e CCB. The identified risks will be resolved and documented by the appropriate risk acceptance organizational commander or equivalent prior to CCB approval of the proposed change.

3.7. System Safety Management Plan and the Software Safety Plan. For Programs that incorporate safety critical software, the System Safety Management Plan (SSMP) shall require a software safety plan, either incorporated into the SSMP or as a stand

- alone document. The software safety plan should correlate to the Sof tware Engineering Plan (as the SSMP correlates to the System Engineering Plan), and should be initiated early in the project life cycle.

3.7.1. Software includes all programs and files used in mission operations that are stored or functions with ― 0‖s and ―1‖s, to include but not limited to: space system operating software, mission dependent databases and mission upload files.

3.7.2. The Software Safety Plan must specify the software safety process for programs where software performs or in fluences safety

- critical functions. The software safety plan should include information on System Safety integration into the overall program structure and software development life cycle.

3.7.3. As part of the design and development process, the software safety process should focus on the identification and tracking of initial software safety requirements, and those derived from system specific hazard analyses, and will include supporting software configuration control.

3.7.4. Criteria f

or software reviews should be part of the Software Safety Plan and conducted in conjunction with the System Safety analysis process (i.e., Preliminary Hazard Analysis, etc.) as part of the standard gateway products required for reviews.

3.7.5. Saf

ety is an integral part of software testing. The System Safety Manager should be involved in the generation of inputs to safety

- specific testing requirements (including26 AFI91

- 217 18 FEBRUARY 2010

requirements for initial validation & verification and regression testing), participat ion in test reviews, determination of acceptance criteria to meet safety objectives and requirements, and that procedures be established to avoid mishaps during testing.

3.7.6. Software upgrades and patches have the potential for causing degradati on or total mission loss, and it is critical that safety analysis be conducted as part of the configuration control process. Such upgrades and patches must not only undergo a safety analysis, but should also be fully tested and validated prior to implemen tation onto flight hardware.

3.7.7. For reference, NASA

- GB

- 8719.13, NASA Software Safety Guidebook , contains details on planning a software safety program.

3.8. Software and Hardware Installations. Software and hardware installatio ns/updates have the potential for causing degradation or total mission loss. It is critical that System Safety be implemented during software design and testing. The Program Manager will ensure that:

3.8.1. New software and hardware is fully tes ted and validated prior to implementation.

3.8.2. Procedures are established to avoid mishaps during testing and installations.

3.9. Test/Operational Performance Reviews. For space systems and support equipment, performance reviews s hould be conducted after each major mission program event (e.g. pre

operational testing, launch, test

- and

- checkout, mission operational milestones, integrated effects, EOL disposal, etc.) Thorough reviews enhance future system performance and mission

assu rance, and can contribute to mishap prevention. The size and scope of the review will be determined by individual programs. Trained space safety personnel will be invited to participate in all post test/operational performance reviews/assessments.

3 .9.1. Safety programs should emphasize test program validation (to include procedures discipline, readiness reviews, and test execution risk management) and configuration control
in order to minimize unintended events or failures.AFI91

- 217 18 FEBRUARY 2010 27

Chapter 4

L AUNCH, SYSTEM DEPLOY MENT, AND REENTRY

4.1. System Deployment. This chapter outlines safety responsibilities and tasks for the space system deployment life cycle phase which includes: transportation from the factory to the launch site or operat ing location; assembly and checkout; for flight hardware, pre

- launch/launch/early

orbit deployment and checkout. It also includes: reentry safety responsibilities and requirements for launch vehicles/components; reentry launch vehicles/components, and reu sable launch vehicles/components including their jettisoned components.

4.1.1. During these sub

- phases, different aspects of safety may be the responsibilities of different commanders. For example, the protection of a program's equipment from th e program's hazards may be the responsibility of the program's commander while the protection of the public from a program's ground and flight hazards may be the primary responsibility of the space launch commander. In most cases, this instruction will us e the term ―appropriate wing commander‖ to refer to the commander having primary responsibility based on the locations, equipment, hazards and personnel involved.

4.2. Safety Responsibilities. The appropriate wing commander is responsible for ensuring safe operations and will protect the public from unacceptable risks.

4.2.1. The wing commander may prohibit, suspend or terminate any DoD, commercial, civil, government, or test/evaluation activity, if such activity would adversely affec t other space/range users or violate accepted risk criteria, requirements for public health and safety or U.S. national security interests. The Wing Safety Office shall document all determinations made and forward to the MAJCOM Safety Office.

4.2.2. The MAJCOM will assign specific deployment responsibilities. Normally, the agency owning the program will be responsible for the safety of a program's hardware, personnel and facilities as long as the hazards do not extend outside of the assigned prog ram facility boundaries. When the hazards could cross outside of these facility boundaries, the appropriate wing commander will ensure that adequate protection/mitigation is provided to protect other personnel/facilities/hardware.

4.3. Transpor tation. The transportation of high

- value and/or hazardous space systems will be planned and executed to minimize hazards posed to the space system as well as hazards posed by the space system.

4.3.1. A transportation plan or equivalent document will be developed and approved by the responsible system wing commander (and coordinated by the receiving wing commander, if any) for transportation from the factory to the operational site or range. The transportation plan will address the following saf ety

- related items: transportation configuration for safety critical items such as ordnance and pressure vessels, compliance with DOT regulations, documentation of planned and alternate routes and safe stop points, cargo environmental
control and monitorin g and escort/convoy requirements.

4.4. Ground Based Equipment Assembly and Checkout. Safety responsibility for this sub

phase is normally the responsibility of the wing commander acquiring the system. If the potential hazards from this sub

- p hase can extend beyond the boundaries of the involved facility,28 AFI91

- 217 18 FEBRUARY 2010

responsibilities may involve, or transfer to, the installation commander for the protection of other resources and personnel. After operational capability certification, safety responsibility transfers to the operational wing commander.

4.5. Pre

- launch Safety. This section covers safety responsibilities for flight hardware, program operations and program facilities during activities at the launch base prior to launch countdown

op erations.

4.5.1. Pre

- launch Operations. Due to the inherent hazards of rockets and launch operations, the pre

- launch campaign will be conducted in a deliberate fashion, with formal milestones and reviews to ensure mission readiness and that adequ ate launch safety processes have been employed for the protection of the public and government resources. These include, at a minimum, dress rehearsals and readiness reviews to ensure the safety and readiness of all personnel and systems, for example Flig ht Readiness Reviews (FRR) and Launch Readiness Reviews (LRR).

4.5.2. Unless otherwise directed by MAJCOM guidance, an Interim Safety Board (ISB) President will be assigned prior to the final readiness review for all AF launches and
launches of si gnificant AF interest. The duties of the ISB President are identified in AFI 91

- 204 and AFMAN 91

- 222. An ISB President will be available and on

- standby prior to and during their assigned launch, until the successful spacecraft separation or other identif ied mission event. The Air Force will reserve the right to appoint an ISB for commercial launches originating at AF ranges.

4.6. Launch Safety. The following outlines risk responsibility for the respective mission flight phases associated wi th launches. It is the duty of all involved organizations to ensure adequate protection to the general public, manned spacecraft and space users is accomplished by coordinating appropriate transfer of responsibility. The management of flight phase risk i s performed primarily using quantitative measures, although for some applications highly developed and documented qualitative measures may suffice. The measures and associated criteria are normally developed by high level organizations, committees or indu stries and documented in standards or published guidelines. In some cases, agreements with local governments or national guidelines may take precedence and require range compliance. The risk responsibility for the mission flight phases may overlap.

4.6.1. Launch Safety Officer. The Launch/Range shall have a Launch Safety Officer, with the appropriate training, to serve as the Space Safety Officer for the Launch/Range. Other launch range safety personnel shall undergo appropriate training (as de termined by the MAJCOM safety office) for their assigned positions, which may or may not be designated a space safety position.

4.6.2. The appropriate wing commander is responsible for all flight risk to the general public, launch area personnel a nd other mission support personnel, commencing at liftoff, up through orbital insertion or until final impact of suborbital vehicles or jettisoned components. In addition, this commander is responsible for ensuring on

- orbit spacecraft protection by implem enting launch holds in the launch window.

4.6.3. Launch Operations Risk. Independent risk budgets for a mission will be developed when the phases of flight meet the guidelines specified in the Range Commander’s Council (RCC) Standard 321. Risk management responsibility directly corresponds with missionAFI91

- 217 18 FEBRUARY 2010 29

command and control responsibility/authority. Launch and orbital risk management will apply quantitative risk analysis consistent with DoD, RCC, AF and industry standards and practices.

4.6 .4. Launch Vehicle And Spacecraft Safety.

4.6.4.1. The SLCC‘s responsibility extends from launch through orbit insertion.

4.6.4.2. The acquisition organization is responsible from orbital insertion through early orbit testing and unti l the operational organization assumes TACON. The acquisition organization also has responsibility for follow

- on support and any post

- EOL activities (e.g. reentry recovery).

4.6.4.3. Consistent with other agreements, the operational organization is responsible for all operational risks after the successful completion of early orbit testing through EOL activities. Post EOL, the acquisition organization is accountable.

4.6.4.4. Reference section 5.2. for on

- orbit risk criteria for launched objects.

4.6.5. Public and Launch Personnel Risk. The risk criteria listed below apply only to the mission flight phases associated with launch. Reference RCC 321 to determine if the risk criteria can be assigned to individual flight phases or should be considered appropriate for the entire flight of the mission.

4.6.5.1. The risk to the public will not exceed the criteria listed below for mission operations (to include launch processing, space and suborbital launches, and subsequent

co ntrolled reentry).

4.6.5.1.1. Public. The general public will not be exposed to a collective Expectation of Casualty (E c ) greater than 100 10 - 6 (one

- hundred in one million) for all hazards associated with a mission (reference RCC 321 for gui dance on assigning mission risk).

4.6.5.1.1.1. When the risk from toxic hazards exists, the range must separately ensure the allowable level of risk does not exceed other range safety standards for toxic exposure limits for the general public, whe n appropriate mitigations are in place. This predetermined level of risk, less than 100 10 - 6 , should account for each range‘s local population and population distribution, applicable national exposure guidelines and agreements with local government aut horities.

4.6.5.1.2. Mission Essential Personnel will have a collective E c less than 300 10 - 6 (three

- hundred in one million) for all hazards associated with a mission. An appropriate allowable level for toxic risk should likewise be determin ed according to the factors stated below for public risk.

4.6.5.2. Space Wings will ensure that range users perform any other required risk analysis needed to adequately address public safety for all launches. The Space Wings will review and appr ove all risk analyses associated with each launch from the range.

4.6.6. Safe Separation

– CA and COLA. The appropriate wing commander is responsible for precluding any activity that would adversely affect active or manned spacecraft, based on

a pre

- launch COLA process identified by the MAJCOM.30 AFI91

- 217 18 FEBRUARY 2010

4.6.6.1. The COLA process will be developed based on assessments that account for launch vehicle flight from launch through orbit insertion plus the required number of
revolutions of the launched o bjects. The COLA process will account for:

4.6.6.1.1. The type of orbit the vehicle or component is injected into, operating in or passing through, and;

4.6.6.1.2. Its altitude exceeding the manned spacecraft or space asset altitude by t he appropriate miss distance, and;

4.6.6.1.3. Sufficient time for the launched objects to be cataloged in the Satellite Catalog. Launch objects include the launch vehicle, payload, jettisoned components and planned debris.

4.6.6.2. The S pace Wings, in conjunction with the JSpOC, will protect on

- orbit manned spacecraft and active satellites from collision with launched objects IAW DoDD 3100.10 and MAJCOM requirements. Space wings will obtain CAs from the JSpOC to establish
COLA holds in t he launch windows to ensure safe separation criteria from manned and active orbital objects based on the risk criteria specified in the following paragraphs.

4.6.6.2.1. This CA/COLA process will be used for all launch vehicles, ballistic
missions and propagated debris with an altitude capability equal to or greater than
150 km.

4.6.6.2.2. A CA/COLA process will also be used for each launch vehicle component that does not immediately reenter after separation from the launch vehicle and/or

s pacecraft.

4.6.6.2.3. The CA/COLA process will be used prior to the planned launch to protect cataloged manned and active orbiting objects from collision with launched objects. This process includes the computation of launch times that would resu lt in violating either the appropriate miss distance or probability of collision IAW RCC 321.

4.6.6.2.4. Safe Separation for launch (CA/COLA) will cover the period of time from when the launched objects achieve an altitude greater than 150 km, and until they are catalogued by the JSpOC and become part of the orbital CA process or until surface impact for suborbital launches.

4.6.6.2.5. If there is a deviation beyond the planned three

- sigma trajectory, the launch wing is relieved of respons ibility for any resulting collision with active or manned orbiting objects.

4.6.6.3. Safe Separation Criteria for Launch.

4.6.6.3.1. Manned Spacecraft. The risk to each on

- orbit manned spacecraft from launched objects will not exceed a c ollision probability of 1 10 - 6 (one in one million).

4.6.6.3.2. Active Satellites. The acceptable risk to active satellites from launched objects will be established by 14 AF, but should not exceed a collision probability of
10 10 - 6 (ten in one million).

4.6.6.3.3. Probability. Since CA and COLA based collision probability determinations require considerably higher fidelity range user data and can be costly,AFI91

- 217 18 FEBRUARY 2010 31

an acceptable alternative to the above criteria is to perform the assessme nt using more
conservative miss distance volumes.

4.6.6.3.3.1. To mitigate the risk to manned spacecraft, either ellipsoidal miss
distance volumes of 200 km in

- track and 50 km cross

- track and radially, or spherical volumes of 200 km may be used.

4.6.6.3.3.2. For active satellites, 14 AF shall provide the appropriate conjunction assessment data to the launch wings to establish launch hold periods. A spherical miss distance volume of 25 km may be used to determine the appropriate launch
hol d periods.

4.6.6.3.3.3. These criteria may be waived based on national need and operational considerations by a MAJCOM

- approved authority.

4.6.6.4. The launching agency is responsible for the protection of manned spacecraft and
active sat ellites from the end of the appropriate wing commander's (or equivalent) responsibility as defined above in paragraph 4.6.6.2 until separation of the last launch component, if there are additional orbital changes during this time.

4.6.7. The Space Wings will ensure each range user complies with safety requirements contained in MAJCOM, NAF/Center, and wing

- level publications.

4.6.7.1. Commercial launches are subject to the requirements of other agencies, including, FAA/AST requirements for licensed launches. Use established agreements for ensuring safety compliance for FAA/AST licensed launches.

4.6.8. Control of Errant Vehicle Flight. All vehicles launched from or onto AF ranges will have a positive, Space Wing Commander approved, method of controlling erratic vehicle flight to meet the objective of managing risks to the public and foreign countries.

4.6.8.1. Range safety organizations will establish flight termination criteria and mission flight rules to ensure operations do not exceed acceptable public safety.

4.6.8.2. Range safety organizations, with wing commander approval, will establish and control hazardous launch areas and implement procedures to protect the public on land, on the sea, and in the air for ea ch launch and launch vehicle using the range.

4.6.8.3. The Range shall coordinate with FAA to ensure timely notification of any expected air traffic hazard associated with range activities. In the event of a mishap, the Range shall immediately in form the FAA of the volume and duration of airspace where an aircraft hazard is predicted. Similarly, the Range shall coordinate with the US Coast Guard (USCG) to ensure timely notification of any associated ship traffic hazard and in the event of mishap, inform the USCG of the area and duration of navigable waters where a ship hazard is predicted.

4.6.8.4. Any launch vehicle component expected to reenter the atmosphere will comply with the risk budget management approach specified in RCC 321 and in this instruction.

4.7. Launch Vehicle EOL Requirements

4.7.1. Any launch vehicle component that has achieved orbital velocity will be passivated as outlined in paragraph 5.11.3. Waivers must be approved by the acquisition organizati on safety office and 14 AF/SE.32 AFI91

- 217 18 FEBRUARY 2010

4.7.2. See section 5.11 for further EOL requirements.

4.8. Reentry Safety

4.8.1. The safety requirements and risk management responsibilities for the disposal of reentering satellites are discusse d in Chapter 5. Reentry hazards posed by expended launch vehicles or other jettisoned components that have achieved orbit and are not actively controlled, but have a planned (not random) reentry will reenter the atmosphere in a predictable location, will be included in the analysis and risk budgets of the launch vehicle. Expended launch vehicle components that will be left in space and may later reenter uncontrolled, will be designed to maximize aerothermal demise to minimize reentry hazards.

4.8.2. General Responsibilities. The appropriate wing commander or equivalent is responsible for ensuring the safe reentry of expendable launch vehicles/components, reentry vehicles/components, and reusable launch vehicles/components, to include their jettis oned components.

4.8.2.1. This commander or equivalent is also responsible for all reentry risks to the general public, landing recovery area personnel and other mission support personnel at
the de

- orbit initiation event through final landing and the safing of the returning space
vehicle.

4.8.2.2. For a controlled reentry vehicle, the appropriate wing commander or equivalent is responsible for preventing collisions with any cataloged orbiting objects from collision with the reentering vehi cle by implementing reentry holds.

4.8.2.2.1. The reentry/recovery site commander or equivalent has the authority to approve or deny the initiation of de

- orbit. This includes the planned nominal and contingency sites.

4.8.3. Reentry Risk . The mission flight safety risk responsibilities and requirements identified in section 4.2 also apply to reentry safety. Independent risk budgets will be developed when the launch and reentry phases of flight meet the criteria in the RCC Standard
321. Risk management responsibility directly corresponds with mission command and control responsibility/authority. Reentry operations risk management will apply quantitative risk analysis consistent with DoD, RCC, AF and industry standards and practices.

4.8.3.1. Public Risk. The launching agency has public risk responsibility for reentry preparations and initiation unless other agreements delineate a different risk responsible organization. The public safety risk criteria listed below applies only to the mission flight phases associated with the reentry and/or recovery of a space vehicle, reusable launch vehicle or the flight of any other test or operation vehicle. RCC 321 should be consulted to determine if the risk criteria can be assigned to th e individual flight phases or if it should be appropriate for the entire flight of the mission.

4.8.3.1.1. The risk to the public will not exceed the criteria listed below for mission operations. The appropriate wing commander may prohibit, suspe nd or terminate any DoD, commercial, civil, government, or any test/evaluation activity, if such an activity would adversely affect other space users or violate accepted risk criteria, requirements for public health and safety or any U.S. national security interest.

4.8.3.1.1.1. The general public will not be exposed to a collective E c greater thanAFI91

- 217 18 FEBRUARY 2010 33

100 10 - 6 (one

- hundred in one million) for all hazards associated with a mission (see RCC 321).

4.8.3.1.1.1.1. When the risk from toxic haz ards exists, the range must separately ensure the allowable level of risk enforced does not exceed other standards for toxic exposure limits for the general public when appropriate mitigations are in place. This level of risk, less than 100 10 - 6 , shoul d account for each range‘s local population and population distribution, applicable national exposure guidelines and agreements with local government
authorities.

4.8.3.2. Mission Essential Personnel Risks. Mission Essential Personnel will have a
collective E c less than 300 10 - 6 (three

- hundred in one million) for all hazards associated with a mission. An appropriate allowable level for toxic risk should likewise be determined according to the factors stated in paragraph 4.8.3.1.1.1 above for public risk.

4.8.3.3. Additional Risk Analyses. The landing/recovery site will ensure that de

orbiting/reentering vehicle owners perform any other required risk analysis required to adequately address public safety for all planned de

- orbit/reent ry events. The appropriate landing/recovery site will review and approve all risk analyses associated with each de

orbit/reentry event onto the range. The approval authority for risks is outlined in section
2.4.

4.8.3.4. The landing/recovery sit e commander or equivalent will ensure each launching agency complies with safety requirements contained in MAJCOM, NAF, Center, and Wing publications. Additionally, vehicle de

- orbit/reentry events are subject to the requirements of other agencies, includi ng the licensing and air traffic control requirements of the FAA.

4.8.3.5. Additional industry standards and codes may be used in conjunction with range safety standards. If a conflict between an industry standard and a range safety standard is
d iscovered, a request for clarification will be submitted to Range Safety.

4.8.3.6. Safe Separation for Reentry Operations. The appropriate wing commander is responsible for precluding any activity that would adversely affect other space users,
in cluding manned spacecraft, based on a pre

- reentry safe separation/COLA process specified by the MAJCOM. The safe separation/COLA process will be developed based on CAs that account for reentry vehicle flight and until the vehicle is below all orbiting obj ects. To prevent collisions, that would also compromise the reentry vehicle and affect public safety, the safe separation/COLA process will account for all orbital objects with a perigee at or below the de

- orbit altitude of the reentry vehicle.

4.8.3 .6.1. Manned Spacecraft. The risk to each on

- orbit manned spacecraft will not exceed a collision probability of 1 10 - 6 (one in one million).

4.8.3.6.2. Active Satellites. The acceptable risk of reentering objects colliding with
active sat ellites and other cataloged objects will be established by 14 AF, but should not exceed a collision probability of 10 10 - 6 (ten in one million).

4.8.3.6.3. Probability. Since CA and COLA based collision probability determinations require consi derably higher fidelity launch agency data and can be34 AFI91

- 217 18 FEBRUARY 2010

costly, an acceptable alternative is to perform the assessment using more conservative
miss distance volumes.

4.8.3.6.3.1. To mitigate the risk to manned spacecraft, either ellipsoidal miss
dis tance volumes of 200 km in

- track and 50 km cross

- track and radially or spherical volumes of 200 km may be used. For active satellites and other cataloged objects, a spherical miss distance volume of 25 km may be used to determine the appropriate de

- orbit initiation hold periods. These criteria may be waived based on national need and operational considerations by a MAJCOM

approved authority.

4.8.4. Launching agency

- authored anomaly/contingency response plans, as well as debris and object recovery plans (land, shallow water and deep water impacts), will be provided to the appropriate landing/recovery site prior to launch.

4.8.5. Control of Errant Vehicle Flight. The appropriate wing commander or equivalent responsible for reentry will e nsure that an analysis is performed to determine if positive control is required for the reentry vehicle to meet the risk criteria for the public (see 4.8.3.1), including foreign country public. If it is determined that positive control is required, then Range Safety will approve the method of controlling erratic vehicle flight based on the requirements of RCC Standard 319 or equivalent.

4.8.5.1. Range/Wing Safety will develop flight termination criteria and mission flight rules to ensure operatio ns do not exceed acceptable public safety requirements IAW MAJCOM directives. The Wing Commander will approve flight termination criteria and mission flight rules. Circumstances that necessitate the activation of the Flight Termination System (FTS) will be described in the de

- orbit/reentry mission rules. The mission rules will be developed by Range Safety with inputs from the Mission Flight Control Officer and launching agency.

4.8.5.2. Range/Wing Safety, with wing commander approval, will estab lish and control hazardous launch areas and implement procedures to protect the public on land, on the sea, and in the air for each returning vehicle IAW MAJCOM directives.

4.8.5.3. The reentry and landing phases of RLV operations will meet the ri sk criteria specified in RCC 321.

4.8.5.4. A means of tracking reentering vehicles is required to ensure that reentry vehicles do not violate established reentry flight safety rules.

4.9. Waiver and Approval Authority. Consistent wit h AFI 91

- 202, MAJCOM guidance and other agreements, the risk acceptance authorities are outlined below.

4.9.1. Normal Risk Approval.

4.9.1.1. Launch. The Spacelift Commander (SLCC) is the approval authority for all risk analyses that mee t normal launch risk criteria, except for risk analyses (which shall be coordinated with the launching agency) conducted by the acquisition Single Manager.

4.9.1.2. Reentry. The acquisition center commander / wing commander is the approval
author ity for all reentry risk analyses that meet normal risk criteria. The CDR JFCC SPACE is the approval authority for all reentry risk analyses that exceed normal risk
criteria.AFI91

- 217 18 FEBRUARY 2010 35

4.9.1.3. AFCESA is the waiver authority for all facility changes that d o not meet the minimum requirements of UFC 1

- 200

- 01, and UFC 3

- 600

- 01.

4.9.2. Approval for Exceeding Normal Risk Criteria. Except as noted in paragraphs 4.9.1.2 and 4.9.1.3, and consistent with MAJCOM guidance and other agreements, the wing

comm ander is the waiver approval authority for risks exceeding normal risk criteria.

4.9.2.1. Subsequent to system testing, the NAF Commander and CDR JFCC SPACE (via 14 AF Director of Safety, if appropriate), will be notified of risks that exceed norm al risk criteria by more than one order of magnitude.

4.9.2.2. Risks exceeding normal risk criteria by two or more orders of magnitude (e.g.,
one in one million vs. one

- hundred in one million) require MAJCOM/CC approval.

4.9.2.3. In the e vent of a commercial/civil launch from the range, use established interagency agreements for risk acceptance and waiver approval. The Code of Federal Regulations (CFR), Title 14, Part 417, Launch Safety, delineates safety requirements for
commercial launc h operators, established by the FAA in conjunction with the DoD, that are fully compatible with DoD space safety guidance.

4.9.2.4. The wing CoS will review all waiver requests requiring wing commander approval. The wing will document risk manage ment decisions that exceed the accepted risk criteria. Subordinate units (wings, centers, NAFs, etc.) will provide the MAJCOM/SE copies of all waiver requests.

4.10. Additional Range, Launch, and RV Guidance. Reference RCC 321, AF Space
Comm and Instruction (AFSPCI) 91

- 700, Range Safety Publication Series , AFSCPI 91

- 701, Launch Safety Program Policy , the AFSPC Manual (AFSPCMAN) 91

- 710, Range Safety User Requirements Manual , and AFSPCMAN 91

- 711, Launch Safety Requirements For Air Force
S pace Command Organizations , for additional range, launch, and RV guidance. Note: For the foreseeable future, most if not all AF launches will occur from AFSPC controlled ranges. AF organizations will use this instruction and AFSPC Space Safety guidan ce when operating from these ranges.36 AFI91

- 217 18 FEBRUARY 2010

Chapter 5

- ORBITAL SAFETY

5.1. Orbital Safety Program. The high cost of orbital space systems, unique operational design and irrecoverable nature of orbital operations make mishap prevention a crit ical component of orbital space systems from the initial design phase through EOL disposal. An orbital safety program will be developed for any non

- ballistic vehicle or payload designed to complete one or more revolutions in Earth orbit. The orbital safe ty program will span the development, testing and operation of these space systems, to include spacecraft design, on

- orbit testing and operations, reentry, recovery and disposal. Ballistic/fractional orbit vehicles/payloads are covered in Chapter 4. This chapter addresses the AF and DoD satellites under the command of the JFCC (―Blue‖), satellite safety programs, to include any systems that reach an altitude high enough to pose significant risk of collision, debris generation or otherwise
interfere with o ther active orbital space systems; all will comply with the requirements specified
in this instruction.

5.1.1. All organizations with Satellite Control Authority or that test or operate any space system (including satellites, payloads and experime ntal systems) that is designed to complete one or more revolutions in Earth orbit, will establish an orbital safety program. All orbital space programs will include orbital safety program processes to ensure that their spacecraft
and on orbit checkout a nd orbital operations:

5.1.1.1. Are designed to survive the space environment or current/projected threats throughout its mission lifetime. In addition, both the spacecraft and required support equipment (including any equipment that transmits/re ceives a signal or power into/from space) will be designed to operate during space environment events (e.g., solar maximum, meteor storms/showers). TTPs should be used to minimize the effects of hazards that are not cost effective to design against.

5.1.1.2. Minimize generation or reduce accumulation of space debris consistent with mission requirements and cost effectiveness in accordance with National Space Policy, DoDI 3100.12, other US government documents, and this instruction. See section 5 .8 for specific requirements.

5.1.1.2.1. Any planned release of orbital debris must be approved by the Single Manager and higher authority when not IAW DoD policy or this instruction, and reported to the NAF/Center Satellite Control Authority‘s sa fety offices prior to design approval, mission planning and the initiation of the event.

5.1.1.3. Ensure spacecraft electromagnetic emissions do not unintentionally interfere with or degrade the operation of any on

- board equipment, adjacent spacec raft or ground

based systems/capabilities.

5.1.1.4. Use an Operational Review Process (ORP) or similar approved processes to
reduce the risk of on

- orbit collisions and electromagnetic/optical interference.

5.1.1.4.1. In addition, the Sate llite Control Authority is responsible for the protection of manned spacecraft and precluding any activity that would adversely affect other space users based on an on

- orbit COLA process identified by the MAJCOM. TheAFI91

- 217 18 FEBRUARY 2010 37

COLA process will be developed based o n assessments that account for on orbit station keeping and other maneuvers conducted as part of the spacecraft‘s mission.

5.1.1.5. The orbital safety program includes activities associated with the disposal reentry of spacecraft. The orbital saf ety program also includes activities associated with the reentry and recovery (if required) of test objects, jettisoned spacecraft components and subsidiary payloads that reenter the atmosphere in a planned and controlled or
uncontrolled manner. Unless ot herwise designated and agreed to, the agency that owns and operates the planned reentry site, if any, is the lead agency for assuring safety during the reentry phase.

5.1.2. Units will provide dedicated Orbital Safety Officers (OSO) for each progr am Orbital Safety Officers should manage the Satellite Control Authority‘s orbital safety program to
include:

5.1.2.1. Participate in all ORP and Operational Review Board or equivalent processes to surface trends and for space safety related issue s.

5.1.2.2. Ensure routine test, operations and experimental procedures take no unnecessary risk, consistent with cost effectiveness and mission requirements.

5.1.2.3. Participate in both routine operations and spacecraft anomaly recovery actions in order to gain experience and help develop lessons learned to prevent future anomalies.

5.1.2.4. Tailor local space safety training for operations and operations

- test personnel for greater applicability for assigned missions and operati onal/test conditions.

5.1.2.5. Assist operations/operations

- test personnel in complying with space safety guidelines, including: EOL passivation and disposal and other applicable space safety requirements.

5.1.2.6. Monitor Crew Rest, tra ining, system modifications and any other aspect of operations, so as to advise the unit commander on risks to the mission.

5.2. On

- Orbit Risk. The appropriate wing commander, in conjunction with the NAF AOC, assumes the responsibility for th e protection of manned spacecraft and active spacecraft from the separation of the last launch vehicle component through EOL disposal or reentry.

5.2.1. The risk criteria listed below form the basis for risk management criteria in all aspects
of o n orbit checkout and orbital operations. Each on orbit checkout and orbital operation will satisfy the following criteria for assessed risk unless higher risk levels are specifically accepted with documented waivers for the operation.

5.2.1.1. Ac cidental Explosions. For each spacecraft and launch vehicle orbital stage employed for a mission, the program shall demonstrate, via failure mode and effects analyses or equivalent analyses, that the integrated probability of explosion for all failure
mod es of each spacecraft and launch vehicle is less than 0.001 (excluding collisions).

5.2.1.2. Intentional Breakups. Immediately before a planned explosion or intentional collision, the probability of debris, orbital or ballistic, larger than 1 mm colliding with any operating spacecraft within 24 hours of the breakup shall be verified to not exceed 1
10 - 6 (one in one million).38 AFI91

- 217 18 FEBRUARY 2010

5.2.1.3. Manned spacecraft shall be protected by not exceeding a probability of impact greater than 1 10 - 6 pe r spacecraft, or criteria outlined by MAJCOM/SE in coordination with the JSpOC. A spacecraft is considered manned if it is currently occupied, or expected to be occupied, and includes spacecraft en route to, and in support of, manned
missions.

5.2.1. 4. Collisions with Active Satellites. The probability of collision with active satellites will be established by 14 AF, but should not exceed 10 x 10 - 6 (ten in one million) for active satellites per object.

5.2.1.5. Collisions with Large Ob jects. For each spacecraft or launch vehicle component in or passing through LEO, the program shall demonstrate that, during the orbital lifetime of each spacecraft or launch vehicle component, the probability of accidental collision with space objects la rger than 10 cm in diameter is less than 0.001.

5.2.1.6. Collisions with Small Objects. For each spacecraft or launch vehicle component, the program shall demonstrate that, during the mission of the space system, the probability of accidental col lision with objects (including space debris and meteoroids) sufficient to prevent post

- mission disposal, is less than 0.01.

5.3. Waiver and Approval Authority. Consistent with AFI 91

- 202, MAJCOM guidance and other agreements, the risk accepta nce authorities are outlined below.

5.3.1. Normal Risk Approval.

5.3.1.1. Operations/End

- of

- Life. Except for reentry decisions, the space operations squadron commander (or equivalent) is the approval authority for all operations/EOL risk analyses that meet normal risk criteria except for risk analyses conducted for the PM as a part of deployment or operational support.

5.3.1.1.1. Reentry. The wing commander is the approval authority for all reentry risk analyses that meet normal risk criteria. The CDR JFCC SPACE is the approval authority for all reentry risk analyses that exceed normal risk criteria.

5.3.2. Approval for Exceeding Normal Risk Criteria. Except as noted in paragraphs 5.3.1.1.1 and consistent with MAJCOM g uidance and other agreements, the wing commander is the waiver approval authority for risks exceeding normal risk criteria.

5.3.2.1. Subsequent to system testing, the NAF Commander and CDR JFCC SPACE (via 14 AF Director of Safety, if appropriate), will be notified of risks that exceed normal risk criteria by more than one order of magnitude.

5.3.2.2. Risks exceeding normal risk criteria by two or more orders of magnitude (e.g.,
one in one million vs. one

- hundred in one million) require MAJ COM/CC approval.

5.3.2.3. The wing CoS will review all waiver requests requiring wing commander approval. The wing will document risk management decisions that exceed the accepted risk criteria. Subordinate units (wings, centers, NAFs, etc.) wil l provide the MAJCOM/SE copies of all waiver requests.

5.4. Orbital Mishaps and Anomalies.AFI91

- 217 18 FEBRUARY 2010 39

5.4.1. Orbital Mishaps

. All mishaps that occur after successful separation from all launch vehicle components, including upper stages and tran sfer/kick motors, are considered orbital mishaps. Refer to AFMAN 91

- 222 for reporting and investigation requirements.

5.4.1.1. Mishaps occurring prior to the separation of the last launch vehicle components may be considered a launch mishap. The specific nature of the mishap may not be determined until after the investigation has begun.

5.4.1.2. Mishaps occurring subsequent to the time the spacecraft operating agency is capable of sending commands to the spacecraft, or such time as the s pacecraft begins any automated command sequences, may be considered orbital mishaps. The specific nature of the mishap may not be determined until after the investigation is complete.

5.4.1.3. It is possible for an orbital mishap to occur while launch vehicle hardware is still attached to the spacecraft. It is also possible for a launch mishap to occur once the spacecraft is commandable but still attached to launch vehicle hardware. The specific nature of the mishap may not be determined until after the investigation is complete.

5.4.2. Anomalies. Anomalies are unexpected events that may or may not result in damage, injury, or mission impact, but do not reach the level of a reportable mishap. This may be due to a malfunction of the sp acecraft, human factors, the space environment or a variety of other reasons. Investigate all spacecraft anomalies in accordance with AFMAN 91

- 222. While anomalies may not initially meet Class A

- E mishap/event criteria, anomalies should be reported as Class E HAPs if preexisting full recovery procedures do not exist (i.e. full recovery is automated or checklist driven without additional planning or intervention).

5.4.2.1. Orbital Safety Officers will be notified within 8 hours of all mission im pacting or emergency anomalies/incidents and within 72 hours of all other anomalies. OSOs will be invited to participate as a full member on all non

- routine Anomaly Resolution Teams, Engineering Review Boards, Operational Review Boards or similar construc ts.

5.4.2.2. Safing. Organizations testing or operating orbital spacecraft, payloads, or experiments will have a formal and approved (wing or equivalent level) safing process that limits/prevents further mission degradation or failure.

5.4.2 .2.1. Depending on the severity of the anomaly, the tester/operator should consider maneuvering the spacecraft to non

- operational orbit, although not necessarily in a final disposal orbit. For GEO spacecraft, this will be at least 235 km
above or belo w GEO.

5.4.2.3. Reporting. To ensure proactive mishap prevention, the relevant findings (to include Smart Ops) and recommendations from any anomaly investigation (e.g., Operations Review Board, Commanders Directed Investigation, or Anomaly Reso lution Process) will be reported through safety channels in accordance with AFI 91

- 204 and
AFMAN 91

- 222, in addition to normal reporting channels.

5.5. Orbital Mishap Prevention. Given the general inaccessibility of on

- orbit hardware and
inab ility of full component replacement, mishap prevention for on

- orbit assets requires significant planning during the design phase. As with normal mishap prevention programs, orbital mishap prevention starts with spacecraft design and on

- orbit test/operatio ns planning.40 AFI91

- 217 18 FEBRUARY 2010

Mishap prevention is, however, an on

- going process that occurs throughout the space systems life cycle.

5.5.1. Satellite Control Authority responsibility for mishap prevention begins after orbital insertion and when the spacecraft is capable of receiving transmitted commands or executing

pre

- stored command sequences. At such time, there is a possibility of overlapping responsibility for mishap prevention with the launching agency. Thus, the appropriate Launch Wing and Satellite Cont rol Authority organization must work closely with one another to ensure proper system integration of the spacecraft with the launch vehicle.

5.6. Orbits. To provide a context for the guidelines in this chapter, four high interest regions of

s pace are identified below and shown in Figure 5.1. Compliance with orbital safety requirements is especially important in these regions of space due to the high use or unique operational advantages provided. Failure to adhere to operational and disposal requirements will adversely affect other users within that region. Regardless of a spacecrafts orbit, it is critical that all mission and disposal operations do not interfere with other users.

Figure 5.1. High Interest Earth Orbits

5.6.1

. Low Earth Orbit (LEO) . The region of space that extends from approximately 150 to
2000 km altitude.

5.6.2. Medium Earth Orbit (MEO) . The region of space midway between LEO and Geostationary Orbit (GEO).

5.6.2.1. Semi

- Synchrono us Orbit (SSO). SSO is a subset of MEO. The region of space containing nearly circular 12

- hour orbits. This region is the spherical shell surrounding the Earth between approximately 18400 to 25200 km.AFI91

- 217 18 FEBRUARY 2010 41

5.6.3. Geosynchronous Orbit (GSO) and Geo stationary Orbit (GEO) . GSO is an orbit with a period equal to the sidereal day. Geostationary orbit is a circular geosynchronous orbit
with a 35786 km altitude and 0o inclination. Note: Common practice is to refer to satellites in low inclination g eosynchronous orbits as geostationary satellites, even if they are technically not stationary due to their non

- zero inclination.

5.6.4. Highly Elliptical Orbit (HEO)

. HEO is an elliptic orbit characterized by a low perigee (typically at LEO a ltitudes) and a relatively high

- altitude apogee (typically in/above GEO). These elongated orbits can have the advantage of long dwell times (~9

- 12 hour period) at a point in the sky during the approach to and descent from apogee. Molniya orbits, at approxi mately 63o inclination, are one example of a typical highly elliptical orbit.

5.7. Space Environmental Hazards. The space environment is the region of space in which spacecraft and orbital launch vehicle components can operate. The space env ironment composition and effects change with altitude, time and solar and cosmic activity. Space hazards to spacecraft fall into two general categories: debris and environmental hazards.

5.7.1. Space debris consists of both man

- made and natural objects. Natural objects include meteoroids and associated dust and gas particulates. Man

- made objects include anything from defunct space systems to solid rocket engine slag, insulation blankets and mission related debris. Regardless of origin, high ve locity impacts can pose a significant if not fatal hazard to spacecraft. Minimizing the creation of this debris is of critical importance. See section 5.8 for specific requirements.

5.7.1.1. Orbital Safety programs will be established to preven t mishaps from space hazards. Once cataloged, the debris from man

- made object from hostile or non

- hostile (or
intentional or non

- intentional debris) does not necessarily change an Orbital Safety program‘s reaction to the debris. In the changing world of sp ace and the introduction of defensive counterspace, there is the possibility of hostile attacks on space assets.

5.7.2. Space environmental hazards include, but are not limited to: microgravity, cosmic rays, charged particles, plasma and solar ra diation.

5.7.2.1. The Earth‘s geomagnetic field is a tear

- drop shaped magnetic field that largely protects the Earth from plasma and other charged particles impacts. Charged particles and plasmas can be a hazard to spacecraft either through direc t impact or by becoming trapped within the two Van Allen radiation belts formed by the geomagnetic field. See Figure 5.2 for a depiction of the Van Allen Belts relative to spacecraft orbits. Note: The size and shape of the Van Allen Belts varies with g eomagnetic and solar activity.

5.7.2.1.1. The inner Van Allen belt (~600 to 6000 km altitude) contains high concentrations of energetic protons and electrons trapped by the geomagnetic field.

5.7.2.1.2. The large outer radiation belt exte nds from an altitude of about 13000 to 65000 km (2 to 10 Earth radii) above the Earth's surface, and has its greatest intensity between 14500 and 19000 km. The outer belt consists mainly of high energy electrons and various ions (e.g. O+ oxygen ions).

5.7.2.2. Space Environmental Effects on Space Systems. Solar cells, integrated circuits, and sensors can be damaged by radiation. In 1962, the Van Allen belts were temporarily amplified by a high

- altitude nuclear explosion and several satellites ceas ed operation.42 AFI91

- 217 18 FEBRUARY 2010

Geomagnetic storms occasionally damage electronic components on spacecraft. Miniaturization and digitization of electronics and logic circuits have made satellites more vulnerable to radiation, as incoming ions may be as large as the circuit' s charge. Electronics on satellites must be hardened against radiation to operate reliably. The Hubble Space Telescope, among other satellites, often has its sensors turned off when passing through regions of intense radiation. Spacecraft in all orbits ar e susceptible to environmental hazards to one degree or another. It is critical that spacecraft designs and experimental/test/operations plans account for the effects of the space environment.

Figure 5.2. Van Allen Belts relative to GPS and GEO o rbits

5.8. Space Debris. Space debris poses a risk to continued reliable use of space

- based services and operations and to the safety of persons and property in space and on Earth. The United
States shall seek to minimize the creation of orbital debris by government and non

- government operations in space in order to preserve the space environment for future generations.

5.8.1. In concert with DoD regulations, the AF will continue to follow the U.S. Government
Orbital Debris Miti gation Standard Practices , consistent with mission requirements and cost effectiveness in the procurement and operation of spacecraft, launch services and the operation of tests and experiments in space.

5.8.1.1. Space Debris Management Objective . This instruction requires that all space systems and launch vehicles (or components), that are expected to achieve orbital velocity, manage (mitigate and control) potential space debris generation through an assessment of the system design and concept of operations through end

- of

- life disposal. Note: The long term goal of any space debris mitigation program is zero debris generation.AFI91

- 217 18 FEBRUARY 2010 43

5.8.2. This instruction provides a life cycle approach to ensure that debris mitigation processes are incorporat ed into system development, operations, disposal, reentry, and recovery. Additionally, for space systems that cannot meet debris mitigation requirements due to mission constraints or cost effectiveness, this instruction describes the requirements and proc ess for a debris risk assessment. Failure to incorporate debris management in the normal system design process could lead to generation of orbital debris and increased hazard to other orbital assets through collisions that would in turn generate additiona l debris. The increased hazard would require more costly and heavier designs to protect operational capabilities at the expense of mission lifetime. Failure to assess reentry risk adequately could lead to property damage and/or human causalities from unc ontrolled random reentries.

5.8.2.1. Space Debris Mitigation Assessments. Space debris mitigation assessments are required to be performed during the initial planning stages of the development of any orbital space system.

5.8.2.1.1. The PM shall assess the mission for compliance with DoDI 3100.12, Strategic Command Instruction (SI) 505

- 4, Satellite Disposal Procedures , and this instruction for generation of space debris during all mission phases.

5.8.2.1.1.1. The PM will prepar e and deliver the mission space debris assessments in the Space Debris Assessment Report (SDAR) per the format and content defined in Attachment 2 for all objects being launched into space by an AF organization. The attachment also outlines the SDAR deli very requirements.

5.8.2.1.2. Hazardous Material Planning. During the design process, PMs will document hazardous materials contained in the space system and will estimate and plan for the system‘s safe disposal.

5.8.2.1.3. Operational S pacecraft Debris Release. Programs are required to assess and minimize the amount of orbital debris released during launch and orbital operations. Ideally, no operational debris will be released during normal operations of a spacecraft.

5.8.2.1.4. Accidental Explosions. Programs are required to implement processes, procedures and measures for the prevention of accidental explosions during and after completion of mission operations.

5.8.2.1.5. Safe Operational Configuration. Programs ar e required to select a safe operational configuration to limit the probability of collisions with known large objects during a spacecraft‘s orbital lifetime.

5.8.2.1.5.1. Programs are required to assess and minimize the probability that a

spacecra ft will become a source of orbital debris through collisions with debris smaller than 1 cm in diameter that could cause loss of control and prevent safe post

- mission disposal. Collision assessment and the corresponding mitigation/limitation will be documen ted in the SDAR.

5.8.2.2. Design Reviews, Plans, and Assessment.

5.8.2.2.1. Systems Development and Demonstration. Space system programs are required to conduct a space debris assessment from the start of the acquisition process
and to e nsure that mitigation requirements are identified for inclusion in contractually44 AFI91

- 217 18 FEBRUARY 2010

binding documents. Consistent with mission requirements and cost effectiveness, space system architectures shall encompass all pertinent debris mitigation requirements for sp acecraft, launch vehicles, orbital stage(s), and objects released during normal operations.

5.8.2.2.1.1. If a requirement cannot be met because of an overriding conflict with mission requirements or prohibitive cost impact, this shall be specifica lly noted in the SDAR with the appropriate rationale and justification.

5.8.2.2.2. Mitigation plans and procedures are defined and documented during the program mission definition and conceptual design phases; relevant debris generation

sources an d/or processes are identified at the Preliminary Design Review (PDR) and resolved by the Critical Design Review (CDR). The SDAR addresses and documents the following:

5.8.2.2.2.1. The potential for debris generation during normal operations or

ma lfunction conditions.

5.8.2.2.2.2. The potential for generating debris by collision with space debris (natural or human generated) or other space systems.

5.8.2.2.2.3. Post

- mission retirement/disposal.

5.8.2.2.3. Debris managemen t considerations shall be formulated in the Initial Space Debris Mitigation Strategy and Disposal Concept. These considerations will be
documented and will serve as the basis for both the SDAR and the End

- of

- Life Plan (EOLP), respectively. This documentati on will also serve as an integral part of the

pre

- systems acquisition/concept development process and support the preparation of the following documentation:

5.8.2.2.3.1. Acquisition Strategy; and

5.8.2.2.3.2. System Specification; and

5.8.2.2.3.3. PESHE; and

5.8.2.2.3.4. National Environmental Policy Act documentation.

5.8.2.2.4. Design Reviews. The debris management planning and implementation shall be reviewed and assessed at major design reviews. Debris man agement considerations in the Systems Development Phase will influence but not be limited to PESHE and the Systems Specification.

5.8.2.3. Operations, Sustainment, and Disposal.

5.8.2.3.1. Programs should develop appropriate orbital safet y TTPs for operations and disposal.

5.8.2.3.2. End of Life Disposal. Programs shall develop appropriate disposal plans for orbital space systems to either to reenter the atmosphere safely or else be moved into a disposal orbit at the end of its u seful where it will be less likely to interfere with operational spacecraft. Programs will provide an EOLP for the disposal of the space system at the end of its useful life. Effective disposal of nonfunctional space systems not only provides an immediat e benefit by protecting operational spacecraft fromAFI91

- 217 18 FEBRUARY 2010 45

accidental collisions with orbital debris, but also has the long

- term benefit of reducing the probability of nonfunctioning objects colliding with one another and creating
additional debris.

5.8.2.3. 2.1. PMs shall prepare, update, and deliver an EOLP using a format and content outlined in Attachment 3 for the configuration of the space vehicles anticipated at EOL for all objects. The attachment also outlines the EOLP delivery requirements.

5 .8.2.3.3. Programs shall develop appropriate reentry/recovery analysis, plans and procedures for:

5.8.2.3.3.1. Launch vehicle reentry into the atmosphere.

5.8.2.3.3.2. Informing the relevant air traffic and maritime traffic authoritie s of the reentry time and trajectory and the associated ground area for controlled reentry.

5.8.2.3.3.3. Reentry risk analyses for ground environmental pollution caused by radioactive substances, toxic substances, or any other environmental pollut ants.

5.8.2.3.3.4. Debris surviving reentry recovery process.

5.8.2.3.4. During disposal, Space Surveillance Network (SSN) tracking data will be used to predict reentry of space systems due to the potential for damage or human
casualties. The JSpOC tracks the space object in orbit and gives a 30 day notification of reentry.

5.8.2.4. Debris Management Controls.

5.8.2.4.1. Failures to meet debris mitigation requirements shall be documented in the
SDAR and submitted to the Center (or equivalent) Chief Engineer for review; the center (or equivalent) Safety Office shall be copied on any non

- compliances.

5.8.3. Assessment of Debris Released During Normal Operations. Programs will assess and
limit the amount of launch vehicle and spacecraft debris released in normal operations. This requirement applies to all space systems in Earth orbit and is recommended for operations beyond Earth orbit.

5.8.3.1. In all operational orbit regimes, space systems will be desig ned not to release debris during normal operations. Where this is not feasible, any release of debris shall be minimized in number, area, and orbital lifetime.

5.8.3.2. Historically, debris has been released as an incidental part of normal space operations. This type of debris is referred to as operational or mission

- related debris and includes such objects as sensor covers, tie

- down straps, explosive bolt fragments, attitude control devices, and dual payload attachment fittings.

5.8.3.3. Programs will design space systems to avoid the creation of any operational or
mission

- related debris. If the release of debris is unavoidable, the release shall be done in a manner that limits the risk to other users of space. Note: Small debris, su ch as slag which is ejected during the burning of a solid rocket motor and liquids dispersed from a spacecraft, are exempt from these requirements.46 AFI91

- 217 18 FEBRUARY 2010

5.8.3.3.1. Debris 1 mm in diameter (about 1 mg) and larger for LEO and 5 cm (about 100 gm) and larg er for GEO is a source of concern because these debris have sufficient energy to critically damage an operating spacecraft. Large debris can create a cloud of secondary debris fragments in the event of a collision with another resident space object.

5.8.3.3.2. Debris passing through LEO. For missions leaving debris in orbits passing through LEO, released debris with diameters of 1 mm or larger shall satisfy the following requirements:

5.8.3.3.2.1. All debris released during the deploymen t, operation, and disposal phases shall be limited to a maximum orbital lifetime of 25 years from date of
release.

5.8.3.3.2.2. The total object

- time product shall be no larger than 100 object

- years per mission. The object

- time product is the sum of all debris of the total time spent below 2000 km altitude during the orbital lifetime of each object.

5.8.3.3.3. Debris passing near GEO. For missions leaving debris in orbits with the potential of traversing the GEO orbital regime, released debris with diameters of 5 cm or greater shall be left in orbits which will ensure that within 25 years after release the apogee will no longer exceed GEO

- 300 km (35486 km).

5.8.3.4. Brief Summary of Mitigation Measures Used. If a program does not fall within the above requirements, a number of mitigation measures may be taken. These include:

5.8.3.4.1. Releasing debris in orbits with lower perigee altitude to reduce orbital
lifetime.

5.8.3.4.2. Designing debris with larger ar ea

- to

- mass ratio to reduce orbital lifetime.

5.8.3.4.3. Releasing debris under conditions in which lunar and solar perturbations
will reduce lifetime.

5.8.3.4.4. Limiting release of debris by making design changes, changing operational

pr ocedures, or confining debris to prevent release into the environment.

5.8.4. Assessment of Debris Generated by Explosions and Intentional Breakups. Programs will assess and limit the probability of accidental explosion during and after completio n of mission operations.

5.8.4.1. Spacecraft and launch vehicle orbital stage explosions have been the primary contributor to the hazardous orbital debris environment. Some explosions have been accidental with onboard energy sources providing the energy such as residual propellants or pressurants left in orbital stages. However, some intentional breakups have occurred as tests or as a means of disposing of spacecraft.

5.8.4.2. In order to limit the risk to other space systems from accide ntal breakups after the completion of mission operations, all onboard sources of stored energy of a space system, such as residual propellants, batteries, high

- pressure vessels, self

- destructive devices, flywheels, and momentum wheels shall be depleted or safed when they are no longer required for mission operations or post

- mission disposal. Depletion shall occur as soon as this operation does not pose an unacceptable risk to the payload.AFI91

- 217 18 FEBRUARY 2010 47

5.8.4.3. Meeting this requirement necessitates reliable des igns to prevent explosions during operations as well as after operations are completed.

5.8.4.4. Accidental Explosions. Accidental explosions of spent orbital stages have been the primary source of long

- lived debris greater than 1 cm in diameter in LEO. The assessed source of energy for most of these events has been residual propellants, including liquid oxygen and hypergolic propellants. Several spacecraft breakups have been linked to battery failures. Accidental explosions, primarily related to propulsion system malfunctions, during orbital deployment or orbital operations have also been documented. However, historically these events have attracted greater attention and more extensive preventive measures.

5.8.4.4.1. Programs will ass ess and limit the probability of accidental spacecraft and launch vehicle orbital stage explosion during and after completion of deployment and mission operations. The acquisition organization for each spacecraft or launch
vehicle will:

5.8.4.4.1.1. Demonstrate, via failure mode and effects analyses or equivalent analyses, that the integrated probability of explosion for all failure modes (excluding collisions) of each spacecraft and launch vehicle is less than 0.001 (one

- thousand in one

- million). If the probability of accidental explosion exceeds this limit for either a spacecraft or orbital stage, design or operational countermeasures shall be implemented to reduce the probability below the limit.

5.8.4.4.1.2. Ensure that the design of all spacecraft and launch vehicle components will include the ability to deplete all onboard sources of stored energy and disconnect all energy generation sources when they are no longer required for mission operations or post

- mission disposal or control. This process is known as passivation. Specific passivation requirements are outlined in paragraph 5.11.3.

5.8.4.5. Intentional Breakups. Intentional breakups have been used to reduce the amount of debris surviving the reentry of large space sys tems and in conjunction with on

- orbit tests. Secondary debris can also be generated by the collision of breakup debris with large operational and non

- operational resident space objects. This risk is mitigated by placing limits on the numbers and orbital lifetime of breakup debris large enough to cause significant subsequent breakups.

5.8.4.5.1. Programs will assess and limit the effect of intentional breakups of spacecraft and launch vehicle orbital stages on other users of space. Consistent wit h

cost

- effectiveness and mission objectives, organizations conducting intentional breakups or collisions of spacecraft or launch vehicles will ensure that:

5.8.4.5.1.1. Planned explosions or intentional collisions are conducted at an
altitude such that for orbital debris fragments larger than 10 cm the object

- time product does not exceed 100 object

- years. No debris larger than 1 mm shall remain in Earth orbit longer than one year.

5.8.4.5.1.2. Immediately before a planned explosion or int entional collision, the probability of debris, orbital or ballistic, larger than 1 mm colliding with any operating spacecraft within 24 hours of the breakup will be verified to not exceed48 AFI91

- 217 18 FEBRUARY 2010

1 10 - 6

. 5.8.4.6. To lower the risk associated with on

- or bit breakups:

5.8.4.6.1. Lower the altitude at which the breakup occurs. This is by far the most effective response for reducing both the near

- term and long

- term risk to other users of

space.

5.8.4.6.2. Lower the perigee altitude of the orbit of the breakup vehicle(s).

5.8.4.6.3. Adjust the time for performing the breakup to avoid spacecraft or large resident space object interactions with regions of high flux concentration.

5.8.4.6.4. Deplete propellants and other store d energy sources as soon as practical.

5.8.5. Assessment of Debris Generated by On

- orbit Collisions. In developing the design and mission profile of a space system, a program will estimate and limit the probability of
accidental collision with kn own resident space objects during the system's orbital lifetime. If reliable orbital data is available, avoidance maneuvers for spacecraft and coordination of launch windows may be considered if the collision risk is not considered negligible. Spacecraft design shall limit the probability of collision with small debris which could cause a loss of control, thus preventing post

- mission disposal.

5.8.5.1. Debris can be generated by random on

- orbit collisions during and after mission operations. At issue are both the direct generation of debris by collision between the space vehicle and another large object in orbit, and the indirect or potential generation of debris when collision with small debris damages the vehicle to prevent its disposal at EOM, making it more likely that the vehicle will be fragmented in a subsequent breakup.

5.8.5.2. While it remains intact, a spacecraft or launch vehicle component represents a small collision risk to other users of space; however, once it is fragmente d by collision, the collision fragments present a risk to other users that may be orders of magnitude larger. Because of typically high collision velocities, debris objects much smaller than the spacecraft may cause severe fragmentation (referred to as a catastrophic collision). For purposes of evaluation, debris with a diameter of 10 cm and larger will be assumed to cause a catastrophic collision.

5.8.5.3. Catastrophic collisions during mission operations represent a direct source of
debris. Ho wever, if a spacecraft or launch vehicle component fails to perform its planned post

- mission disposal operations, it becomes a potential source of debris because a structure that is abandoned in orbit can subsequently experience catastrophic breakup by
col lision or explosion.

5.8.5.4. Programs will assess and limit the probability that the operating space system
becomes a source of debris if it collides with orbital debris or meteoroids.

5.8.5.4.1. Limiting debris generated by collisions w ith large objects. For each space system in or passing through LEO, the program will demonstrate that, during the orbital lifetime of each space system, the probability of accidental collision with space objects larger than 10 cm in diameter is less than 0.001.

5.8.5.4.2. Limiting debris generated by collisions with small objects. For each spacecraft, the program or project shall demonstrate that, during the mission of theAFI91

- 217 18 FEBRUARY 2010 49

spacecraft, the probability of accidental collision with objects, includin g orbital debris and meteoroids, sufficient to prevent post

- mission disposal is less than 0.01.

5.8.5.5. Brief Summary of Mitigation Measures Used.

5.8.5.5.1. If a spacecraft or launch vehicle component in LEO or passing through
LEO has a high probability of colliding with large objects during its orbital lifetime, there are several mitigation measures that may be taken, to include the following
courses of action:

5.8.5.5.1.1. Changing the planned mission orbit altitude to reduce the expected collision probability.

5.8.5.5.1.2. Changing the spacecraft design to reduce cross

- sectional area and thereby reduce the expected collision probability.

5.8.5.5.1.3. Reducing the amount of time in orbit by selecting a lower d isposal
orbit.

5.8.5.5.2. There are many mitigation measures to reduce the probability that collisions with small debris will disable the spacecraft and prevent successful post

mission disposal. These measures use the fact that the debris threat is directional (for orbital debris, highly directional) and that the directional distribution can be predicted
with confidence.

5.8.5.5.2.1. Design responses to reduce failure probability include addition of component and/or structural shielding, rearrangement of components to let less sensitive components shield more sensitive components, use of redundant components or systems, and compartmentalizing to confine damage.

5.9. Conjunction Assessment. Through the JSpOC, JFCC SPACE is the lead agency for orbital conjunction assessments. All AF launch and orbital space systems will use JSpOC generated CA runs for official COLA risk decisions. Secondary CA determinations, outside JSpOC are authorized, but will not be used for official COLA risk decisions without Wing CC approval in coordination with the JSpOC.

5.9.1. Consistent with mission capabilities and resource availability, conjunction assessments will be conducted for all active spacecraft against all satellite catalog objec ts within JSpOC established threat thresholds. These thresholds are typically identified by a miss distance, but other criteria may be used, as appropriate.

5.9.1.1. Given resource constraints and consistent with established agreements, manned

sp acecraft and active US and allied spacecraft will be prioritized.

5.9.2. Each spacecraft operator, in coordination with the wing Safety Office, JFCC SPACE and 14 AF/SE, will develop thresholds (e.g. very low Delta

- V (ΔV) maneuvers) within which

no CA/COLA is required.

5.9.3. Spacecraft owner/operators, operating spacecraft using automated maneuver protocols, will work with JFCC SPACE, 14 AF/SE and the wing Safety Office (or equivalent) to develop appropriate CA/COLA procedures.

5.10

. Collision Avoidance. In addition to damaging or destroying objects in space, collisions generate large quantities of hazardous debris that can lead to further collisions, potentially50 AFI91

- 217 18 FEBRUARY 2010

rendering some orbits unsafe for years. Thus, it is of critical importance that collisions involving orbiting objects are avoided. Ensure the probability of collision is weighed against the risk of shortening mission

- life due to expenditure of fuel when making this maneuver decision.

5.10.1. An ORP approved COLA processes will be developed for both maneuverable and

non

- maneuverable active spacecraft.

5.10.1.1. MAJCOMs will establish notification processes for non

- maneuverable spacecraft designed to alert cognizant officials of potentially unavoidable collisions prior
to the event.

5.10.1.2. AF organizations will use an AFSPC approved Commercial and Foreign Entities (CFE) process (or substitute) for all CA issues with commercial or foreign spacecraft. This does not relieve AF organizations of reporting requirements outlined in
this or other AF documents.

5.10.1.3. All COLA processes will identify risk acceptance levels for each program.

5.10.2. See section 4.6.6 for CA/COLA processes for launch vehicle components.

5.10.3

. Regardless of whether or not a COLA maneuver is performed, all high risk COLA decision processes shall be documented for mishap prevention purposes.

5.10.3.1. Any COLA risk decision that is calculated to be a high or extremely high risk (per Operational Risk Management (ORM) risk assessment matrix) or any COLA risk decision that requires Satellite Control Authority Wing CC (or designated COLA approving official), will be reported in AFSAS as a Class E HAP or higher, consistent
with AFMAN 91

- 2 22. Waivers to this requirement must be approved and documented by NAF/Center Safety Office and 14 AF/SE.

5.10.4. ―Smart Ops‖ or TTPs can be used for collision avoidance purposes.

5.10.5. The COLA process shall be used prior to any RV pl anned descent phase implementation (de

- orbit burn) to protect against collision with the returning vehicle and shall compute the closest approach or collision probability of the descending vehicle.

5.10.5.1. The NAF/Center Safety Office is respons ible for enforcing COLAs during reentry phase.

5.10.6. Automated maneuver protocols will employ risk management techniques that prevent unintended consequences. Failure modes will be designed to prevent collisions or debris generation events.

5.10.7. Noncompliance with approved COLA procedures will be reported to JFCC SPACE (via 14 AF/SE) and MAJCOM/SE.

5.10.8. Close Proximity Operations. Orbital operations involving the close proximity of two or more space objects require speci al consideration. Formation operations typically involve spacecraft that are specifically designed to operate in close proximity to one another. These operations may involve refueling or re

- boosting of the  ̳recipient‘ space object. Rendezvous operations may also involve space objects that are  ̳unaware‘ of the other object(s).

5.10.8.1. Traditional CA procedures will not work for close proximity operations. ORP approved procedures will be developed for CA and close proximity operations. TheseAFI91

- 217 18 FEBRUARY 2010 51

p rocedures will be designed to avoid unintended spacecraft

- spacecraft contact, unnecessary debris generation, or the contamination of sensitive equipment from spacecraft thruster firings or other off

- gassing.

5.10.8.2. Objects designed for close pr oximity operations, will include failure modes that are designed to avoid collisions between the objects.

5.11. End

- of

- Life Actions. All spacecraft and launch vehicle components will be passivated and disposed of at EOL via methods outlined i n this section.

5.11.1. Reliability of post

- mission disposal operations. Programs will ensure that all post

mission disposal operations are designed for a probability of success as follows:

5.11.1.1. For disposal maneuvers not associated with controlled reentry, the probability
of success shall be no less than 0.90 at EOL.

5.11.1.2. For controlled reentry, the probability of success at the time of reentry burn shall be sufficiently high so as not to cause a violation of section 4 .8.3 pertaining to limiting the risk of human casualty.

5.11.2. Disposal. All Air Force space systems, including research and development systems

, will comply with the disposal requirements in SI 505

- 4, in addition to requirements outlined
belo w. Waivers for research and development systems must be approved of by MAJCOM/SE and 14 AF/SE. See Figure 5.3 for disposal orbits described below. Note: Any MAJCOM approved waivers to the following disposal requirements must be justified and
documente d. A copy of the justification and approval will be sent to HQ AFSC/SES.

5.11.2.1. When determining disposal orbits, operators will account for spacecraft area/mass ratio and the effect of future orbital drift due to gravitational perturbations a nd other space environmental effects. Due to fuel gauging uncertainties near the end of mission, use a maneuver strategy that has the least risk of leaving the structure near an operational orbit regime.

5.11.2.1.1. The use of orbital transfer ve hicles is authorized to be used to meet disposal orbit requirements if the orbital transfer vehicles are operational and on

- orbit at the time of the EOL of the spacecraft/launch vehicle in question. The spacecraft/launch vehicle component must still meet the 25 year decay orbit rule, if applicable for the particular orbit.

5.11.2.1.2. Due to the long period variability of eccentric orbits, it is essential that the final disposal orbits be propagated for a minimum of 100 years to ensure that its or bit does not intersect (within 500 km) high density orbits (e.g. LEO or GEO).

5.11.2.2. Atmospheric Reentry. Limit the amount of debris that can survive atmospheric reentry when used as a means of removing space systems from orbit at the EOL. Al l reentries will meet the risk requirements of RCC 321. If drag augmentation devices are to be used to reduce the orbit lifetime, demonstrate that such devices will significantly
reduce the area

- time product of the system or that it will not cause the spa cecraft or large debris to fragment if a collision occurs while the system is decaying from orbit. The disposal options described in the following paragraphs provide further guidance when destruction is not guaranteed.52 AFI91

- 217 18 FEBRUARY 2010

5.11.2.2.1. Uncontrolled Re entry. If there is a significant amount of debris expected to survive uncontrolled reentry, reduce the risk by establishing procedures or designs to reduce the amount of debris reaching the Earth's surface.

5.11.2.2.2. Controlled (destructive) Re entry. For controlled reentry of an object
intended to burn

- up in the atmosphere, the selected trajectory shall ensure that no surviving debris impacts closer than 370 km from foreign landmasses, or is 50 km from the continental U.S., territories of the U.S., and the permanent ice pack of
Antarctica.

5.11.2.2.3. Controlled (non

- destructive) / Active Reentry. The selected trajectory of an object intended to survive reentry (e.g. reusable launch vehicles and spacecraft) will comply with all airsp ace control policies, procedures and requirements.

5.11.2.3. LEO. A spacecraft or launch vehicle component with a perigee below 2000 km shall be disposed of by one of three methods:

5.11.2.3.1. Atmospheric Reentry.

5.11.2.3.1.1. Leave the spacecraft or launch vehicle component in an orbit in which natural forces will lead to atmospheric reentry within 25 years after the end of mission but no more than 30 years after launch.

5.11.2.3.1.2. Maneuver the space system into a controlled de

- orbit trajectory as soon as practical after completion of mission.

5.11.2.3.2. Disposal Orbit.

5.11.2.3.2.1. Maneuver the space system into an orbit with a perigee above 2000 km and apogee below 18400 km.

5.11.2.3.2.1.1

. For space systems in orbits below 1400 km, generally, the most energy

- efficient means for disposal is via maneuver to an orbit from which natural decay will occur within 25 years of EOL and 30 years from
launch.

5.11.2.3.2.1.2. For space sys tems in orbits between 1400 km and 2000 km, a maneuver to a storage orbit above 2000 km would likely be the best disposal option.

5.11.2.3.3. Direct Retrieval.

5.11.2.3.3.1. Retrieve the space system and remove it from orbit within 10 yea rs after completion of mission.

5.11.2.4. Between LEO and MEO. A spacecraft or launch vehicle component with a perigee above LEO and apogee below MEO shall be disposed of by the following
method:

5.11.2.4.1. Maneuver the space system int o an orbit with a perigee altitude greater than 2000 km and apogee less than 18400 km.AFI91

- 217 18 FEBRUARY 2010 53

Figure 5.3. Operating, Storage and Disposal Regions/Orbits.

5.11.2.5. MEO Navigation Orbits. Spacecraft or launch vehicle components between
18400 km and 25200 km shall be disposed of by the following method:

5.11.2.5.1. Maneuver the space system to a stable orbit that has the following parameters:

5.11.2.5.1.1. An eccentricity less than or equal to 0.003; and

5.11.2.5.1.2. A perigee altitude above 2000 km and apogee altitude below 18400 km; or54 AFI91

- 217 18 FEBRUARY 2010

5.11.2.5.1.3. A perigee altitude above 25200 km or nearby operational region and apogee altitude below 34800 km.

5.11.2.6. Between MEO and GEO. A spacecraft or lau nch vehicle component with a perigee above MEO and apogee below GEO shall be disposed of by the following
method:

5.11.2.6.1. Maneuver the space system to an orbit that has:

5.11.2.6.1.1. An eccentricity less than or equal to 0.003, and

5.11.2.6.1.2. A perigee altitude above 20700 km and apogee altitude below 22000 km, or

5.11.2.6.1.3. A perigee altitude above 25200 km and apogee less than 34800 km.

5.11.2.7. GEO. A spacecraft or launch vehicle component in an o rbit near GEO shall be disposed of by the following method:

5.11.2.7.1. Maneuver the space system to an orbit above GEO such that orbital perturbations will not cause the satellite to reenter the GEO region for a period of at least 100 years after disposal.

5.11.2.7.1.1. The minimum perigee altitude taking into account all orbital perturbations will be the greater of 36100 km or:

36086 km + C R  (1000  A/m) where A/m: Aspect area [m 2 ] to EOL mass [kg] ratio and C R is the spacecraft coefficient of reflectivity at EOL.

5.11.2.7.1.2. Orbits with modest eccentricities near GEO can be perturbed over long periods into more elliptical orbits with lower perigees. Therefore, the initial eccentricity of a GEO disposal orbit will be l ess than 0.005.

5.11.2.7.2. Use a maneuver strategy that results in a guaranteed minimum increase in the post

- maneuver perigee after each subsequent burn.

5.11.2.8. HEO/Geosynchronous Transfer Orbits (GTO)/Molniya. A spacecraft or launch vehicle component in a HEO, GTO or a Molniya orbit shall be disposed of by one of the following methods:

5.11.2.8.1. Atmospheric Reentry.

5.11.2.8.1.1. HEO/GTO. Maneuver the space system into an orbit in which
natural forces will lead t o atmospheric reentry within 25 years after the end of mission. This option is the preferred disposal option for HEO/GTO space systems.

5.11.2.8.1.2. Molniya. Maneuver the space system into an orbit in which natural forces will lead to atmospher ic reentry within 25 years after the end of mission. Atmospheric reentry options for Molniya space systems in high density orbits should be favored over disposal orbits due to the collision hazards these highly elliptical orbits pose to sun

- synchronous mi ssions as well as their own active and disposal orbits. Note: For Molniya satellites, atmospheric reentry requires less energy than placement in a disposal orbit if EOL eccentricity is greater than 0.7.AFI91

- 217 18 FEBRUARY 2010 55

5.11.2.8.2. Disposal Orbit.

5.11.2. 8.2.1. Maneuver the space system such that it will achieve a stable orbit that has the following parameters:

5.11.2.8.2.1.1. A minimum perigee of 2500 km (HEO/GTO) / 3000 km (Molniya), and:

5.11.2.8.2.1.2. An apogee not between: 184 00 km and 20700 km, 22000 km and 25200 km, or 34800 km and 36100 km.

5.11.2.8.2.1.2.1. Space systems whose inclination is not projected to come within 15o of GEO within 100 years are exempt from this requirement.

5.11.2.8.2.1.2.2. Launch vehicle components should reach GEO

- 500 km, or lower, within 25 years after separation from the spacecraft.

5.11.2.9. Disposal of space systems in heliocentric or Earth

- escape trajectories.

5.11.2.9.1. Place the spacecraft or launch veh icle component in a heliocentric orbit. Deconflict the planned disposal orbit with NASA Office of Safety and Mission
Assurance.

5.11.2.10. Brief Summary of Mitigation Measures Used. For a program that elects to limit orbital lifetime using atmos pheric drag and reentry, several options are available:

5.11.2.10.1. Lower the initial perigee altitude for the disposal orbit.

5.11.2.10.2. When deploying LEO spacecraft to altitudes above 700 km, utilize a lower altitude staging orbit, followed by spacecraft raising maneuvers, to accelerate the orbital decay of launch vehicle stages, particularly those with no re

- start capability.

5.11.2.10.3. Increase the area

- to

- mass ratio for the structure using drag augmentation
but be aware of the issues regarding collision potential with resident space objects.

5.11.2.10.4. For highly elliptical orbits, restrict the initial right ascension of ascending node of the orbit plane relative to the initial right ascension of the Sun so
th at the average perigee altitude is lowered naturally.

5.11.2.10.5. In order to increase the probability that the post

- mission disposal maneuver will be successful, disposal systems should have a redundant capability.

5.11.3. Passivation. All spacecraft and launch vehicle components, to include research and development systems, will be passivated during final disposal. This procedure must eliminate all forms of stored energy and will disconnect all energy generation. Specific requirement s are outlined in SI 505

- 4, section 8 and below. Waivers for research and development systems must be approved by 14 AF/SE and MAJCOM/SE. Note: All post

passivation orbital parameters will meet required disposal criteria outlined in section 5.11.2.

5.11.3.1. During space system design and development, the program or project shall identify sources or potential sources of stored energy and shall develop and implement a plan for minimizing these sources at EOL. Passivation procedures to be consi dered include, but are not limited to the following actions:56 AFI91

- 217 18 FEBRUARY 2010

5.11.3.1.1. Burning residual propellants to depletion.

5.11.3.1.2. Venting propellant lines and tanks.

5.11.3.1.3. Venting pressurized systems.

5.11.3.1.4. Dis charging batteries, other energy storage systems, and preventing recharging.

5.11.3.1.5. Depressurizing gas and liquid filled batteries.

5.11.3.1.6. Deactivating range safety systems.

5.11.3.1.7. De

- energizing control moment gyro scopes.

5.11.3.2. Residual propellants and other fluids, such as pressurant, will be depleted as thoroughly as possible, either by depletion burns or venting, to prevent accidental break

ups by over

- pressurization or chemical reaction. At EOL, al l fluid vessels and lines should be open to the space environment directly or indirectly.

5.11.3.2.1. To ensure that all disposal orbit parameters are met, the final disposal operation will account for any induced ΔV due to depletion burns/venting

. 5.11.3.2.2. Depletion burns and venting shall be conducted in a manner which does not affect other space systems and which will not induce a fragmentation.

5.11.3.2.3. Leak

- before

- burst tank designs are beneficial but are not sufficient to prevent explosions in all scenarios. Therefore, such tanks must still be depressurized
at the end of use.

5.11.3.2.4. Small amounts of trapped fluids could remain in tanks or lines after venting or depletion burning. Design and operational p rocedures shall be employed to minimize the amount of these trapped fluids.

5.11.3.2.5. Sealed heat pipes and passive nutation dampers need not be depressurized
at EOL.

5.11.3.3. Batteries will be adequately designed and manufactured, bot h structurally and electrically, to prevent breakups. Pressure increase in battery cells and assemblies could be prevented by mechanical measures unless these measures cause an excessive reduction of mission assurance. At the end of operations, battery ch arging lines will be de

activated.

5.11.3.3.1. The complete discharge of batteries and their subsequent disconnection from charging circuits is preferred. If this is impractical, the batteries shall be left with a permanent electrical drain to pr event recharging. If permitted by design, pressurized batteries should be depressurized at EOL.

5.11.3.4. High

- pressure vessels will be vented to a level guaranteeing that no break

- ups can occur. Leak

- before

- burst designs are beneficial but are not sufficient to meet all passivation recommendations of propulsion and pressurization systems. Heat pipes may be left pressurized if the probability of rupture meets acceptable risk criteria.AFI91

- 217 18 FEBRUARY 2010 57

5.11.3.5. Self

- destruct systems shall be designed no t to cause unintentional destruction due to inadvertent commands, thermal heating, or radio frequency interference. Self

destruct systems will be designed not to cause unintentional destruction.

5.11.3.6. The removal of electrical energy inputs f rom rotational energy devices, such as a gyro, is usually sufficient to ensure the timely passivation of these units.

5.11.3.7. The program or project shall include a description of the passivation procedure in the SDAR and EOLP. This description shall not only identify the passivation actions to be employed for all sources of stored energy but also shall provide a notional timeline of when the actions will take place. For example, an orbital stage main propulsion system depletion burn may be sch eduled 15 minutes after separation of the payload, followed by a sequenced venting of the propellant and pressurant tanks thereafter.

5.11.3.8. A passivation plan for post

- mission disposal shall be developed as a part of
both the SDAR and EOLP. T his plan shall identify all passivation measures to include at a minimum spacecraft fuel depletion, propellant venting, disabling of battery charging systems, safing of bus and payloads, and any sources of stored energy that will remain.

5.11.4. M AJCOM/SE approval is required for all testing on spacecraft with limited ability (as determined by a trained Orbital Safety Officer) to meet disposal and passivation guidelines outlined above.

5.12. Recovery Procedures. Recovery of space obje cts that have reentered the atmosphere may provide useful information for future mishap prevention or enhance future spacecraft development. Typically, the applicable acquisition organization is responsible for AF owned objects/assets, and they will deter mine if recovery is required. Develop written recovery procedures that require notification to the State Department when recovery is contemplated in foreign territory since an international incident could be created if proper recovery processes are
not fo llowed. Coordinate all procedures with 14 AF/SE.

5.13. Near Earth Objects. Near Earth Objects (NEOs) are Sun

- orbiting space debris, such as comets and asteroids that have orbits that either have or potentially have Earth

- crossing orbits.
Th ese objects can impact the Earth causing massive amounts of damage and casualties. The debris associated with NEOs can also damage or destroy space systems. The annual Leonids meteor shower, produced by the comet Tempel

- Tuttle, is one example of the hazar ds posed by NEOs to space systems. In 1993, the European Olympus F1 satellite was struck by a Perseid meteoroid, leading to its ultimate failure.

5.13.1. High altitude large meteor airbursts (i.e., bolides) occur several times a year and are

usua lly detected by missile early warning satellites. An airburst over a sensitive site could be misconstrued as an act of war by nations lacking sophisticated early warning capabilities. Early warning data sharing agreements designed to prevent misinterpret ations of airbursts
should be considered when feasible.

5.13.2. High yield surface impacts and airbursts are very rare. However, due to the extremely catastrophic nature of these events, the overall risk is considered non

- negligible.
A surface i mpact or airburst would have a TNT equivalent explosive power between 10 kilotons (1 kiloton is equal to one thousand tons of TNT) to 1,000,000 megatons (1 megaton is equivalent to 1 million tons of TNT).58 AFI91

- 217 18 FEBRUARY 2010

5.13.3. Not all NEOs have been identified, and for those that have, their orbits may be poorly understood. Due to the mass and velocity of these objects, attempts at changing NEO orbits must take place years, if not decades in advance of any predicted impact. Highly
accurate orbit determination is critical in order to mitigate this possibility.

5.13.4. NEOs pose a risk to both space systems and the general public. Consistent with resource availability and other DoD/Air Force requirements, Air Force space systems capable of detecting or tracking NEOs should implement procedures to do so and coordinate with the NASA NEO Program Office.AFI91

- 217 18 FEBRUARY 2010 59

Chapter 6

- SAFETY OF SPACE CONT ROL SYSTEMS

6.1. Space Control Systems. Space Control Systems include systems, such as the Space
Survei llance Network, Command and Control Warning and Offensive and Defensive Counter Space Systems, have unique missions that don‘t directly support other space systems.

6.2. Safety Program. All organizations that test or operate space control sys tems will have a space safety program. Note: Consistent with MAJCOM guidelines, passive space systems are exempt from this requirement. However, the directed energy (DE) requirements specified in Chapter 7 still apply to DE systems attached to passive space systems (e.g. laser guide stars used for adaptive optics).

6.2.1. Consistent with guidance related to Environment, Safety, and Occupational Health hazard elimination or mitigation requirements, all space control systems will limit the
unint ended effects of the system on personnel, the environment, or on other ground, air or space systems.

6.2.1.1. Space control systems should take into account system interfaces, capabilities,
and vulnerabilities in order to assess the risks of testi ng or operating these systems in isolation or in conjunction with other systems.

6.2.2. C2 systems are to be treated as weapons systems and as such require intensive evaluations for overall support to the warfighters.

6.2.3. Operators of these systems should take special care not to produced unintended effects when operating these systems. Reference SI 534

- 15, Risk Management and Radio Frequency Deconfliction for Space Control Activities for further information.

6.2.4. Safety p rograms should emphasize test program validation (to include procedures discipline, readiness reviews, and test execution risk management) and configuration control
in order to minimize unintended events or failures.

6.3. Other Space Systems. Space systems that directly support more than one other space systems (e.g. Air Force Satellite Control Network) will have their own space safety program. This safety program will take into account system interfaces, capabilities, and vulnerabilities in order to assess the risks of testing or operating these systems. Note: Safety for systems that directly support only one other space system should be addressed within the scope of the supported system. These systems are considered ground support equip ment for the larger, supported, space system.

6.4. Risk Responsibility Phases. The following outlines the risk responsibility for the mission program phases for space control Systems. Risk responsibility only applies to risks that are
within the control of a particular agency/authority. The risk responsibility for the various program phases may overlap.

6.4.1. The acquisition organization is responsible for risk management from concept design through FOC. It is also responsible for risk management for all follow

- on support activities.60 AFI91

- 217 18 FEBRUARY 2010

6.4.2. The TACON organization is responsible for risk management during testing that leads to Initial Operational Capability (IOC) through end

- of

- mission disposal upon which time the
risk mana gement returns to the acquisition organization.

6.4.3. Space safety professionals of some programs may have additional responsibilities dealing with risk assessments to security measures, as directed by the MAJCOM.

6.4.4. Warning systems have unique operational risks.

6.4.4.1. The risks associated with the use of high power used in radars will be addressed by the space safety program.

6.4.4.2. Reducing the risk of and preventing mission down time is an important aspect on warning systems. Use the same timeframes used by the controlling Air Operations Center to report down times that relate to safety.

6.4.4.3. The risk of sending erroneous warning information to the Integrated Tactical Warning and Assessment Cente r is critical; the risk of erroneous warnings getting to National Command Authority is catastrophic. Warning safety programs will ensure risk reduction methods are employed to prevent erroneous data being sent up command channels by reviewing all test proc edures and changes to systems and procedures.

6.5. Waiver and Approval Authority. Consistent with AFI 91

- 202, MAJCOM guidance and other agreements, the risk acceptance authorities are outlined below.

6.5.1. Normal Risk Approval.

6.5.1.1. The acquisition organization‘s commander or equivalent is responsible for ensuring proper risk management and acceptance involving design and operation of a space system throughout its life cycle when hazards causing the risks are controlled by engineering technical documentation.

6.5.1.2. Operations/End

- of

- Life. Except for reentry decisions, the space operations squadron commander (or equivalent) is the approval authority for all operations/EOL risk analyses that meet normal risk cr iteria except for risk analyses conducted for the PM as a part of deployment or operational support.

6.5.1.3. AFCESA is the waiver authority for all facility changes that do not meet the minimum requirements of UFC 1

- 200

- 01, and UFC 3

- 600

- 01.

6.5.2. Approval for Exceeding Normal Risk Criteria. Except as noted in paragraph 6.5.1.3, and consistent with MAJCOM guidance and other agreements, the wing commander is the waiver approval authority for risks exceeding normal risk criteria.

6.5 .2.1. During any life cycle phase up through system deployment in the Build And Operations Phase , the center Commander and CDR JFCC SPACE (via 14 AF Director of Safety, if appropriate) will be notified of risks that exceed normal risk criteria by mor e than one order of magnitude (e.g., one in one million vs. ten in one million).

6.5.2.2. Subsequent to system testing, the NAF Commander and CDR JFCC SPACE (via 14 AF Director of Safety, if appropriate), will be notified of risks that exceed norm al risk criteria by more than one order of magnitude.AFI91

- 217 18 FEBRUARY 2010 61

6.5.2.3. Risks exceeding normal risk criteria by two or more orders of magnitude (e.g.,
one in one million vs. one

- hundred in one million) require MAJCOM/CC approval.

6.5.2.4. The wing CoS will review all waiver requests requiring wing commander approval. The wing will document risk management decisions that exceed the accepted risk criteria. subordinate units (wings, centers, NAFs, etc.) will provide the MAJCOM/SE copies of all waive r requests.62 AFI91

- 217 18 FEBRUARY 2010

Chapter 7

HIGH ALTITUDE OPERAT IONS SAFETY

7.1. High Altitude Operations. Normally, High Altitude Operations is an Aviation Safety issue; however, there are unique similarities to on

- orbit checkout and orbital operations sa fety. While there is no legal definition of high altitude, common usage identifies it as the region between 65,000 (~20 km) to 325,000 feet (~100 km).

7.2. Platforms. HAO systems should follow the Aviation Safety discipline for general safety program guidance.

7.3. Payloads. Due to the similarity between payloads on spacecraft and HAO systems, mishaps involving HAO payloads should be examined for mishap prevention and lessons learned, by both space safety and aviation safety pers onnel.

7.4. High Altitude Environment. This environment, while not as hazardous as the space environment, still presents certain risks. Risks include high winds and ultraviolet radiation.

7.4.1. HAO systems and payloads should be de signed to operate in this environment.AFI91

- 217 18 FEBRUARY 2010 63

Chapter 8

- SAFETY OF DIRECTED E NERGY/KINETIC SYSTEM S

8.1. Directed Energy Systems. All Directed Energy systems that are designed to be aimed above the horizon will establish procedures to ensure coordination with the Directed Energy Clearinghouse (i.e., Laser Clearinghouse), local (installation) and MAJCOM Spectrum Office (to include the Joint Restricted Frequency List), as applicable, prior to the testing or operation of directed energy or radio frequency systems in/into/from space.

8.1.1. Coordination with Directed Energy Clearinghouse, operated by the JSpOC (Unified Space Vault), is required for all Class 3b and 4 lasers that project into or through space to verify that on

- orbit objects are not adversely affected by the laser operation.

8.1.2. Reference DoDI O

- 3100.11, Illumination of Objects in Space by Lasers , SI 534

- 12, Laser Deconfliction Process , and AFI 91

- 401, Directed Energy Weapon Safety , for further
directed ener gy safety guidance.

8.2. Kinetic Energy Systems. All kinetic systems will establish procedures to conduct Conjunction Assessments or Collision Avoidance, as applicable, prior to the testing or operation of these systems in/into/from space.

8.2.1. Reference the relevant AFI 91

- 1xx and AFI 91

- 2xx series of instructions for further weapons safety guidance.64 AFI91

- 217 18 FEBRUARY 2010

Chapter 9

FUTURE FOR SPACE SAF ETY PROGRAMS

9.1. Updates. AF space systems will continue to expand into new miss ion areas. These areas may include nuclear space power and propulsion, manned missions, joint

- commercial operations and deep space missions (e.g. Clementine lunar probe). Expanded emphasis on Joint, Coalition and NEOs should be expected. Please forward inputs for this and other AF space safety documents to HQ AFSC/SESS or visit the Space Safety Community of Practice on the AF Knowledge Now portal.

9.2. Forms

9.2.1. No forms are prescribed in this publication.

FREDERICK F. RO GGERO Major General, USAF Chief of SafetyAFI91

- 217 18 FEBRUARY 2010 65

Attachment 1

GLOSSARY OF REFERENC ES AND SUPPORTING IN FORMATION

References:

AFDD 2

- 2

, Space Operations , 27 November 2006

AFPD 90

- 9

, Operational Risk Management , 1 April 2000

AFPD 91

- 2 , Safety Programs , 28 September 1993

AFPD 91

- 4 , Directed Energy Weapons Safety , 11 July 2003

AFI 51

- 701

, Negotiating, Concluding, Reporting, and Maintaining International Agreements , 6 May 1994

AFI 63

- 124

, Performance

- Base d Services Acquisition , 1 August 2005

AFI 63

- 1201

, Life Cycle Systems Engineering, 23 July 2007

AFI 90

- 801 , Environment, Safety and Occupational Health Councils , 25 March 2005

AFI 90

- 901

, Operational Risk Management , 1 April 2000

AFI 91

- 110 , Nuclear Safety Review and Launch Approval for Space or Missile Use of Radioactive Material and Nuclear Systems , 28 June 2002

AFI 91

- 202 , The US Air Force Mishap Prevention Program , 1 August 1998

AFI 91

- 204 , Safety Inves tigations and Reports , 24 September 2008

AFI 91

- 301

, Air Force Occupational and Environmental Safety, Fire Protection, and Health (AFOSH) Program , 1 June 1996

AFI 91

- 401

, Directed Energy Weapons Safety , 29 September 2008

AFMAN 91

- 201 , Explosives Safety Standards , 18 October 2001

AFMAN 91

- 222 , Space Safety Investigations and Reports, 9 August 2005

AFPAM 90

- 902 , Operational Risk Management (ORM) Guidelines and Tools , 14 December
2000

DFARS 252.223

- 7002

, Safety Precautions for Ammunition and Explosives , May 1994

DoD 4 145.2

- M, DoD Contractor’s Safety Manual for Ammunition and Explosives , 13 March
2008

DoD 6055. 09

- STD

, DoD Ammuni tion and Explosives Safety Standards , 29 February 2008

DoDD 3 100.10 , Space Policy , 9 July 1999

DoDD 3 200.11

, Major Range and Test Facility Base (MRTFB) , 27 December 2007

DoDD 5000. 01

, The Defense Acquisition System , 12 May 2003

DoDD 5 101.2

, DoD Executive Agent for Space , 03 June 2003

DoDI O

- 3 100.11

, Illumination of Objects in Space by Lasers , 31 March 2000

DoDI 3 100.12

, Space Support , 14 September 200066 AFI91

- 217 18 FEBRUARY 2010

DoDI 5000. 02

, Operation of the Defense Acquisition System , 08 December 2008

DoDI 6055. 07

, Accident Investigation, Reporting, and Record Keeping , 3 October 2000

IEEE Std 1228

- 1994, IEEE Standard for Software Safety Plans

Inter

- Agency Space Debris Coordination Committee Protection Manual, v3.3 , 4 April 2004

Inter

- Agency Space Debris Coordination Committee GTO

– MEO

– Molniya

– Upper Stage Disposal, Final Report , 21 April 2004

Joint Publication 1

- 02

, Department of Defense Dictionary of Military and Associated Terms , 12 April 2001

MI L

- STD

- 882D

, Standard Practice for System Safety , 10 February 2000

NASA P rocedural Requirements (NPR) 8 715.5 , NASA Range Safety Program , 8 July 2005

NPR 8 715.6 A

, NASA Procedural Requirements for Limiting Orbital Debris , 19 February 2008

NASA Safety Standard 1 740.14

, Guidelines and Assessment Procedures for Limiting Orbital
Debris , 1 August 1995

NASA

- GB

- 8 719.13

, NASA Software Safety Guidebook , 31 March 2004

NASA

- STD

- 8 719.13 B w/Change 1, NASA Software Safety Standard , 8 July 2004

NASA Technical Standard 8 719.14 , Process for Limiting Orbital Debris , 28 August 2007

NASA Policy Directive 80 10.3

, Notification of Intent to Decommission or Terminate Operating Space Systems and Terminate Missions , 14 June 2004

Occupational Safety and Health Administration Standards , accessed 2 November 2007

Office of Management and Budget Circular No. A

- 119, Revised

, Federal Participation in the Development and Use of Voluntary Consensus Standards and in Conformity Assessment
Activities , 10 February 1998

Public Law 104

- 113

, National Techno logy Transfer and Advancement Act of 1995 , 7 March
1996

RCC 321

- 07 , Common Risk Criteria Standards For National Test Ranges

, June 2007

RCC 321

- 07 , Common Risk Criteria Standards For National Test Ranges: Supplement

, June
2007

Sate llite Mission Operations Best Practices , accessed 26 September 2007

SI 505

- 04

, Satellite Disposal Procedures , 21 April 2006

SI 534

- 12

, Laser Deconfliction Process , 25 July 2007

SI 534

- 15

, Risk Management and Radio Frequency Deco nfliction for Space Control Activities

, 16 March 07

Space and Missile Systems Center Human Systems Integration (HSI) Policy , 12 February 2006

STRATCOM Directive 714

- 02, Satellite Communication (SATCOM) System Expert Responsibilities , 20 Septem ber 2005AFI91

- 217 18 FEBRUARY 2010 67

Title 14, Code of Federal Regulations, Part 417, Launch Safety , current edition

Title 47, Code of Federal Regulations, Part 25

, Satellite Communications , current edition

UFC 1

- 200

- 01

, General Building Requirements , 27 Novembe r 2007

UFC 3

- 600

- 01

, Fire Protection Engineering for Facilities , 26 September 2006

United States Government Orbital Debris Mitigation Standard Practices , accessed 4 April 2007

U.S. National Space Policy, 31 August 2006

http://www.fas.org/spp/guide/europe/comm/olympus.htm

Abbreviations and Acronyms

AFRL

— Air Force Research Laboratory

AFB

— Air Force Base

AFSAS

— Air Force Safety Automated System

AFSC

— Air Force Safety Center

AIS

— Abbreviated Injury System

AOC

— Air Operations Center

BPC

— Board Presidents Course

CA

— Conjunction Assessment

CDR JFCC SPACE

— Commander, Joint Functional Component Command for Space

COLA

— Co llision Avoidance

COS

— Chief of Safety

CFE

— Commercial and Foreign Entities

CFR

— Code of Federal Regulations

ΔV

— Delta V

DE

— Directed Energy

DFARS

— Defense Federal Acquisition Regulation Supplement

Ec

— Expectation of Casu alty

EOL

— End of Life

EOLP

— End

- of

- Life Plan

FAA

— Federal Aviation Administration

FAA/AST

— FAA Office of Commercial Space Transportation

FCC

— Federal Communications Commission

FOC

— Full Operational Capability

GBSS

— Ground Based Space Systems68 AFI91

- 217 18 FEBRUARY 2010

GEO

— Geostationary Orbit

GSO

— Geosynchronous Orbit

GTO

— Geosynchronous Transfer Orbit

HAP

— High Accident Potential

ISB

— Interim Safety Board

ITAR

— International Traffic of Arms Regulations

IV&V

— Initi al Validation & Verification

JSpOC

—

Joint Space Operations Center

LEO

— Low Earth Orbit

LRR

— Launch Readiness Review

MAJCOM

— Major Command

MINA

— Mishap Investigation Non

- Aviation

MEO

— Medium Earth Orbit

NAF

— Numbered Air F orce

NASA

— National Aeronautics and Space Administration

NEO

— Near

- Earth Object

NPR

— NASA Procedural Requirements

NTSB

— National Transportation Safety Board

OPCON

— Operational Control

ORM

— Operational Risk Management

ORP

— Operations Review Process

OSO

— Orbital Safety Officer

PESHE

— Programmatic Environment, Safety, and Occupational Health Evaluation

PM

— Program Manager

RV

— Reentry Vehicle

SCCS

— Space Command And Control Systems

SDAR

— Space Deb ris Assessment Report

SIB

— Safety Investigation Board

SIDC

— Space Innovation & Development Center

SLCC

— Spacelift Commander

SMC

— Space and Missile Systems Center

SRB

— Safety Review BoardAFI91

- 217 18 FEBRUARY 2010 69

SSG

— System Safety Group

SSMP

— Sys tem Safety Management Plan

SSN

— Space Surveillance Network

SSO

— Space Safety Officer or Semi

- Synchronous Orbit

TACON

— Tactical Control

TTP

— Tactics, Techniques, and Procedures

Terms:
Acceptable risk

— A predetermined criterion o r standard for a maximum risk ceiling which permits the evaluation of cost, national priority interests, and number of tests to be conducted.

Accumulated risk

— See Aggregated Risk and Collective Risk . The combined collective risk to
all individua ls exposed to hazard through all phases of an operation. For the flight of an expendable orbital launch vehicle, risk will be accumulated from liftoff until the spacecraft and launch vehicles are cataloged or reenter. For the flight of a suborbital launc h vehicle, risk will be accumulated from liftoff through the impact of all pieces of the launch vehicle, including the payload. For flight of a reusable launch vehicle, risk will be accumulated from liftoff through recovery for all components of the vehic le unless a separate risk budget can be identified for the reentry phase according to the conditions stated in RCC 321.

ACQUISITION ORGANIZATION

— The organization responsible for acquiring either hardware or a service (e.g. launch service). For most Air Force launches this will usually be the Space and Missiles Systems Center.

Aggregated risk

— See Accumulated Risk and Collective Risk. The accumulated risk due to all hazards associated with an operation. For a specified launch, aggregated ri sk includes, but is not limited to, the risk due to debris impact, toxic release, and distant focusing of blast overpressure.

AIR FORCE LAUNCH

— Any launch operation conducted with significant oversight or insight by the AF and not subject to licensing requirements of 14 CFR Part 415. The AF may or may not be the space system owner. There may also be launches out of the range that are commercial
launches.

AIR OPERATIONS CENTER or AIR FORCE AIR AND SPACE OPERATIONS CENTER (AOC)

— The aerospace opera tions planning and execution focus point for the Joint Task Force and Numbered Air Force where centralized planning, direction, control, and coordination of aerospace operations occur for which the Commander Air Forces (COMMAFFOR)/Joint Force Air Component Commander has Operational Control (OPCON) and/or TACON of air and/or space forces to achieve operational/tactical effects and objectives.

anomaly resolution process

— Any process used to resolve a spacecraft anomaly. Typically conducted by the operat ing/testing organization (squadron or equivalent level).

Apogee

— The point in the orbit that is the farthest from the center of the Earth. The apogee altitude is the distance of the apogee point above the surface of the Earth.

AUTOMATED MANEUVER PROTOCOLS

— Computer controlled processes which allow the spacecraft to determine and/or implement maneuvers, without human intervention.70 AFI91

- 217 18 FEBRUARY 2010

Cataloged Objects

— Items that have been entered into the AF Satellite Catalog. Some items may have re

- entered a fter being cataloged.

CASUALTY

— A serious injury or worse, including death, for a human. For the purposes of this standard, serious injury is defined as Abbreviated Injury Scale (AIS) Level 3.

COLLECTIVE RISK

— See Accumulated Risk and Aggrega ted Risk . The total combined risk to all individuals within a category (for example, launch

- essential personnel, general public) exposed to a particular hazard during a specific period of time or event; unless otherwise noted,
the mean number of casualti es predicted (E c ) to result from a given hazard. Collective risk is specified as either a per mission or per year value. The collective risk will include the aggregated and accumulated risk.

COLLISION AVOIDANCE

— A process designed to prevent colli sions between on

- orbit tracked objects or to prevent collisions between on

- orbit tracked objects and launched vehicles (including spent stages)/payloads by determining and implementing courses of action through careful analysis of validated conjunction ass essments and satellite health and mission requirements; the process includes establishing launch wait periods in either the launch window or spacecraft maneuvering based on validated conjunction assessments and accounts for uncertainties in spatial dispers ions, arrival time of orbiting objects and/or the launch vehicle/payload, and modeling accuracy. There are two different types of collision avoidance: safety collision avoidance and mission assurance collision avoidance.

COMMERCIAL LAUNCH

— A commerc ial launch is a launch licensed by the FAA.

CONFIGURATION CONTROL

— Process of approving or disapproving, and coordinating changes to configuration items after formal establishment of their configuration identification.

CONFIGURATION MANAGEMENT

— P rocess of identifying and defining the configuration items in a system, controlling the release and change of these items throughout the system life cycle, recording and reporting the status of configuration items and change request, and verifying the comp leteness and correctness of configuration items.

CONJUNCTION ASSESSMENT

— A process for determining the point and time of the closest approach of two tracked orbiting objects or between a tracked orbiting object and a launched vehicle (including spent stages) or payload; conjunction assessment is performed in association with a specified miss distance screening criteria or the corresponding probability of collision. Associated with the closest approach assessment are the closest approach distance, the times of launch and/or orbital maneuvering that would result in the closest approach and meeting the miss distance or collision probability criteria, and a probability of collision with accuracy given for the ephemeris of both objects.

CONTROLLED REENT RY

— See Uncontrolled Reentry . A planned reentry for which the final atmospheric penetration time has been chosen through spacecraft maneuvering so as to either maximize the amount of spacecraft material that burns up in the atmosphere, limiting the pot ential for endangering the public, or to bring down a recoverable reentry vehicle (e.g. capsule) in a controlled manner that does not endanger the public. This is typically used to control the time and place of the disposal of space objects that are at th e end of their mission life or for reentry capsules.AFI91

- 217 18 FEBRUARY 2010 7 1

CRITICAL HARDWARE

— Any hazardous or safety critical equipment or system; non

hazardous DoD high value items such as spacecraft, missiles, or any unique item identified by the DoD as critical; non

- ha zardous, high value hardware owned by range users (other than the DoD) may be identified as critical or non

- critical by the Range User.

Critical operations personnel

— See Launch Essential Personnel

, Mission Essential Personnel
and Neighboring Ope rations Personnel . The minimum number of persons necessary to successfully and safely complete a launch operation and whose absence would jeopardize the completion of the operation.

DEBRIS

— Any non

- maneuverable/non

- operational orbital space system o r component.

DEBRIS CLOUD

— Describes the initial collection of debris generated by an on

- orbit collision or explosion. Represents a dense area of debris which is extremely hazardous to other spacecraft
in the immediate area.

DEBRIS GENERATION

— R elease of objects from a spacecraft into the space environment. This generally occurs in an unpredictable and uncontrolled manner. Debris generation may be the result of a collision or an occurrence within the spacecraft. Mission related debris should b e minimized or avoided altogether.

DEEP SPACE

— Region of space where objects have an eccentricity > 1 (escape trajectory) with respect to the closest planetary body, but that they may have an eccentricity < 1 (orbit) with respect to the closest star.

DELTA V (ΔV)

— Change in velocity. Used as a measure of required energy (i.e. fuel) used to maneuver an orbital space system from one orbit to another (or a reentry).

DESIGNATED APPROVING OFFICIAL

— An individual with delegated approval authority.
Fo r matters concerning safety (e.g. SDAR approval), agreements delegating approval authority below that of CDR JFCC SPACE should be reviewed by the MAJCOM SE and 14 AF/SE, as appropriate.

DIRECTED ENERGY

— An umbrella term covering technologies that rela te to the production of a beam of concentrated electromagnetic energy or atomic or subatomic particles.

DIRECTED ENERGY CLEARING HOUSE

— All DoD agencies and or contractors performing laser tests under contract to DoD have to go through laser clearing house procedures with the JSpOC prior to performing laser tests per DoDI O

- 3100.11.

DIRECTED ENERGY SYSTEMS

— Systems that use the electromagnetic field to remotely place energy on an intended target.

ELECTROMAGNETIC INTERFERENCE (EMI)

— Any electr omagnetic disturbance that interrupts, obstructs, or otherwise degrades or limits the effective performance of electronics and electrical equipment. It can be induced intentionally, as in some forms of electronic warfare, or unintentionally, as a result of spurious emissions and responses, intermodulation products, and
the like.

EXPECTATION OF CASUALTY

— Risk associated with death or serious injury of a member of the general public (i.e. the consequence of failure).72 AFI91

- 217 18 FEBRUARY 2010

END

- OF

- LIFE

— Final stage of spac ecraft lifetime. End result will be either recovery, reentry, spacecraft disposal (passivation), or catastrophic loss (due to on

- board explosion/failure or collision with another object).

Failure modes

— How a system or component might fail.

GEOST ATIONARY ORBIT

— See Geosynchronous Orbit . A circular geosynchronous orbit
with 0° inclination and an altitude of 35786 km above sea level.

Geosynchronous orbit

— See Geostationary Orbit . An orbit with a period equal to the sidereal day. Typica lly, geosynchronous orbits have an inclination between ±15o of the equatorial plane.

Geosynchronous transfer orbit

— A highly eccentric orbit with perigee normally within or near LEO altitudes and apogee near GEO altitude.

Hazard

— Any real or p otential condition that can cause injury, illness, or death to personnel; damage to or loss of a system, equipment or property; or damage to the environment.

hazardous launch areas

— Safety clearance zones during launch operations with defined mishap

p robabilities, including the flight caution area, flight hazard area, vessel/boat exclusion area, and impact limit lines.

hazardous materials

— Liquids, gases, or solids that may be toxic, reactive, or flammable or that may cause oxygen deficiency eithe r singularly or in combination with other materials.

HIGH ACCIDENT POTENTIAL

— An event or occurrence that could have led (in the determination of a space safety officer) to a mishap or other mission impacting event. The difference between a mishap an d a HAP is often luck. Regardless, the mishap prevention is generally the same.

HUMAN FACTORS

— A body of scientific facts about human characteristics. The term covers all biomedical and psychosocial considerations; it includes, but is not limited to, principles and applications in the areas of human engineering, personnel selection, training, life support, job performance aids, and human performance evaluation.

Inclination

— The angle the orbit plane makes with the equatorial plane.

INTEGRATIN G Agency

— The organization responsible for building/stacking the launch vehicle and integrating the spacecraft/satellite prior to launch. For AF missions, this is typically the launch wing or launch wing provider (e.g. United Launch Alliance).

KINETI C ENERGY

— The energy due to the velocity of an object.

KINETIC ENERGY SYSTEMS

— Systems that use the velocity, mass and/or explosives of an object to derive their intended effects.

LASER CLEARING HOUSE

— See Directed Energy Clearing House.

L AUNCH ASSESSMENT

— The process of determining closest approaches to active space objects (through one revolution) by a launch vehicle and its components during an available
launch window. Also known as Pre

- launch Screening.

launch essential personnel

— See Critical Operations Personnel

, Mission Essential Personnel
and Neighboring Operations Personnel . The minimum number of persons necessary toAFI91

- 217 18 FEBRUARY 2010 73

successfully and safely complete a launch operation and whose absence would jeopardize the completion o f the operation.

Launch/Range Operator

— The 30 SW and 45 SW own and operate the range whether the launch is military or commercial.

Launch Mishap

— See Orbital Mishap and Pre

- Launch . Mishaps that occur between the initial ignition of any stag e of the rocket and up until the final piece of launch hardware separates from the spacecraft. This includes payloads that are not launched into the intended orbit.

Launch Operation

— Operations occurring in the terminal countdown through sub

- orbital flight
or orbital insertion.

LAUNCH OPERATOR

— A person or entity that conducts or proposes to conduct the launch of a launch vehicle for the purpose of inserting a spacecraft into orbit or delivering a payload to a specified ballistic location.

LA UNCH SUPPORT SYSTEMS

— Launch support systems directly support launches. This includes, for example, range equipment including tracking radars operating in a launch support
mode.

LAUNCH SYSTEM

— Sum of all the parts of the system used to prepare and l aunch a launch
vehicle.

launch vehicle

— Any means of transportation used to place an object into Earth orbit or deep space. It also includes ballistic missiles.

LAUNCH VEHICLE COMPONENTS

— All the parts of a launch vehicle except payload(s), to
i nclude upper stages and any apogee kick motors that separate from the spacecraft after operation.

Launch Vehicle Owner

— The organization or person who owns or procured the space launch
vehicle.

launch window

— A period of time during which the fli ght of a launch vehicle may be initiated.

LAUNCHING AGENCY

— The range user at AF ranges or equivalent organization at other
locations.

LICENSED LAUNCH

— See Non

- Licensed Launch . An FAA licensed launched is indemnified by insurance up to a set a mount and above which is indemnified by the government. The FAA issues a commercial space transportation license when they determine that a launch or reentry proposal will not jeopardize public health and safety, property, U.S. national security or foreig n policy interests, or international obligations of the United States. The Air Force Launch Decision Authority has range safety responsibility for all launches being launched from Air Force ranges.

LOW EARTH orbit

— An orbit between 150 km and 2000 km.

MANEUVER

— Spacecraft operation that is designed to change the velocity (speed and direction) of a spacecraft using either an internal/integrated propulsion system or an externally attached booster system.74 AFI91

- 217 18 FEBRUARY 2010

MANNED OBJECT

— See Unmanned Object

. Spacecraft that are currently occupied or are expected to be occupied in the future. Examples include the International Space Station, the Space Transportation System (i.e. space shuttle), and Progress supply vehicles.

Meteoroids

— A solid object mo ving in interplanetary space, of a size considerably smaller than an asteroid and considerably larger than an atom or molecule. Meteoroid material is often associated with asteroid breakup or material released from comets.

MISHAP

— An unplanned event or series of events resulting in death, injury, occupational illness, or damage to or loss of equipment or property or damage to the environment.

MISSILE

— A type of rocket used to deliver a warhead. Typically has a ballistic trajectory.

MISSION A SSURANCE

— An integrated engineering

- level assessment of analysis, production, verification, validation, operation, maintenance, and problem resolution processes performed over the life cycle of a program by which an operator/user determines that there is an acceptable level of risk to employment of a system or end item to deliver an intended capability in an intended environment. The objective of the assurance process is to identify and mitigate design, production, test and operational deficiencies that c ould impact mission success.

MISSION DEGRADATION

— A space system that cannot fully complete its assigned mission. Parts of the mission may be accomplished, but full mission accomplishment is not possible.

MISSION ESSENTIAL PERSONNEL

— See Critic al Operations Personnel

, Launch Essential
Personnel and Neighboring Operations Personnel . The minimum number of persons necessary to successfully and safely complete an operation and whose absence would jeopardize the completion of the operation. Th is includes persons required to perform emergency actions according to authorized directives, persons specifically authorized by the Wing Commander to perform scheduled activities, and person in training. The number of mission

- essential personnel
allowed within Safety Clearance Zones or Hazardous Launch Areas is determined by the Wing Commander and the Range User with Range Safety concurrence.

MISSION FAILURE

— The inability of a space or ballistic system to complete its assigned
mission.

MISSION R ISK

— The risk that the mission will fail or be significantly degraded in capability.

Near Earth Objects

— Objects in the solar system (asteroids and comets) with orbits that regularly bring them close to the Earth and which are capable of striking the planet.

Neighboring Operations personnel

— See Critical Operations Personnel

, Launch Essential
Personnel and Mission Essential Personnel . Individuals who are required to perform safety, security, or operationally critical tasks but are not asso ciated with the specific/current operation
or launch under consideration.

nominal vehicle

— A properly performing launch vehicle whose instantaneous impact point does not deviate from the intended instantaneous impact point locus.

non

— compliancE

– A noticeable or marked departure from requirements, standards, or procedures; includes equivalent level of safety determinations (formally meets intent certifications), and waivers.

non - credible

— An event determined to be so improbable that such an occurrence is virtually impossible, based on careful analysis of the potential hazard and mode of prevention such asAFI91

- 217 18 FEBRUARY 2010 75

permanent physical barriers and/or enforced separation distance; cost and convenience are not
valid rationales for a determination of non

- c redible.

non - essential personnel

— Those persons not deemed launch

- essential or critical operations personnel; includes the general public, visitors, the media, and any persons who can be excluded from Safety Clearance Zones with no effect on the opera tion or parallel operations.

NON

- LICENSED LAUNCH

— See Licensed Launch . A launch not licensed by the FAA. This would typically be a civil or DoD launch. It is indemnified by the government. The Air Force Launch Decision Authority has range safety responsibility for all launches being launched from his/her range.

NON

- NOMINAL FLIGHT

— A launch vehicle that performs in an unexpected manner during flight.

OPERATIONAL CONTROL

— Command authority that may be exercised by commanders at any eche lon at or below the level of combatant command. Operational control is inherent in combatant command. Operational control includes authoritative direction over all aspects of military operations and joint training necessary to accomplish missions assigned to the command. OPCON does not include authoritative direction for logistics or matters of administration, discipline, internal organization, or unit training.

OPERATIONAL REVIEW PROCESS (ORP)

— The panel, established in 10

- series instructions, chair ed by the responsible commander that approves system modifications, training, procedures, and database changes to operational equipment.

OPERATIONAL REVIEW BOARD

— Established in 10

- series instructions, this board is chaired by the responsible command er that reviews problems in operations of systems. This is especially important in space systems, as there are numerous system modifications and updates to training, procedures, and database to operational equipment.

OPERATIONAL EFFECTIVENESS

— The ove rall degree of mission accomplishment of a system or end

- item used by representative personnel in the environment planned or expected (e.g., natural, electronic, threat) for operational employment of the system or end

- item considering organization, doctrin e, tactics, information assurance, force protection, survivability, vulnerability, and threat (including countermeasures; initial nuclear weapons effects; and nuclear, biological, and chemical contamination threats).

OPERATIONS REVIEW PROCESS

— A proce ss of reviewing and approving procedures to be used when conducting tests or operations.

Orbital debris

— See Space Debris . Non

- controllable artificial objects, including derelict spacecraft and spent launch vehicle orbital stages, in planetary orbi t which no longer serve a useful purpose. Sometimes referred to as Man Made Orbital Debris.

orbital insertion

— The sequence of events in time and space, whereby an object achieves an altitude in excess of 150 km and sufficient velocity to complete at least one orbit of the Earth.

ORBITAL SUPPORT SYSTEMS

— Space systems that directly support orbital space systems.

ORBITAL SPACE SYSTEMS

— Term used to describe the hardware and activities associated with the design, development, testing and opera tion of any man

- made object exceeding 100 km in altitude and achieving or exceeding planetary orbital velocity.76 AFI91

- 217 18 FEBRUARY 2010

PASSIVATION

— The process of removing stored energy from a space system at EOL which could result in an explosion or deflagration of the spa ce system. This includes energy in the form of electrical, pressure, mechanical or chemical.

payload

— See Satellite or Spacecraft . Refers either to the object(s) carried by a launch vehicle or the operational portion of a satellite/spacecraft (e. g. the main communications package on communications satellite). Once a satellite/spacecraft has separated from the launch vehicle, it should not be referred to as a payload.

Perigee

— The point in the orbit that is nearest to the center of the Earth. The perigee altitude is the distance of the perigee point above the surface of the Earth.

populated area

— An outdoor location, structure, or cluster of structures that may be occupied by people; sections of roadways and waterways that are frequented by automobile and boat traffic are populated areas; agricultural lands, if routinely occupied by field workers, are also populated

areas.

PRE

— LAUNCH

– Space related activities occurring during ground handling, processing, and transportation operation s just prior to ignition (lift

- off) actions.

POST

- MISSION

— Describes the time period after a spacecraft has completed its mission and culminates with final passivation and disposal activities.

PROGRAM MANAGER

— The designated individual with respo nsibility for and authority to accomplish program objectives for development, production, and sustainment to meet the user‘s operational needs. The PM shall be accountable for credible cost, schedule, and performance reporting to the Milestone Decision Au thority.

Programmatic Environment, Safety, and Occupational Health Evaluation

— The PESHE documents the status of Environment, Safety, and Occupational Health (ESOH) hazard identification, assessment, mitigation, verification, and residual risk assessm ent, and the National Environmental Policy Act (NEPA) compliance schedule. It describes the PM‘s strategy for integrating across the ESOH disciplines and into systems engineering using MIL

- STD

- 882 System Safety methodology, provides a repository for ESOH risk data, and provides a method for tracking progress.

protected area

— Any area behind the impact limit lines.

public

— See Critical Operations Personnel

, Launch Essential Personnel and Neighboring Operations Personnel

. For AF launches, this consists of all persons not in either the Launch Essential Personnel or Neighboring Operations Personnel categories. For commercial launches, this consists of all persons not in the Critical Operations Personnel category.

public safety

— Safety i nvolving risks to the general public of the US or foreign countries and/or their property (both on

- and off

- base); includes the safety of people and property that are not involved in supporting a launch along with those that may be within the boundary of a launch
site.

radioactive material

— Materials that generate, or are capable of generating, ionizing radiation including naturally occurring radioactive materials, by

- product materials, source materials, special nuclear materials, fission products, mat erials containing induced or deposited radioactivity, and nuclear reactors.AFI91

- 217 18 FEBRUARY 2010 77

Range Safety Critical Systems

— Includes all airborne and ground subsystems of the flight safety system.

RANGE USER

— Any individual or organization that conducts or suppor ts any activity on resources (land, sea, or air) owned or controlled by an AF range. This includes such organizations as the DoD, US government agencies, civilian launch operators, foreign government agencies and other foreign entities that use AF range f acilities and test equipment; conduct pre

- launch and launch operations, including payloads to orbital insertion or impact; and/or require on

- orbit or other related support.

REENTRY

— The event occurring when a spacecraft or other object comes back into the sensible atmosphere after going to higher altitudes.

REUSABLE LAUNCH VEHICLE

— A vehicle that is launched from a ground or aerial method of boosting into sub or space orbit that is intended after depositing a payload or other mission
needs to retu rn to point of launch or other designated location and then be reused following
vehicle recertification.

risk

— See Collective risk . A measure that takes into consideration both the probability of occurrence and the consequence of a hazard to a popu lation or installation. Risk is measured in the same units as the consequence such as number of injuries, fatalities, or dollar loss. For Range Safety, risk is expressed as casualty expectation or shown in a risk profile.

risk analysis/STUDY

— The an alysis of systems (hardware, software, firmware, and procedures) to determine potential hazards that could result in loss of personnel, injury to personnel, loss or degradation of the system, or loss of life or injury to the public.

Risk Responsibility Transition Plan

— A document used to outline the organization(s) responsible for risk management during a launch and subsequent orbital insertion of payload(s). It will be used to identify milestones or decision points in the transfer of risk responsibil ity from the launching agency to the subsequent test/operational organization(s). As appropriate, it will also outline management of overlapping risk responsibilities. This document can be as simple as a MOA between the pertinent organizations.

safe/ SAFING

— Placing an object in a condition that limits the possibility of new or further system or component failures. Typically unable to perform its mission when safed.

SAFE SEPARATION

— The process that prevents collision and unplanned proximity clo se calls between space launch vehicles, active on

- orbit satellites, manned spacecraft and on

- orbit uncontrollable tracked objects. Activities associated with the safe separation process include, but are not limited to pre

- launch conjunction assessment an d screening; collision avoidance analysis and maneuvering; space situational awareness, high accident potential events, cataloging, and tracking; command and control of space systems and their effects; system hazards and risk reduction measures; and space controller (AOC) and operator practices and responsibilities. The operating standards for measuring/assessing safe separation include, but are not limited to criteria such as close approach/miss distances, docking and maneuvering safe distances, collisio n probability, close proximity/rendezvous safe distances, space traffic control wait periods, launch and reentry holds and safety notifications. The unplanned effects of ground

based directed energy and spacecraft electromagnetic emissions may have roots in poor separation planning and/or poor space effects planning.78 AFI91

- 217 18 FEBRUARY 2010

Safety catastrophic

— An operation, process, system, or component that controls or monitors equipment, operations, systems, or components to ensure personnel, launch area, and public
safet y; may be hazardous or non

- hazardous.

SAFETY CRITICAL SOFTWARE

— Software whose failure or malfunction may result in death or serious injury to people, loss or severe damage to property, environmental harm, or could cause permanent loss of mission.

SAFETY CRITICAL SYSTEM

— Hardware or software system which, if it fails or malfunctions could cause a mishap of critical or catastrophic severity.

Safety Critical Computer System Function

— A computer function containing operations that, if not perfor med, if performed out of sequence, or if performed incorrectly, may result in failed control functions which may contribute to a hazard.

Safety Critical Facility

— A hazardous facility or a facility that is used to store, handle, or process systems det ermined to be safety critical by Range Safety.

Safety Critical Procedure

— A designation for a particular type of procedure; a document containing steps in sequential order used to reliably process safety critical systems or conduct safety critical ope rations; non

- hazardous safety critical procedures have no specific content requirements but do require safety review and approval.

SAFETY SIGNIFICANT ITEM

— Hardware or software item which contributes to a safety
critical function.

SATELLITE

— See Payload or Spacecraft . An object that orbits another object known as a central body. Commonly, this term refers to unmanned spacecraft in orbit around the Earth.

SATELLITE CONTROL AUTHORITY

— The authority to plan, schedule and perform
satellite commanding.

Semisynchronous Orbit

— The region of space containing nearly circular 12

- hour orbits. This region is the spherical shell surrounding the Earth between approximately 18400 to 25200 km.

sensible atmosphere

— The portion of the atmospher e where the dynamic pressure remains significant.

SEPARATION

— Occurs when the last launch vehicle component (to include non

- integrated apogee kick motors) physically separates from the spacecraft. Final separation would occur when both physical separ ation and any tethers are detached from the spacecraft.

SHALL

— See Should and Will . Mandatory action.

Should

— See Shall and Will . Recommend action.

SMART OPS

— Operations/tests conducted by organizations that maximize mission capabi lity and/or spacecraft lifetime through intelligent, risk

- based decisions and actions. Smart Ops usually occur when operations/testing is faced with a previously unknown/unencountered situation. Operations/testing that unnecessarily expose a spacecraft t o the same hazard may cease to be construed as Smart Ops unless alternatives are more risky or represent an unacceptable loss of mission capability.AFI91

- 217 18 FEBRUARY 2010 79

SPACECRAFT

— A man

- made object either orbits a central body (planet or star) or is in an escape traject ory (eccentricity > 1) from that central body. This can include both satellites and interplanetary spacecraft.

SPACELIFT COMMANDER

— The title of the Space Wing Commander (or their designated representative) on the day of launch.

SPACE ANOMALY

— A n on

- orbit malfunction of a space system, or a deviation from what is expected with normal operations, that does not meet the criteria of a mishap. An anomaly will be initially investigated using the spacecraft anomaly resolution process until such time th at it meets mishap criteria. When enough information is gathered to classify the event as a mishap, transition to a mishap investigation.

Space and Missile Systems Center

— A direct reporting unit to AFSPC that develops and acquires space launch vehic les, spacecraft, and range systems for the AF.

SPACE ASSETS

— Space assets include military and civil space systems, commercial and foreign entities, ground control elements, operators, and launch vehicles. These assets are unique in that they provide global persistence, perspective, and access unhindered by geographical or political boundaries. Military space assets are aligned under established military C2 processes, different from civil and CFE C2 processes. It is essential to integrate these

separ ate processes for synergistic space effects.

SPACE COMMAND AND CONTROL SYSTEMS (SCCS)

— Systems required providing telemetry, tracking, commanding, mission data dissemination, data processing, communication and ranging support for space vehicles. SCCS examples include the common user AF Satellite Control Network and other program

- dedicated networks.

SPACE DEBRIS

— See Meteoroids and Orbital Debris . General class of debris, including both
meteoroids and orbital debris .

SPACE EXPERIMENTS

— Space mission used to develop or prove new procedures and/or technologies.

SPACE FORCES

— Space forces are military space assets and personnel utilized by the joint force, are normally organized as units, and are categorized by their impact on global o r theater requirements. As such, there are global space forces and theater space forces. Global space forces support multiple theater and/or national objectives and are controlled by the Commander, United States Strategic Command. Theater space forces support individual theater requirements and generally fall under the control of the geographic combatant commander. Theater space forces are primarily focused on a single theater, with little or no direct impact outside the designated area of responsibil ity.

Space Launch Squadron

— An AFSPC unit that provides oversight of AF space launch operations at the Eastern and Western ranges.

SPACE MISHAP

— Any unplanned event involving space systems that results in personnel injury, system damage/destructi on or mission capability loss/delay. For reporting purposes, it also includes near misses, close calls and high accident potential events.

SPACE OBJECT

—

Any object above the Earth‘s atmosphere. Includes spacecraft, debris, and natural phenomena, a mongst other objects.80 AFI91

- 217 18 FEBRUARY 2010

SPACE PERSONNEL

— Personnel designing, developing, integrating, testing, processing, launching, or operating any space system or component of a space system.

SPACE RANGE

— A range with the explicit intent of launching orbital and sub

- orbital space vehicles and the specific purpose of protecting the public from the impact of a failed launch. Space range systems include telemetry, tracking and control, and flight termination systems used to protect the public.

Space Safety

— Space Safety is a dynamic process designed to improve operational effectiveness by preventing close calls, mishaps, and provide for mission assurance throughout the life cycle of a space system. It also encompasses System Safety, integrated effects of co mbined systems, software safety, risk management and mishap investigations.

SPACE SAFETY OFFICER

— Personnel assigned to a space mishap prevention or mishap investigation course. SSO positions include System Safety Manager, Space Control Safety
Office r, Launch Safety Officer and Orbital Safety Officer.

SPACE SYSTEMS

— All the devices and organizations forming the space network. These consist of: launch vehicles; launch ranges; launch and range support equipment and systems; spacecraft; ground and a irborne stations; and data links among spacecraft, mission, and user terminals. Space systems refer to the equipment required for space operations, and these systems are comprised of nodes and links. There are three types of nodes: space, airborne, and te rrestrial. Space nodes include satellites, space stations, or reusable space transportation systems like the space shuttle. Airborne nodes are primarily aircraft weapon systems that leverage space capabilities. Terrestrial nodes include any land or sea e quipment that receives, processes, or uses data derived from space capabilities. Information conduits called links tie these nodes together. These links also are classified into two types: control and mission. Space operators use control links to operate space systems. Space systems disseminate data on mission links, which enable force multiplication.

SPACE TESTS

— Limited scope mission used to develop or prove new procedures, capabilities and/or technologies.

SPACE VEHICLE

— Devices, manned and u nmanned, designed to be placed into an orbit about the Earth or into a trajectory toward another celestial body. This definition differentiates between vehicles that remain in space (included) and vehicles that are suborbital (excluded).

SPACE WING CO MMANDER

— Commander of a wing that acquires, operates, or supports space systems.

SPACECRAFT

— See Satellite and Payload. An object designed to perform some function in space. This includes satellites and manned objects in space. This term can als o be used while the object is still on the ground. This does NOT include launch vehicle components that have separated from the spacecraft.

suborbital

— An object trajectory that does not complete a complete orbit.

SUBORBITAL LAUNCH VEHICLE

— A la unch vehicle that is not designed to achieve orbit.

SUBSYNCHRONOUS ORBIT

— Westward drifting orbit that lies below geosynchronous orbit. Typical orbit for geosynchronous spacecraft drifting west to operational or test station.AFI91

- 217 18 FEBRUARY 2010 81

SUPERSYNCHRONOUS ORB IT

— Eastward drifting orbit that lies above geosynchronous orbit. This is the typical disposal region for geosynchronous spacecrafts that have reached the end of their operational lifetime.

SYSTEM SAFETY

— The application of engineering and managemen t principles, criteria, and techniques throughout all phases of the system life cycle to optimize safety within the constraints of operational effectiveness, time, and cost.

SYSTEM SAFETY GROUP

— A group of key personnel formed to ensure the effectiven ess and oversee a program‘s system safety program IAW AFI 91

- 202. SSGs are required for all Acquisition Category 1 and for all aircraft unless waived by the MAJCOM. AFI 91

- 202 describes the membership and functions of the SSG.

TACTICAL CONTROL

— Comm and authority over assigned or attached forces or commands or military capability made available for tasking that is limited to the detailed direction and control of movements or maneuvers within the operational area necessary to accomplish assigned missio ns or tasks. TACON is inherent in OPCON and may be delegated to and exercised by commanders at any echelon at or below the level of combatant command. Satellite Control Authority is inherent in TACON but may be delegated.

TELEMETRY

— Remote measuremen t and reporting of spacecraft information of interest.

Space control systems

— Includes space systems with unique missions that either don‘t directly support other space systems (e.g. space control systems), or that support multiple independent

on

- or bit systems (e.g. AFSCN). Space control systems can be located anywhere on the Earth‘s surface or in the atmosphere above the surface.

TESTS

— The trial of a new, relatively unproven space system. The launch of a new launch
vehicle counts as a launch vehicle test while the launch of a test spacecraft on a proven launch vehicle would count as a test for the orbital portion of the mission, but not the launch, unless the test spacecraft somehow affects the launch vehicle performance.

TETHER SYSTEM

— A rope

- like restraint to attach two or more objects in space. Used to maintain a relatively close distance between objects without physical contact between the objects. Electrical power and telemetry are often transferred using tethers.

TRANSFER ORBI T

— The pre

- planned orbit that moves a spacecraft from one orbit to another. Usually occurs during launch to move a spacecraft to its final orbit.

Uncontrolled reentry

— See Controlled Reentry . A random reentry in which the spacecraft/object reente rs the atmosphere where the surface impact point can not sufficiently be determined, or influenced by the operator, prior to reentry. This is the typical reentry method for debris and spacecraft in decay orbits where the final reentry point and time is un derdetermined due to uncertainty in atmospheric density conditions due to the extended time period between disposal and reentry.

UNIQUE SPACE SUPPORT EQUIPMENT

— Systems, equipment and facilities required for supporting other space systems. Includes l aunch and orbital space support systems.

UNMANNED OBJECT

— See Manned Object. A spacecraft that is neither currently occupied nor expected to be occupied in the future.82 AFI91

- 217 18 FEBRUARY 2010

UPPER STAGE

— Typically the last portion of a launch vehicle used to delive r a spacecraft into orbit. Some spacecraft may also have an apogee kick motor beyond the upper stage that will actually be the last portion of the launch system to separate from the spacecraft.

VEHICLE

— Any space

- related object with its own propulsio n system. Includes rockets, satellites and other spacecraft.

Western Range

— Part of the National Launch Range facilities, operated by the 30 SW. The range includes the operational launch and base support facilities located at Vandenberg AFB and
thos e radar tracking sites and ground stations located on sites up range and downrange along the Pacific Coast, including United States Navy facilities at Point Mugu.

WILL

— See Shall and Should. Mandatory action.AFI91

- 217 18 FEBRUARY 2010 83

Attachment 2

SPACE DEBRIS ASSESSMENT REPORT

A2.1. Delivery Requirements The SDAR shall be delivered in accordance with the requirements specified below. The normal schedule is:

A2.1.1. PDR Draft SDAR: 30 days prior to the program PDR for the spacecraft or

e quivalent program/project development milestone. This draft is submitted to the PM, who will make distribution to the Chief Engineer and Safety Office, and any other offices as needed. The purpose of preparing the report early in the design and developme nt process is to ensure that orbital debris issues are identified early when resolutions are least costly to implement. Any orbital debris mitigation compliance issues not resolved by PDR shall be addressed and resolved no later than the CDR or equivalent program/project development
milestone.

A2.1.2. CDR Draft SDAR: 45 days prior to the program or project CDR for the spacecraft or equivalent program/project development milestone. This Draft is submitted by the PM to the Chief Engineer and Safet y Office who will make distribution as with the PDR DRAFT SDAR. The purpose of the CDR Draft is to update and clarify the issues and changes to the PDR Draft. Any noncompliance that remains prior to beginning the launch approval process will require form al risk acceptance by the CDR JFCC SPACE (or designated approving official).

A2.1.3. FINAL SDAR: shall be submitted to the CDR JFCC SPACE (or designated approving official) for approval and signature prior to the beginning of the launch approval process. Formal acceptance of the risk associated with any noncompliance remaining in the SDAR shall accompany the delivery of the Final SDAR. Each SDAR delivered will be reviewed by the center (or equivalent) Safety Office and by JFCC SPACE. The CDR JF CC SPACE (or designated approving official) will be the final approving authority for the
SDAR.

A2.2. Format Each SDAR shall follow the format shown in Table A2.1 below and, at a minimum, include the content indicated. Note that space debris mitigation requirements for the spacecraft and launch vehicle shall be addressed in separate SDAR sections (Sections 2 through 8 and Sections 9 through 14, respectively) to promote the ease of preparing the assessment report. The draft SDAR may be submit ted in electronic form only. Programs are encouraged to use existing program documentation for mission and spacecraft descriptions.

Table A2.1. SDAR Format.

Cover and Front Matter

Cover showing the document version and date of delivery

Inside c over signed by (at a minimum): document preparer(s), program management, and the Chief Engineer and safety office reviewers.

Statement of any restrictions on the data in the SDAR such as proprietary, ITAR, or export
controls. If the document does not conta in any restrictions, then a statement to that effect shall be included. If the document does contain restricted information, the restricted information shall be84 AFI91

- 217 18 FEBRUARY 2010

summarized and marked clearly on the page(s) where it occurs and on the cover.

Document history page showing each version of the report. Reviews of the previous versions by the Chief Engineer or safety office shall be included on this page.

Section 1: Program Management and Mission Overview

Identification of the program sponsoring the mission and t he PM
Identification of any mission partners‘ participation in the program and a summary of the AF‘s responsibility under the governing agreement(s)

Schedule of mission design and development milestones through proposed launch date, including spacecraft PD R and CDR (or equivalent) dates

Summary table indicating compliance or noncompliance with each debris mitigation requirements of DoDI 3100.12 and this instruction

Brief description of the mission

Identification of the anticipated launch vehicle and launch site

Identification of the proposed launch date and mission duration

Description of the launch and deployment profile, including all parking, transfer, and operational orbits with apogee, perigee, and inclination

Identification of all spacecraft, launch ve hicle orbital stages, and all other released objects (> 1 mm in diameter), including their orbital parameters following insertion of the spacecraft into a mission orbit or into an Earth escape orbit

Identification of any interaction or potential physical i nterference with other operational spacecraft

Section 2: Spacecraft Description

Physical description of the spacecraft, including spacecraft bus, payload instrumentation, and all appendages, such as solar arrays, antennas, and instrument or attitude contro l booms

Detailed illustration of the entire spacecraft in the mission operation configuration with clear overall dimensional markings and marked internal component locations

Total spacecraft mass at launch, including all propellants and fluids

Dry mass of spacecraft at launch, excluding solid rocket motor propellants

Description of all propulsion systems (cold gas, monopropellant, bipropellant, electric, nuclear)

Identification, including mass and pressure, of all fluids (liquids and gases) planned to be on board and a description of the fluid loading plan or strategies, excluding fluids in sealed heat pipes

Description of all fluid systems, including size, type, and qualifications of fluid containers such as propellant and pressurization tanks

Description o f all active and/or passive attitude control systems with an indication of the normal attitude of the spacecraft with respect to the velocity vectorAFI91

- 217 18 FEBRUARY 2010 85

Description of any range safety or other pyrotechnic devices

Description of the electrical generation and s torage system
Identification of any other sources of stored energy not noted above

Identification of any radioactive materials on board

Section 3: Assessment of Spacecraft Debris Released during Normal Operations

Identification of any object (>1 mm) expect ed to be released from the spacecraft any time after launch, including object dimensions, mass, and material

Rationale/necessity for release of each object

Time of release of each object, relative to launch time

Release velocity of each object with respect to spacecraft

Expected orbital parameters (apogee, perigee, and inclination) of each object after release

Calculated orbital lifetime of each object, including time spent in Low Earth Orbit

Assessment of spacecraft compliance with DoDI 3100.12 paragraph 6.3.1 and section 5.8.3 of
this instruction

Section 4: Assessment of Spacecraft Potential for Explosions and Intentional Breakups

Identification of all potential causes of spacecraft breakup during deployment and mission operations

Summary of failure modes and effects analyses of all credible failure modes that may lead to an accidental explosion

Detailed plan for any designed spacecraft breakup, including explosions and intentional
collisions

List of components that shall be passivated at EOL. List shall include method of passivation and amount that cannot be passivated.

Rationale for all items that shall be passivated but are not designed to be passivated

Assessment of spacecraft compliance with DoDI 3100.12 section 6.3.2 and section 5.8.4 of this
instruc tion

Section 5: Assessment of Spacecraft Potential for On

- Orbit Collisions

Calculation of spacecraft probability of collision with known space objects larger than 10 cm in diameter during the orbital lifetime of the spacecraft

Identification of all systems or components required to accomplish any post

- mission disposal operation, including passivation and maneuvering

Calculation of spacecraft probability of collision with space objects, including orbital debris and meteoroids, of sufficient size to prevent p ost

- mission disposal

Assessment of spacecraft compliance with DoDI 3100.12 paragraph 6.3.3 and section 5.8.5 of
this instruction86 AFI91

- 217 18 FEBRUARY 2010

Section 6: Assessment of Spacecraft Post

- mission EOLPs and Procedures

Description of spacecraft disposal option selected

Plan for any spacecraft maneuvers required to accomplish post

- mission disposal

Calculation of area

- to

- mass ratio after post

- mission disposal, if the controlled reentry option is
not selected

Assessment of spacecraft compliance with DoDI 3100.12 paragraphs 6.3.2 .2 and 6.4 and section
5.11 of this instruction

Section 7: Assessment of Spacecraft Reentry Hazards

Detailed description of spacecraft components by size, mass, material, and shape, if the atmospheric reentry option is selected

Summary of objects expected to survive an uncontrolled reentry using NASA Debris Assessment Software (DAS), NASA Object Reentry Survival Analysis Tool (ORSAT) or comparable
software

Calculation of probability of human casualty for the expected year of uncontrolled reentry and the spa cecraft orbital inclination

If appropriate, preliminary plan for spacecraft controlled reentry

Assessment of spacecraft compliance with DoDI 3100.12 paragraph 6.4 and section 5.11 of this
instruction

Section 8: Assessment for Tether Missions

Type of tether ; e.g., momentum or electrodynamic

Description of tether system, including (1) tether length, diameter, materials, and design (single strand, ribbon, multistrand mesh), at a minimum and (2) end

- mass size and mass

Determination of minimum size of object tha t will cause the tether to be severed

Tether mission plan, including duration and post

- mission disposal

Probability of tether colliding with large space objects

Probability of tether being severed during mission or after post

- mission disposal

Maximum orbit al lifetime of a severed tether fragment

Assessment of compliance with DoDI 3100.12 paragraph 6.3.3 and section 5.8.5 of this
instruction

Section 9: Launch Vehicle Description

Identification of launch vehicle to be used

Identification of any non

- basic uppe r stages to be used

Identification of any launch vehicle stage that will be inserted into Earth orbit and left there

Dry mass of each orbital stage after spacecraft deployment

Detailed illustration of each orbital stage with clear dimensional markings and marked internalAFI91

- 217 18 FEBRUARY 2010 87

component locations

Section 10: Assessment of Launch Vehicle Debris Released during Normal Operations

Identification of any object greater than 1 mm that will be released into Earth orbit from any stage, including, but not limited to, dual payload attachment fittings and stage separation devices

Rationale/necessity for release of each object

Time of release of each object, relative to launch time

Release velocity of each object with respect to orbital stage

Expected orbital parameters (apoge e, perigee, and inclination) of each object after release

Calculated orbital lifetime of each object, including time spent in LEO

Assessment of launch vehicle compliance with DoDI 3100.12 paragraph 6.3.1 and section 5.8.3
of this instruction

Section 11: As sessment of Launch Vehicle Potential for Explosions and Intentional Breakups
Identification of all potential causes of launch vehicle orbital stage breakup during all operations

Summary of failure modes and effects analyses of all credible failure modes wh ich may lead to an orbital stage accidental explosion

Detailed plan for any designed orbital stage breakup, including explosions and intentional
collisions

Detailed plan, under normal EOL conditions and deployment malfunction scenario, for passivating (dep leting all energy sources) each orbital stage, including the burning or release of all propellants and fluids

Assessment of launch vehicle compliance with DoDI 3100.12 paragraph 6.3.1 and section 5.8.3
of this instruction

Section 12: Assessment of Launch V ehicle Potential for On

- orbit Collisions

Calculation of each orbital stage probability of collision with known space objects larger than 10 cm in diameter during the orbital lifetime of the stage

Assessment of launch vehicle compliance with DoDI 3100.12 pa ragraph 6.3.3 and section 5.8.5
of this instruction

Section 13: Assessment of Launch Vehicle Post

- mission EOLPs and Procedures

Description of orbital stage disposal option selected

Plan for any orbital stage maneuvers required to accomplish disposal after end of orbital stage
mission

Calculation of area

- to

- mass ratio after completion of all orbital stage operations, including disposal maneuvers, if the controlled reentry option is not selected

Procedure for executing orbital stage disposal plan, including t imeline from final shutdown of each orbital stage to completion of passivation and disposal operations88 AFI91

- 217 18 FEBRUARY 2010

Demonstration of reliability of orbital stage disposal operations

Assessment of launch vehicle compliance with DoDI 3100.12 paragraph 6.4 and section 5.1 1 of
this instruction

Section 14: Assessment of Launch Vehicle Reentry Hazards

[Note: if a reentry hazard assessment has already been performed for an orbital stage, simply refer to that report and make any necessary adjustments for orbital inclination and year of reentry]
Detailed description of launch vehicle components by size, mass, material, and shape, if the atmospheric reentry option is selected

Summary of objects expected to survive an uncontrolled reentry using NASA DAS, NASA ORSAT, or comparable s oftware

Calculation of probability of human casualty for the expected year of uncontrolled reentry and the orbital stage inclination

If appropriate, preliminary plan for launch vehicle controlled reentry

Assessment of launch vehicle compliance with DoDI 31 00.12 paragraph 6.4.1. and sections 4.8.3
and 5.11 of this instruction

A2.3. Review Each SDAR delivered will be reviewed by the Center Chief Engineer in coordination with the Center Safety Office. After the review, results (with corrective actions) will be provided to the PM.AFI91

- 217 18 FEBRUARY 2010 89

Attachment 3

END

- OF

- LIFE PLAN

The End

- of

- Life Plan shall be a living document that evolves with the program. Note : the level of detail required prior to launch is limited and is intended to be complete only as the EOL approaches.

A3.1. Delivery Requirements Disposal plans shall be delivered in accordance with the requirements specified below. The nominal schedule is:

A3.1.1. Preliminary EOLP: 45 days prior to the program CDR for the spacecraft or equivalent program/project development milestone. This draft is submitted to the PM, who will make distribution to the Chief Engineer and Safety Office, and any other offices as needed. The purpose of preparing the plan early in the ope rational development process is to ensure that EOL issues are identified early when resolutions are least costly to implement.

A3.1.2. Prelaunch EOLP: 30 days prior to the launch of the mission. The prelaunch EOLP shall be submitted by the PM to the Center Chief Engineer for review and subsequent submission to CDR JFCC SPACE (or designated approving official) for approval and signature prior to beginning the launch approval process. Formal acceptance of the risk associated with any noncompliance remaining in the EOLP shall be included in the approval

process.

A3.1.3. Updates to the EOLP (titled: ― [date] Update to the EOLP‖): to be made at the major program operational milestones identified in the EOLP.

A3.1.4. Final EOLP: sh all be delivered at 3 months prior to the expected implementation of the EOLP for spacecraft decommissioning/disposal.

Each EOLP delivered will be reviewed by Center (or equivalent) Chief Engineer and Safety
Office

. CDR JFCC SPACE (or designated appro v ing official) will be the final approving authority for the EOLP. The draft EOLP may be submitted in electronic form only. Signed EOLP shall be delivered in both electronic and paper copies. Note that programs are encouraged to use existing program doc umentation and the SDAR for mission and spacecraft descriptions and identification of the EOL decommissioning issues. A copy of the Final SDAR shall be included in the delivery of the Final EOLP.

A3.2. Contents of EOLP Table A3.1 below paren thetically identifies the data needed prior to launch and additional data needed during EOLP updates; the required assessments shall reflect achieved operational orbit parameters and on

- orbit state of the spacecraft.

Table A3.1. Contents of EOLP.

Cover and Front Matter ( all data is needed prior to launch )

Cover showing the document version and date of delivery.

Inside cover showing the signatures on that report. This shall include as a minimum: document preparer(s), program management, and the Ch ief Engineer and safety office reviewers. Statement of any restrictions on the data in the EOLP such as proprietary, ITAR, or export controls. If the document does not contain any restrictions, then a statement to that effect shall be90 AFI91

- 217 18 FEBRUARY 2010

included. If the docu ment does contain restricted information, the restricted information shall be summarized and marked clearly on the page(s) where it occurs and on the cover.

Document history page showing each version of the report. Reviews of the previous versions by
the Chief Engineer or safety office shall be included on this page.

Section 1: Program Management and Mission Overview ( data needed prior to launch )

Identification of the Program sponsoring the mission and the PM

Schedule of mission operational milestones from launch through EOL

Summary table indicating compliance or noncompliance with each debris mitigation requirements of DoDI 3100.12 and this instruction

Brief description of the mission (single paragraph)

Description of operational orbits with apogee, perige e, and inclination (data added during operations)

Chronology of management reviews of the EOLP to include changes in spacecraft operability which may affect the ability to passivate and dispose per the plan in Section 6 of the EOLP

Section 2: Spacecraft De scription ( data needed prior to launch )

The SDAR Section 2 contains a full description of the spacecraft. Since the SDAR remains a reference, it does not need to be repeated here.

Table of the following onboard the spacecraft at time of issue of EOLP vers ion, expected at commencement of passivation, and expected at completion of passivation.

o Fluids

o Pyrotechnic devices

o Electrical generation and storage system

o Identification of any other sources of stored energy not noted above

o Any radioactive mate rials

List of changes in the propulsion systems and energy systems which have occurred since launch. Include a detailed illustration of the entire spacecraft in the EOL configuration with clear dimensional markings and marked internal component locations ( data added during operations )

Total mass of post

- passivation spacecraft, including all propellants and fluids

Status of the major systems on board the spacecraft, including any changes in redundancy

Section 3: Assessment of Spacecraft Debris Released Duri ng and After Passivation ( data needed prior to launch, reference SDAR Section 3 )

Identification of any solid object (>1 mm) expected to be released during passivation

Identification of all objects (>1 mm) expected to be released (including fluids)

Rational e/necessity for release of each object

Time of release of each object, relative to passivation

Release velocity of each object with respect to spacecraftAFI91

- 217 18 FEBRUARY 2010 91

Expected orbital parameters (apogee, perigee, and inclination) of each object after release

Calculate d orbital lifetime of each object, including time spent in LEO

Assessment of spacecraft compliance with DoDI 3100.12 paragraph 6.3.1 and section 5.8.3 of
this instruction

Section 4: Assessment of Spacecraft Potential for Explosions and Intentional Breakups (data needed prior to launch, reference SDAR Section 4)

Identification of all potential causes of spacecraft breakup during passivation and post passivation

Summary of remaining failure modes and effects analyses of all credible failure modes which may le ad to an accidental explosion during passivation and after passivation.

Assessment of spacecraft compliance with DoDI 3100.12 paragraph 6.3.2 and section 5.8.4 of
this instruction

Section 5: Assessment of Spacecraft Potential for On

- orbit Collisions ( data needed prior to launch, reference SDAR Section 5 )

Identification of all systems or components required to accomplish any post

- mission disposal operation, including passivation and maneuvering

Evaluation of the vulnerability of systems required for post

- mis sion disposal to impacts by space objects smaller than 10 cm in diameter

Assessment of EOL spacecraft compliance with DoDI 3100.12 paragraph 6.3.3 ( data added during operations ) and section 5.8.5 of this instruction

Calculation of spacecraft probability of collision with space objects larger than 10 cm in diameter during the orbital lifetime of the spacecraft after passivation

Assessment of EOL spacecraft compliance with DoDI 3100.12 paragraph 6.3.3 ( data added during operations ) and section 5.8.5 of this i nstruction

Section 6: Assessment of Spacecraft Post

- mission EOLP and Procedures ( data needed prior to launch, reference SDAR Section 6 )

Demonstration of reliability of post

- mission disposal operations

Description of spacecraft disposal option selected

Plan for any spacecraft maneuvers required to accomplish post

- mission disposal

Calculation of area

- to

- mass ratio after post

- mission disposal, if the controlled reentry option is
not selected

Procedure for executing post

- mission disposal plan

Detailed plan for passivating (depleting all energy sources) the spacecraft, including the burning or release of all propellants and fluids, the discharge of batteries, the disabling of charging circuits, and the de

- energizing of rotational energy sources

Assessment of spacecraft compliance with DoDI 3100.12 paragraphs 6.3.2.2 and 6.4; and section
5.11 of this instruction92 AFI91

- 217 18 FEBRUARY 2010

Section 7: Assessment of Spacecraft Reentry Hazards ( reference SDAR Section 7, all data added during operations )

Detailed description of spacecraft components by size, mass, material, and shape, if the atmospheric reentry option is selected

Summary of objects expected to survive an uncontrolled reentry, specifying software tool(s) used for the analysis

Calculation of probability of human ca sualty for the expected year of uncontrolled reentry and the spacecraft orbital inclination

If appropriate, preliminary plan for spacecraft controlled reentry

Assessment of spacecraft compliance with DoDI 3100.12 paragraph 6.4 and section 5.11 of this
inst ruction

Section 8: Assessment for Tether Missions (all data added during operations)

Description of tether system, including (1) tether length, diameter, materials, and design (single strand, ribbon, multi

- strand mesh) at a minimum and (2) end

- mass size an d mass remaining at
EOL

Assessment of compliance with DoDI 3100.12 and section 5.8.5 of this instruction

EOLP Addendum: Final SDAR

For the Final EOLP, a copy of the final SDAR shall be included for reference.

A3.3. Review Each EOL plan deli vered will be reviewed by the Chief Engineer and Safety Office. After the review, results (with corrective actions) will be provided to the PM.