This appendix applies to each flight termination system and the components that make up the system for each launch. Section 417.301 requires that a launch operator's flight safety system include a flight termination system that complies with this appendix. Section 417.301 also contains requirements that apply to a launch operator's demonstration of compliance with the requirements of this appendix.

(a) When a flight safety system terminates the flight of a vehicle because it has either violated a flight safety rule as defined in § 417.113 or the vehicle inadvertently separates or destructs as described in section D417.11, a flight termination system must:

(1) Render each propulsion system that has the capability of reaching a populated or other protected area, incapable of propulsion, without significant lateral or longitudinal deviation in the impact point. This includes each stage and any strap on motor or propulsion system that is part of any payload;

(2) Terminate the flight of any inadvertently or prematurely separated propulsion system capable of reaching a populated or other protected area;

(3) Destroy the pressure integrity of any solid propellant system to terminate all thrust or ensure that any residual thrust causes the propulsion system to tumble without significant lateral or longitudinal deviation in the impact point; and

(4) Disperse any liquid propellant, whether by rupturing the propellant tank or other equivalent method, and initiate burning of any toxic liquid propellant.

(b) A flight termination system must not cause any solid or liquid propellant to detonate.

(c) The flight termination of a propulsion system must not interfere with the flight termination of any other propulsion system.

(a) Reliability prediction. A flight termination system must have a predicted reliability of 0.999 at a confidence level of 95 percent. A launch operator must demonstrate the system's predicted reliability by satisfying the requirements for system reliability analysis of § 417.309(b).

(b) Single fault tolerance. A flight termination system, including monitoring and checkout circuits, must not have a single failure point that would:

(1) Inhibit functioning of the system during flight; or

(2) Produce an inadvertent initiation of the system that would endanger the public.

(c) Redundancy. A flight termination system must use redundant components that are structurally, electrically, and mechanically separated. Each redundant component's mounting on a launch vehicle, including location or orientation, must ensure that any failure that will damage, destroy or otherwise inhibit the operation of one redundant component will not inhibit the operation of the other redundant component and will not inhibit functioning of the system. Each of the following exceptions applies:

(1) Any linear shaped charge need not be redundant if it initiates at both ends, and the initiation source for one end is not the same as the initiation source for the other end; or

(2) Any passive component such as an antenna or radio frequency coupler need not be redundant if it satisfies the requirements of this appendix.

(d) System independence. A flight termination system must operate independently of any other launch vehicle system. The failure of another launch vehicle system must not inhibit the functioning of a flight termination system. A flight termination system may share a component with another launch vehicle system, only if the launch operator demonstrates that sharing the component will not degrade the flight termination system's reliability. A flight termination system may share a connection with another system if the connection must exist to satisfy a flight termination system requirement, such as any connection needed to:

(1) Accomplish flight termination system arming and safing;

(2) Provide data to the telemetry system; or

(3) Accomplish any engine shut-down.

(e) Performance specifications for components and parts. Each flight termination system component and each part that can affect the reliability of a flight termination component during flight must have written performance specifications that show, and contain the details of, how the component or part satisfies the requirements of this appendix.

(f) Ability to test. A flight termination system, including each component and associated ground support and monitoring equipment, must satisfy the tests required by appendix E of this part.

(g) Software safety critical functions. The requirements of § 417.123 apply to any computing system, software or firmware that is associated with a flight termination system and performs a software safety critical function as defined in § 417.123.

(h) Component storage, operating, and service life. Each flight termination system component must have a specified storage life, operating life, and service life and must satisfy all of the following:

(1) Each component must satisfy all its performance specifications when subjected to the full length of its specified storage life, operating life, and service life; and

(2) A component's storage, operating, or service life must not expire before flight. A launch operator may extend an ordnance component's service life by satisfying the service life extension tests of appendix E of this part.

(i) Consistency of components. A launch operator must ensure that each flight component sample is manufactured using parts, materials, processes, quality controls, and procedures that are each consistent with the manufacture of each qualification test sample.

(a) General. A flight termination system, including all of its components, mounting hardware, cables, and wires, must each satisfy all of their performance specifications when subjected to each maximum predicted operating and non-operating environment and environmental design margin required by this appendix. As an alternative to subjecting the flight termination system to the maximum predicted environments and margin for each dynamic operating environment, such as vibration or shock, a flight termination system need only satisfy all its performance specifications when subjected to an environmental level greater than the level that would cause structural breakup of the launch vehicle.

(b) Maximum predicted environments. A launch operator must determine all maximum predicted non-operating and operating environments that a flight termination system, including each component, will experience before its safe flight state. This determination must be based on analysis, modeling, testing, or monitoring. Non-operating and operating environments include temperature, vibration, shock, acceleration, acoustic, and other environments that apply to a specific launch vehicle and launch site, such as humidity, salt fog, dust, fungus, explosive atmosphere, and electromagnetic energy. Both of the following apply:

(1) Each maximum predicted vibration, shock, and thermal environment for a flight termination system component must include a margin that accounts for the uncertainty due to flight-to-flight variability and any analytical uncertainty. For a launch vehicle configuration for which there have been fewer than three flights, the margin must be no less than plus 3 dB for vibration, plus 4.5 dB for shock, and plus and minus 11 °C for thermal range; and

(2) For a launch vehicle configuration for which there have been fewer than three flights, a launch operator must monitor flight environments at as many locations within the launch vehicle as needed to verify the maximum predicted flight environments for each flight termination system component. An exception is that the launch operator may obtain empirical shock environment data through ground testing. A launch operator must adjust each maximum predicted flight environment for any future launch to account for all data obtained through monitoring.

(c) Thermal environment. A component must satisfy all its performance specifications when exposed to preflight and flight thermal cycle environments. A thermal cycle must begin with the component at ambient temperature. The cycle must continue as the component is heated or cooled to achieve the required dwell time at one extreme of the required thermal range, then to achieve the required dwell time at the other extreme, and then back to ambient temperature. Each cycle, including all dwell times, must be continuous without interruption by any other period of heating or cooling. Paragraphs (c)(2) through (c)(6) of this section identify the required thermal range for each component. A thermal cycle must include no less than a one-hour dwell time at each temperature extreme. The thermal rate of change between the extremes must be no less than the maximum predicted thermal rate of change or 1 °C per minute, whichever is greater. For an ordnance device, the thermal cycle must include no less than a two-hour dwell time at each temperature extreme. The thermal rate of change between the extremes for an ordnance device must be no less than the maximum predicted thermal rate of change or 3 °C per minute, whichever is greater.

(1) Acceptance-number of thermal cycles. For each component, the acceptance-number of thermal cycles must be no less than eight thermal cycles or 1.5 times the maximum number of thermal cycles that the component could experience during launch processing and flight, including all launch delays and recycling, rounded up to the nearest whole number, whichever is greater.

(2) Passive components. A passive component must satisfy all its performance specifications when subjected to:

(i) The acceptance-number of thermal cycles from one extreme of the maximum predicted thermal range to the other extreme; and

(ii) Three times the acceptance-number of thermal cycles from the lower of −34 °C or the predicted lowest temperature minus 10 °C, to the higher of 71 °C or the predicted highest temperature plus 10 °C.

(3) Electronic components. An electronic flight termination system component, including any component that contains an active electronic piece-part such as a microcircuit, transistor, or diode must satisfy all its performance specifications when subjected to:

(i) The sum of ten thermal cycles and the acceptance-number of thermal cycles from one extreme of the maximum predicted thermal range to the other extreme; and

(ii) Three times the acceptance-number of thermal cycles from the lower of −34 °C or the predicted lowest temperature minus 10 °C, to the higher of 71 °C or the predicted highest temperature plus 10 °C.

(4) Power source thermal design. A flight termination system power source, including any battery, must satisfy all its performance specifications when exposed to preflight and flight thermal environments. The power source must satisfy the following:

(i) A silver zinc battery must satisfy all its performance specifications when subjected to the acceptance-number of thermal cycles from 10 °C lower than the lowest temperature of the battery's maximum predicted temperature range to 10 °C higher than the highest temperature of the range. An exception is that each thermal cycle may range from 5.5 °C lower than the lowest temperature of the battery's maximum predicted temperature range to 10 °C higher than the highest temperature of the range if the launch operator monitors the battery's operating temperature on the launch vehicle with an accuracy of no less than ±1.5 °C.

(ii) A nickel cadmium battery must satisfy all its performance specifications when subjected to three times the acceptance-number of thermal cycles from the lower of −20 °C or the predicted lowest temperature minus 10 °C, to the higher of 40 °C or the predicted highest temperature plus 10 °C.

(iii) Any other power source must satisfy all its performance specifications when subjected to three times the acceptance-number of thermal cycles from 10 °C lower than the lowest temperature of the maximum predicted temperature range to 10 °C higher the highest temperature of the range.

(5) Electro-mechanical safe-and-arm devices with internal explosives. A safe-and-arm device must satisfy all its performance specifications when subjected to:

(i) The acceptance-number of thermal cycles from one extreme of the maximum predicted thermal range to the other extreme; and

(ii) Three times the acceptance-number of thermal cycles from the lower of −34 °C or the predicted lowest temperature minus 10 °C, to the higher of 71 °C or the predicted highest temperature plus 10 °C.

(6) Ordnance thermal design. An ordnance device and any associated hardware must satisfy all its performance specifications when subjected to the acceptance-number of thermal cycles from the lower of −54 °C or the predicted lowest temperature minus 10 °C, to the higher of 71 °C or the predicted highest temperature plus 10 °C. Each cycle must include a two-hour dwell time at each temperature extreme and a thermal rate of change between the extremes must be no less than the maximum predicted thermal rate of change or 3 °C per minute, whichever is greater.

(d) Random vibration. A component must satisfy all its performance specifications when exposed to a composite vibration level profile consisting of the higher of 6 dB above the maximum predicted flight random vibration level or a 12.2Grms workmanship screening level, across the 20 Hz to 2000 Hz spectrum of the two levels. The component must satisfy all its performance specifications when exposed to three times the maximum predicted random vibration duration time or three minutes per axis, whichever is greater, on each of three mutually perpendicular axes and for all frequencies from 20 Hz to 2000 Hz.

(e) Sinusoidal vibration. A component must satisfy all its performance specifications when exposed to 6 dB above the maximum predicted flight sinusoidal vibration level. The component must satisfy all its performance specifications when exposed to three times the maximum predicted sinusoidal vibration duration time on each of three mutually perpendicular axes and for all frequencies from 50% lower than the predicted lowest frequency to 50% higher than the predicted highest frequency. The sweep rate must be no greater than one-third the maximum predicted sweep rate on each of the three axes.

(f) Transportation vibration. A component must satisfy all its performance specifications when exposed to 6 dB above the maximum predicted transportation vibration level to be experienced when the component is in the configuration in which it is transported, for three times the maximum predicted transportation exposure time. A component must also satisfy all its performance specifications when exposed to the workmanship screening vibration levels and duration required by section E417.9(f).

(g) Pyrotechnic shock.

(1) A flight termination system component must satisfy all its performance specifications when exposed to the greater of:

(i) A force of 6 dB above the maximum predicted pyrotechnic shock level to be experienced during flight with a shock frequency response range from 100 Hz to 10,000 Hz; or

(ii) The minimum breakup qualification shock levels and frequencies required by Table E417.11-2 of appendix E of this part.

(2) A component must satisfy all its performance specifications after it experiences a total of 18 shocks consisting of three shocks in each direction, positive and negative, for each of three mutually perpendicular axes.

(h) Transportation shock. A flight termination system component must satisfy all its performance specifications after being exposed to the maximum predicted shock to be experienced during transportation while in the configuration in which it is packed for transport.

(i) Bench handling shock. A flight termination system component must satisfy all its performance specifications after being exposed to the maximum predicted shock to be experienced during handling in its unpacked configuration.

(j) Acceleration environment. A flight termination system component must satisfy all its performance specifications when exposed to launch vehicle breakup acceleration levels or twice the maximum predicted flight acceleration levels, whichever is greater. The component must satisfy all its performance specifications when exposed to three times the maximum predicted acceleration duration for each of three mutually perpendicular axes.

(k) Acoustic environment. A flight termination system component must satisfy all its performance specifications when exposed to 6 dB above the maximum predicted sound pressure level. The component must satisfy all its performance specifications when exposed to three times the maximum predicted sound pressure duration time or three minutes, whichever is greater for each of three mutually perpendicular axes. The frequency must range from 20 Hz to 2000 Hz.

(l) Other environments. A flight termination system component must satisfy all its performance specifications after experiencing any other environment that it could experience during transportation, storage, preflight processing, or preflight system testing. Such environments include storage temperature, humidity, salt fog, fine sand, fungus, explosive atmosphere, and electromagnetic energy environments.

(a) A flight termination system must include a command destruct system that is initiated by radio command and satisfies the requirements of this section.

(b) A command destruct system must have its radio frequency components on or above the last launch vehicle stage capable of reaching a populated or other protected area before the planned safe flight state for the launch.

(c) The initiation of a command destruct system must result in accomplishing all the flight termination system functions of section D417.3.

(d) At any point along the nominal trajectory from liftoff until no longer required by § 417.107, a command destruct system must operate with a radio frequency input signal that has an electromagnetic field intensity of 12 dB below the intensity provided by the command transmitter system under nominal conditions over 95 percent of the radiation sphere surrounding the launch vehicle.

(e) A command destruct system must survive the breakup of the launch vehicle until the system accomplishes all its flight termination functions or until breakup of the vehicle, including the use of any automatic or inadvertent separation destruct system, accomplishes the required flight termination.

(f) A command destruct system must receive and process a valid flight termination system arm command before accepting a flight termination system destruct command.

(g) For any liquid propellant, a command destruct system must allow a flight safety official to non-destructively shut down any thrusting liquid engine by command before destroying the launch vehicle.

(a) A flight termination system must include an automatic or inadvertent separation destruct system for each stage or strap-on motor capable of reaching a protected area before the planned safe flight state for each launch if the stage or strap-on motor does not possess a complete command destruct system. Any automatic or inadvertent separation destruct system must satisfy the requirements of this section.

(b) The initiation of an automatic or inadvertent separation destruct system must accomplish all flight termination system functions of section D417.3 that apply to the stage or strap-on motor on which it is installed.

(c) An inadvertent separation destruct system must activate when it senses any launch vehicle breakup or premature separation of the stage or strap-on motor on which the inadvertent separation destruct system is located.

(d) A launch operator must locate an automatic or inadvertent separation destruct system so that it will survive launch vehicle breakup until the system activates and accomplishes all its flight termination functions.

(e) For any electrically initiated automatic or inadvertent separation destruct system, each power source that supplies energy to initiate the destruct ordnance must be on the same stage or strap-on motor as the system.

(a) General. A flight termination system must provide for safing and arming of all flight termination system ordnance through the use of a mechanical barrier or other positive means of interrupting power to each of the ordnance firing circuits to prevent inadvertent initiation of ordnance.

(b) Flight termination system arming. A flight termination system must provide for each flight termination system ordnance initiation device or arming device to be armed and all electronic flight termination system components to be turned on before arming any launch vehicle or payload propulsion ignition circuits. For a launch where propulsive ignition occurs after first motion of the launch vehicle, the system must include an ignition interlock that prevents the arming of any launch vehicle or payload propulsion ignition circuit unless all flight termination system ordnance initiation devices and arming devices are armed and all electronic flight termination system components are turned on.

(c) Preflight safing. A flight termination system must provide for remote and redundant safing of all flight termination system ordnance before flight and during any launch abort or recycle operation.

(d) In-flight safing. Any safing of flight termination system ordnance during flight must satisfy all of the following:

(1) Any onboard launch vehicle hardware or software used to automatically safe flight termination system ordnance must be single fault tolerant against inadvertent safing. Any automatic safing must satisfy all of the following:

(i) Any automatic safing must occur only when the flight of the launch vehicle satisfies the safing criteria for no less than two different safing parameters or conditions, such as time of flight, propellant depletion, acceleration, or altitude. The safing criteria for each different safing parameter or condition must ensure that the flight termination system on a stage or strap-on-motor can only be safed once the stage or strap-on motor attains orbit or can no longer reach a populated or other protected area;

(ii) Any automatic safing must ensure that all flight termination system ordnance initiation devices and arming devices remain armed and all electronic flight termination system components remain powered during flight until the requirements of paragraph (d)(1)(i) of this section are satisfied and the system is safed; and

(iii) If operation of the launch vehicle could result in satisfaction of the safing criteria for one of the two safing parameters or conditions before normal thrust termination of the stage or strap-on motor to which the parameter or condition applies, the launch operator must demonstrate that the greatest remaining thrust, assuming a three-sigma maximum engine performance, cannot result in the stage or strap-on motor reaching a populated or other protected area;

(2) If a radio command safes a flight termination system, the command control system used for in-flight safing must be single fault tolerant against inadvertent transmission of a safing command under § 417.303(d).

(a) A launch operator must establish and implement written procedures to ensure that all flight termination system components are installed on a launch vehicle according to the qualified flight termination system design. The procedures must ensure that:

(1) The installation of all flight termination system mechanical interfaces is complete;

(2) Installation personnel use calibrated tools to install ordnance when a specific standoff distance is necessary to ensure that the ordnance has the desired effect on the material it is designed to cut or otherwise destroy; and

(3) Each person involved is qualified for each task that person is to perform.

(b) Flight termination system installation procedures must include:

(1) A description of each task to be performed, each facility to be used, and each hazard involved;

(2) A checklist of tools and equipment required;

(3) A list of personnel required for performing each task;

(4) Step-by-step directions written with sufficient detail for a qualified person to perform each task;

(5) Identification of any tolerances that must be met during the installation; and

(6) Steps for inspection of installed flight termination system components, including quality assurance oversight procedures.

(c) The personnel performing a flight termination system installation procedure must signify that the procedure is accomplished, and record the outcome and any data verifying successful installation.

(a) A flight termination system must interface with the launch vehicle's telemetry system to provide the data that the flight safety system crew needs to evaluate the health and status of the flight termination system prior to and during flight.

(b) The telemetry data must include:

(1) Signal strength for each command destruct receiver;

(2) Whether the power to each electronic flight termination system component is on or off;

(3) Status of output commands for each command destruct receiver and each automatic or inadvertent separation destruct system;

(4) Safe or arm status of each safe-and-arm device of sections D417.35 and D417.39;

(5) Voltage for each flight termination system battery;

(6) Current for each flight termination system battery;

(7) Status of any electrical inhibit at the system level that is critical to the operation of a flight termination system and is not otherwise identified by this appendix;

(8) Status of any exploding bridgewire firing unit, including arm input, power level, firing capacitor charge level, and trigger capacitor charge level;

(9) Temperature of each flight termination system battery, whether monitored at each battery or in the immediate vicinity of each battery so that each battery's temperature can be derived; and

(10) Status of each switch used to provide power to a flight termination system, including any switch used to change from an external power source to an internal power source.

(a) General. All flight termination system electrical components and electronic circuitry must satisfy the requirements of this section.

(b) Electronic piece-parts. Each electronic piece-part that can affect the reliability of an electrical component or electronic circuitry during flight must satisfy § 417.309(b)(2) of this part.

(c) Over and under input voltage protection. A flight termination system component must satisfy all its performance specifications and not sustain any damage when subjected to a maximum input voltage of no less than the maximum open circuit voltage of the component's power source. The component must satisfy all its performance specifications and not sustain any damage when subjected to a minimum input voltage of no greater than the minimum loaded voltage of the component's power source.

(d) Series-redundant circuit. A flight termination system component that uses a series-redundant branch in a firing circuit to satisfy the prohibition against a single failure point must possess one or more monitoring circuits or test points for verifying the integrity of each series-redundant branch after assembly and during testing.

(e) Power control and switching. In the event of an input power dropout, a power control or switching circuit, including any solid-state power transfer switch and arm-and-enable circuit must not change state for 50 milliseconds or more. Any electromechanical, solid-state, or relay component used in a flight termination system firing circuit must be capable of delivering the maximum firing current for no less than 10 times the duration of the intended firing pulse.

(f) Circuit isolation, shielding, and grounding. The circuitry of a flight termination system component must be shielded, filtered, grounded, or otherwise isolated to preclude any energy sources, internal or external to the launch vehicle, such as electromagnetic energy, static electricity, or stray electrical currents, from causing interference that would inhibit the flight termination system from functioning or cause an undesired output of the system. An electrical firing circuit must have a single-point ground connection directly to the power source only.

(g) Circuit protection. Any circuit protection provided within a flight termination system must satisfy all of the following:

(1) Electronic circuitry must not contain protection devices, such as fuses, except as allowed by paragraph (g)(2) of this section. A destruct circuit may employ current limiting resistors;

(2) Any electronic circuit designed to shut down or disable a launch vehicle engine and that interfaces with a launch vehicle function must use one or more devices, such as fuses, circuit breakers, or limiting resistors, to protect against over-current, including any direct short; and

(3) The design of a flight termination system output circuit that interfaces with another launch vehicle circuit must prevent any launch vehicle circuit failure from disabling or degrading the flight termination system's performance.

(h) Repetitive functioning. Each circuit, element, component, and subsystem of a flight termination system must satisfy all its performance specifications when subjected to repetitive functioning for five times the expected number of cycles required for all acceptance testing, checkout, and operations, including re-tests caused by schedule or other delays.

(i) Watchdog circuits. A flight termination system or component must not use a watchdog circuit that automatically shuts down or disables circuitry during flight.

(j) Self-test capability. If a flight termination system component uses a microprocessor, the component and the microprocessor must perform self-tests, detect errors, and relay the results through telemetry during flight to the launch operator. The execution of a self-test must not inhibit the intended processing function of the unit or cause any output to change.

(k) Electromagnetic interference protection. The design of a flight termination system component must eliminate the possibility of the maximum predicted electromagnetic interference emissions or susceptibilities, whether conducted or radiated, from affecting the component's performance. A component's electromagnetic interference susceptibility level must ensure that the component satisfies all its performance specifications when subjected to the maximum predicted emission levels of all other launch vehicle components and external sources to which the component would be exposed.

(l) Ordnance initiator circuits. An ordnance initiator circuit that is part of a flight termination system must satisfy all of the following:

(1) An ordnance initiator circuit must deliver an operating current of no less than 150% of the initiator's all-fire qualification current level when operating at the lowest battery voltage and under the worse case system tolerances allowed by the system design limits;

(2) For a low voltage ordnance initiator with an electro-explosive device that initiates at less than 50 volts, the initiator's circuitry must limit the power at each associated electro-explosive device that could be produced by an electromagnetic environment to a level at least 20 dB below the pin-to-pin direct current no-fire power of the electro-explosive device; and

(3) For a high voltage ordnance initiator that initiates ordnance at greater than 1,000 volts, the initiator must include safe-and-arm plugs that interrupt power to the main initiator's charging circuits, such as the trigger and output capacitors. A high voltage initiator's circuitry must ensure that the power that could be produced at the initiator's command input by an electromagnetic environment is no greater than 20 dB below the initiator's firing level.

(a) Each parameter measurement made by a monitor circuit must show the status of the parameter.

(b) Each monitor circuit must be independent of any firing circuit. A monitor, control, or checkout circuit must not share a connector with a firing circuit.

(c) A monitor circuit must not route through a safe-and-arm plug.

(d) Any monitor current in an electro-explosive device system firing line must not exceed one-tenth of the no-fire current of the electro-explosive device.

(e) Resolution, accuracy, and data rates for each monitoring circuit must provide for detecting whether performance specifications are satisfied and detecting any out-of-family conditions.

(a) An ordnance train must consist of all components responsible for initiation, transfer, and output of an explosive charge. Ordnance train components must include, initiators, energy transfer lines, boosters, explosive manifolds, and destruct charges.

(b) The reliability of an ordnance train to initiate ordnance, including the ability to propagate a charge across any ordnance interface, must be 0.999 at a 95% confidence level.

(c) The decomposition, cook-off, sublimation, auto-ignition, and melting temperatures of all flight termination system ordnance must be no less than 30(C higher than the maximum predicted environmental temperature to which the material will be exposed during storage, handling, installation, transportation, and flight.

(d) An ordnance train must include initiation devices that can be connected or removed from the destruct charge. The design of an ordnance train must provide for easy access to the initiation devices.

(a) General. A radio frequency receiving system must include each flight termination system antenna, radio frequency coupler, any radio frequency cable, or other passive device used to connect a flight termination system antenna to a command receiver decoder. The system must deliver command control system radio frequency energy that satisfies all its performance specifications to each flight termination system command receiver decoder when subjected to performance degradation caused by command control system transmitter variations, launch vehicle flight conditions, and flight termination system hardware performance variations.

(b) Sensitivity. A radio frequency receiving system must provide command signals to each command receiver decoder at an electromagnetic field intensity of no less than 12dB above the level required for reliable receiver operation. The system must satisfy the 12-dB margin over 95% of the antenna radiation sphere surrounding the launch vehicle and must account for command control system radio frequency transmitter characteristics, airborne system characteristics including antenna gain, path loses due to plume or flame attenuation, and vehicle trajectory. For each launch, the system must satisfy the 12-dB margin at any point along the nominal trajectory until the planned safe flight state for the launch.

(c) Antenna. All of the following apply to each flight termination system antenna:

(1) A flight termination system antenna must have a radio frequency bandwidth that is no less than two times the total combined maximum tolerances of all applicable radio frequency performance factors. The performance factors must include frequency modulation deviation, command control transmitter inaccuracies, and variations in hardware performance during thermal and dynamic environments;

(2) A launch operator must treat any thermal protection used on a flight termination system antenna as part of the antenna; and

(3) A flight termination system antenna must be compatible with the command control system transmitting equipment.

(d) Radio frequency coupler. A flight termination system must use a passive radio frequency coupler to combine radio frequency signals inputs from each flight termination system antenna and distribute the required signal level to each command receiver. A radio frequency coupler must satisfy all of the following:

(1) A radio frequency coupler must prevent any single point failure in one redundant command receiver or antenna from affecting any other redundant command receiver or antenna by providing isolation between each port. An open or short circuit in one redundant command destruct receiver or antenna path must not prevent the functioning of the other command destruct receiver or antenna path;

(2) Each input port must be isolated from all other input ports;

(3) Each output port must be isolated from all other output ports; and

(4) A radio frequency coupler must provide for a radio frequency bandwidth that exceeds two times the total combined maximum tolerances of all applicable radio frequency performance factors. The performance factors must include frequency modulation deviation of multiple tones, command control transmitter inaccuracies, and variations in hardware performance during thermal and dynamic environments.

(a) General. The requirements in this section apply to each electronic component that contains piece-part circuitry and is part of a flight termination system, including each command receiver decoder. Each piece-part used in an electronic component must satisfy § 417.309(b)(2) of this part.

(b) Response time. Each electronic component's response time must be such that the total flight termination system response time, from receipt of a destruct command sequence to initiation of destruct output, is less than or equal to the response time used in the time delay analysis required by § 417.221.

(c) Wire and connectors. All wire and connectors used in an electronic component must satisfy section D417.31.

(d) Adjustment. An electronic component must not require any adjustment after successful completion of acceptance testing.

(e) Self-test. The design of an electronic component that uses a microprocessor must provide for the component to perform a self-test, detect errors, and relay the results through telemetry during flight to the launch operator. The execution of a self-test must not inhibit the intended processing function of the unit or cause any output to change state.

(f) Electronic component repetitive functioning. An electronic component, including all its circuitry and parts, must satisfy all its performance specifications when subjected to repetitive functioning for five times the total expected number of cycles required for acceptance tests, preflight tests, and flight operations, including potential retests due to schedule delays.

(g) Acquisition of test data. The test requirements of appendix E of this part apply to all electronic components. Each electronic component must allow for separate component testing and the recording of parameters that verify its functional performance, including the status of any command output, during testing.

(h) Warm-up time. The warm-up time that an electronic component needs to ensure reliable operation must be no greater than the warm-up time that is incorporated into the preflight testing of appendix E of this part.

(i) Electronic component circuit protection. An electronic component must include circuit protection for power and control circuitry, including switching circuitry. The circuit protection must ensure that the component satisfies all its performance specifications when subjected to launch processing and flight environments. An electronic component's circuit protection must satisfy all of the following:

(1) Circuit protection must provide for an electronic component to satisfy all its performance specifications when subjected to the open circuit voltage of the component's power source for no less than twice the expected duration and when subjected to the minimum input voltage of the loaded voltage of the power source for no less than twice the expected duration;

(2) In the event of an input power dropout, any control or switching circuit critical to the reliable operation of a component, including solid-state power transfer switches, must not change state for at least 50 milliseconds;

(3) An electronic component must not use a watchdog circuit that automatically shuts down or disables the component during flight;

(4) An electronic component must satisfy all its performance specifications when any of its monitoring circuits or nondestruct output ports are subjected to a short circuit or the highest positive or negative voltage capable of being supplied by the monitor batteries or other power supplies where the voltage lasts for no less than five minutes; and

(5) An electronic component must satisfy all its performance specifications when subjected to any undetectable reverse polarity voltage that can occur during launch processing for no less than five minutes.

(j) Electromagnetic interference susceptibility. The design of an electronic component must eliminate the possibility of electromagnetic interference or modulated or unmodulated radio frequency emissions from affecting the component's performance. These electromagnetic interference and radio frequency environments include emissions or susceptibilities, whether conducted or radiated.

(1) The susceptibility level of an electronic component must be below the emissions of all other launch vehicle components and external transmitters.

(2) Any electromagnetic emissions from an electronic component must not be at a level that would affect the performance of other flight termination system components.

(3) An electronic component must not produce any inadvertent command output and must satisfy all its performance specifications when subjected to external radio frequency sources and modulation schemes to which the component could be subjected prior to and during flight.

(k) Output functions and monitoring. An electronic component must provide for all of the following output functions and monitoring:

(1) Each series redundant branch in any firing circuit of an electronic component that prevents a single failure point from issuing a destruct output must include a monitoring circuit or test points that verify the integrity of each redundant branch after assembly;

(2) Any piece-part used in a firing circuit must have the capacity to output at least 1.5 times the maximum firing current for no less than 10 times the duration of the maximum firing pulse;

(3) An electronic component's destruct output circuit and all its parts must deliver the required output power to the intended output load while operating with any input voltage that is within the component's input power operational design limits;

(4) An electronic component must include monitoring circuits that provide for monitoring the health and performance of the component including the status of any command output; and

(5) The maximum leakage current through an electronic component's destruct output port must:

(i) Not degrade the performance of downstream circuitry;

(ii) Be 20 dB lower than the level that could degrade the performance of any downstream ordnance initiation system or component, such as any electro-explosive device; and

(iii) Be 20 dB lower than the level that could result in inadvertent initiation of any downstream ordnance.

(a) General. Each command receiver decoder must:

(1) Receive radio frequency energy from the command control system through the radio frequency receiving system and interpret, process, and send commands to the flight termination system;

(2) Be compatible with the command control system transmitting equipment;

(3) Satisfy the requirements of section D417.27 for all electronic components;

(4) Satisfy all its performance specifications and reliably process a command signal when subjected to command control system transmitting equipment tolerances and flight generated signal degradation, including:

(i) Locally induced radio frequency noise sources;

(ii) Vehicle plume;

(iii) The maximum predicted noise-floor;

(iv) Command transmitter performance variations; and

(v) Launch vehicle trajectory.

(b) Tone-based radio frequency processing. Each tone-based command receiver decoder must satisfy all of the following for all pre-flight and flight environments:

(1) Decoder channel deviation. A receiver decoder must reliably process the intended tone deviated signal at the minimum and maximum number of expected tones. The receiver decoder must satisfy all its performance specifications when subjected to:

(i) Plus and minus 3 KHz per tone; or

(ii) A nominal tone deviation plus twice the maximum and minus half the minimum of the total combined tolerances of all applicable radio frequency performance factors, whichever range is greater.

(2) Operational bandwidth.

(i) The receiver decoder's operational bandwidth must be no less than plus and minus 45 KHz and must ensure that the receiver decoder satisfies all its performance specifications at:

(A) Twice the worst-case command control system transmitter radio frequency shift;

(B) Doppler shifts of the carrier center frequency; and

(C) Shifts in flight hardware center frequency during flight at the manufacturer guaranteed receiver sensitivity.

(ii) The operational bandwidth must account for tone deviation and the receiver sensitivity must not vary by more than 3dB across the bandwidth.

(3) Radio frequency dynamic range. The receiver decoder must satisfy all its performance specifications when subjected to the variations of the radio frequency input signal level that will occur during checkout and flight. The receiver decoder must output all commands with input from the radio frequency threshold level up to:

(i) The maximum radio frequency level that it will experience from the command control system transmitter during checkout and flight plus a 3-dB margin; or

(ii) 13 dBm, whichever is greater.

(4) Capture ratio. For each launch, the receiver decoder's design must ensure that no transmitter with less than 80% of the power of the command transmitter system for the launch, could capture or interfere with the receiver decoder.

(5) Radio frequency level monitor.

(i) The receiver decoder must include a monitoring circuit that accurately monitors and outputs the strength of the radio frequency input signal during flight.

(ii) The output of the monitor circuit must be directly related and proportional to the strength of the radio frequency input signal from the threshold level to saturation.

(iii) The dynamic range of the radio frequency input from threshold to saturation must be no less than 50 dB. The monitor circuit output amplitude from threshold to saturation must have a corresponding range of 18 dB or greater.

(iv) The monitor output signal level must be compatible with vehicle telemetry system interfaces and provide a maximum response time of 100 ms.

(v) The slope of the monitor circuit output must not change polarity.

(6) Radio frequency threshold sensitivity. The receiver decoder's threshold sensitivity must satisfy its performance specifications and be repeatable within a tolerance of plus and minus 3 dB, to demonstrate in-family performance.

(7) Noise level margin. The receiver decoder's guaranteed input sensitivity must be no less than 6 dB higher than the maximum predicted noise-floor.

(8) Voltage standing wave ratio. All radio frequency losses within the receiver decoder interface to the antenna system must satisfy the 12-dB margin of § 417.9(d) and be repeatable to demonstrate in-family performance. The radio frequency receiving system and the impedance of the receiver decoder must match.

(9) Decoder channel bandwidth. The receiver decoder must provide for reliable recognition of the command signal when subjected to variations in ground transmitter tone frequency and frequency modulation deviation variations. The command receiver must satisfy all its performance specifications within the specified tone filter frequency bandwidth using a frequency modulation tone deviation from 2 dB to 20 dB above the measured threshold level.

(10) Tone balance. Any secure receiver decoder must reliably decode a valid command with an amplitude imbalance between two tones within the same message.

(11) Message timing. Any secure receiver decoder must function reliably when subjected to errors in timing caused by ground transmitter tolerances. The receiver decoder must process commands at twice the maximum and one-half the minimum timing specification of the ground system.

(12) Check tone. The receiver decoder must decode a tone, such as a pilot tone or check tone, which is representative of link and command closure and provide a telemetry output indicating whether the tone is decoded. The presence or absence of this tone signal must have no effect on a command receiver decoder's command processing and output capability.

(c) Inadvertent command output. A command receiver decoder must satisfy all of the following to ensure that it does not provide an output other than when it receives a valid command.

(1) Dynamic stability. The receiver decoder must not produce an inadvertent output when subjected to a radio frequency input short-circuit, open-circuit, or changes in input voltage standing wave ratio.

(2) Out of band rejection. The receiver decoder must not degrade in performance nor respond when subjected to any out-of-band vehicle or ground transmitter source that could be encountered from liftoff to the no-longer endanger time. The receiver decoder must not respond to frequencies, from 10 MHz to 1000 MHz except at the receiver specified operational bandwidth. The receiver decoder's radio frequency rejection of out of band signals must provide a minimum of 60 dB beyond eight times the maximum specified operational bandwidth. These frequencies must include all expected interfering transmitting sources using a minimum bandwidth of 20% of each transmitter center frequency, receiver image frequencies and harmonics of the assigned center frequency.

(3) Decoder channel bandwidth rejection. The receiver decoder must distinguish between tones that are capable of inhibiting or inadvertently issuing an output command. Each tone filter must not respond to another tone outside the specified tone filter frequency bandwidth using an FM tone deviation from 2 dB to 20 dB above the measured threshold level.

(4) Adjacent tone decoder channel rejection. The receiver decoder must not be inhibited or inadvertently issue an output command when subjected to any over-modulation of adjacent tones. The tone decoder channels must not respond to adjacent frequency modulation-modulated tone channels when they are modulated with a minimum of 150% of the expected tone deviation.

(5) Logic sequence. Each tone sequence used for arm and destruct must protect against inadvertent or unintentional destruct actions.

(6) Destruct sequence. The receiver decoder must provide a Destruct command only if preceded by a valid Arm command.

(7) Receiver abnormal logic. The receiver decoder must not respond to any combination of tones or tone pairs other than the correct command sequence.

(8) Noise immunity. The receiver decoder must not respond to a frequency modulated white noise radio frequency input that has a minimum frequency modulated deviation of 12 dB above the measured threshold deviation.

(9) Tone drop. The receiver decoder must not respond to a valid command output when one tone in the sequence is dropped.

(10) Amplitude modulation rejection. The receiver decoder must not respond to any tone or modulated input at 50% and 100% amplitude modulated noise when subjected to the maximum pre-flight and flight input power levels.

(11) Decoder channel deviation rejection. The receiver decoder must not inadvertently trigger on frequency modulated noise. The receiver decoder must not respond to tone modulations 10 dB below the nominal tone modulation or lower.

(a) All wiring, including any cable and all connectors, that interface with any flight termination system component must provide for the component, wiring, and connectors to satisfy the qualification tests required by appendix E of this part.

(b) Each connector that interfaces with a flight termination system component must protect against electrical dropout and ensure electrical continuity as needed to ensure the component satisfies all its performance specifications.

(c) All wiring and connectors must have shielding that ensures the flight termination system satisfies all its performance specifications and will not experience an inadvertent destruct output when subjected to electromagnetic interference levels 20 dB greater than the greatest electromagnetic interference induced by launch vehicle and launch site systems.

(d) The dielectric withstanding voltage between mutually insulated portions of any component part must provide for the component to function at the component's rated voltage and satisfy all its performance specifications when subjected to any momentary over-potentials that could normally occur, such as due to switching or surge.

(e) The insulation resistance between mutually insulated portions of any component must provide for the component to function at its rated voltage. Any insulation material must satisfy all its performance specifications when subjected to workmanship, heat, dirt, oxidation, or loss of volatile material.

(f) The insulation resistance between wire shields and conductors, and between each connector pin must withstand a minimum workmanship voltage of at least 1,500 volts, direct current, or 150 percent of the rated output voltage, whichever is greater.

(g) If any wiring or connector will experience loads with continuous duty cycles of 100 seconds or greater, that wiring or connector, including each connector pin, must have a capacity of 150% of the design load. If any wiring or connector will experience loads that last less than 100 seconds, all wiring and insulation must provide a design margin greater than the wire insulation temperature specification.

(h) All wiring, including any cable or connector, must satisfy all its performance specifications when subjected to the pull force required by section E417.9(j) and any additional handling environment that the component could experience undetected.

(i) Redundant circuits that can affect a flight termination system's reliability during flight must not share any wiring harness or connector with each other.

(j) For any connector or pin connection that is not functionally tested once connected as part of a flight termination system or component, the design of the connector or pin connection must eliminate the possibility of a bent pin, mismating, or misalignment.

(k) The design of a flight termination system component must prevent undetectable damage or overstress from occurring as the result of a bent connector pin. An inadvertent initiation must not occur if a bent connector pin:

(1) Makes unintended contact with another pin;

(2) Makes unintended contact with the case of the connector or component; or

(3) Produces an open circuit.

(l) Each connector that can affect a flight termination system component's reliability during flight must satisfy the requirements of § 417.309(b)(2) of this part.

(m) All connectors must positively lock to prevent inadvertent disconnection during launch vehicle processing and flight.

(n) The installation of all wiring, including any cable, must protect against abrasion and crimping of the wiring.

(a) Capacity. A flight termination system battery must have a manufacturer-specified capacity of no less than the sum total amp-hour and pulse capacity needed for:

(1) Any self discharge;

(2) All load and activation checks;

(3) All launch countdown checks;

(4) Any potential hold time;

(5) Any potential number of preflight re-tests due to potential schedule delays including the number of potential launch attempts that the battery could experience before it would have to be replaced;

(6) Two arm and two destruct command loads at the end of the flight; and

(7) A flight capacity of no less than 150% of the capacity needed to support a normal flight from liftoff to the planned safe flight state. For a launch vehicle that uses solid propellant, the flight capacity must be no less than a 30-minute hang-fire hold time.

(b) Electrical characteristics. A flight termination system battery, under all load conditions, including line loss, must have all the following electrical characteristics:

(1) The manufacturer specified minimum voltage must be no less than the minimum acceptance test voltage that satisfies the electrical component acceptance tests of appendix E of this part. For a battery used in a pulse application to fire an electro-explosive device, the manufacturer specified minimum voltage must be no less than the minimum qualification test voltage that satisfies the electro-explosive device qualification tests of appendix E of this part;

(2) A battery that provides power to an electro-explosive device initiator, including to any initiator fired simultaneously with another initiator, must:

(i) Deliver 150% of each electro-explosive device's all-fire current at the qualification test level. The battery must deliver the current to each ordnance initiator at the lowest system battery voltage;

(ii) Have a current pulse that lasts ten times longer than the duration required to initiate the electro-explosive device or a minimum workmanship screening level of 200 milliseconds, whichever is greater; and

(iii) Have a pulse capacity of no less than twice the expected number of arm and destruct command sets planned to occur during launch vehicle processing, preflight flight termination system end-to-end tests, plus flight commands including load checks, conditioning, and firing of initiators;

(3) The design of a battery and any activation procedures must ensure uniform cell voltage after activation. Activation must include any battery conditioning needed to ensure uniform cell voltage, such as peroxide removal or nickel cadmium preparation; and

(4) The design of a battery or the system using the battery must protect against undetectable damage to the battery from any reverse polarity, shorting, overcharging, thermal runaway, or overpressure.

(c) Service and storage life. The service and storage life of a flight termination system battery must satisfy all of the following:

(1) A flight termination system battery must have a total activated service life that provides for the battery to meet the capacity and electrical characteristics required by paragraphs (a) and (b) of this section; and

(2) A flight termination system battery must have a specified storage life. The battery must satisfy the activated service life requirement of paragraph (c)(1) of this section after experiencing its storage life, whether stored in an activated or inactivated state.

(d) Monitoring capability. A battery or the system that uses the battery must provide for monitoring the status of the battery voltage and current. The monitoring must be sufficient to detect the smallest change in voltage or current that would indicate any health problem with each battery. Monitoring accuracy must be consistent with the minimum and maximum voltage and current limits used for launch countdown. The design of a battery that requires heating or cooling to sustain performance must provide for monitoring the battery's temperature with a resolution of 0.5 °C.

(e) Battery identification. Each battery must have an attached permanent label with the component name, type of construction (including chemistry), manufacturer identification, part number, lot and serial number, date of manufacture, and storage life.

(f) Battery temperature control. Any battery heater must ensure even temperature regulation of all battery cells.

(g) Silver zinc batteries. Any silver zinc battery that is part of a flight termination system must satisfy all of the following:

(1) A silver zinc battery must consist of cells assembled from electrode plates that are manufactured together and without interruption;

(2) The design of a silver zinc battery must allow activation of each individual cell within the battery;

(3) For any silver zinc battery that may vent electrolyte mist as part of normal operations, the battery must satisfy all its performance specifications for pin-to-case and pin-to-pin resistances after the battery experiences the maximum normal venting;

(4) The design of a silver zinc battery and its cells must allow for the qualification, acceptance, and storage life extension testing required by appendix E of this part. A launch operator must ensure sufficient batteries and cells are available from the same lot to accomplish the required testing;

(5) Each silver zinc battery must have attached, no less than one additional cell from the same production lot, with the same lot date code, as the cells in the battery for use in cell acceptance verification tests. The cell must remain attached to the battery from the time of assembly until performance of the acceptance tests to ensure that the additional cell is subjected to all the same environments as the complete battery;

(6) The design of a silver zinc battery must permit voltage monitoring of each cell during open circuit voltage and load tests of the battery; and

(7) All cell and battery parts and materials and manufacturing parts, materials, and processes must undergo configuration control that ensures that each cell and battery has repeatable in-family performance unless each cell and battery undergoes lot testing that demonstrates repeatable in-family performance. The launch operator must identify and implement any lot testing that replaces configuration control.

(h) Rechargeable cells and batteries.

(1) Any rechargeable battery or cell that is part of a flight termination system must satisfy all the requirements of this section for each charge-discharge cycle.

(2) With the exception of any silver zinc battery, a rechargeable battery must satisfy all its performance specifications for five times the number of operating charge and discharge cycles expected of the battery throughout its life, including all acceptance testing, preflight testing, and flight. A silver zinc rechargeable battery must satisfy all its performance specifications for each operating charge-discharge cycle expected of the battery throughout its life, including all acceptance testing, preflight testing, and flight.

(3) A rechargeable battery must consist of cells from the same production lot. For a battery that consists of commercially produced nickel cadmium cells, each cell must be from the same production lot of no less than three thousand cells that are manufactured without interruption.

(4) The design of a silver zinc or commercial nickel cadmium battery and each of its cells must allow for the qualification and acceptance tests required by appendix E of this part. A launch operator must ensure sufficient batteries and cells are available to accomplish the required testing. A launch operator must identify and implement design and test requirements for any other type of rechargeable battery proposed for use as part of a flight safety system.

(i) Commercial nickel cadmium cells and batteries. Any nickel cadmium battery that uses one or more commercially produced nickel cadmium cells and is part of a flight termination system must satisfy each of the following to demonstrate that each cell or battery satisfies all its performance specifications:

(1) The battery or cell must have repeatable capacity and voltage performance. Capacity must be repeatable within one percent for each charge and discharge cycle.

(2) Any battery or cell venting device must ensure that the battery or cell does not experience a loss of structural integrity or create a hazardous condition when subjected to electrical discharge, charging and short-circuit conditions.

(3) The battery or cell must retain its charge and provide its required capacity, including the required capacity margin, from the final charge used prior to launch to the planned safe flight state during flight at the maximum pre-launch and flight temperature. The cell or battery must not self-discharge more than 10% of its fully charged capacity after 72 hours at ambient temperature.

(4) The design of the battery must prevent current leakage from pin-to-pin or pin-to-case from creating undesired events or battery self-discharge. Pin-to-pin and pin-to-case resistances must be repeatable so that measurements of pin-to-pin and pin-to-case resistances can establish in-family performance and determine whether all battery wiring and connectors are installed according to the manufacturer's design specifications.

(5) The battery or battery case must be sealed to the required leak rate and not loose structural integrity or create a hazardous condition when subjected to the predicted operating conditions plus all required margins including any battery short-circuit. The battery or battery case must maintain its structural integrity when subjected to no less than 1.5 times the greatest operating pressure differential that could occur under qualification testing, preflight, or flight conditions.

(6) Any battery voltage, current, or temperature monitoring circuit that is part of the battery must have resolution, accuracy, and data rates that all for detecting whether the performance specifications are satisfied and detecting any out-of-family conditions.

(7) Any battery heater circuit, including any thermostat must ensure that all cells are heated uniformly and must allow for repeatable battery performance that satisfies all the battery's performance specifications. Any heating must ensure that cells are not overstressed due to excessive temperature. The thermostat tolerances must ensure that the battery remains within its thermal design limits.

(8) The battery or cell must satisfy all its electrical performance specifications and be in-family while subjected to all pre-flight and flight environments, including hot and cold temperature, and all required electrical loads at the beginning, middle, and end of its manufacturer specified capacity.

(a) This section applies to any electro-mechanical safe-and-arm device that has an internal electro-explosive device and is part of a flight termination system. A safe-and-arm device must provide for safing and arming of the flight termination system ordnance to satisfy section D417.13.

(b) A safe-and-arm device in the arm position must remain in the arm position and satisfy all its performance specifications when subjected to the design environmental levels determined under section D417.7.

(c) All wiring and connectors used in a safe-and-arm device must satisfy section D417.31.

(d) Each piece-part that is used in the firing circuit of a safe-and-arm device and that can affect the reliability of the device during flight must satisfy § 417.309(b)(2) of this part.

(e) A safe-and-arm device's internal electro-explosive device must satisfy the requirements for an ordnance initiator of section D417.41.

(f) A safe-and-arm device must not require any adjustment throughout its service life.

(g) A safe-and-arm device's internal electrical firing circuitry, such as wiring, connectors, and switch deck contacts, must satisfy all its performance specifications when subjected to an electrical current pulse with an energy level of no less than 150% of the internal electro-explosive device's all-fire energy level for 10 times as long as the all-fire pulse lasts. A safe-and-arm device must deliver this firing pulse to the internal electro-explosive device without any dropout that could affect the electro-explosive device's performance when subjected to the design environmental levels.

(h) A safe-and-arm device must satisfy all its performance specifications after being exposed to the handling drop required by section E417.9(k) and any additional transportation, handling, or installation environment that the device could experience undetected.

(i) A safe-and-arm device must not initiate and must allow for safe disposal after experiencing the abnormal drop required by section E417.9(l).

(j) When a safe-and-arm device's electro-explosive device is initiated, the safe- and arm-device's body must not fragment, regardless of whether the explosive transfer system is connected or not.

(k) When dual electro-explosive devices are used within a single safe-and-arm device, the design must ensure that one electro-explosive device does not affect the performance of the other electro-explosive device.

<