earthcare project product assurance and safety...

Ref.: EC-RS-ESA-SY-002 Issue: 1 Date: 02 February 2007 Page: 1 of 27

Prepared by D. Spence

Approved by A. Lefebvre

Approved by J. Bosma

EarthCARE Project Product Assurance and Safety Requirements for Phases B, C/D, E1

ESTEC Noordwijk

The Netherlands


DOCUMENT CHANGE RECORD

ISSUE/REV DATE CHANGE

1 02 February 2007 EarthCARE ITT Release


TABLE OF CONTENTS 1. SCOPE ............................................................................................................... 5

2. Applicability ..................................................................................................... 5

3. Documents ....................................................................................................... 5

3.1 Normative Documents ................................................................................. 5

4. Product Assurance........................................................................................... 8

4.1 PA Programme............................................................................................... 8 4.2 PA Plan ............................................................................................................ 8 4.3 Right of Access .............................................................................................. 9 4.4 PA Progress Reporting................................................................................... 9 4.5 PA Database.................................................................................................. 9

5. Quality Assurance ......................................................................................... 10

5.1 Normative documents ............................................................................... 10 5.2 QA Programme Audits................................................................................ 10 5.3 Critical Items Control................................................................................... 10 5.4 Non-conformance Control System........................................................... 11 5.5 Alert System .................................................................................................. 11 5.6 Handling, Storage, Preservation................................................................ 11 5.7 Statistical Quality Control and Analysis.................................................... 11 5.8 Verification ................................................................................................... 11 5.9 Cleanliness and Contamination Control................................................. 12 5.10 Manufacturing, Assembly and integration reports ............................ 12 5.11 Test Facilities.............................................................................................. 12 5.12 Test Reports ............................................................................................... 12 5.13 End Item Data Package (EIDP) ............................................................. 12 5.14 Packaging, Marking and Labelling, Transportation ........................... 12

6. Dependability Assurance ............................................................................. 13

6.1 Consequence Category and Severity .................................................... 13 6.2 Failure Tolerance ......................................................................................... 13 6.3 Reliability Analysis ........................................................................................ 14 6.4 Failure Propagation..................................................................................... 15 6.5 Dependability Testing and Demonstration ............................................. 15

7. Safety .............................................................................................................. 16

7.1 Safety Programme ...................................................................................... 16 7.2 Safety Plan.................................................................................................... 16 7.3 Safety certification ...................................................................................... 16


7.4 Launcher Safety Submission ...................................................................... 17

8. EEE Components ............................................................................................ 18

8.1 General ......................................................................................................... 18 8.2 Components Control Programme............................................................ 18 8.3 EEE Components Selection........................................................................ 18 8.4 EEE Components Approval........................................................................ 19 8.5 EEE Component De-rating......................................................................... 19 8.6 Radiation-Sensitive EEE Components ...................................................... 19 8.7 Components in Off-The-Shelf equipment................................................ 20 8.8 Components from stock............................................................................. 20 8.9 Specific component requirements........................................................... 21

8.9.1 Application Specific Integrated Circuits (ASIC) ............................................. 21 8.9.2 Hybrids ............................................................................................................. 21 8.9.3 Field programmable Gate Arrays (FPGA)....................................................... 21 8.9.4 Monolithic Microwave Integrated Circuit (MMIC)......................................... 22 8.9.5 Electro-optical devices ..................................................................................... 22 8.9.6 Electro-magnetic devices ................................................................................. 22

9. Materials, Processes, AND Mechanical Parts.............................................. 23

9.1 Technical Requirements For Selection of Materials ............................... 23 9.1.1 Vacuum ............................................................................................................ 23 9.1.2 Forbidden Materials ......................................................................................... 23 9.1.3 Thermal Cycling............................................................................................... 23 9.1.4 Electrochemical Compatibility......................................................................... 23 9.1.5 Corrosion.......................................................................................................... 23 9.1.6 Stress Corrosion ............................................................................................... 24 9.1.7 Fluid Compatibility .......................................................................................... 24 9.1.8 Solar Radiation................................................................................................. 24 9.1.9 Allowable Stress............................................................................................... 24 9.1.10 Limited Life Time ............................................................................................ 24 9.1.11 Atomic Oxygen ................................................................................................ 24 9.1.12 Magnetic Materials........................................................................................... 24

9.2 Processes....................................................................................................... 24 9.3 Material/Mechanical Parts and Process Lists.......................................... 25

10. Configuration management....................................................................... 25

11. Software Product Assurance ...................................................................... 26

12. Off-The-Shelf Space Equipment ................................................................. 26

13. Abbreviations............................................................................................... 27


1. SCOPE

This document defines the Product-Assurance and Safety requirements applicable to the EarthCARE project.

The satellite shall be designed, tested, manufactured and operated in compliance with these requirements, which are applicable to the Prime-contractor, sub-contractors and suppliers. It is the responsibility of the Prime-contractor to tailor these requirements to sub-contractors and suppliers and to ensure their implementation.

2. APPLICABILITY

The requirements are applicable to the spacecraft (flight hardware, flight software and flight spares) for the project phases B, C/D, E1. Other hardware and software shall be safe for ground operations and shall be representative of flight hardware with respect to form, fit, and function, and shall not lead to the failure or degradation of flight hardware/software.

3. DOCUMENTS

This document is based on the ECSS standards on space product assurance and project management. The requirements specified here are established by tailoring the ECSS requirements to the needs and constraints of the EarthCARE project.

Where ECSS documents are not available, the relevant ESA PSS documents are used. Tailoring of the ECSS-Q requirements is achieved by specifying:

the clauses applicable without modifications the clauses not applicable clause modifications

3.1 Normative Documents

The following documents (latest issue at contract signature) shall be applicable with the modifications specified in this document.

ND13 ECSS-E-30-01A Fracture Control ND15 ECSS-E-40B Software ND44 ECSS-Q-80B Software Product Assurance ND45 ECSS-Q-70-01A Contamination and cleanliness control ND46 ECSS-M-00B Space project management - policy and principles ND52 ECSS-M-40B Configuration Management ND53 ECSS-M-50A Information/Documentation Management ND56 ECSS-P-001B Glossary of Terms ND57 ECSS-Q-00A Policy and principles ND58 ECSS-Q-20B Quality Assurance


ND59 ECSS-Q-20-04A Critical Item Control ND60 ECSS-Q-20-07A Quality Assurance for test facilities ND61 ECSS-Q-20-09B Non-conformance Control System ND62 ECSS-Q-40B Safety ND63 ECSS-Q-30B Dependability ND64 ECSS-Q-30-01A Worst case circuit performance ND65 ECSS-Q-30-02A Failure Modes, Effects and Criticality Analysis ND66 ECSS-Q-30-11A EEE components - Derating and end-of-life parameter

drifts ND67 ECSS-Q-60A EEE Components ND68 ECSS-Q-60-01A European preferred parts list (EPPL) and its management ND69 ECSS-Q60-02A ASIC and FPGA development ND70 ECSS-Q-60-05A Generic Procurement Requirements for Hybrid

Microcircuits ND71 ECSS-Q-70B Materials, Mechanical Parts and Processes ND72 ECSS-Q-70-02A Thermal vacuum test for the screening of space materials ND73 ECSS-Q-70-04A Thermal cycling test for the screening of space materials

and processes ND74 ECSS-Q-70-05A Detection of organic contamination of surfaces by

infrared spectroscopy ND75 ECSS-Q-70-07A Verification and approval of automatic machine wave

soldering ND76 ECSS-Q-70-08A Manual soldering of high-reliability electrical

connections ND77 ECSS-Q-70-09A Measurements of thermo-optical properties of thermal

control materials ND78 ECSS-Q-70-10A Qualification of printed circuit board ND79 ECSS-Q-70-11A Procurement of printed circuit board ND80 ECSS-Q-70-13A Measurement of the peel and pull-off strength of

coatings and finishes using pressures-sensitive tapes ND81 ECSS-Q-70-18A Preparation, assembly and mounting of RF coaxial

cables ND82 ECSS-Q-70-20A Determination of the susceptibility of silver plated

copper wire and cable to “red-plague” corrosion ND83 ECSS-Q-70-22A The control of limited shelf-life materials ND84 ECSS-Q-70-25A The application of the black coating Aeroglaze Z 306 ND85 ECSS-Q-70-26A Crimping of high-reliability electrical connections ND86 ECSS-Q-70-28A The repair and modification of printed circuit board

assemblies for space use ND87 ECSS-Q-70-30A The wire wrapping of high reliability electrical

connections ND88 ECSS-Q-70-33A The application of the thermal control coating PSG 120

FD

http://ids2.esa.int:81/ATTACHEMENTS/A132787/ECSS-Q-70-05A.pdf


ND89 ECSS-Q-70-34A The application of the black electrically conductive coating Aeroglaze H322

ND90 ECSS-Q-70-35A The application of the black electrically conductive coating Aeroglaze L300.

ND91 ECSS-Q-70-36A Material selection for controlling stress corrosion cracking

ND92 ECSS-Q-70-37A Determination of susceptibility of metals to stress corrosion cracking

ND93 ECSS-Q-70-45A Standard methods for mechanical testing of metallic materials

ND94 ECSS-Q-70-46A Requirements for manufacturing and procurement of threaded fasteners

ND95 ECSS-Q-70-51A Process of terminating and splicing optical fibres/cables/assemblies

ND96 ECSS-Q-70-71A-1 Data for selection of space materials and processes ND97 PSS-01-202 Preservation, storage, handling and transportation of

ESA spacecraft hardware ND98 PSS-01-204 Particulate Contamination Control in Clean Rooms by

Particle Fall-out Measurement ND100 PSS-01-604 Generic specification for silicon solar cells ND101 PSS-01-605 Capability approval programme for hermetic thin-film

hybrid micro circuits ND102 PSS-01-606 Capability approval programme for hermetic thick-film

hybrid micro circuits ND103 NASA-STD-6001 Flammability, Odor, Offgassing, and Compatibility

Requirements and Test Procedures ND104 ECSS-Q-70-03A Black Anodizing of Metals with Inorganic Dyes ND105 PSS-01-706 The particle and ultraviolet (UV) radiation testing of

space materials ND106 PSS-01-738 High-reliability soldering for surface-mount and mixed-

technology printed circuit boards

ND107 PSS-01-748 Requirements for ESA approved skills training and certification (Electronic assembly techniques)

ND108 DOT/FAA/AR-MMPDS-01 Metallic Materials Properties Development and Standardization (replaces MIL-HDBK-5)

ND109 ESCC 9000 Generic Specification ND110 MIL-STD-981B Electro-magnetic Devices

ND116 ECSS-Q-60-11A EEE components - Derating and end-of-life parameter drifts NOTE: Applicable only for end-of-life parameter drifts, the Derating requirements are covered in ECSS-Q-30-11A.

ND117 ECSSQ-60-12A Design, selection, procurement and use of die form monolithic microwave integrated circuits (MMICs)


4. PRODUCT ASSURANCE

4.1 PA Programme

The PA programme shall ensure that the EarthCARE mission will successfully achieve the intended objectives. This shall be achieved in the most cost-effective way by managing the available resources and personnel within the allocated budget, and by coordinating in an integrated effort the PA activities with the functions of project management and engineering.

The PA programme shall be established according to the requirements of ND57 chapter 3, Product Assurance Management and ND46 chapter 5.2, Policy and Principles.

4.2 PA Plan

The Prime-contractor shall establish and maintain a PA Plan to describe the resources, tasks, responsibilities, methods and procedures adopted by the Prime-contractor for the implementation of the PA requirements and for the achievement of the PA objectives.

The PA Plan shall serve as a master planning and control document for the product assurance programme.

The PA Plan shall include details as to how the Prime-contractor intends to verify that the programme will be accomplished and how he intends to perform supervisory and monitoring actions on Sub-contractors and Suppliers. Prime-contractor internal company procedures may be referenced in the PA Plan, in this case they shall be provided to ESA on request. Prime-contractor should be aware that referencing internal company procedures in the PA Plan will limit the company's ability to unilaterally change the procedures. All modifications to these procedures shall be considered as modifications to the PA Plan.

The PA Plan shall be approved by ESA.

The Prime-contractor shall deliver with the proposal a compliance matrix, complemented with the relevant supporting documentation.


4.3 Right of Access

ESA reserves the right of access to: all documentation relevant to the programme; all areas and operations within the Prime-contractor, sub-contractors or suppliers

facilities in which work is performed or items are stored relevant to the project, even if the information is considered proprietary.

ESA will undertake not to disclose such information to a third party, in accordance with the ESA General Clauses and Conditions.

ESA reserves the right to perform or participate in any or all audits, surveys, inspections, reviews, etc. relevant to the project. ESA’s participation shall not in any way replace or relieve the Prime-contractor of his responsibilities.

4.4 PA Progress Reporting

PA progress reporting shall be part of the overall project progress reporting and shall include as a minimum:

Status of the PA activities since the last progress report, separated for the different disciplines (QA, Dependability, Safety, EEE-Components, MPP, Software PA)

Non-conformance and waiver / deviation status. Critical items status. Accomplishments during the considered period. Planned accomplishments in the next reporting period Identified problems & risk which may affect customer requirements schedule

and cost. Activities planned to control identified problems & risk factors Alert status report

4.5 PA Database

All PA-related data and analyses (such as NCR’s, RFW/RFD, EEE components list, materials, mechanical parts and processes lists, reliability/safety analysis, CIL, pictures…) shall be stored in an electronic database. This shall allow to import and export data from and to sub-contractors and ESA. The database format and content shall be agreed with ESA.


5. QUALITY ASSURANCE

The Prime-contractor shall prepare, maintain, and implement a plan of the QA activities. The plan describing the QA programme for EarthCARE shall be part of the PA plan. The requirements for the EarthCARE QA programme are defined in ND58 with the following modifications.

5.1 Normative documents

This chapter is a supplement to clause 2 of ND58.

Where suitable, further existing documentation can be applied. Besides ECSS, this can be MIL, NASA or ISO standards.

In case of conflict, ECSS standards shall prevail.

5.2 QA Programme Audits

This chapter is a supplement to 4.6 of ND58.

The Prime-contractor shall prepare a checklist to be used when performing audits. This checklist shall be subject to ESA review before it is used.

The Prime contractor shall notify ESA, at least ten working days in advance, of the intention to conduct an audit (external or internal).

A copy of the audit report generated by the Prime-contractor shall be sent to ESA within 2 weeks after the audit has taken place. The report shall include:

identification of areas of non-compliance or weakness, if any corrective actions with due dates, conclusions with statement on the acceptability to proceed with the activities, the completed audit checklist.

5.3 Critical Items Control

This chapter is a supplement to clause 4.8 of ND58.

The Prime-contractor shall establish and maintain a list of critical items (CIL) as defined in ND59. When the corresponding actions have been implemented a close out reference shall be added.


5.4 Non-conformance Control System


The Prime Contractor shall establish and maintain an electronic non-conformance control system according to above Para 4.5 (PA Database), which allows the customer to have permanent full visibility of all NCRs and their disposition.

All Major NCR’s shall be notified to the Customer within 2 working days.

Accidents/ incidents shall be processed according to the non-conformance control system, and treated as a major non-conformance.

The Prime-contractor shall provide visibility to ESA of all project NCR using the web based NCTS database throughout the industrial organisation.

5.5 Alert System


The Prime Contractor shall participate in the Alert System established by ESA. The Prime Contractor shall ensure that all subordinate suppliers also participate into the ESA Alert System. This requires, as a minimum, that the prime Contractor distributes all ESA Alerts to the lower tier suppliers and that there is an established procedure for collecting and assessing inputs from lower tier suppliers to provide inputs to the ESA Alert System where warranted.

The prime contractor shall maintain a document that identifies for all alerts, their applicability to the projects and where applicable, the actions taken to meet the alert recommendations.

5.6 Handling, Storage, Preservation


Detailed requirements for handling, storage and preservation are defined in ND97.

5.7 Statistical Quality Control and Analysis

This chapter supersedes clause 5.9 of ND58.

A Statistical Quality Control and Analysis is not required for the EarthCARE project.

5.8 Verification


Precedence shall be given to the EarthCARE specific verification requirements.


5.9 Cleanliness and Contamination Control


The Prime Contractor shall identify the hardware and facilities that require specific controls for molecular or particulate contamination. The cleanliness and contamination control standard to be applied shall be ND45 (Contamination and cleanliness control).

The Prime Contractor shall write a Cleanliness Requirement Specification (CRS) according to ND45 Annex G and a Cleanliness and Contamination Control Plan (C&CCP) according to ND45Annex H. ESA approval shall be required for these documents.

The allowed particulate and molecular contamination levels shall be agreed with the Instrument providers, based on acceptable performance losses.

5.10 Manufacturing, Assembly and integration reports


Pictures shall be taken of the inside and outside of all flight units.

Pictures shall be taken of both sides of all PCBs prior to coating.

All pictures shall be maintained in the PA database and included in the relevant EIDP.

5.11 Test Facilities

This chapter supersedes clause 9.1 of ND58.

The Prime-contractor shall ensure that test facilities, either internal or external, comply with ND60. The Contractor shall ensure that test facilities are suitably qualified to perform the tests to be conducted, and do not cause any degradation to the test article or its interface.

5.12 Test Reports

This chapter is a supplement to clause 9.3.2 of ND58.

Each test report shall contain a conclusion stating the actual achievement of test objectives and shall identify any specific deficiencies. Test Reports shall include reference to NCR’s relevant for the test subject of the test report.

5.13 End Item Data Package (EIDP)

This chapter is a supplement to clause 10.2.4 of ND58.

The content of the EIDP is defined in the Earth care DRD.

5.14 Packaging, Marking and Labelling, Transportation

This chapter is a supplement to clause 10.4.1, 10.4.2 and 10.5.2 of ND58.

Detailed requirements for packing, marking and labelling and transportation are defined in ND97.


6. DEPENDABILITY ASSURANCE

The objective of Dependability Assurance (Reliability, Availability and Maintainability) is to ensure a successful mission (achieving the scientific objectives) by optimizing the system within all competing technical and financial constraints.

The Prime-contractor shall develop, maintain and implement a Dependability Programme plan as part of the overall Product Assurance Plan.

The Prime-contractor shall follow the requirements of ND63, with the modifications defined in this chapter.

6.1 Consequence Category and Severity

This chapter supersedes Clause 7.3.1 of ND63.

Failure events shall be classified on the basis of the severity of their consequences, according to the following categories.

1S- Catastrophic: Loss of life or life-threatening injury, Permanent disabling injury to personnel or occupational illness, Loss of launcher, Launch site facilities, spacecraft. Loss of public or private property, Long-term detrimental environmental effects.

2S - Critical: Major damage to private or public property, or ground facilities Temporary disabling but no-life-threatening injury, or temporary occupational

illness Short term detrimental environment effects

2 - Critical Loss of mission or unacceptable degradation of mission performance.

3 - Major: Mission degradation.

4 - Negligible: Other less minor events

Note: the suffix “S” is used to indicate Safety impacts.

6.2 Failure Tolerance

This chapter supersedes clause 7.3.2 of ND63.

Note: these requirements may be transferred to the SRD.


No single failure of human error shall lead to critical or catastrophic consequences.

For the failure consequence “degradation of mission performance” the acceptable failure tolerance has to be agreed on a case by case basis depending on the severity of the degradation.

The failure tolerance approach needs not to be applied to: primary structures, load-carrying structures, structural fasteners, load-carrying elements of mechanisms, pressure vessels. Fracture control for these items shall be applied as defined in ND13.

Note: Additional failure tolerance requirements may be defined by the Launch Authority or by the applicable safety regulations.

6.3 Reliability Analysis

This chapter supersedes clause 8.2.2, 8.2.3 and 8.2.4 of ND63.

The following analyses shall be performed:

Failure Modes, Effects and Criticality Analysis (FMECA)

Clause 8.2.2.a of ND63 applies.

Common-mode and common cause failure shall be considered. Multiple failures resulting from common cause or common mode failures shall be considered as single failure when determining failure tolerance, and shall be analysed into the FMECA.

Hardware/Software Interaction Analysis

Clause 8.2.2.b of ND63 and Clause 4.10 of ND65 apply.

Contingency Analysis

Clause 8.2.2.c of ND63 applies.

Probabilistic Reliability and Availability Analyses

The Probabilistic Reliability and availability requirements are defined in the SRD

The reliability and availability requirements shall be apportioned to set reliability requirements for lower level products.

Reliability and availability prediction techniques shall be used to demonstrate compliance with the requirements and to optimize the design against competing constraints such as cost and mass.

Worst Case Analysis

Clause 8.2.2.h of ND63 and ND64 apply. Derating requirements are covered in ND66 End-of-life parameter drifts are defined in ND116.

Part de-rating Analysis

Clause 8.2.2.i of ND63 applies with the following modification. ECSS Q-60-11 is replaced by ND66.

Maintainability Analysis

The Prime-contractor shall identify the preventive and corrective maintenance actions for ground operations. Emergency restoration or repair activities necessary to sustain system capabilities crucial to mission success shall be also identified. The Prime-contractor shall


identify those items that cannot be checked after integration and that require late servicing, access or replacement, and limited-life items or consumables.

6.4 Failure Propagation

No hardware or software failure shall propagate to a redundant item or functional path. No hardware or software failure of Support Equipments shall cause damage to interfacing Flight Hardware.

6.5 Dependability Testing and Demonstration

This chapter supersedes clause 9 of ND63.

Dependability Testing and Demonstration is not required for the EarthCARE Project.


7. SAFETY

The contractor shall apply ND62 as specified below.

7.1 Safety Programme

The Prime-contractor shall establish a safety program to protect: ground personnel, the launch vehicle (including other launcher payloads), ground support equipment, public and private properties the environment from hazards associated with the EarthCARE

hardware/software and operations.

The safety programme shall ensure compliance to the launch authority safety requirements and the applicable international and national safety regulations (i.e. during manufacturing, integration, testing, handling and transportation).

The Prime-contractor shall identify and plan all activities required to obtain approval from the launch authority.

Accidents and incidents shall be reported as defined in ND62, 4.9.

Hazard reduction shall be performed as defined in ND62, 5.2.3 using Hazard Analysis as defined in ND62, 6.4.2.

7.2 Safety Plan

The Prime-contractor shall show how the Safety Programme is implemented in a dedicated chapter of the Product Assurance Plan. The safety organisation shall comply with ND62, 4.2.

7.3 Safety certification

The Prime-contractor shall certify that the flight and ground system products are in compliance with the requirements of the applicable standards as well as any applicable EarthCARE specific safety requirements, in accordance with ND62, 4.7. In case the verification process is not completed the certification shall include a statement that open verification will be closed in accordance with the established verification tracking log and do not affect further safe processing at third party premises.

The Prime-contractor shall ensure that for testing and general handling of the spacecraft at third party premises the required Ground Support Equipment has a valid calibration/acceptance certification for the planned activities.


7.4 Launcher Safety Submission

The Prime Contractor shall deliver the documentation requested by the launcher authority. The Safety Data Package shall cover the complete Satellite (Spacecraft and Payload), as well as any Ground Support Equipment to be used at the launch site. The content of the Safety Data Package shall be in accordance with launcher authority requirements.


8. EEE COMPONENTS

8.1 General

The objective associated to EEE components is to ensure that the components will satisfy the mission performance requirements during the full life cycle of the product.

The Prime-contractor shall establish and implement throughout the duration of the project an EEE component programme which ensures that the selection, approval, procurement and usage of EEE components used in all flight hardware meet the requirements as defined in ND67 and as modified in the sub-clauses hereunder.

8.2 Components Control Programme

Complementary to the requirements defined in clause 2.3 of ND67:

The EEE Components Control Plan can be part of the overall EarthCARE PA Plan.

The Prime-contractor shall define a policy for the procurement of EEE parts for EarthCARE (based on principles of self procurement, centralised procurement via CPPA or combination of both), and shall demonstrate in the Control Plan how this policy will be compliant with the equipment manufacturing schedule.

Long Lead Items may need to be identified before the end of Phase B.

8.3 EEE Components Selection


Components shall be chosen that satisfy the following requirements:

Components included in recognized QPL’s issued by: ESCC US Defence Supply Centre, Columbus (DSCC)- MIL Class S , ER Level R

(exponential), Level C (Weibull) Components belonging to QML-V Components included in NASA NPSL, Level 1 Components that have been evaluated successfully according ESCC, ND67 or

equivalent requirements and for which a recognised procurement specification is available.

EEE Components shall preferably be selected from the European Preferred Parts List (ND68) Part 1 available at https://escies.org. Alternatively, NASA Parts Selection List (Level 1) shall be used as a baseline for selection.

The selection of components not meeting the above requirements shall be based on knowledge regarding technical performance, qualification status and history of previous use in similar applications. In such cases, the Prime-contractor shall provide a justification for the selection of a specific component type or manufacturer in association with the Parts Approval Document.


The components used for engineering models shall meet the same functional requirements as the ones used for flight hardware, although they do not have to meet the same quality requirements. It is the responsibility of the developer of the equipment to select components that assure valid results of Engineering models tests.

For Qualification Models the same quality level of components shall be selected as for flight.

8.4 EEE Components Approval

This paragraph supersedes the requirements of clause 3.3 of ND67.

EEE components used in EarthCARE flight hardware require approval by the first-level supplier/sub-contractors/Prime-contractor and ESA prior to usage.

Parts that meet the selection criteria given in paragraph 8.3 are considered as standard components and can be approved via the Declared Components List (DCL). For such components a Part Approval Document (PAD) is only required where the proposed procurement conditions differ from those specified in the lists mentioned in paragraph 8.3 or special evaluations are envisaged. For standard parts, the DCL shall identify the approval status and list the remark “standard EPPL/QPL”, together with the following procurement details:

Procurement inspections by customer (pre-cap inspection, etc) if any Single Event Effects Linear Energy Transfer (SEE LET) threshold and/or total

dose sensitivity level (when applicable) Date code. In case of procurement from stock, date of re-life activities if

applicable.

Specific components (Hybrid Circuits, ASICs, etc…) for which the technology is qualified by Capability Approval (or similarity), but which are newly developed and for which a Specific Detail Specification is not listed in the EPPL and QPL, shall be covered by an individual PAD.

All components not meeting the selection criteria of paragraph 8.3 are considered as non-standard components, for which the approval requires submittal of a PAD and supporting justification documentation to the first-level supplier/sub-contractors/Prime-contractor and ESA.

8.5 EEE Component De-rating

Clause 3.2.6 of ND67 applies with the following modification:

Reference to ECSS–Q–30–xx is replaced by reference to ND66.

8.6 Radiation-Sensitive EEE Components


The Prime-contractor shall perform a radiation analysis to assess the actual radiation tolerance of the selected components for compliance with the radiation requirements/environment in terms of total dose (including Enhanced Low Dose Rate Sensitivity (ELDRS)), Displacement Damage and Single Event Effects (e.g. SEB, SEGR, SEFI, SEL, SET, SEU). Those components which are not fully, or only conditionally


compliant, with the radiation requirements shall be treated as radiation sensitive components.

Whenever possible, technologies shall be selected which are inherently insensitive to single event effects and latch-up. The following rules apply for Single Event Latch-up (SEL) and Single Event Upset (SEU) sensitivity:

Components with an assured LETth> 70 MeV/mg cm ² shall be considered as SEL and SEU insensitive.

Components exhibiting a sensitivity between 15 MeV/mg cm² < LETth < 70 MeV/mg cm² shall be subject to the appropriate Heavy Ion SEE rate prediction.

Components with a sensitivity of LETth < 15 MeV/mg cm² shall be subject to the appropriate Heavy Ion SEE and Proton rate prediction. Depending on the SEE rate prediction results for sensitive components, SEL and/or SEU countermeasures shall be implemented as required on the application level. Proton test results are not conclusive for SEL sensitivity demonstration and must be supported by Heavy Ion test results.

The following rules apply for total dose radiation: For components for which the total dose radiation sensitivity is demonstrated by

data to be at least a factor of 2 better than the expected dose in the application, no testing will be required on component level.

When such data does not exist, or are not assumed to be valid, a sample from the procured lot (flight parts) shall be subjected to Radiation Verification Testing (RVT) to a factor of 1.5 of the dose in the application.

The Prime-contractor shall demonstrate in the Radiation Analysis Report that the components selected and the protective measures taken are adequate.

8.7 Components in Off-The-Shelf equipment

The Prime-contractor shall review the components used in Off-The-Shelf equipment to verify compliance with the requirements of this document.

8.8 Components from stock

This chapter is a supplement to clause 3.4.5 b of ND67 as follows: Solderability test on a sample shall be performed Re-lifeing should be performed on parts with lot date code which indicates more

than 6 years will have elapse from date of manufacture to date of intended installation.


8.9 Specific component requirements

The requirements of this paragraph supersede and replace those of clause 3.5 of ND67.

8.9.1 Application Specific Integrated Circuits (ASIC)

The design, development, prototyping, manufacturing, testing and validation of ASICs shall meet the requirements of ND69.

All ASICs shall be considered as non-standard parts and therefore controlled via PAD agreement.

8.9.2 Hybrids

The specific requirements detailed in ND70 shall apply, covering the evaluation, qualification and procurement of add-on components.

8.9.3 Field programmable Gate Arrays (FPGA)

ASICs shall be preferred over FPGAs to implement all functions critical for the success of the mission, or wherever the FPGA selection and application can not be conducted in accordance with the requirements of this paragraph.

The design, development, prototyping, manufacturing, testing and validation of FPGAs shall meet the requirements of ND69.

All FPGAs shall be considered as non-standard parts and therefore controlled via PAD agreement. The PAD shall allow traceability to the information related to the procurement of blank parts, the programming and the acceptance of the programmed parts.

Dynamic post–programming burn-in activities at component level shall be required for FPGA according with chart III of ND109.

A generic programming specification shall cover the following aspects: Method of calibration, i.e. verify that the programmer equipment passes all the

diagnostic checks. Verification of status of the program of the programming equipment. Method of configuration, i.e. by using data from computer mass memory and use

of reference devices. Method of identification of each program configuration, i.e. the part number to

be assigned to each device. Use of Manufacturer’s 100 % serialization to maintain traceability. Programming procedure, i.e. current/voltage waveform to be applied. Only 1

programming cycle is allowed. Method of verification of the contents of the programmed device. Corrective actions in case of a programming failure. An analysis shall be carried

out if the number of failures for each lot/date code that are programmed relying on the same programmer calibration exceeds 15 %.


Electrical measurements, in accordance with the part specification (read and record optional).

Burn-in test with the configuration for burn-in in accordance with the component procurement specification.

Electrical verification of correct programming and electrical measurements pre- and post-burn-in.

The maximum PDA shall be 5 % for each lot/date code. If the PDA is higher than 5% the lot shall be rejected and submitted to Material Review Board disposition.

The FPGAs used in Engineering models shall be guaranteed to be fit, form and function representative of the parts intended for Flight, and shall be procured from the same manufacturer with guarantee to contain the same chips as the parts intended for Flight

8.9.4 Monolithic Microwave Integrated Circuit (MMIC)

MMICs shall be considered non-standard parts. The procurement of MMICs shall be governed by ND117. The design, development, manufacturing and testing of custom MMICs shall be agreed via PAD sheet 2 (refer to ND67) prior to commencing the said activities.

8.9.5 Electro-optical devices

For components not covered by a generic specification the Prime-contractor shall propose specifications and procedures which shall be coherent with the general quality/reliability and control requirements of the project. They shall be made available for review and approval by the first-level supplier/sub-contractors/Prime-contractor and ESA via the submission of a PAD.

8.9.6 Electro-magnetic devices

The specific requirements detailed in ND110 shall apply, covering design, manufacturing and quality control of custom-made electromagnetic devices such as coils and transformers.


9. MATERIALS, PROCESSES, AND MECHANICAL PARTS

ND71 shall be applicable with the following modifications:

9.1 Technical Requirements For Selection of Materials

The chapter supersedes clause 3.1.1 of ND71.

ND96 shall be used for the selection of materials with a previous history of space use. Specific material data present in the informative annexes may be used for information. Equivalent standards from MIL system or NASA may also be accepted providing ESA approval is obtained.

9.1.1 Vacuum

The acceptance criteria for materials used in space application shall be generally as follows:

Residual Mass Loss (RML) < 1.00 % Collected Volatile Condensable Material < 0.10 %

When relevant out-gassing data are not available (e.g. obsolete if test conducted more than 10 years ago, or unacceptable because missing information such as report reference or insufficient materials/processes description), out-gassing test shall be carried out as per ND72.

9.1.2 Forbidden Materials

The use of pure tin, mercury, cadmium, zinc, beryllium, beryllium oxide radioactive materials and PVC is prohibited. This applies also to any support equipment used in a vacuum chamber.

9.1.3 Thermal Cycling

Materials (incl. non-flight hardware) subject to thermal cycling shall be assessed to ensure their capability to withstand the induced thermal stresses.

9.1.4 Electrochemical Compatibility

When bimetallic contacts are used, the choice of the pair of metallic materials used shall take into account ND96 (paragraph 5.2.14). Maximum allowed couple is 0.5 V in controlled and 0.25 V in uncontrolled environments (no temperature or humidity controls).

9.1.5 Corrosion

Aluminium surfaces shall be treated for corrosion protection with a chemical conversion coating if necessary. Mechanical parts made of stainless steel shall be “passivated”. Mechanical parts made of Titanium alloys shall be anodised.


9.1.6 Stress Corrosion

Metallic materials used in structural applications shall have a high resistance to Stress Corrosion Cracking (SCC) and shall be chosen from Table 1 of ND91. Metallic materials and welds that are not listed in ND91 or whose SCC resistance is unknown shall be tested and categorised according to the requirements of ND92.

9.1.7 Fluid Compatibility

Materials that will be in contact with an identified fluid shall be compatible with that fluid. If compatibility data are not available, then testing shall be performed according ND103.

9.1.8 Solar Radiation

Materials shall comply with ND105 for solar radiation for particle radiation.

9.1.9 Allowable Stress

Allowable stresses for materials shall be derived from ND108. Other sources shall be subject to ESA approval. Composite structure allowable stresses shall conservatively allow for degradation due to moisture, temperature and process variables. The material justification shall prove hardware structural integrity during storage and on-orbit lifetime.

9.1.10 Limited Life Time

Materials with limited-life characteristics shall be subject to lot/ batch acceptance tests, when required by ESA, and shall have their date of manufacture and shelf-life expiration date marked on each lot/ batch.

9.1.11 Atomic Oxygen

The effects of atomic oxygen in the outer surfaces shall be assessed on the basis of the orbit parameters, mission duration and launch date.

9.1.12 Magnetic Materials

The use of materials or mechanical parts that react in a magnetic field shall be minimised. In the event that such materials or mechanical parts are used, additional testing and verification activities shall be performed to ascertain the magnetic cleanliness of the EarthCARE spacecraft.

9.2 Processes


The Prime-Contractor shall maximise the use of existing ESA specifications. The following specifications shall be applicable:

ND76 for soldering ND81 for coaxial cable assembly ND85 for crimping ND86 for repair and modification of PCB’s


ND106 for surface-mounting technology assembly

Equivalent standards from MIL system or NASA may also be accepted pending compliance review.

Critical processes shall be identified by the Prime-contractor and reported to ESA through a Declared Critical Process List (DCPL) or as a part of the DPL. Any process that involves critical or catastrophic hazards shall be identified as critical.

9.3 Material/Mechanical Parts and Process Lists

The Prime-contractor’s Materials and Processes Manager shall review all sub-contractors lists and produce a fully consolidated:

Declared Material List (DML) Declared Mechanical Part List (DMPL) Declared Process List (DPL)

A breakdown of such lists and suitable examples are given in ND71.

The Prime-contractor shall determine and decide upon the acceptability of each line item on the DML, DMPL and DPL prior to delivering each list to ESA for final approval.

In addition to the required paper copies, the DML/DMPL/DPL shall be provided in a form that is exchangeable, searchable and sort-able and suitable for storage and retrieval.

10. CONFIGURATION MANAGEMENT

The Prime-contractor shall establish and implement a system for configuration identification, configuration control, configuration status accounting, and configuration verification, which shall be in effect throughout the complete project life cycle.

This system shall also manage interfaces to the Customer Furnished Instruments.

The requirements of ND52 (Configuration Management) shall be applicable.


11. SOFTWARE PRODUCT ASSURANCE

The Prime-contractor shall develop software standards in conformance with the ND44 and ND15 requirements.

The ND44 shall apply with the following modifications: ND44, through out the document:

Delete the references to ECSS-Q-80-02, ECSS-Q-80-03 and ECSS-Q-80-04. ND44, clause 5.4.1: A separate software PA plan is not required. The Prime-contractor may include the Software PA planning in the overall PA plan.

Sub-clause 6.2.6.13, ISVV: Replace “Highly critical software” with “mission or safety critical software”.

Sub-clause 6.3.4.29, ISVV: Replace “Highly critical software” by “mission or safety critical software”.

12. OFF-THE-SHELF SPACE EQUIPMENT

An "Off the Shelf" item is an item originally developed for a different project (though possibly with a common or generic application) which has been selected for reuse in the current project.

The Contractor who decides to use an OTS item shall demonstrate its full suitability with the EarthCARE requirements, both on technical and PA aspects. The Prime Contractor shall submit an Off-the-Shelf Item List.

The Prime Contractor shall establish an OTS Item Suitability File for each selected OTS item. This OTS Item Suitability File shall contain at least:

EarthCARE Technical Specification identifying the EarthCARE requirements, Justification File clearly identifying any non compliance between the

EarthCARE requirements and the actual characteristics/performances of the item,

Delta Activities Program describing all necessary tasks to be performed to verify the fulfilment of the EarthCARE requirements, if any,

OTS Item Suitability Report presenting the results of the Delta Activities and demonstrating the full suitability of the OTS Item.

For each OTS Item, a dedicated OTS Item Suitability Review shall be held. This OTS Item Suitability Review shall take place not later than the PDR of the Upper Subassembly Level.

The Delta Activities Program shall be completed not later than the CDR of the Upper Subassembly Level.


13. ABBREVIATIONS

CIDL Configuration Item Data List

DCL Declared Components List

DRB Delivery Review Board

ECSS European Co-operation for Space Standardisation

EEE Electronic, Electrical, Electromechanical

EFM Electrical Functional Model

EIDP End Item Data Package

LET Linear Energy Transfer

MIP Mandatory Inspection Point

NRB Non conformance Review Board

OTS Off the Shelf

PA Product Assurance

QM Qualification Model

QA Quality Assurance

MPP Material, Parts and Processes

RFCP Reduced Fracture Control Programme

RFD Request For Deviation

RFW Request For Waiver

SRD System Requirement Document

--- End of the document ---