E X O M A R S. Phase B1 Product Assurance & Safety Requirements EXM-MS-RS-ESA ESTEC Noordwijk The Netherlands. Prepared by: ExoMars PA Team

Transcription

1 Page: 1/42 Appendix 3 to /05/NL/GM E X O M A R S Phase B1 Product Assurance & Safety Requirements EXM-MS-RS-ESA Prepared by: ExoMars PA Team ESTEC Noordwijk The Netherlands

2 Page: 2/42 DOCUMENT CHANGE LOG Issue/ Date Modified pages Observations Revision Issue for Phase B1 Contract Signature Issue for Phase B1 Redirection Change Request

3 Page: 3/42 Table of Contents 1 INTRODUCTION Scope Applicability Applicable Documents PRODUCT ASSURANCE General PA Right of Access ESA Participation PA Plan (Addition to ECSS-Q-00A para 3.2) PA Progress Reporting (Addition to ECSS-Q-00A para 3.5.3) PA Database (Addition to ECSS-Q-00) QUALITY ASSURANCE Quality Assurance Plan (Addition to ECSS-Q-20B para 4.3) Audits (Addition to ECSS-Q-20B para 4.6) Critical Items Control (Addition to ECSS-Q-20B para 4.8) Non-Conformance Control System (Addition to ECSS-Q-20 para 5.6) Waivers (Addition to ECSS-Q-20B para 5.6.9) Cleanliness and Contamination Control (Addition to ECSS-Q-20B para 8.8) Acceptance Data Package (ADP) (Addition to ECSS-Q-20B para 10.1) DEPENDABILITY ASSURANCE Failure Tolerance SAFETY Objective Safety Approach Software RISK ASSESSMENT (TECHNICAL) General Requirements Risk Factors Consequences EEE COMPONENTS General Parts Selection Components Selection Parts Quality Level Planetary Protection Provisions Radiation Hardness... 14

4 Page: 4/42 8 MATERIALS, PROCESSES AND MECHANICAL PARTS (MPM) General Environmental Interaction Sterilization SOFWARE PRODUCT ASSURANCE OFF-THE-SHELF (OTS) EQUIPMENT ANNEX Applicable ECSS Standards: Tailoring Tables ECSS-Q-20B (08 March 2002) Tailoring for ExoMars Phase B ECSS-Q-30B (08 March 2002) Tailoring for ExoMars Phase B ECSS-Q-40B (17 May 2002) Tailoring for ExoMars Phase B ECSS-Q-60A (19 April 1996) Tailoring for ExoMars Phase B ECSS-Q-70A (19 April 1996) Tailoring for ExoMars Phase B ECSS-Q-70-01A (11 December 2002) Tailoring for ExoMars Phase B ECSS-Q-80B (10 October 2003) Tailoring for ExoMars Phase B1...34

5 Page: 5/42 1 INTRODUCTION 1.1 Scope This document defines the Product Assurance & Safety Requirements applicable to the ExoMars Mission. This document is a complement to the Mission & System Requirements and to the Management Requirements. 1.2 Applicability The requirements defined here are applicable to the phase B1 of the project. 1.3 Applicable Documents The following documents shall be applicable with modifications, if any, defined in the text of this document. All ECSS Standards refer to the current issue. They are available from the ESA Publications Division and also online on the Internet at: 3. ECSS-P-001A Glossary of Terms 4. ECSS-Q-00A Policy and principles 5. ECSS-Q-20B Quality Assurance 6. ECSS-Q-30B Dependability. 7. ECSS-Q-30-02A Failure Modes, Effects and Criticality Analysis. 8. ECSS-Q-40B Safety 9. ECSS-Q-60A EEE Components 10. ECSS-Q-70B Materials, Mechanical Parts and Processes 11. ECSS-Q-70-01A Contamination and Cleanliness control 12. ECSS-Q-80B Software Product Assurance 13. Planetary Protection Policies & Requirements EXM-MS-RS-ESA-00005, Issue 2

6 Page: 6/42 2 PRODUCT ASSURANCE The spacecraft design and operation regime shall be developed in compliance with these requirements, which are applicable to the prime contractor, sub-contractors and suppliers. It is the responsibility of the contractor to allocate these requirements to sub-contractors and suppliers and to ensure their implementation. 2.1 General The prime objective of the Contractors PA programme shall be to ensure that the EXOMARS mission will accomplish the intended objectives successfully. This shall be achieved in the most cost effective way. The contractor shall implement a PA programme in accordance with ECSS-Q-00 for the duration of the project. In particular the outputs from the PA and Safety programme shall be linked to a Risk Management programme. 2.2 PA Right of Access ESA shall have the right of access to all technical and programmatic documentation, all areas and operations within the contractor s or supplier s facilities, in which work is performed or items are stored, which relate to the project even if the information is considered proprietary. ESA will undertake not to disclose such information to a third party. 2.3 ESA Participation ESA shall have the right to perform or participate in audits, surveys, source inspection, test reviews, mandatory inspections, Delivery Review Boards, Non conformance Review Boards etc at the contractor or supplier facility. ESA participation shall not in any way replace or relieve the supplier of his responsibility. 2.4 PA Plan (Addition to ECSS-Q-00A para 3.2) The PA Plan shall be supported by a compliance matrix against the ECSS requirements and the ExoMars Mission specific modifications cited in this document, including an organisation chart showing responsibilities and reporting. The contractor shall provide a justification and an equivalent alternative approach for any non-compliance. Output PA-01: PA plan and related compliance matrix 2.5 PA Progress Reporting (Addition to ECSS-Q-00A para 3.5.3) PA progress reporting shall be part of the overall project progress reporting and shall include: status of the PA activities since the last progress report risk management non conformance and waiver status

7 Page: 7/ PA Database (Addition to ECSS-Q-00) All PA-related data and analyses (e.g., waivers, PA analyses, PA planning, alerts, etc) shall be stored in an electronic database. This shall allow to import and export data from and to sub-contractors and the Customer. The database format and content shall be agreed with the Customer.

8 Page: 8/42 3 QUALITY ASSURANCE The contractor shall implement a QA program in accordance with ECSS-Q-20 with the limitations or modifications given below. 3.1 Quality Assurance Plan (Addition to ECSS-Q-20B para 4.3) This may be a part of the PA plan required by clause 2.4 of these requirements. 3.2 Audits (Addition to ECSS-Q-20B para 4.6) The Contractor shall establish an Audit plan covering external and in-house audits linked to the Risk Management programme. Thus new processes will be audited. Critical items will be audited on a case by case basis pending the risk management. Auditing may be required by the customer. Thus the audit planning will also evolve with the risk monitoring. Output PA-02: Audit planning 3.3 Critical Items Control (Addition to ECSS-Q-20B para 4.8) The contractor shall implement the requirements of ECSS-Q-20 for the control of critical items. The contractor shall identify those items which are a risk to the programme, e.g. newly developed hardware, unqualified processes, unqualified materials, critical items from the dependability and safety analyses, special software, special GSE. These risk items shall be tracked and controlled via the project risk management programme, which will be reported on a monthly basis except where failures occur these will be reported within 2 working days. Output PA-03: Critical Items Control Plan and Critical Items list 3.4 Non-Conformance Control System (Addition to ECSS-Q-20 para 5.6) The Contractor shall establish and maintain an electronic non-conformance control system, covering both the spacecraft and the science instruments, which gives the customer full visibility of NCRs and their disposition. The Customer shall concur in the disposition of any NCR affecting system requirements, a science instrument and all system level NCRs. All major non-conformances shall be notified to the Customer within 2 working days. Any non-conformance affecting the planetary protection requirements shall be classified and reported with the highest criticality. Output PA-04: Non-conformances reports and status list 3.5 Waivers (Addition to ECSS-Q-20B para 5.6.9) Waiver submittal shall be done by electronic mean as reference and also in paper.

9 Page: 9/42 Output PA-05: Requests for waivers and status list 3.6 Cleanliness and Contamination Control (Addition to ECSS-Q-20B para 8.8) In addition to the requirements given in the ECSS-Q-20B, the ECSS-Q-70-01A shall be applicable taking into account the tailoring per the attached spreadsheet in annex. All MAIT (manufacture, assembly, integration and testing) activities shall be performed in class clean room or higher. The requirements of AD 13 shall apply. Output PA-06: Preliminary Cleanliness and Contamination control plan 3.7 Acceptance Data Package (ADP) (Addition to ECSS-Q-20B para 10.1) The Contractor shall deliver an ADP containing the deliverable outputs mentioned in the present document.

10 Page: 10/42 4 DEPENDABILITY ASSURANCE The Dependability programme shall follow the requirements of ECSS-Q-30B, however Maintainability analyses are not required. Output PA-07: The following analyses are required: (Limitation to ECSS-Q-30B para & 8.2.4) Failure Modes, Effects and Criticality Analysis (including common-mode and common cause analyses) Contingency Analysis. The major output of the programme shall be the identification of those items which contribute to project risk. The Risk Management program shall also track these items. 4.1 Failure Tolerance In accordance with both ECSS-Q-30B dependability and ECSS-Q-40B Safety the design of the system shall meet the failure tolerance requirements as per ECSS-Q-40B para Failure tolerance need not be applied to: primary structures, load-carrying structures, structural fasteners, load-carrying elements of mechanisms, and pressure vessels. In these cases, the requirements of design for minimum risk shall be applied. See also para of ECSS-Q-40B safety.

11 Page: 11/42 5 SAFETY 5.1 Objective The requirement of the safety program is to identify hazards and to implement a means of reducing and controlling the hazards so as to minimize the consequences to personnel, flight hardware, launch vehicle and facilities. 5.2 Safety Approach The Contractor shall establish a safety program and assign a contact person within the project team. The ECSS-Q-40B is made applicable, besides, the safety assurance program shall assure compliance to the launch authority safety requirements and applicable national and international safety standards and regulations (i.e. during handling and transportation). Safety critical items shall be monitored and tracked as part of the project risk management approach. For this purpose a safety critical item is defined as an item which does not comply with the applicable safety requirements. The Contractor shall demonstrate that results of the safety analysis confirm that the design is in agreement with the launch authority. Output PA-08: Hazard analysis and Safety critical functions at system level 5.3 Software Software shall not be used as a hazard control.

12 Page: 12/42 6 RISK ASSESSMENT (TECHNICAL) 6.1 General Requirements Loss of mission definition: The ExoMars Mission is considered to be lost when either the lander does not reach the Mars' surface or in case that after landing the scientific measurements cannot be performed. Launch and Ground Station risk shall also be assessed Instruments risk shall also be assessed. The scope of the Risk Analysis is to identify the Risk Scenarios that can potentially jeopardise the ExoMars Mission, to identify the Risk Causes and consequently the Risk Control to eliminate, or minimise and control the risks. The main parameters normally used to evaluate the risk scenario level of criticality are relevant to the capability of satisfying the required performances in terms of mission success, and the constraints on safety, cost and schedule. The supplier shall, using the identified Risk Factors as a basis for the analysis, develop a Risk Scenario Tree in order to identify the specific Risk scenarios inherent to the ExoMars mission Risk Factors The following risk factors shall be considered as a minimum: Related to Environment knowledge Thermal Environment Radiation Meteoroid Environment Contamination Condensation of moisture or contaminants on cold surfaces during test and transportation EMC Requirements definition Performances Lifetime Mission Profile (Ops) Reliability Related to Technologies + Design Materials EEE Components AOCS Propulsion Power Communication Separation Landing Structure Realisation AIV

13 Page: 13/ Consequences The following consequences shall be considered as a minimum: Performance Safety Interplanetary Protection The consequence severity level is defined according to the worst case potential effect. For what concerns safety, the severity is defined in ECSS-Q-40B Safety. For what concerns performance the ECSS-Q-30B dependability apply. For what concerns cost and schedule is defined according to the risk of overcoming an established target or a requirement according to ECSS-M-00-03A. The Risk register format and content shall be agreed with the Customer. Output PA-09: Technical risk assessment as per ECSS-M chap. 7

14 Page: 14/42 7 EEE COMPONENTS 7.1 General The purpose of this chapter is to describe the EEE-Parts requirements for the phase B1 of ExoMars Mission. These requirements define parts selection, procurement, use and quality assurance. The contractor shall comply with all the general and detail requirements of ECSS-Q-60A with any amendment specified herein (as per Table in Annex). 7.2 Parts Selection Components Selection The contractor shall be considered fully responsible of parts selection: it shall select parts which meet operating, stability, environmental, radiation, material, safety, quality and reliability requirements defined for the ExoMars mission. No Preferred Parts List (PPL) is dedicated to the project. EEE Components shall preferably be selected from the European PPL (part 1) available at Alternatively, NASA Parts Selection List (Level 1) in shall be used as a baseline for selection Parts Quality Level All EEE Components shall be selected in accordance with the standards outlined below: Integrated circuits Hybrids Diodes, transistors, optos ESCC level B, or MIL-PRF class V ESA PSS level B, or MIL-PRF class K ESCC level B, or MIL-PRF JANS Passives, other components ESCC level B or C, or MIL Spec, failure rate R or S Crystals, Relays ESCC level B Strategic components: The mid/long term availability of any identified components shall be assessed Planetary Protection Provisions The selection of components shall take into account AD 13. The compatibility with its requirements (i.e. sterilization, bake out temperatures) shall be assessed Radiation Hardness When selecting the components, the Contractor shall pay due attention to the radiation hardness. At Prime level, this activity shall be based on the environment specification.

15 Page: 15/42 Output PA-10: Preliminary Assessment of Parts Selection. This document shall identify main building blocks (at the supplier s criteria) implicitly considered in the technical baseline. For each identified component, the possible options for parts screening shall be identified. Any identified components shall be assessed w.r.t. all requirements specified in this paragraph: possible screening options, RHA, obsolescence issues (if any) and compatibility with Planetary Protection Specification. Output PA-11: Radiation Hardness Assurance Plan. This document shall specify the necessary requirements and provisions to be put in place for the implementation of a RHA program in the next phase of the project.

16 Page: 16/42 8 MATERIALS, PROCESSES AND MECHANICAL PARTS (MPM) 8.1 General The requirements of ECSS-Q-70A shall be followed except where modified in the spreadsheet attached in annex or in the paragraphs below. 8.2 Environmental Interaction When considering the materials environment it should be noted that atomic oxygen might be present during the earth escape orbit and the Mars insertion/operation orbit. The amount of atomic oxygen shall be predicted and its effect on materials shall be estimated. Particularly sensitive materials shall be avoided. The survivability of materials in the Martian environment (atmosphere, sand, etc.) for orbit /landing and operation shall be demonstrated if applicable 8.3 Sterilization In case of sterilization, relevant hardware shall be compatible with appropriate sterilization techniques or processes as defined in AD 13. Such Processes shall be considered as a special process in future MPM lists. Time efforts for the validation for such sterilization techniques shall be considered for the mission schedule.

17 Page: 17/42 9 SOFWARE PRODUCT ASSURANCE An effective Software Product Assurance (SPA) programme shall be implemented with the objective to provide adequate confidence that the software performs properly and safely and meets the specified quality requirements. The SPA requirements are applicable for flight software and ground support software. The Contractor shall develop software in accordance with the requirements of ECSS-E-40B and ECSS- Q-80B. A Software Product Assurance programme shall be implemented by the Contractor to fulfil the requirements of ECSS Q-80, as tailored in annex The supplier shall provide with the Software Product Assurance Plan a compliance matrix documenting conformance to the software product assurance requirements (ref. ECSS Q-80, sub clause ). For each applicable requirement listed in annex, a reference shall be provided to the section(s) of the relevant document(s) where that requirement is implemented. N.B.: The ECSSQ-80 requirements made not applicable in the annex, due to the scope of the contract phase B1 -, will be evaluated and opportunely made applicable for the next phases of software development. Output PA-12: Software PA plan and related compliance matrix

18 Page: 18/42 10 OFF-THE-SHELF (OTS) EQUIPMENT 1 OTS equipment is defined as equipment that has been developed and manufactured to sound industrial practices and that has been qualified for its originally intended use. OTS equipment for use in the EXOMARS programme shall have a demonstrated compliant heritage and usage. OTS equipment shall be able to withstand the environmental conditions applicable to the ExoMars Mission during all mission phases. Depending on the intended use, the following classes of OTS equipment can be identified: Equipment developed, built and qualified for other space projects under PA requirements equivalent to the ones of this document (equipment S ). S equipment may be used for flight applications. Equipment developed and built for commercial, aviation or military applications (equipment CAM ). CAM equipment may be used for non-flight applications. The use of OTS equipment shall not lead to the violation of any applicable safety requirement. System-level reliability and safety analyses (e.g., the FMEA) shall consider also OTS equipment failures. Candidate OTS equipment shall be reviewed by an Equipment Suitability Board chaired by a customer representative and including the PA function. It shall ensure that the proposed OTS meet the environmental and PA requirements. Following the review, the board shall issue an assessment and justification report Output PA-13: Preliminary list of OTS and related justification reports 1 Commercial OTS software is covered by Chapter 9 of this document.

19 Page: 19/42 11 ANNEX 11.1 Applicable ECSS Standards: Tailoring Tables ECSS-Q-20B (08 March 2002) Tailoring for ExoMars Phase B1 Tailoring: Y = tailor in; N = tailor out; M = modified; NA = not applicable, due to the scope of the contract; these requirements will be considered for their applicability in the next phases of project development. Clause Description Tailori Comments ng 4 Quality Assurance management 4.1 QA programme Y 4.2 Organization Y 4.3 QA programme plan Y 4.4 QA status reporting Y 4.5 Personnel training and certification NA 4.6 QA programme audits M 4.7 QA role in configuration management Y For only 4.8 Critical Items control Y 5 Quality Assurance general requirements 5.1 Documentation and data control Y 5.2 Quality records NA 5.3 Stamp control NA 5.4 Traceability NA 5.5 Metrology and calibration NA 5.6 Non Conformance control system M 5.7 Alert system NA 5.8 Handling, storage and preservation NA 5.9 Statistical quality control and analysis NA 6 QA requirements for design and verification 6.1 General Y 6.2 Planning Y 6.3 Organizational and technical interfaces Y 6.4 Design rules Y 6.5 Standards and procedures Y 6.6 Verification Y 6.7 Design changes Y 7 QA requirements for procurement NA 8 QA requirements for manufacturing, NA assembly and integration 9 Testing NA 10 QA requirements for acceptance and M delivery 11 Operations NA

20 Page: 20/ ECSS-Q-30B (08 March 2002) Tailoring for ExoMars Phase B1 Tailoring: Y = tailor in; N = tailor out; M = modified; NA = not applicable, due to the scope of the contract; these requirements will be considered for their applicability in the next phases of project development. 5 Dependability programme management Organization Y 5.2 Dependability programme planning Y Y 5.3 Dependability critical items Y Y 5.4 Design reviews Y Y Y Y 5.5 Audits Y 5.6 Use of previously designed, fabricated, qualified or -- flown items Y Y 5.7 Subcontractor control Y 5.8 Progress reporting Y 5.9 Documentation Y Y 6 Dependability risk reduction and control General Y 6.2 Identification and classification of undesirable events Y Y Y 6.3 Assessment of failure scenarios Y Y Y 6.4 Criticality classification of functions and products Y 6.5 Actions and recommendations for risk reduction Y 6.6 Risk decisions Y Y Y 6.7 Verification of risk reduction Y 6.8 Documentation Y 7 Dependability engineering Integration of dependability in the project Y

21 Page: 21/ Y Y Y 7.2 Dependability requirements in technical specification Y 7.3 Dependability design criteria Consequence category and severity Y Failure Tolerance Y Design approach Y 7.4 Involvement in test definition Y Y 7.5 Involvement in operational aspects Y Y Y 7.6 Dependability recommendations Y Y Y 8 Dependability Analysis Dependability Analysis and the project life cycle Y Y Y Y 8.2 Dependability analytical methods General Y Reliability analyses Y Maintainability analyses N Availability analyses Y 8.3 Classification of design characteristics in production N documents 8.4 Critical items list A A A A 9 Dependability testing, demonstration and data -- collection 9.1 Dependability testing and demonstration N N N 9.2 Dependability data collection and dependability growth N

22 Page: 22/ ECSS-Q-40B (17 May 2002) Tailoring for ExoMars Phase B1 Tailoring: Y = tailor in; N = tailor out; M = modified; NA = not applicable, due to the scope of the contract; these requirements will be considered for their applicability in the next phases of project development. 4 Safety programme Scope Y 4.2 Safety organization General Y Safety representative Y Reporting lines Y Safety integration Y Coordination with others Y 4.3 Safety representative access and -- authority Access Y Delegated authority to reject-stop work Y Delegated authority to interrupt Y operations Launch sequence NA Safety audits Y Safety audit schedule and access Y Conformance Y Approval of reports Y Review Y Representation on boards Y 4.4 Safety risk management Risks Y Hazard assessment Y Preferred measures Y 4.5 Project phases and safety review cycle Progress meetings Y Project reviews General Y Mission definition review Y Preliminary requirements review Y System requirements review Y Preliminary design review NA Critical design review NA Qualification review NA Acceptance review NA Flight readiness review NA Operational readiness review NA Launch commitment meeting NA In-orbit test review NA End-of-life assessment NA

23 Page: 23/ Safety programme review Y Safety data package Y 4.6 Safety programme plan Implementation Y Safety activities Y Definition Y Description Y Safety and project engineering activities Y Supplier and sub-supplier premises Y Conformance Y 4.7 Safety certification NA 4.8 Safety training Overall training NA Participation NA Basic technical training NA Product specific training NA Records NA Identification Y 4.9 Accident incident reporting and NA investigation 4.10 Safety documentation General Y Customer access Y Supplier review Y Documentation Y Safety data package Y Safety deviations and waivers Request for deviation Y Description, analysis and rationale Y Identification and review Y Assessment of deviation Y Review and disposition Y Certification authority approval Y Verification tracking log Y Lessons-learnt file NA 5 Safety engineering Safety engineering policy General Y Elements Y Lessons-learnt Y 5.2 Safety design principles Human life consideration Y Design selection Y Hazard reduction precedence Y Environmental compatibility M Must comply also with Interplanetary protection rules.

24 Page: 24/ Safe without services M Must comply also with Interplanetary protection rules Fail-safe design M Must comply also with Interplanetary protection rules Hazard detection signalling and safing NA Debris, fallout and impact prevention M Must comply also with Interplanetary protection rules Access NA 5.3 Safety risk reduction and control Severity Y Failure tolerance requirements Basic requirements Y Software Y Payload interface Y Redundancy separation Y Failure propagation Y Design for minimum risk General Y Fracture control Y Safety factors Y Materials Y Probabilistic safety targets M Safety target for the civil population tbd 5.4 Identification and control of safety critical -- functions Identification Y Inadvertent operation Y Provisions Y Safe shutdown and failure tolerance Y requirements Electronic, electrical, electromechanical Y 6 Safety analysis requirements and -- techniques 6.1 General Y 6.2 Assessment and allocation of -- requirements Safety requirements Y Additional safety requirements Y Define safety requirements functions Y Define safety requirements subsystems Y Justification Y Functional and subsystem specification Y 6.3 Safety analysis General Y Mission analysis Y Feasibility Y Preliminary definition Y

25 Page: 25/ Detailed definition, production and NA qualification Utilization NA Disposal NA 6.4 Specific safety analysis General NA Hazard analysis M Must comply also with Interplanetary protection rules Safety risk assessment Y Safety analysis for hardware software -- systems Safety-critical function Y Requirements definition phase Y Architectural and detailed design phase NA Software code NA 6.5 Supporting assessment and analysis General NA Warning times analysis NA Caution and warning analysis NA Common-cause and common-mode -- failure analysis Multiple failures Y Identification of requirements and scope NA Identification of common-cause failures Y Analysis of common-mode failures Y Integration of results Y Fault tree analysis NA Human dependability analysis NA Failure modes, effects and criticality Y analysis Sneak analysis Applicability NA Use of results NA Zonal analysis Definition NA Redundancy and objectives NA Energy trace analysis NA 7 Safety verification General Y 7.2 Tracking of hazards Hazard reporting system Y Status Y Safety progress meeting Y Review and disposition Y Documentation Y Mandatory inspection points NA 7.3 Safety verification methods --

26 Page: 26/ Verification engineering and planning Y Methods and reports NA Verification requirements NA Analysis NA Inspections NA Tests NA Verification and approval NA 7.4 Qualification of safety-critical functions Validation NA Qualification NA Failure tests NA Verification of design or operational NA characteristics Safety verification testing NA 7.5 Hazard close out Safety assurance verification NA Safety approval authority NA 7.6 Residual risk reduction NA 8 Operational safety Basic requirements Y 8.2 Flight operations and mission control Launcher operations Y Contamination M Must comply also with Interplanetary protection rules Flight rules NA Hazardous commanding control NA Mission operation change control NA Safety surveillance and anomaly control NA Hazardous debris, fallout and impact Y control 8.3 Ground operations Applicability NA Initiation NA Review and inspection NA Hazardous operations NA Launch and landing site Y Ground support equipment Y 11.4 ECSS-Q-60A (19 April 1996) Tailoring for ExoMars Phase B1 Tailoring: Y = tailor in; N = tailor out; M = modified; NA = not applicable, due to the scope of the contract; these requirements will be considered for their applicability in the next phases of project development. 1 General Y

27 Page: 27/42 2 Components Programme Management N/A 3 Component Engineering M See below 3.1 General Y 3.2 Component Selection M See below General rules Y Components requiring specific N/A Components approval not foreseen in authorisation this phase Type reduction and Standardization N/A Radiation Sensitive Components M Re-written just to require the deliverable documentation specified by the project Material Requirements for EEE Y components Derating M PSS called as applicable while ECSS- Q mentioned as reference only Availability of EEE Components Y Component Selection Criteria M EPPL and NPSL considered in equivalence. Preference given to EPPL part 1 and NSPL Level 1. Nonexhaustive table of required screening levels included 3.3 Component Approval N/A 3.4 Procurement Requirements N/A 3.5 Specific components N/A 4 Component Quality Assurance N/A 5 Non conformances or Failures N/A 6 Alerts N/A 7 Documentation M OUTPUTs of this phase defined Annex PAD format N/A A Annex B Level 3 standards N/A 11.5 ECSS-Q-70A (19 April 1996) Tailoring for ExoMars Phase B1 Tailoring: Y = tailor in; N = tailor out; M = modified; NA = not applicable, due to the scope of the contract; these requirements will be considered for their applicability in the next phases of project development. 0 Foreword 1 General Y 1.1 Scope Y 1.2 Objectives Y 1.3 Applicability Y 1.4 Normative Documents Y 1.5 Informative Documents Y 1.6 Definitions and Abbreviations Y Definitions Y Abbreviations. Y

28 Page: 28/42 2 General Requirements 2.1 Materials, Parts and Processes Y Programme Management Product Assurance Plan Y Materials, Parts and Processes Manager Y Materials, Parts and Processes Board N Materials, Parts and Processes Reviews N 2.2 Management and consolidation of the Materials, Parts and Processes N N N 2.3 Technical Constraints Y Y M in addition, resistance to sterilisation techniques Y 2.4 Cleanliness, Contamination Control N Not relevant to phase B N Not relevant to phase B M Shall in addition, make reference to planetary protection requirements 2.5 Safety Hazardous Materials and Parts Y 2.6 Mechanical GSE/Electrical GSE N Hardware 3 Materials Control 3.1 Selection of Materials Y Technical Criteria Y Identification of Needs Y Declared Material List (DML) Content Criticality Analysis Y Evaluation and Validation Phases Y Evaluation phase Y Validation phase Y Deviation request Y 3.2 Procurement of Materials M Procurement Specifications Incoming Inspection Procedure N 3.3 Use of Materials Validation status of Materials Y Traceability of Materials Y M Packaging, Storage, Removal from Storage Limited-Life Materials before N Implementation M No delivery required but future lists shall be prepared electronically in a readable, exchangeable and sortable format Only for critical items or new/novel materials & processes Shall be considered in view of planetary protection (hardware sterilisation etc.)

29 Page: 29/42 Limited-Life Materials after N Implementation Materials Non conformances and Alerts N Health and Safety Y 4 Mechanical Parts Control 4.1 Selection of Mechanical Parts Y Technical Criteria Y Identification of Needs Y M Declared Mechanical Part List (DMPL) Content Criticality Analysis Y Evaluation and Qualification Phases Y Evaluation phase Y Qualification phase Y Deviation request Y 4.2 Procurement of Mechanical Parts M Procurement Specification Source Inspection N Incoming Inspection Procedure N 4.3 Use of Mechanical Parts Qualification Status of Parts Y Traceability of Parts Y M Packaging, Storage, Removal from Storage Limited Life Parts or Parts Subject to N Wearout Parts Non conformance and Alerts N 5 Process Control 5.1 Selection of Processes Y Technical Criteria Y Identification of Needs Y M Declared Processes List Content Criticality Analysis Y Evaluation and Validation Phase Y Evaluation phase Y Validation phase Y Deviation request Y 5.2 Use of a Process Validation Status of a Process Y Revalidation of a Process N Implementation of a Process N M Special Processes Traceability of Processes Y No delivery required in phase B, but future lists shall be prepared electronically in a readable, exchangeable and sortable format Only for critical items or new/novel materials & processes Shall be considered in view of planetary protection (hardware sterilisation etc.) No delivery required in phase B, but future lists shall be prepared electronically in a readable, exchangeable and sortable format Shall be considered in view of planetary protection (hardware sterilisation etc.)

30 Page: 30/ Process Non conformances and N Alerts Mandatory Inspection Points (MIP) N M Shall be considered in view of Packaging/Storage/Removal from planetary protection (hardware Storage sterilisation etc.) 6 Annex A (informative): Relationship Between Materials, Parts and Processes Activities and Programme Phases 6.1 A.1 Conceptual Phase (Phase A) 6.2 A.2 Project Definition Phase (Phase B) A.3 Detailed Design, Development, Manufacturing, Integration and Test 6.3 Phase (Phase C/D) 6.4 A.4 Operational Phase (Phase E) 11.6 ECSS-Q-70-01A (11 December 2002) Tailoring for ExoMars Phase B1 Tailoring: Y = tailor in; N = tailor out; M = modified; NA = not applicable, due to the scope of the contract; these requirements will be considered for their applicability in the next phases of project development. 0 Foreword 1 Contents 2 Introduction 1 Scope Y 2 Normative references Y 3 Terms, definitions and abbreviated terms Y 3.1 Terms and definitions Y airborne particle Y airborne particle cleanliness class Y bakeout Y bio-contamination Y clean area Y cleaning Y cleanliness (contamination) control Y cleanliness level Y cleanliness verification Y cleanroom Y clean work station Y clean zone Y contaminant Y contaminate, to Y contamination budget Y contamination potential Y controlled area Y fibre Y FTIR spectrometer Y HEPA particle filter Y

31 Page: 31/ induced contaminant environment Y molecular contamination Y monitoring Y non-volatile residue (NVR) Y obscuration factor (OF) Y offgassing Y outgassed quantity Y outgassing Y particle Y particle fallout Y particle size Y particulate Y particulate contamination (PAC) Y plume Y purging Y quartz crystal microbalance (QCM) Y ram direction Y sensitive item Y ULPA particle filter Y venting Y visibly clean Y wake direction Y witness sample Y 3.2 Abbreviated terms Y 4 General cleanliness and contamination Y control aspects 4.1 General Y 4.2 Contamination attributes Y Main effects of contamination on space Y systems Typical contaminants and their sources on M in view of planetary protection ground requirements taking also into account bio-contamination etc Particulate contaminants Y Molecular contaminants Y Gases and vapours Y Liquids Y Other contaminants Y Typical contaminants during operations Y and their sources Launch Y Mission (external) Y General Y Natural environment Y Induced environment Y Mission (inhabited space cabins) Y

32 Page: 32/ General Y Sources of contamination - natural Y 2 environment Sources of contamination - induced Y 3 environment (internal) Effects of contaminants and failure modes Y due to contaminants in space Particle transport in space Y Molecular contaminants transport in space Y 4.3 Cleanliness levels Y General Y Particulate levels on surfaces Y General Y Expression of levels for particles on Y surfaces Standard method 1 (MIL-STD-1246C) Y Standard method 2 (Obscuration factor) Y Correlation for particles on surfaces Y Particle levels in environments Y Molecular levels on surfaces Y Sources of molecular levels on surfaces Y Acceptance levels for molecular Y contamination on surfaces Molecular levels in environments Y 4.4 Cleanliness monitoring Y Particulate contamination monitoring Y Molecular contamination monitoring Y Contamination monitoring in vacuum Y facility Contamination monitoring during launch Y Contamination monitoring in space Y 4.5 Cleaning Y Removal of particulate contamination Y Removal of molecular contamination Y 4.6 Modelling Y 5 Cleanliness and contamination control programme M In view of planetary protection requirements this shall also take into account bio-contamination (Sterilsation, bio-burden control, monitoring etc). 6 Contamination control during the product Y life cycle 6.1 General design provisions Y 6.2 Manufacturing, integration and test N Manufacturing N Assembly and integration N Testing N Vacuum facilities N 6.3 Budgets, prediction and modelling

33 Page: 33/ General Y On-ground contamination budget N In-orbit molecular contamination budget N Launch contamination budget N 6.4 Cleanliness verification General M In view of planetary protection requirements taking also into Cleaning procedures N General N Cleaning aids N Cleaning solvents N Bakeout N Purging N 6.5 Packing, containerization, transportation and storage M account bio-contamination (Sterilsation, bio-burden control, monitoring etc). Shall be considered in view of planetary protection (hardware sterilisation etc.) 6.6 Launch N General N Specific provisions N Launcher level N System (payload) level N 6.7 Mission (external) Molecular outgassing from materials M No output required but to be considered for preliminary design Design aspects M No output required but to be considered for preliminary design Mission (inhabited space cabins) N 6.8 Mission (internal) System level M No output required but to be considered for preliminary design Lower levels N Monitoring N 7 Annex A (normative): Document requirements list 8 Annex B (informative): Space system cleanliness control flow chart 9 Annex C (informative): Molecular contaminant content of some wipe materials 10 Annex D (informative) Compatibility of various solvents with listed materials 11 Annex E (informative): Non-volatile residue of commercially available solvents, measured by infrared techniques 12 Annex F (informative): Clean-room requirements 12.1 F-- F--F.1 Particle levels and clean-room classification Y N N N N N N

34 Page: 34/ F.2 Interpretation for particles in N environments 12.3 F.3 Monitoring of clean-room air N 12.4 F.4 Indicative correlation between particles N in air and particle fallout 12.5 F.5 Molecular levels N 12.6 F.6 Measurement of molecules in N environments 12.7 F. 7 D e s i g n N 12.8 F.8 Environmental control N 12.9 F.9 Maintenance and cleaning N F.10 Access control N F.11 General requirements for a cleanroom N 13 Annex G (normative): Cleanliness M Shall in addition encompass the requirement specification Document planetary protection requirements requirements definition (DRD) 13.1 G.1 Introduction Y 13.2 G.2 Scope and applicability Y 13.3 G.3 Terms, definitions and abbreviated Y terms 13.4 G.4 Description and purpose Y 13.5 G.5 Application and interrelationship Y 13.6 G.6 CRS preliminary elements Y 13.7 G.7 CRS contents Y 14 Annex H (normative): Cleanliness and contamination control plan Document requirements definition (DRD) 14.1 H.1 Introduction Y 14.2 H.2 Scope and applicability Y 14.3 H.3 Terms, definitions and abbreviated Y terms 14.4 H.4 Description and purpose Y 14.5 H.5 Application and interrelationship Y 14.6 H.6 C&CCP Preliminary elements Y 14.7 H.7 C&CCP contents Y 15 Bibliography 16 ECSS Document Improvement Proposal M Shall in addition encompass the planetary protection requirements 11.7 ECSS-Q-80B (10 October 2003) Tailoring for ExoMars Phase B1 Tailoring: Y = tailor in; N = tailor out; M = modified; NA = not applicable, due to the scope of the contract; these requirements will be considered for their applicability in the next phases of project development. 5 Software product assurance programme implementation 5.1 Introduction 5.2 Organization and responsibility

35 Page: 35/ Organization Y Responsibility and authority Y Resources Y Software product assurance manager Y Y Training M Expected Output not required M Expected Output not required Y Y 5.3 Contractual aspects Y 5.4 Software product assurance programme management Software product assurance planning and control M A separate software PA plan is not required. The contractor shall include the software PA planning in the overall PA Plan Y Y Y NA Y Software product assurance reporting M Separate software PA reporting is not required. The contractor shall include the software PA reporting in the PA reporting for the project Y NA NA Audits Y Alerts Y Nonconformances Y Y Y Software problems NA

36 Page: 36/ NA NA 5.5 Risk management and critical item control Risk management Y Critical item control Y 5.6 Supplier selection and control Supplier selection Y Supplier requirements Y Y Supplier monitoring Y Y NA NA Criticality classification Y 5.7 Procurement Requirements Y Selection Y Approval Y Procurement details Y Identification Y Inspection NA Exportability Y 5.8 Tools and supporting environment Development computer selection Y Choice description Y Methods and tools Y Y M The suitability of the software development environment shall be justified in the PAF Y Y Tool selection NA NA 5.9 Assessment and improvement process Assessment process Y Assessment procedure Y Assessment records Y Assessment data Y Quality data Y Applicable to the methods and tools used in the activities performed within the scope of the contract (e.g. requirements analysis).

37 Page: 37/ Process improvement Y Process or project documentation Y 6 Software process assurance 6.1 Software development life cycle Life cycle definition Y Life cycle definition review Y Life cycle resources Y Quality objectives Y Phase outputs Y Special characteristics Y Milestones Y Role of customer Y Validation process schedule Y 6.2 Requirements applicable to all software engineering processes Documentation of processes Y Y Y Y Y NA NA NA NA NA Software dependability and safety analysis Y Y NA NA NA NA NA Handling of critical software NA NA NA NA NA NA NA NA NA Software configuration management Y Y

38 Page: 38/ NA NA NA NA Y Y Y NA Y Y Process metrics Y Y Y NA NA NA Verification Y Y Y Y NA NA NA Y Y Y Y Y M Reuse of existing software Y Y Y Y Y Y Y Y Y Y Y Independent software verification shall be performed for safety and mission critical software.

39 Page: 39/ Requirements applicable to individual software engineering processes or activities Software requirements analysis Y Y Y Y Y Software architectural design and design of software NA NA NA NA NA NA NA NA Y Coding NA NA NA NA NA NA NA NA NA NA Testing and validation NA NA NA NA NA NA NA NA NA NA NA NA NA NA NA NA

40 Page: 40/ NA NA NA NA NA NA NA NA NA NA NA NA M Independent software validation shall be performed for safety and mission critical software NA NA NA Software delivery and acceptance NA NA NA NA NA NA NA NA NA Operations NA NA NA Maintenance NA NA NA NA NA NA NA 7 Software product quality assurance 7.1 Product quality objectives and metrication Assurance activities for product quality Y requirements Deriving of requirements Y Quality models

41 Page: 41/ NA NA NA Product metrics NA NA Measurement NA Measurement results NA Basic metrics NA Metrication process NA Metrics analysis NA Numerical accuracy NA Analysis of software behaviour NA Metrics trend NA Improvement actions NA 7.2 Product quality requirements Technical specification Y Y Y Y Design and related documentation NA NA NA Software intended for reuse Y Y Y Y Y NA Y 7.3 Supporting documentation Test and validation documentation NA NA NA NA NA NA Reports and analysis Y 7.4 Standard hardware for operational system Procurement Y Constraints Y Selection Y Maintenance Y

42 Page: 42/ Documentation Y 7.5 Firmware Device programming NA Marking NA Calibration NA