...
The actions taken when safing goes active depends on the mode. In disabled mode, no action is taken because all the engine is already "safed" as all valves must be closed prior to entering disabled and must remain so. In cold mode, all valves are immediately closed as fast as possible. Safing in cold mode prioritizes the safety of people in proximity to the engine, albeit potentially damaging the system. In hot mode, there is no personnel allowed within the safe blast radius of the engine and fuel is assumed to be live in the system, for this reason the purge is run after closing fuel and oxidizer valves. This prioritizes making the engine safe to approach without damage to the system, but does introduce pressure in the line from purging so is not optimal if there are personnel nearby.
After To prevent an operator accidentally disabling safing, after the controller goes into active safing mode, the operator must perform two steps to set safing to lowinactive and continue testing:
- Place the engine in disabled
- Set safing to inactive
...
The engine has a 3 light tower (red, yellow, green) that is used to communicate mode and safing information visually. A green light indicates the engine is disabled and safe to approach, as the engine is unfueled in this mode. A yellow light indicates that the engine is in cold mode, and indicates that the only personnel near the engine should be the minimum required for the fill process. A red light indicates hot mode, and the engine should be approached under no circumstances whatsoever. Additionally, a loud buzzer will beep five times before initiating any engine testing test to warn all personnel that a test is beginningand provide feedback to the operator.
When the engine goes into active safing, all lights will be lit up and will blink until the safing procedure is complete. This provides feedback to the operator for when the network link goes down.