"Should" is the ambiguous word there Michael. In traditional formal systems Engineering (INCOSE), we never, ever allow that word in system requirements, it is literally untestable.
One word like that, allowed to remain in system requirements can be the weak link that causes the whole system to fail.
In this case it is statistically almost inevitable to fail, by at least a few of those flying shrapnel to do something other than what they "should" have done.