Section Objective Criteria to Determine if the Application is Complete Timeframe § 450.119(c)(4) Malfunction flight trajectory analysis outputs for a representative flight
• For each phase of flight, are there sets of trajectories (normally a few sets of hundreds or more, depending on the failure mode, phase of flight, and resolution required) for different types of malfunction flight?
• Do the malfunction trajectories contain position and velocity as a function of flight time?
• Is the probability of each set of trajectories that characterizes a type of malfunction flight specified?
• Is there a set of trajectories that characterizes the limits of a useful mission?
(This set normally contains at least six trajectories).
11.8 § 450.121 Debris analysis.
§ 450.121(d)(1) Hazardous scenarios
• Does the description of hazardous scenarios account for all phases of flight?
• Does the description of hazardous scenarios include the event sequence for multiple causes of vehicle breakup and intact impact?
§ 450.121(d)(2) Breakup analysis methods
• Does the methodology reference an accepted means of compliance for breakup criteria (structural limits) analysis?
• Does the methodology reference an accepted means of compliance for breakup debris analysis?
• Does the methodology reference an accepted means of compliance for impact analyses (when propellant or other hazardous substances are present at impact)?
§ 450.121(d)(3) Methods for dispersions
• Does the methodology reference an accepted means of compliance for computing debris impact dispersions?
Phase 1 37
Section Objective Criteria to Determine if the Application is Complete Timeframe § 450.121(d)(4) Atmospheric data
• Is there a narrative description of the atmospheric data used?
• Does the description include references to specific data sources?
• Does the description account for all phases of flight?
• Does the description identify the data elements used, including wind uncertainty?
§ 450.121(d)(5) Output debris data for a representative flight
• Does the debris data cover all hazardous scenarios for each phase of flight?
• Does the debris data include physical characteristics of debris (size, mass)?
• Does the debris data include aerodynamic characteristics of debris (ballistic coefficient with uncertainty, lift uncertainty, breakup-induced velocity)?
• Does the debris data include harmful characteristics (including explosives or toxics)?
11.9 § 450.123 Population exposure analysis.
§ 450.123(c)(1) Exposure input data methods
• Does the methodology reference an accepted means of compliance for determining population exposure regions, characterized by fidelity and resolution required?
• Is there a methodology associated with each identified region?
• Does each identified methodology reference an accepted means of compliance for developing population exposure data?
§ 450.123(c)(2) Population exposure data for a representative flight
• Is there a demonstration that the region covered by the population exposure data is sufficient?
• Does the population exposure data include population as a function of geographic location?
• Is the population data in tabular form (normally should be machine readable)?
Phase 2 38
Section Objective Criteria to Determine if the Application is Complete Timeframe
11.10 § 450.131 Probability of failure analysis.
§ 450.131(f)(1) Probability of failure (POF) analysis methods
• Does the methodology reference an accepted means of compliance for probability of failure development?
§ 450.131(f)(2) Failure probability data for a representative flight
• Does the POF data account for all phases of flight?
• Is there tabular (quantitative) data on the predicted failure rate for multiple failure modes for each phase of flight?
• Are their graph(s) of the predicted failure rate for each failure mode for each phase of flight?
• Is there tabular (quantitative) data of the cumulative failure probability for each foreseeable failure mode for each phase of flight?
• Are their graph(s) of the cumulative failure probability for each failure mode for each phase of flight?
Phase 2
11.11 § 450.133 Flight hazard area analysis.
§ 450.133(e)(1) Vehicle's flight behavior methods
• Does the methodology reference an accepted means of compliance for flight hazard area analysis?
§ 450.133(e)(2) Flight hazard area analysis results for a representative flight
• Are there geographic coordinates that define the boundaries of all hazard areas?
• Are there contours that demonstrate 97 percent probability of containment for debris resulting from normal flight events capable of causing a casualty?
Note: Contours, in this section, means a set of geographic coordinates defining an isopleth, normally rendered on a map.
• Are there individual probability of casualty contours for unsheltered people?
• Do the unsheltered probability of casualty contours specify 1E-5 and 1E-6 levels?
Phase 3 39
Section Objective Criteria to Determine if the Application is Complete Timeframe
• Are there probability of casualty-producing impact contours for persons on a waterborne vessel?
• Do the waterborne vessel probability of impact contours specify 1E-5 and 1E-6 levels?
• Are there probability of casualty-producing impact contours for persons on an aircraft?
• Do the aircraft probability of impact contours specify 1E-6 and 1E-7 levels?
11.12 § 450.135 Debris risk analysis.
§ 450.135(c)(1) Compliance methods
• Does the methodology reference an accepted means of compliance for debris risk analysis?
§ 450.135(c)(2) Atmospheric data
• Is there a description of atmospheric data used as input for the debris risk analysis?
Note: Normally this is the same as the data used for debris analysis, § 450.121(d)(4), and that could be referenced here.
§ 450.135(c)(3) Unsheltered casualty area
• Is there an effective unsheltered casualty area for all fragment classes for all phases of flight?
§ 450.135(c)(4) Sheltered casualty area
• Is there an effective casualty area for all phases of flight for all fragment classes for:
o One or more types of buildings?
o One or more types of ground vehicles?
o One or more types of waterborne vessels?
o One or more types of aircraft?
§ 450.135(c)(5) Debris risk analysis outputs for a representative flight, with both representative and worst-case conditions under which an operation might be attempted.
Phase 3 40
Section Objective Criteria to Determine if the Application is Complete Timeframe
• Is there a total collective casualty expectation?
• Is there a total collective casualty expectation?
o Is there a collective risk contribution for (at minimum) the top ten population centers?
o Is there a list of all centers with collective risk exceeding 1% of 2 x 10-4 expected casualties for all neighboring operations personnel (NOPs)?
o Is there a list of all centers with collective risk exceeding 1% of 1 x 10-4 expected casualties for all members of the public (excluding [NOPs])?
• Individual risk o Are the ten population centers with the highest maximum individual risks identified?
o Is there a list of all centers that exceed 10% of 1 x 10-5 probability of casualty for any neighboring operations personnel?
o Is there a list of all centers that exceed 10% of 1 x 10-6 probability of casualty for any member of the public (excluding NOPs)?
• Conditional risk o Is there a list of the conditional collective casualty expectation results for each failure mode for each significant period of flight (e.g., 1s intervals)?
o Are all of the outputs required by 450.135(c)(5) provided for two cases, one labeled “representative” and one labeled “worst foreseeable”?
11.13 § 450.137 § 450.137(c)(1) Population center, terrain, etc. description Phase 1:
Far-field • Is there a description of the population centers used as input that addresses § 450.137(c)(2) overpressure blast the requirement in 450.137(b)(3)?
effects analysis. • Is there a description of the terrain used as input?
Note: This is usually a narrative along with digital data.
Phase 2:
§ 450.137(c)(1) § 450.137(c)(3) 41
Section Objective Criteria to Determine if the Application is Complete Timeframe § 450.137(c)(2) Probability pairs methods § 450.137( c)(4)
• Does methodology reference an accepted means of compliance for computing yield probability pairs?
§ 450.137(c)(8)
• Is there a set of yield-probability pairs? Phase 3:
§ 450.137(c)(3) Peak incident overpressure methods § 450.137(c)(5)
• Does the methodology reference an accepted means of compliance for § 450.137(c)(6) computing peak incident overpressure?
• Are sample calculations included for a representative range of foreseeable meteorological conditions, yields, and population centers?
§ 450.137(c)(4) Window breakage methods
• Does the methodology reference an accepted means of compliance for computing the probability of window breakage?
• Is there tabular data for the probability of window breakage as a function of the peak incident overpressure?
• Are there graphs of the probability of window breakage as a function of the peak incident overpressure?
• Does the probability of window breakage data cover a representative range of window types?
• Does the probability of window breakage data cover a representative range of building types?
• Does the probability of window breakage data cover a representative range of yields?
§ 450.137(c)(5) Individual probability of casualty (Pc) methods
• Does the methodology reference an accepted means of compliance for computing the Pc for a representative individual?
• Is the Pc for a representative individual as a function of location relative to the window and peak incident overpressure?
§ 450.137(c)(7) 42
Section Objective Criteria to Determine if the Application is Complete Timeframe
• Does the Pc account for a representative range of window types?
• Does the Pc account for a representative range of building types?
• Does the Pc account for a representative range of yields?
§ 450.137(c)(6) Exposed persons data
• Is there tabular/graphic data showing the hypothetical location of any NOPs that could be exposed to Pc ≥ 1 x 10-5? (or a statement that there are no NOPs at the site)
• Is there tabular/graphic data showing the hypothetical location of any other member of the public that could be exposed to Pc ≥ 1 x 10-6?
• I n lieu of the tabular/graphic data on the hypothetical location of member of the public, are there tabular/graphic data on the actual location where members of the public (both NOPs and otherwise) would be subject to the maximum individual risks under the worst-case conditions when an operation might be attempted?
§ 450.137(c)(7) Max expected casualties
• Does the application identify a maximum expected casualties that could result from far-field overpressure hazards?
§ 450.137(c)(8) Meteorological measurements
• Is there a description of meteorological measurements used as input including the temporal and spatial resolution?
Section Narrative Objective Criteria to Determine if the Application is Complete Timeframe
11.14 § 450.139 Prior to application acceptance, a § 450.139(e)(1) Phase 1:
Toxic hazards means of compliance for • Does the methodology reference an accepted § 450.139(e)(1) for flight. § 450.139 must be accepted. means of compliance for toxic risk analysis? § 450.139(f)(1) Hazards associated with toxics § 450.139(f)(1) § 450.139(f)(2) utilized during licensed flight must be properly managed and
• Is a reference for what constitutes a toxic substance identified?
§ 450.139(f)(7) compliance demonstrated with criteria in § 450.101.
• Are possible toxic release sources identified from:
o Propellants?
Phase 2:
§ 450.139(f)(3) o Chemicals? § 450.139(f)(4) o Combustion products?
o Derivatives?
§ 450.139(f)(5) § 450.139(f)(2) Phase 3:
• Is there a list of toxic concentration and duration § 450.139(f)(6) thresholds?
§ 450.139(f)(3)
• Are meteorological conditions provided?
§ 450.139(f)(4)
• Is a characterization of terrain provided?
§ 450.139(f)(5)
• Is the toxic dispersion modeled identified?
• Is other input data to the toxic model provided?
§ 450.139(f)(6)
• Are representative results of the toxic analysis provided?
• Do the results include toxic concentrations and durations?
§ 450.139(f)(8) 44
§ 450.139(f)(7)
• Are failure modes and probabilities of toxic scenarios provided?
• Are representative results of a worst-case toxic release provided?
§ 450.139(f)(8)
• Is the use of a containment or risk assessment approach specified?
• If a containment approach is used:
o Is there a description of evacuation plans?
o Is there a description of meteorological constraints and associated launch commit criteria?
• If a risk assessment approach is used:
o Is there a demonstration of compliance with safety criteria?
o Is population data provided?
o Is there a description of risk mitigations?
PRESCRIBED HAZARD CONTROLS FOR SAFETY-CRITICAL SYSTEMS Section Narrative Objective Criteria to Determine if the Application is Complete Timeframe
12.1 § 450.141 Computing systems.
In pre-application, FAA reviews documentation to define an agreed set of computing system safety items, assess the criticality of each computing system safety item, and evaluate the development processes for the computing § 450.141(d)(1)
• Is there a list of computing system safety items (CSSI)?
• Is there a description of how severity is determined?
• Is there a description of how degree of control Phase 1:
§ 450.141(d)(1) § 450.141(
d)(3) Phase 2:
§ 450.141(d)(2) system safety items to verify is determined? Phase 3:
sufficient rigor. • Is the degree of control specified for each § 450.141(d)(4) The identification and assessment of computing system safety items (CSSI) is accomplished through CSSI?
• Is the severity of outcome specified for each CSSI?
§ 450.141(d)(5) § 450.107 functional hazard analysis, flight hazard analysis, and/or other software safety analysis.
With respect to “evidence”, this means artifacts of the development process, such as design documents, test reports, etc.
• Are criticality levels defined?
• Is the level of criticality specified for each CSSI?
§ 450.141(d)(2)
• Are there safety requirements for each CSSI?
• Is a description of the approach for identifying safety requirements included?
• Is a description of the approach for evaluating each safety requirement included?
§ 450.141(d)(3) Is there documentation of:
• Responsibilities for tasks associated with CSSIs?
Section Narrative Objective Criteria to Determine if the Application is Complete Timeframe
• Processes for internal review and approval of CSSIs?
• Processes to ensure development personnel are trained, qualified, and capable of performing their role?
• Processes that trace requirements to verification and validation evidence?
• Processes for configuration management?
• Processes for testing?
• Reuse policies?
• Third-party product use policies?
§ 450.141(d)(4)
• Is there evidence of the development process being executed for each CSSI?
§ 450.141(d)(5)
• Is there evidence for verification of implementation of each safety requirement identified for each CSSI?
12.2 § 450.143 The robustness of safety-critical § 450.143(f)(1) Safety-cr itical systems Phase 1;
Safety-critical system design, systems must be demonstrated via compliance to the design, test, and • Is there a list of safety-critical systems? Phase 2-4 for completion test, and documentation requirements of • Is there a description of each safety-critical qualification documentation. § 450.143.
Safety-critical systems of flight systems are primarily identified via § 450.107 functional hazard analysis. Additional “safety-critical system?
§ 450.143(f)(2) Drawings
• Are there drawings and/or schematics that include every safety-critical system?
and acceptance with results / data and resolution of findings 47
Section Narrative Objective Criteria to Determine if the Application is Complete Timeframe system” designations may be § 450.143(f)(3) Operating environments, for each de termined via § 450.109 flight safety-critical system identified in (f)(1):
hazard analysis, flight safety analysis, § 450.185 ground hazard analysis, or other system safety analyses. Safety-critical systems
• Is there a summary of the analysis approach to determine the predicted operating environments?
may be excluded per • Does each summary discuss how the § 450.143(a)(2). duration of associated testing is determined?
• Does each summary discuss how service-life is determined?
§ 450.143(f)(4) Validation
• Is there a description of method(s) used to validate the predicted operating environments?
§ 450.143(f)(5) Aging
• Is there a description of instrumentation or inspection processes to monitor aging of each safety-critical system?
§ 450.143(f)(6)
• Are there criteria and procedures for disposal or refurbishment for service life extension of safety-critical system components?
§ 450.143(f)(7)
• Is there a description of the standards used for different phases of the system lifecycle?
Normally this is a list of documents with a summary description and how they are applied to the system lifecycle.