# AC 431.35-1: Expected Casualty Calculations for Commercial Space Launch and Re-Entry Missions - Type: Advisory circular (guidance, not mandatory unless a rule or AD requires it) - Status: Historical - Approved: August 30, 2000 - Last reviewed: April 16, 2001 - Family: AC 431.35-1 - 14 CFR parts: 431 - Pages: 25 - PDF: https://openairdocs.org/files/sha256/f1/5f/f15fbcd3a60a6bd4f517033dfb7370aa83d7215ce5d59d9ae57126273060aeb8 - FAA DRS: https://drs.faa.gov/browse/excelExternalWindow/9C6D50F599CB3620862569F10075A035.0001 - DRS record last changed: November 21, 2025 - Page: https://openairdocs.org/ac/431.35-1 ## Versions - [AC 431.35-1](https://openairdocs.org/ac/431.35-1) (Historical), approved Aug 30, 2000, 25 pages ## Text Each page's text from the PDF; open the PDF at a page with #page=N. ### Page 1 Subject: EXPECTED CASUALTY CALCULATIONS **FOR COMMERCIAL SPACE LAUNCH AND** REENTRY MISSIONS Date: August 30, 2000 Initiated By: AST-1 AC No: 431.35-1 Change: 1. PURPOSE. This advisory circular provides an acceptable methodology for estimating the val ue, or upper limit of the value, of Expected Casualty Ec for commercial space launch and reentry missions. 2. BACKGROUND. The FAA Office of the Associate Administrator for Commercial Space Transportation (AST) is responsible for licensing commercial sp ace launch and reentry (return from Earth orbit or outer space) operations. A principal objective of the licensing process is to limit risk to public health and safety, and safety of property, and to protect national security and foreign policy interests o f the United States. Sections 415, 431 and 435 establish that, to be eligible for licensing, the launch of a launch vehicle (415.35(a)), the launch and reentry of a reusable launch vehicle (431.35(b)), or the reentry of a reentry mission (435.35) shall not exceed an expected average number of 0.00003 casualties per mission ( Ec < 30 X 10-6). The purpose of the requirement is to ensure that risks to public safety presented by launch and reentry operations is limited to an acceptable level, defined in a mann er consistent with acceptable launch risk at national ranges administered by the Air Force. In summary, a license applicant is in compliance with sections 415.35(a), 431.35(b) or 435.35 if its expected casualty calculation utilizes the methodologies and procedures detailed in this advisory and yields an Ec of less than or equal to 0.00003. For further information: Ronald Gress, Manager, Licensing and Safety Division, (202) 267-8602. ### Page 2 3. DISCUSSION. Expected casualty is used in the space transportation industry as a measure of risk to public safety from a specific mission, and is one of the factors typically used within the U.S. Government to determine if a mission may proceed or a license may be granted. Expected casualty is the expected average number of human casualties per commercial space mission. Human casualty is defined as a fatality or serious injury. For the purpose of this advisory circular, a human casualty is considered to be any human contact with a piece of vehicle debris that can cause injury or exposure to explosive overpressure of 3.5 pounds per square inch (psi) or greater. Note: 3.5 psi is the level that will cause eardrum damage to 1% of the exposed population. Reference DOD 6055.9 -STD, DOD Ammunition and Explosive Safety Standards, August, 1997. Another way of expressing the measure of expected casualty is that if thousands of identical missions were conducted and all the casualties that resulted were added up and the sum divided by the number of missions, the actual casu alties and the expected casualties per mission should ideally be the same. For the purpose of this advisory circular, a mission includes all licensed flight segments throughout the mission. If there are activities that occur on orbit that are not condu cted under a license, these segments, or phases, are not included in the mission. For example, a sub-orbital mission might include launch, stage separations, stage ignitions and payload landing or recovery. An orbital mission of an expendable launch vehicle (ELV) might include vehicle launch, multiple booster stage separations, stage ignitions, booster stage recovery, and payload insertion into orbit. (Note: The reentry of orbiting stages of an ELV is not a licensed activity and while vehicle orbiting st ages and payloads eventually reenter the Earth’s atmosphere they are not usually designed to survive reentry and most components burn up before reaching the Earth’s surface. Therefore public risk from ELV reentry stages is very small.) A mission involvi ng a reusable launch vehicle (RLV) might include launch vehicle takeoff, stage separation and ### Page 3 3 launch vehicle recovery, ascent of upper stages to orbit, payload separation, reentry of the vehicle upper stage from orbit and its recovery or landing. RLV miss ions may include contingency or emergency abort scenarios, use of alternate recovery sites or flight termination events. In order to explain the basic methodology, this advisory circular uses simplified examples. The number of possible events and inputs are selected to allow the reader to focus on the process, rather than on the large number of events and situations that may actually need to be considered, in performing a specific Ec analysis. Actual analyses are generally far more extensive, yet all utilize the basics described in this document. The methodology described here provides acceptable approaches. However, the user is cautioned that the applicant is responsible for demonstrating that the inputs to the formula and assumptions made are appropriate for the situation being addressed. Advisory Circular 431.35 -2, Reusable Launch Vehicle System Safety Process, provides guidance on the types of analyses which would support the development of some of the data, such as failure modes, used in the calcula tion of Ec. 3.1 Overview of Expected Casualty . Risk is defined by the safety community as the product of the probability of occurrence of an event and the consequences of that event. If there is more than one possible event, total risk is the sum over all possible events of the products of the probability of each event and its associated consequence. While the probability of an event is always between zero and one, the consequences of that event can be any value. For risk, the larger the value the gr eater the risk. Risk can be relatively high if the probability is high and can be high if the consequence is great even if the probability is low. Risk can be lowered by reducing the probability of an event occurring or by reducing the consequences of an event. For example, a highly reliable system will increase the probability of success and lower risk. Planning a mission that avoids flight operations over populated areas will decrease or eliminate consequences of human casualties and thereby reduce the risk measure of Ec. Expected casualty for a mission measures the public safety risk of conducting the mission and includes all ### Page 4 4 contributions to risk as a result of the mission. Ec is expressed as the summation over the mission of the products of th e probability of each possible event and the casualty consequences of each possible event. Casualty consequence is expressed as the product of the casualty area of debris (see 3.2.2) and the population density of the area at risk. The basic equation is: n Ec = S Pi x Aci x Dpi i=1 where: n = the number of possible different events, Pi = probability of occurrence of the i th event, Aci = the casualty area of impacting debri s for the i th event, and Dpi = the population density of the area at risk for the i th event. Ec is the sum of the expected casualties calculated for each possible mission event. Acceptable Ec is limited to thirty expected casualties per million missions (i.e., maximum Ec for a mission is less than .00003) for AST licensed missions. This standard reflects the FAA’s determination that the public will be protected from licensed commercial space missions such that risk confronting the public from a commercial space launch and reentry mission is significantly less than the average background risk experienced by the general public in daily activities. The 30 x 10 -6 risk level is consistent with launch standards curre ntly used at federal ranges (reference: Eastern and Western Range 127 -1 Range Safety Requirements, Sec. 1.4(d), March 31, 1995). In order to compare expected casualty with voluntary annual individual risk, the expected casualty, which is a collective ris k, must be converted to annual individual risk. For example, a collective risk of 30 x 10 -6 for a defined population of one hundred thousand people exposed to a single launch results in a probability of injury or death to a single exposed individual of 3 x 10-10. If there were one hundred launches per year, annual individual risk would be 3 x 10 -8. The U.S. annual individual probability of fatality due to a non - ### Page 5 5 occupational accident has been estimated as 2 x 10 -4 (reference: Report No. 97/350 -2.1-01, Acceptable Risk Criteria for Launches from National Ranges: Rationale, ACTA, for the Department of the Air Force, 30 th and 45th Space Wings, September, 30, 1997). For the same defined population of one hundred thousand, there would be .003 casualties from c ommercial space operations and 20.0 fatalities from non -occupational accidents expected per year. Thus, the risk to the public from commercial space operations is several orders of magnitude less than the risk of fatality from accidents. It is noted that expected casualty is defined as a fatality or serious injury while the comparison statistics measure fatalities only. Inputs to the Ec analysis should consider all reasonable mission scenarios that may result in a public casualty. An Ec value of 30 x 1 0-6 (or .00003) reflects an upper limit on allowable expected casualties. Because of this, the applicant need only demonstrate that the true value of Ec is less than the threshold and need not necessarily determine the precise value of Ec. Therefore, use of conservative assumptions with respect to the calculation inputs will ensure that Ec limitations are not exceeded. The system safety process used to identify and manage risk and the Ec methodology work together to achieve a level of safety. The syst em safety process is used to identify failure modes, their probability of occurrence (Pi) and associated consequences of commercial space missions. The system safety process (see Advisory Circular AC 431 -01), as illustrated in the following chart, will ev aluate risk to the public from planned trajectories and sequence of events as well as unplanned variances to the nominal mission. These factors are critical to the determination of risk and Ec. If risk is too large additional mitigation measures will be necessary to achieve safety. ### Page 6 Under the Ec methodology, the vehicle breakup characteristics are identified and the casualty area ( Ac) calculated. Contributing factors to Ac include: human exposure to debris and the debris size, weight, velocity components, ballistic coefficients (weight/maximum cross - sectional area of a piece of debris), kinetic energy, impact, bounce, slide and fragmentation characteristics of that debris, as well as any explosive properties the debris might have. Finally population density (Dp) profiles for the areas at risk must be determined and factored into the expected casualty calculations. In summary, because risk is the product of probability and consequence, several options are available to the applicant that will enable compliance with the Ec limit of thirty casualties per million missions. Reducing the system probability of failure is normally achieved by a rigorous design, development and test process coupled with successful operational experience and continuous system improvement. Management planning for safety and reliability early in the development process will minimize the likelihood of various failure modes and thus reduce casualty expectations and provide enhanced operational flexibility. Reducing the conseque nces of mission or vehicle failure is most directly achieved by avoiding operations over or near populated areas. The applicant may be expected to implement additional risk reduction measures as needed to satisfy the Ec standard. These include but are no t limited to operational procedure changes, system redesign, material, software ### Page 7 7 and launch or recovery site changes. 3.2 Elements of E c. The following is a more detailed discussion of the meaning of each of the elements of the expected casualty calcula tion formula and provides an acceptable methodology as to how they are to be derived. 3.2.1 Probability of Failure . An applicant identifies mission scenarios and the failure modes that present risk to the public. Example: a vehicle loses guidance cont rol and breaks up during flight over a populated area. System safety engineering methods (See Advisory Circular 431.35-2), such as failure modes and effects and fault tree type analyses are used to determine which modes present a hazard to the public an d the probability ( Pi) of their occurrence. The probability calculations should account for all possible outcomes. That is, the sum of all probabilities for a mission must equal one. In the simplest terms; P(success) + P(failure) = 1.0. In this context , P(success) is associated with zero consequences (i.e., P(success) x 0.0 = 0.0), and a successful mission or successful mission abort will contribute nothing to the expected casualty calculations. On the other hand, P(failure) must usually be broken dow n by the nature of the failure (e.g., does vehicle break up or remain intact)and the location of the vehicle at the time of failure. For example, if the failure is an explosion soon after launch the amount of impacting debris may be at a maximum because t he bulk of the propellant has not been burned and early boost stages, if any, have not been safely jettisoned. This may be contrasted with an out of control ballistic reentry of a single stage vehicle with no propellant or hazardous material on board. Th e latter scenario would involve minimal debris generation. Also, the location along the flight path will determine the population at risk (see Section 3.2.3 Population Density) from any falling debris resulting from vehicle failure. This may be particula rly important when areas of drastically different homogeneous population density require separate assessments of the likelihood of events exposing each area. ### Page 8 8 For some vehicles, it may be appropriate to look at each second of flight, as each second may re sult in different amounts of debris and debris characteristics. The applicant may need to recognize that population characteristics of the debris footprint may change from second to second. It is also not unusual for there to be different possible failur e modes at the same time with separate probabilities of occurrence, each resulting in different debris characteristics (e.g., explosion or thrust failure). Here the applicant may have an opportunity to simplify the problem by assuming the total failure likelihood at each time step in the flight and the worst debris characteristics for all failure modes. Such an assumption would result in a conservative estimation of Ec. For other vehicles, particular points or events along the flight path may have great er likelihood of failure, such as stage separations or stage ignitions. Some vehicles may have systems intended to detect problems and take steps to avoid or mitigate the consequences. However, not all system failures may be detected and the consequences of some failures may not be mitigated even if detected. Thus the distribution of failure probability may be made up of a combination of distinct events and uniform distributions. Once again, all probabilities for failure events should add to the overall failure probability of the vehicle and the sum of all probabilities of all events (failures and success) should add to 1.0. Not all outcomes contribute to Ec. For example, a successful mission, a successful contingency abort or emergency abort that does not jeopardize public health or safety, and vehicle failure modes occurring during segments of flight over unpopulated areas do not contribute to casualty expectation. To illustrate the concept of probability of failure events as applied to commercial space operations, consider an extremely simple example: the launch of a two stage vehicle where a reusable second stage delivers a payload to orbit, reenters the atmosphere and performs a controlled landing at a remote site. In a nominal mission, the firs t stage is jettisoned over an unpopulated area five minutes after launch and the second stage attains orbit ten minutes later. Landing occurs 30 ### Page 9 9 minutes after reentry initiation. If an emergency develops during first stage boost, the vehicle has the capability to abort by jettisoning the first stage and returning the second stage to an alternate landing site. The second stage boost phase may also be aborted by terminating thrust and maneuvering to an alternate landing site or in some circumstances aborti ng to orbit. Extensive design and systems analyses have been performed as well as Failure Modes and Effects Analyses and Fault Tree Analyses as part of the Systems Safety Process (see AC 431.35-2). Based on these analyses and some empirical data, the veh icle has a 90% probability of success, a 9% probability of mission failure and a 1% probability of mission abort. Note that in this example successful mission aborts do not necessarily contribute to expected casualty and will therefore be treated separate ly. Assume that analysis and testing determined that the failure probability is distributed such that .05 of the failure probability is during the first stage boost, .03 is during second stage boost and .01 is during reentry. (Note: an example where ther e is a probability of failure on-orbit such that reentry is not or cannot be attempted is presented later in this document). If there is no indication of specific points or events in the mission (e.g., stage ignition) having a different probability of failure with respect to any other point of time in the mission, spreading the failure and abort probabilities uniformly over the mission yields: 3 P(failure) = Σ P(failure per event) i=1 = .05(first stage boost) + .03(second stage boost) + .01(reentry) = .09 P(abort) = .01 Breaking these down into one second intervals yields: Pf(1st stage) / sec ond = .05 / 300sec = 1.667 x 10 - 4/sec Pf(2nd stage) / second = .03 / 600sec = 0.5 x 10 -4/sec Pf(reentry) / second = .01 / 1800sec = 5.56 x 10 - ### Page 10 10 6/sec P(abort) / second = .01 / 2700sec = 3.70 x 10 -6/sec. Note that multiplying the time in each phase by its Pf and summing the product yields Pf = 0.09 for the 2700 second mission. Uniformly distributing the probability of failure over the 2700 seconds of the mission yields a probability of failure per second of: Pf(mission) / second = 0.09 / 2700sec = 0.33 x 10 - 4/sec. Note that in either case the total probability of failure over the 2700 second (45 minutes) mission is 0.09, and as noted earlier: P(total) = Ps(.9) + Pf(.09) + Pa(.01) = 1.0. In reality, probability of catastrophic failure may not be uniformly distributed during the flight and the analysis must consider the actual probability distribution over the mission. Normally the probability of failure is greater during periods of powered flight or discrete events such as stage ignition or separation. In these circumstances uniform distribution of failure probability is inappropriate . 3.2.2 Casualty Area . The next step is the determination of casualty a rea during each step of the mission. The Ac is the aggregate casualty area of each piece of debris created by a vehicle failure at a particular point on its trajectory. The casualty area for each piece of debris is the area within which 100 percent of th e unprotected population on the ground is assumed to be a casualty. Some debris will not cause casualties and therefore will not contribute to casualty area. For example fragments with low ballistic coefficients (small light pieces)or those with low kine tic energy (less than 58 ft -lb has been used) will not be expected to cause casualties. (Note: The effects of sheltering (e.g., people in structures etc.) typically reduce the number of casualties and can be examined. However, applying assumptions of thi s nature requires considerably more analysis and supporting documentation in order to ### Page 11 11 demonstrate that the treatment is appropriate.) The casualty area is based on the characteristics of the debris piece including its size, the path angle of its trajectory, impact explosion, skip, splatter, and bounce as well as the size of a person. Debris may be created by planned stage jettison operations, vehicle breakup due to aerodynamic overload, in flight explosion or other failure modes. The characteristics of d ebris at any given time in flight may also depend on the failure mode. Major factors in assessing debris hazards include: the number, weight and size of the fragments, where they will land, each impacting fragment’s energy and velocity vector; whether the fragment is inert or explosive. The first step in the determination of casualty area is a vehicle debris or breakup analysis. The analysis will provide debris lists for all potential failure modes throughout the course of the planned mission. These lists are intended to estimate the immediate post breakup environment of the malfunctioned vehicle, the fragment characteristics over time through impact and the public safety risk resulting from the fragments upon impact. Factors to be considered in the br eakup analysis typically include, but may not be limited to: (1) Casualty area from debris, explosive forces and other hazards of impact of the intact vehicle versus failure time where breakup is a possible failure mode; (2) Fragments and compo nents (inert and explosive) produced upon vehicle breakup that impact the Earth due to each failure mode. (Fragments may be categorized into classes, so that the hazards associated with the “mean” piece in each class adequately represent the hazards for every piece in the class. The number of pieces in the class and “mean” piece should be identified.); (3) Quantities of confined and unconfined propellant chunks and fueled components that will impact, as a function of vehicle malfunction time, and; (4) Probability and TNT equivalency of impact explosions and numbers of fragments projected from each vehicle failure mode, as function of vehicle time into flight the malfunction (failure mode) occurs. These types of breakup analyses have been common practice in the launch vehicle industry and are based upon prior experience, empirical data, structural analysis, system safety methodologies and engineering judgment. The applicant should ensure that the major portion of the ### Page 12 12 vehicle by mass has been acc ounted for. As mentioned above, not all fragments will contribute to casualty area. Pieces with low kinetic energy, pieces with low ballistic coefficients and pieces of propellant that burn or vaporize before impact would not be likely to cause a casualty. 3.2.2.1 Inert Debris . The casualty area of a vertically falling inert piece of debris is a circle whose radius is the sum of the radius of a circle with area equal to the largest cross sectional area of the piece and the radius of a human being (1. 0 ft). This is illustrated in figure 1. Note that for Ac calculations, an acceptable dimension for a human is a 6 ft tall cylinder with a 1 ft radius. To this, add the effects of any horizontal velocity component (such as wind or trajectory angles) to calculate the basic casualty area. The equation for basic casualty area is: Ac(basic) = 2[r(p) + r(f)]d + π[r(p) + r(f)] 2 Where: r(p) = radius of person (1 ft) r(f) = radius of the fragment d = (height of person (6 ft)) / ta ngent(impact ### Page 13 13 angle) The basic casualty area is illustrated in figure 2. Note that ‘d’ is the horizontal distance that the debris travels as it falls the height of a person (6 ft) and the impact angle is the angle that the velocity vector makes with the horizontal plane or surface impacted. Adjustments to account for other effects that may increase casualty area would then be made. Among the effects to be considered are: area increases due to the impacting debris tendency to slide, skid, bounce, ricochet or splatter. Pieces of debris may slide or skid after impact adding to the casualty area as a function of horizontal velocity and the coefficient of friction of the impacted surface. Debris that remains essentially intact may bounce or ricochet along the impacted surface and also add to effective casualty area. If an inert vehicle piece or component impacts an open area, piece fragments or chunks of the impacted surface may be forcefully projected from the point of impact. For high velocity impacts o n hard surfaces such as rock or concrete, fragments and surface chunks may be thrown considerable distances. These effects are mutually exclusive so the conservative approach is to add the ### Page 14 14 largest increase to the basic casualty area to determine the composite casualty area for each piece of debris. Reference "Casualty Areas from Impacting Inert Debris for People in the Open", Research Triangle Institute Report No. RTI/5180/60 -31F dated April 13, 1995, for a procedure to calculate composite casualty area as well as sample casualty area calculations for existing launch vehicles. This report is available on AST’s Web Site. Previous analysis of various launch vehicles shows that the effective casualty area of an inert piece of debris represents an increase by a factor of from 1.7 to 7.0 over basic casualty area when the effects of slide, bounce and splatter are accounted for. Originally, basic casualty area was multiplied by 1.5 in order to account for bounce, skip and splatter. Currently used calculation me thods give effective casualty areas that range from 3.0 to 7.0 times greater that the basic casualty area. Therefore, a simple and conservative approach in the calculation of the inert portion of Ac is to apply a factor of 7.0 to the basic casualty area. 3.2.2.2 Explosive Debris . If the debris may explode on impact, equations can be used to calculate effective casualty areas based upon equivalent TNT yields. To account for explosive contributions to casualty area, the propellant or hazardous material is converted to equivalent weight of TNT. An acceptable assumption for the purposes of Ec calculation is a blast overpressure threshold of 3.5 pounds per square inch. A 3.5 psi overpressure will result in eardrum damage to 1% of exposed (unprotected) po pulation. Overpressures as low as 0.5 psi may cause glass breakage that results in casualties to building occupants. The radius of the explosive debris casualty area is expressed as an equation of the form: D = K x W1/3 Where: D is the distance (ft), K is a distance scaling factor (ft/lb 1/3), and W is the net equivalent weight of TNT (lb). The factor K is derived from scaling laws (reference: Chemical Propulsion Information Agency Publicat ion 394, Hazards of Chemical Rockets and Propellants, June 30, 1985). If D 1 is the distance from a reference explosion ### Page 15 15 of W1 lb of material at which a specified overpressure is found, then for any explosion of W lb of the same material, the same overpress ure will occur at a distance D such that: D/D1 = (W/W1)1/3. The distance scaling factor K is defined as K = D/W1/3 (ft/lb1/3). W is the TNT equivalent weight and D is the distance from the center of the explosion at which a specific overpressure occurs . In this methodology, the equivalent weight of a particular explosive/propellant is the weight of TNT required to produce an overpressure of equal magnitude produced by a unit weight of the explosive/propellant in question. Acceptable K factors may be obtained from DOD 6055.9 -STD, DOD Ammunition and Explosive Safety Standards, August, 1997 or from CPIA Publication 394, Hazards of Chemical Rockets and Propellants, June 30, 1985. The explosive equivalent range for credible TNT yields varies from 5 to 50 % for LH2/LOX and 18 to 100% for solid rocket motors (reference: Hazard Analysis of Commercial Space Transportation, OCST -RD-RES01-88, May, 1988). Note that the lower bound for these yields is zero since the propellants may react or burn without producing casualties. Acceptable measures of equivalent TNT explosive yields for various propellants may be obtained from such sources as: Farber, E.A. and J.H. Deese, A Systematic approach for the Analytical Analysis and Prediction of the Yield from Liquid Propellant Explosions, Tech. Paper 347, Engineering Progress At the University of Florida, March 3, 1966, Kinsel, T.I., Determination of the TNT equivalency of a Typical Class 1.1 Solid Rocket Propellant (Blast Hazards), AFRPL -TR-80-24, April, 1980, DOD 6055.9-STD, DOD Ammunition and Explosives Safety Standards, August 1997, and ### Page 16 16 Chemical Propulsion Information Agency Publication 394, Hazards of Chemical Rockets and Propellants, June 30, 1985. 3.2.2.3 Total A c. The contributions of explosive debris to casualty area are added to the casualty area attributed to inert debris to determine effective casualty area Ac. A conservative calculation for Ac would utilize the factor of 7.0 applied to the inert debris basic casualty area in addition to assuming the maxim um explosive casualty area for each phase of the mission. Conservatively, the effective casualty area may be calculated as: Aci = 7.0 x Aci(inert) + Aci(explosive). Note: The summation of each casualty area of each contributor to inert and explosive deb ris is a conservative approach in that it is assumed that no individual debris casualty areas overlap. In actuality, individual areas may overlap, thus reducing the total effective casualty area. A piece of debris is either inert or explosive. If a frag ment could be either, the larger area should be used. 3.2.2.4 Example A c calculations . Ac may decrease as the mission progresses due to propellant consumption, stage separations and payload deliveries. Some vehicles may have large effective casualty are as during the early (low altitude) launch phase when inert and explosive debris contributions are accounted for; while explosive forces at a sufficiently high altitude of liquid fueled vehicles are not an issue other than that they cause breakup and generate debris. A reentry vehicle may not have any explosive material remaining that would impact after a breakup event and the entire Ac may be composed entirely of inert debris. Also the number of fragments of debris will depend on the failure mode and the time or phase in the mission. It may range from a handful of large pieces from a loss of thrust or aerodynamic breakup to several thousand pieces resulting from explosion. As an example, typical multistage expendable launch vehicle casualty areas range f rom 11,000 ft 2 to 20,000 ft 2 during the launch phase and from 500 ft 2 to 2000 ft2 during the late ascent phase. Likewise the number of fragments may range from a few to several thousand (Reference USDOT Office of Commercial Space Transportation, "Baseline Assessment ### Page 17 17 Eastern Space and Missile Center (ESMC)" September, 1988). The following provides a simple example of an acceptable Ac calculation: A two stage to orbit vehicle breaks up into five inert pieces having basic casualty areas of 10, 30, 50, 80 and 100 ft2; and three impacting explosive pieces of 2, 16 and 54 lbs. Assuming that the TNT equivalency of the explosive pieces is 50%, the TNT equivalent weights are 1, 8 and 27 lbs respectively. Assuming that the debris falls vertically, the basic casualty area of the inert debris is equivalent to the sum of the basic casualty areas of the inert pieces. Therefore: Ac(inert) = 10.+30.+50.+80.+100. = 270 ft 2. The casualty area is calculated for each explosive piece. Ac(explosive) = πD2 D = KW1/3 and K is 18 for a 3.5 psi overpressure level which would harm an exposed person (reference: DOD Ammunition and Explosives Safety Standards, DOD 6055.9 - STD, August, 1997). The explosive radii are: D 1 = 18 x (1)1/3 = 18 ft D2 = 18 x (8)1/3 = 36 ft D 3 = 18 x (27) 1/3 = 54 ft, and A c(explosive) = π x (182 +362 +542) = 3.14 x 4536. = 14243 ft 2, and The basic casua lty area of the inert debris is multiplied by 7.0, to conservatively account for slide, bounce and scatter and then added to the casualty area from the explosive debris. The total casualty area is: Ac(total) = 7.0 x Ac(inert) + Ac(explosive) = 7.0 x (270) ft 2 + 14243 ft2 = 1890 ft 2 + 14243 ft2 = 16133 ft 2. Assuming the first stage is successfully separated and the second stage fails, breaking into four inert pieces ### Page 18 18 with maximum cross -sectional areas having equivalent circular radii of 1, 3, 5 and 10 ft, the inert basic casualty area is: Ac(inert) = π(1 + 1)2 + π(1 + 3)2 + π(1 + 5)2 + π(1 + 10)2 = π(4 + 16 + 36 + 121) = 556 ft 2. Applying the 7.0 factor to conservatively account for bounce, skip and splatter, the inert casualty area is: Ac = 7 X 556 ft 2 = 3892 ft2. An applicant would be responsible for identification of debris characteristics and the calculation of Ac for each failure mode and time in the mission. Once again, a conservative approach to Ac calculation is to apply a factor of seven to the basic casualty area of inert debris and to add the maximum explosive co ntribution for the vehicle over each mission segment. The applicant may make further refinements to the Ac determinations as design, test and operational data allow. 3.2.3 Population Density . As noted in section 3.1, population density in the affected i mpact area is required to calculate Ec. After the launch and reentry trajectory are determined for each mission, those areas that can be affected by impacting debris for the all the failure modes and time of occurrence are identified. The population dens ities exposed in these areas are determined. Acceptable measure of population density areas used to perform the Ec analysis is no larger than a U.S. census block group for the first 100 nautical miles from a launch point and no bigger than a 1 degree latitude by 1 degree longitude grid beyond 100 nautical miles downrange. If there are different population concentrations among a number of areas, it is acceptable to assume that the entire larger area has the highest population density within that area. Thi s approach is conservative because it will overestimate the expected casualty while reducing the number of individual calculations needed. Because it is very conservative, the applicant may decide to refine the approach (e.g., divide any populated area in to smaller areas and determine the probability for each) in order to meet Ec ### Page 19 19 limitations if the simplified approach yields a value in excess of the Ec threshold. Sheltering of the population may also be a factor but is not considered in this advisory circ ular, as noted previously. However, any attempt by the applicant to address sheltering will be considered on a case -by-case basis. As an example, assume that the vehicle flies for 2 seconds of dwell time over a desert area that includes .02 seconds of d well time over a city within the area. The desert population density is 5 people per square mile and the city has 10,000 people per square mile. The conservative approach is to assume that the entire 2 seconds is flown over an area with 10,000 people per square mile. The consequence for this 2 second segment of flight is the product of the casualty area and the population density. For a vehicle casualty area of 3892 square feet, from the previous example, the expected casualty of a failure in the area w ith a population of 10,000 people per square mile is: E ci = Pi x Aci x Dpi = Pi x (3892/(5280 x 5280)) x 10000 = 1.3961 x Pi. A more complicated and less conservative refinement might be to proportion the flight segment according to dwell time over each area of homogeneous population density. The result is an expected casualty of: Eci = Pi x Aci x [(1.98/2.0) x 5 + (.02/2.0) x 10000] = Pi x (3892/(5280 x 5280)) x [.99 x 5 + .01 x 10000] = Pi x .0001396 x 104.95 = 0.01465 x Pi. The examples presented assume the vehicle and its instantaneous impact point footprint fly a precise trajectory and ground track respectively. However, this is not likely to be the case. Veh icles typically may deviate from the planned flight path, thus the population area exposed may depend on the variance of the vehicle’s position relative to the planned trajectory. Calculations of the probability of debris impact on populated areas are bas ed on statistical treatment of trajectory downrange and cross -range dispersions. For a ### Page 20 20 normal distribution these equations may take the form of: Pi = Pi x Px x Py. Where the equations for Px and Py are: The x and y values are depicted in figure 3. Figure 3. This level of fidelity is beyond the scope of this advisory circular but is presented to illustrate the level of complexity that should be addressed during the Ec ### Page 21 21 determination process. Population density data may be obtained from publishe d sources such as the U.S. Census Bureau, The United Nations FAO Yearbook, the Guinness World Data Book, the Rand McNally World Atlas and The Carbon Dioxide Information Analysis Center, Oak Ridge National Laboratory Global Population Distribution Database. To demonstrate the sensitivity of expected casualty ( Eci = Aci x Dpi) to changes in Dpi, consider that if a vehicle with an Aci of 1000 square feet impacts an area with Dpi of 1.0 person per square mile, the expected casualty is .000036 for an impact i n that area. Likewise an area with a population density of 100 people per square mile has an Eci of .0036 and an area with a density of 5000 people per square mile has an Eci of 0.18. To put this in perspective, New York City has an Eci of .853 with 23,7 00 people per square mile, Houston, Texas has an Eci of .108 with Dp of 3,000 and Jacksonville, Florida has an Eci of .029 with Dp equal to 800. 3.3 Example Calculations of E c. As a simple example of an Ec calculation, assume a mission where a vehicle launches from a moderately populated coastal area, enters orbit, reenters and lands in a sparsely populated desert. The time to orbit is 15 minutes. During the first five minutes of flight, any debris would impact on land and for the remaining time to or bit, the debris would impact in the ocean. The reentry time from orbit to landing is 35 minutes with the final 5 minutes over sparsely populated desert (the time in orbit does not contribute to Ec). Ac for the launch segment over land is 16,133 square feet, 3,892 square feet for the over water segment and 500 square feet for the orbit and reentry segments. The decrease is due to fuel burn, stage separation and payload release. There is a city in the first segment overflight corridor with a Dp of 600 people per square mile. Conservatively, assume that the population density for the launch segment over land is 600 people per square mile. The Dp is zero for the ocean and on orbit segments. There is a small populated area in the desert with a density of 1 00 people per square mile and this density is assumed to apply over the entire overland mission segment. The mission probability of failure is .05 during the first five minutes, .02 for the remainder of the ascent phase, .01 in orbit (i.e., failure to ree nter) ### Page 22 22 and .02 during reentry. The probability of a successful mission is .85 and the probability of abort during ascent is .05 (assumed to be successful, i.e., no casualties).Therefore the total probability of all identified events totals to 1.0 indicatin g that all possibilities for the mission are accounted for: Σ Pi = .85 + .05 + .05 + .02 + .01 + .02 = 1.0. The expected casualty for the mission is: E c = S Pi x Ai x Di = (.85) x 0 + (.05) x 0 + (.05) x 16133 x 600/(5280)(5280) + (.02) x 3892 x 0 + (.01) x 500 x 0 + (.02)(30/35) x 500 x 0 + (.02)(5/35) x 500 x 100/(5280)(5280) = 0 + 0 + .01736 + 0 + 0 + 0 +.000005 = .01737 The mission does not meet the allowable Ec of .00003 using conservative assumptions. Adding some measure of fidelity to these assumptions demonstrates the following: If the vehicle impact are a is only over the city for the last 2 seconds of the over land launch segment and the rest of the segment is unpopulated, the probability of failure over the city becomes (.05)(2/300). Also, the effective casualty area drops to 3892 square feet due to propellant burn -off. Likewise the overland reentry segment is only over the populated area for 10 seconds and the probability of impact becomes (.02)(10/300)(5/35). Therefore: Ec = (.85) x 0 + (.05) x 0 +(.05)(298/300) x 16133 x 0 ### Page 23 23 + (.05)(2/300) x 3892 x 600/(5280)(5280) + (.02) x 3892 x 0 + (.01) x 500 x 0 + (.02)(30/35) x 500 x 0 + (.02)(290/300)(5/35) x 500 x 0 + (.02)(10/300)(5/35) x 500 x 100/(5280)(5280) = 0 + 0 + 0 + .0000279 + 0 + 0 + 0 + 0 + .0000002 = .0000281 This is less than the allowable expected casualty value. This example demonstrates how a simple refinement to a conservative Ec calculation process may produce acceptable results. As a special example of expected casualty analysis, assume that an applicant wants to define a mission that will satisfy the requirement for an unproven reusable launch vehicle. Failure is assume d impacting in each exposed populated area along its flight. Given that failure is assumed (probability = 1.0) and that the effective casualty areas are defined by the vehicle design, the applicant must solve for allowable population densities that meet t he threshold value of expected casualty (i.e., Ec is less than 30 X 10 -6) throughout the mission. Assume a two stage to orbit vehicle with the second stage reentering after payload insertion. The maximum casualty areas have been calculated to be 16,133 f t2 during the launch stage, 3,892 ft 2 during the second stage to orbit phase, and 500 ft 2 during the reentry phase. From the risk equation for each phase: Eci = Pi x Aci x Dpi. The solution for allowable population density for each phase becomes: ### Page 24 24 Dpi = Eci / (Pi x Aci). With a failure probability of 1.0, the allowable population densities are: Dp(launch) = (30. X 10 -6) / 16133ft2/(5280ft/mi) 2 = .0519 people/mi 2 Dp(2nd stage) = (30. X 10 -6) / 3892ft2/(5280ft/mi) 2 = .2149 people/mi 2 Dp(reentry) = (30. X 10 -6) / 500ft2/(5280ft/mi) 2 = 1.6727 people/mi 2 Therefore a mission using an unproven vehicle must be planned to avoid overflight of areas with population densities greater than those calculated in this example. 3.4 Summary. In the calculation of public risk ( Ec), each failure mode, its probability and its consequence must be evaluated to ensure that the 30 x 10 -6 expected casualty threshold for the total mission is not exceeded. An applicant may elect to simplify the Ec analysis by making conservative assumptions that lead to an overestimation of Ec. These assumptions might include: (1) Conservative or worst case assignments of probability to the failure mod es, (2) Applying a factor of 7.0 to the basic casualty area from inert debris, (3) Applying the maximum casualty area from explosive debris for each phase of flight over the entire phase, and (4) Applying the population density of a segment within a flight corridor over a larger area having actual population densities equal to or less than this segment. An applicant may apply refinements that lead to “higher fidelity” expected casualty values in order to meet expected public safety thresholds. These ana lyses will be evaluated on a case -by-case basis to validate assumptions used. Using an acceptable methodology, such as that detailed in this Advisory Circular, an applicant would be required to demonstrate that the Ec for a proposed mission is equal to ### Page 25 25 or less than the acceptable expected casualty threshold, not the exact value for Ec. Hence, an applicant may begin the risk management process using conservative assumptions and mitigate risks during the vehicle design, development, test and operational mi ssion planning process to ensure that public safety considerations are satisfied. Original Signed by: Patricia Grace Smith Associate Administrator for Commercial Space Transportation --- OpenAirDocs.org is an independent research project of [Contrail Labs](https://contraillabs.com/). It is not affiliated with the FAA or the NTSB. Source documents are U.S. government works in the public domain.