AC 431.35-1

Subject: EXPECTED CASUALTY CALCULATIONS

FOR COMMERCIAL SPACE LAUNCH AND

REENTRY MISSIONS Date: August 30, 2000 Initiated By: AST-1 AC No: 431.35-1 Change:

1. PURPOSE. This advisory circular provides an acceptable methodology for estimating the val ue, or upper limit of the value, of Expected Casualty Ec for commercial space launch and reentry missions.

2. BACKGROUND. The FAA Office of the Associate Administrator for Commercial Space Transportation (AST) is responsible for licensing commercial sp ace launch and reentry (return from Earth orbit or outer space) operations. A principal objective of the licensing process is to limit risk to public health and safety, and safety of property, and to protect national security and foreign policy interests o f the United States. Sections 415, 431 and 435 establish that, to be eligible for licensing, the launch of a launch vehicle (415.35(a)), the launch and reentry of a reusable launch vehicle

(431.35(b)), or the reentry of a reentry mission (435.35) shall not exceed an expected average number of 0.00003 casualties per mission ( Ec < 30 X 10-6). The purpose of the requirement is to ensure that risks to public safety presented by launch and reentry operations is limited to an acceptable level, defined in a mann er consistent with acceptable launch risk at national ranges administered by the Air Force.

In summary, a license applicant is in compliance with sections 415.35(a), 431.35(b) or 435.35 if its expected casualty calculation utilizes the methodologies and procedures detailed in this advisory and yields an Ec of less than or equal to 0.00003. For further information:

Ronald Gress, Manager, Licensing and Safety Division,

(202) 267-8602.

3. DISCUSSION. Expected casualty is used in the space transportation industry as a measure of risk to public safety from a specific mission, and is one of the factors typically used within the U.S. Government to determine if a mission may proceed or a license may be granted.

Expected casualty is the expected average number of human casualties per commercial space mission. Human casualty is defined as a fatality or serious injury. For the purpose of this advisory circular, a human casualty is considered to be any human contact with a piece of vehicle debris that can cause injury or exposure to explosive overpressure of 3.5 pounds per square inch (psi) or greater. Note: 3.5 psi is the level that will cause eardrum damage to 1% of the exposed population.

Reference DOD 6055.9 -STD, DOD Ammunition and Explosive Safety Standards, August, 1997. Another way of expressing the measure of expected casualty is that if thousands of identical missions were conducted and all the casualties that resulted were added up and the sum divided by the number of missions, the actual casu alties and the expected casualties per mission should ideally be the same.

For the purpose of this advisory circular, a mission includes all licensed flight segments throughout the mission. If there are activities that occur on orbit that are not condu cted under a license, these segments, or phases, are not included in the mission. For example, a sub-orbital mission might include launch, stage separations, stage ignitions and payload landing or recovery. An orbital mission of an expendable launch vehicle (ELV) might include vehicle launch, multiple booster stage separations, stage ignitions, booster stage recovery, and payload insertion into orbit. (Note: The reentry of orbiting stages of an ELV is not a licensed activity and while vehicle orbiting st ages and payloads eventually reenter the Earth’s atmosphere they are not usually designed to survive reentry and most components burn up before reaching the Earth’s surface. Therefore public risk from ELV reentry stages is very small.) A mission involvi ng a reusable launch vehicle (RLV) might include launch vehicle takeoff, stage separation and

3 launch vehicle recovery, ascent of upper stages to orbit, payload separation, reentry of the vehicle upper stage from orbit and its recovery or landing. RLV miss ions may include contingency or emergency abort scenarios, use of alternate recovery sites or flight termination events.

In order to explain the basic methodology, this advisory circular uses simplified examples. The number of possible events and inputs are selected to allow the reader to focus on the process, rather than on the large number of events and situations that may actually need to be considered, in performing a specific Ec analysis.

Actual analyses are generally far more extensive, yet all utilize the basics described in this document.

The methodology described here provides acceptable approaches. However, the user is cautioned that the applicant is responsible for demonstrating that the inputs to the formula and assumptions made are appropriate for the situation being addressed. Advisory Circular 431.35 -2, Reusable Launch Vehicle System Safety Process, provides guidance on the types of analyses which would support the development of some of the data, such as failure modes, used in the calcula tion of Ec.

3.1 Overview of Expected Casualty . Risk is defined by the safety community as the product of the probability of occurrence of an event and the consequences of that event. If there is more than one possible event, total risk is the sum over all possible events of the products of the probability of each event and its associated consequence. While the probability of an event is always between zero and one, the consequences of that event can be any value. For risk, the larger the value the gr eater the risk. Risk can be relatively high if the probability is high and can be high if the consequence is great even if the probability is low. Risk can be lowered by reducing the probability of an event occurring or by reducing the consequences of an event. For example, a highly reliable system will increase the probability of success and lower risk. Planning a mission that avoids flight operations over populated areas will decrease or eliminate consequences of human casualties and thereby reduce the risk measure of Ec.

Expected casualty for a mission measures the public safety risk of conducting the mission and includes all

4 contributions to risk as a result of the mission. Ec is expressed as the summation over the mission of the products of th e probability of each possible event and the casualty consequences of each possible event.

Casualty consequence is expressed as the product of the casualty area of debris (see 3.2.2) and the population density of the area at risk. The basic equation is:

n Ec = S Pi x Aci x Dpi i=1

where:

n = the number of possible different events, Pi = probability of occurrence of the i th event, Aci = the casualty area of impacting debri s for the i th event, and Dpi = the population density of the area at risk for the i th event.

Ec is the sum of the expected casualties calculated for each possible mission event. Acceptable Ec is limited to thirty expected casualties per million missions (i.e., maximum Ec for a mission is less than .00003) for AST licensed missions. This standard reflects the FAA’s determination that the public will be protected from licensed commercial space missions such that risk confronting the public from a commercial space launch and reentry mission is significantly less than the average background risk experienced by the general public in daily activities. The 30 x 10 -6 risk level is consistent with launch standards curre ntly used at federal ranges (reference: Eastern and Western Range 127 -1 Range Safety Requirements, Sec. 1.4(d), March 31, 1995).

In order to compare expected casualty with voluntary annual individual risk, the expected casualty, which is a collective ris k, must be converted to annual individual risk. For example, a collective risk of 30 x 10 -6 for a defined population of one hundred thousand people exposed to a single launch results in a probability of injury or death to a single exposed individual of 3 x 10-10. If there were one hundred launches per year, annual individual risk would be 3 x 10 -8. The U.S. annual individual probability of fatality due to a non -

5 occupational accident has been estimated as 2 x 10 -4 (reference: Report No. 97/350 -2.1-01, Acceptable Risk Criteria for Launches from National Ranges: Rationale, ACTA, for the Department of the Air Force, 30 th and 45th Space Wings, September, 30, 1997). For the same defined population of one hundred thousand, there would be .003 casualties from c ommercial space operations and 20.0 fatalities from non -occupational accidents expected per year. Thus, the risk to the public from commercial space operations is several orders of magnitude less than the risk of fatality from accidents. It is noted that expected casualty is defined as a fatality or serious injury while the comparison statistics measure fatalities only.

Inputs to the Ec analysis should consider all reasonable mission scenarios that may result in a public casualty.

An Ec value of 30 x 1 0-6 (or .00003) reflects an upper limit on allowable expected casualties. Because of this, the applicant need only demonstrate that the true value of Ec is less than the threshold and need not necessarily determine the precise value of Ec. Therefore, use of conservative assumptions with respect to the calculation inputs will ensure that Ec limitations are not exceeded.

The system safety process used to identify and manage risk and the Ec methodology work together to achieve a level of safety. The syst em safety process is used to identify failure modes, their probability of occurrence (Pi) and associated consequences of commercial space missions. The system safety process (see Advisory Circular AC 431 -01), as illustrated in the following chart, will ev aluate risk to the public from planned trajectories and sequence of events as well as unplanned variances to the nominal mission. These factors are critical to the determination of risk and Ec. If risk is too large additional mitigation measures will be necessary to achieve safety.

Under the Ec methodology, the vehicle breakup characteristics are identified and the casualty area ( Ac) calculated. Contributing factors to Ac include: human exposure to debris and the debris size, weight, velocity components, ballistic coefficients (weight/maximum cross - sectional area of a piece of debris), kinetic energy, impact, bounce, slide and fragmentation characteristics of that debris, as well as any explosive properties the debris might have.

Finally population density (Dp) profiles for the areas at risk must be determined and factored into the expected casualty calculations.

In summary, because risk is the product of probability and consequence, several options are available to the applicant that will enable compliance with the Ec limit of thirty casualties per million missions. Reducing the system probability of failure is normally achieved by a rigorous design, development and test process coupled with successful operational experience and continuous system improvement. Management planning for safety and reliability early in the development process will minimize the likelihood of various failure modes and thus reduce casualty expectations and provide enhanced operational flexibility. Reducing the conseque nces of mission or vehicle failure is most directly achieved by avoiding operations over or near populated areas. The applicant may be expected to implement additional risk reduction measures as needed to satisfy the Ec standard.

These include but are no t limited to operational procedure changes, system redesign, material, software

7 and launch or recovery site changes.

3.2 Elements of E c. The following is a more detailed discussion of the meaning of each of the elements of the expected casualty calcula tion formula and provides an acceptable methodology as to how they are to be derived.

3.2.1 Probability of Failure . An applicant identifies mission scenarios and the failure modes that present risk to the public.

Example: a vehicle loses guidance cont rol and breaks up during flight over a populated area.

System safety engineering methods (See Advisory Circular

431.35-2), such as failure modes and effects and fault tree type analyses are used to determine which modes present a hazard to the public an d the probability ( Pi) of their occurrence. The probability calculations should account for all possible outcomes. That is, the sum of all probabilities for a mission must equal one. In the simplest terms; P(success) + P(failure) = 1.0.

In this context , P(success) is associated with zero consequences (i.e., P(success) x 0.0 = 0.0), and a successful mission or successful mission abort will contribute nothing to the expected casualty calculations.

On the other hand, P(failure) must usually be broken dow n by the nature of the failure (e.g., does vehicle break up or remain intact)and the location of the vehicle at the time of failure. For example, if the failure is an explosion soon after launch the amount of impacting debris may be at a maximum because t he bulk of the propellant has not been burned and early boost stages, if any, have not been safely jettisoned. This may be contrasted with an out of control ballistic reentry of a single stage vehicle with no propellant or hazardous material on board. Th e latter scenario would involve minimal debris generation. Also, the location along the flight path will determine the population at risk (see Section 3.2.3 Population Density) from any falling debris resulting from vehicle failure.

This may be particula rly important when areas of drastically different homogeneous population density require separate assessments of the likelihood of events exposing each area.

8 For some vehicles, it may be appropriate to look at each second of flight, as each second may re sult in different amounts of debris and debris characteristics. The applicant may need to recognize that population characteristics of the debris footprint may change from second to second. It is also not unusual for there to be different possible failur e modes at the same time with separate probabilities of occurrence, each resulting in different debris characteristics (e.g., explosion or thrust failure). Here the applicant may have an opportunity to simplify the problem by assuming the total failure likelihood at each time step in the flight and the worst debris characteristics for all failure modes.

Such an assumption would result in a conservative estimation of Ec.

For other vehicles, particular points or events along the flight path may have great er likelihood of failure, such as stage separations or stage ignitions. Some vehicles may have systems intended to detect problems and take steps to avoid or mitigate the consequences. However, not all system failures may be detected and the consequences of some failures may not be mitigated even if detected. Thus the distribution of failure probability may be made up of a combination of distinct events and uniform distributions. Once again, all probabilities for failure events should add to the overall failure probability of the vehicle and the sum of all probabilities of all events (failures and success) should add to 1.0.

Not all outcomes contribute to Ec. For example, a successful mission, a successful contingency abort or emergency abort that does not jeopardize public health or safety, and vehicle failure modes occurring during segments of flight over unpopulated areas do not contribute to casualty expectation.

To illustrate the concept of probability of failure events as applied to commercial space operations, consider an extremely simple example: the launch of a two stage vehicle where a reusable second stage delivers a payload to orbit, reenters the atmosphere and performs a controlled landing at a remote site. In a nominal mission, the firs t stage is jettisoned over an unpopulated area five minutes after launch and the second stage attains orbit ten minutes later. Landing occurs 30

9 minutes after reentry initiation. If an emergency develops during first stage boost, the vehicle has the capability to abort by jettisoning the first stage and returning the second stage to an alternate landing site.

The second stage boost phase may also be aborted by terminating thrust and maneuvering to an alternate landing site or in some circumstances aborti ng to orbit.

Extensive design and systems analyses have been performed as well as Failure Modes and Effects Analyses and Fault Tree Analyses as part of the Systems Safety Process (see AC 431.35-2). Based on these analyses and some empirical data, the veh icle has a 90% probability of success, a 9% probability of mission failure and a 1% probability of mission abort. Note that in this example successful mission aborts do not necessarily contribute to expected casualty and will therefore be treated separate ly.

Assume that analysis and testing determined that the failure probability is distributed such that .05 of the failure probability is during the first stage boost, .03 is during second stage boost and .01 is during reentry.

(Note: an example where ther e is a probability of failure on-orbit such that reentry is not or cannot be attempted is presented later in this document). If there is no indication of specific points or events in the mission

(e.g., stage ignition) having a different probability of failure with respect to any other point of time in the mission, spreading the failure and abort probabilities uniformly over the mission yields:

3 P(failure) = Σ P(failure per event) i=1 = .05(first stage boost) + .03(second stage boost) + .01(reentry) = .09

P(abort) = .01

Breaking these down into one second intervals yields:

Pf(1st stage) / sec ond = .05 / 300sec = 1.667 x 10 - 4/sec

Pf(2nd stage) / second = .03 / 600sec = 0.5 x 10 -4/sec

Pf(reentry) / second = .01 / 1800sec = 5.56 x 10 -

10 6/sec

P(abort) / second = .01 / 2700sec = 3.70 x 10 -6/sec.

Note that multiplying the time in each phase by its Pf and summing the product yields Pf = 0.09 for the 2700 second mission.

Uniformly distributing the probability of failure over the 2700 seconds of the mission yields a probability of failure per second of:

Pf(mission) / second = 0.09 / 2700sec = 0.33 x 10 - 4/sec.

Note that in either case the total probability of failure over the 2700 second (45 minutes) mission is 0.09, and as noted earlier:

P(total) = Ps(.9) + Pf(.09) + Pa(.01) = 1.0.

In reality, probability of catastrophic failure may not be uniformly distributed during the flight and the analysis must consider the actual probability distribution over the mission. Normally the probability of failure is greater during periods of powered flight or discrete events such as stage ignition or separation. In these circumstances uniform distribution of failure probability is inappropriate .

3.2.2 Casualty Area . The next step is the determination of casualty a rea during each step of the mission. The Ac is the aggregate casualty area of each piece of debris created by a vehicle failure at a particular point on its trajectory. The casualty area for each piece of debris is the area within which 100 percent of th e unprotected population on the ground is assumed to be a casualty.

Some debris will not cause casualties and therefore will not contribute to casualty area. For example fragments with low ballistic coefficients (small light pieces)or those with low kine tic energy (less than 58 ft -lb has been used) will not be expected to cause casualties.

(Note: The effects of sheltering (e.g., people in structures etc.) typically reduce the number of casualties and can be examined. However, applying assumptions of thi s nature requires considerably more analysis and supporting documentation in order to

11 demonstrate that the treatment is appropriate.) The casualty area is based on the characteristics of the debris piece including its size, the path angle of its trajectory, impact explosion, skip, splatter, and bounce as well as the size of a person. Debris may be created by planned stage jettison operations, vehicle breakup due to aerodynamic overload, in flight explosion or other failure modes. The characteristics of d ebris at any given time in flight may also depend on the failure mode.

Major factors in assessing debris hazards include: the number, weight and size of the fragments, where they will land, each impacting fragment’s energy and velocity vector; whether the fragment is inert or explosive.

The first step in the determination of casualty area is a vehicle debris or breakup analysis. The analysis will provide debris lists for all potential failure modes throughout the course of the planned mission. These lists are intended to estimate the immediate post breakup environment of the malfunctioned vehicle, the fragment characteristics over time through impact and the public safety risk resulting from the fragments upon impact.

Factors to be considered in the br eakup analysis typically include, but may not be limited to:

(1) Casualty area from debris, explosive forces and other hazards of impact of the intact vehicle versus failure time where breakup is a possible failure mode;

(2) Fragments and compo nents (inert and explosive) produced upon vehicle breakup that impact the Earth due to each failure mode. (Fragments may be categorized into classes, so that the hazards associated with the “mean” piece in each class adequately represent the hazards for every piece in the class. The number of pieces in the class and “mean” piece should be identified.);

(3) Quantities of confined and unconfined propellant chunks and fueled components that will impact, as a function of vehicle malfunction time, and;

(4) Probability and TNT equivalency of impact explosions and numbers of fragments projected from each vehicle failure mode, as function of vehicle time into flight the malfunction (failure mode) occurs.

These types of breakup analyses have been common practice in the launch vehicle industry and are based upon prior experience, empirical data, structural analysis, system safety methodologies and engineering judgment.

The applicant should ensure that the major portion of the

12 vehicle by mass has been acc ounted for. As mentioned above, not all fragments will contribute to casualty area. Pieces with low kinetic energy, pieces with low ballistic coefficients and pieces of propellant that burn or vaporize before impact would not be likely to cause a casualty.

3.2.2.1 Inert Debris . The casualty area of a vertically falling inert piece of debris is a circle whose radius is the sum of the radius of a circle with area equal to the largest cross sectional area of the piece and the radius of a human being (1. 0 ft). This is illustrated in figure

1. Note that for Ac calculations, an acceptable dimension for a human is a 6 ft tall cylinder with a 1 ft radius.

To this, add the effects of any horizontal velocity component (such as wind or trajectory angles) to calculate the basic casualty area. The equation for basic casualty area is:

Ac(basic) = 2[r(p) + r(f)]d + π[r(p) + r(f)] 2 Where: r(p) = radius of person (1 ft) r(f) = radius of the fragment d = (height of person (6 ft)) / ta ngent(impact