AC 431.35-3

Subject: LICENSING TEST FLIGHT

REUSABLE LAUNCH VEHICLE

MISSIONS Date: August 15, 2002 Initiated By: AST-1 AC No: 431.35-3 Change:

1. PURPOSE . This Advisory Circular (AC) demonstrates how existing federal regulations on obtaining a license to conduct a reusable launch vehicle (RLV) mission(s) may be used to obtain a license to conduct RLV missions for test flight purposes (referred to herein as test flight RLV missions) while an RLV is under development. Specifically, this document addresses how to obtain a license for test flights subject to RLV mission licensing under Title 14, Code of Federal Regulations, Part 431 (referred to herein as part

431). The methods and procedures described herein provide an acceptable approach to utilizing a risk analysis and system safety process for test flight RLV missions as required by 14 CFR § 431.35, and an acceptable approach to meeting environmental requirements for test flight RLV missions as required by 14 CFR § 431.93. Other approaches that fulfill regulatory requirements may also be employed.

2. REFERENCES . Commercial Space Transportation, Federal Aviation Administration, Department of Transportation, Title 14, Code of Federal Regulations, Part 413 and 431, as well as Advisory Circulars 413-1 (License Application Procedures),

431.35-1 (Expected Casualty Calculations for Commercial Space Launch and Reentry Missions), and 431.35-2 (Reusable Launch and Reentry Vehicles System Safety Process).

3. BACKGROUND . As the commercial space transportation industry develops RLV and/or reentry vehicle (RV) designs and enters into a development phase, the Federal Aviation Administration (FAA) expects that some vehicle development flight-testing will be necessary. Just as aviation flight-testing can be conducted under 14 CFR part 21 regulations pertaining to experimental aircraft certification, RLV missions that are test flights can be conducted under the commercial space transportation licensing procedures and requirements of part 431. Licenses that are granted under these regulations are granted by the FAA’s Office of the Associate Administrator for Commercial Space Transportation (AST). FAA licensing regulations for commercial space transportation protect the public health and safety, and safety of property, as well as national security and foreign policy interests of the United States. FAA licensing and regulatory requirements also are intended to ensure that international treaty obligations of the United States are not jeopardized. The FAA will apply the existing regulations consistent with the regulatory concerns of the FAA.

4. LICENSE APPLICABILITY :

a. General: Unlike most expendable launch vehicles (ELVs), RLVs may fly missions, especially during initial test flights, significantly below a vehicle’s maximum performance capabilities or the mission for which the vehicle was designed – its design reference mission.

This AC is intended to facilitate an applicant’s preparation of a license application and ability to obtain the various approvals required for an RLV mission license used for the purpose of conducting test flights. It must be noted that there is not a separate set of licensing regulations that pertain specifically to test flight RLV missions and there is no regulation that requires a vehicle to undergo test flights prior to a vehicle’s first design reference mission, whether suborbital or orbital.

Certain low-performance RLV missions that are test flights may fall under the FAA’s statutory authority to license the launch of a launch vehicle that is a suborbital rocket. (See 49 USC Subtitle IX, ch. 701.) Consistent with final rules governing RLV mission licensing, suborbital RLV missions are regulated under part 431. A test flight of an RLV that is a launch† as defined in 49 USC 70102(3) and 14 CFR § 401.5 is subject to licensing under part

431.

During these low-performance test flights, the performance of safety-critical RLV systems, subsystems and concepts can be validated. Safety-critical systems and subsystems are those whose performance can affect public safety. Reliable performance of safety-critical systems is especially significant during higher-performance RLV missions over populated areas. Data generated from licensed test flight RLV missions can be used as part of the process to remove or relieve additional restrictions placed on flight of unproven vehicles∗. The data from test flights can affect probabilities used in future flight risk analyses, thereby potentially increasing the likelihood of demonstrating acceptable risk for operations near or over populated areas.

† Launch means “to place or try to place a launch vehicle or reentry vehicle and any payload from Earth in a suborbital trajectory, in Earth orbit in outer space, or otherwise in outer space,...” 14 CFR § 401.5.

∗ It is important to remember that for any unproven vehicle (a category into which test vehicles certainly fall), FAA regulations require the use of a probability of failure equal to one in all Ec calculations at any time the vehicle’s Instantaneous Impact Point is over a populated area, as stated in 14 CFR § 431.43(d)(2).

b. RLV Concepts and Test Flights: Proposed RLV concepts are varied in both design and operation. The list includes single and multiple stage vehicles as well as concepts that use various combinations of vertical and horizontal takeoff and landing operations. This AC is geared toward a generic vehicle and does not assume any particular configuration. It is equally applicable to a test or series of tests of any single phase or combination of phases of flight during launch. Although an RLV may consist of multiple stages, this AC is pertinent to a test flight of any one of the stages by itself or any combination of stages tested together as long as the flight qualifies as an RLV mission. This document also provides an acceptable means of demonstrating compliance with certain requirements of part 431 in support of an application for a license to test a reusable stage that flies to a designated landing site as well as one that must be recovered. In other words, an RLV operator does not need to have a completed vehicle capable of delivering payloads to orbit or flying its design reference mission before it can apply for an RLV mission license to conduct test flights under the existing regulations provided the test flights qualify as RLV missions (i.e., the vehicle or concept qualifies as an RLV and the test flight is a launch of a launch vehicle).

c. Licenses: Two types of RLV mission licenses are available to an applicant as stated in 14 CFR § 431.3: a mission-specific license and an operator license. A mission-specific license authorizes a licensee to launch and reenter, or otherwise land, one model or type of RLV from a launch site to a reentry site or other location approved for the mission. The mission-specific license may authorize more than one RLV mission provided that each flight is identified and authorized in the license. An operator license authorizes a licensee to launch and reenter, or otherwise land, any of a designated family of RLVs within authorized parameters, including launch sites and trajectories, transporting specified classes of payloads to any reentry site or other location specified in the license. This AC demonstrates how a mission-specific license may be obtained for a defined series of test flight RLV missions.

5. LICENSING PROCESS:

a. General: The FAA does not issue licenses that are “test flight only.” Instead, the FAA bases licensing decisions on satisfactory demonstration that the operator can operate the vehicle in a safe manner, that is, such that the conduct of the licensed RLV mission will satisfy the requirements set forth in part 431. The procedure for obtaining a safety approval in support of a license to conduct a suborbital or orbital test flight RLV mission, under the scenarios presented in this AC, is a streamlined version of the basic procedure followed to obtain a design reference RLV mission license. In other words, an RLV operator would submit an application for a license that includes the necessary engineering data for a specific type of mission(s) to the FAA – the particular details of a specific mission(s) (vehicle performance, mission trajectory, launch location, etc.) can result in streamlined or tailored licensing requirements.

To successfully obtain a safety approval in support of an RLV mission license, an applicant must satisfy requirements of part 431, subpart C, including those for safety-critical systems.

As stated 14 CFR § 431.35, two principal requirements for obtaining an RLV mission license are: (i) meeting acceptable risk as measured by the expected casualty standard (Ec ≤ 30 x 10-6 for each mission); and (ii) employing a System Safety Process (SSP) to identify hazards and assess risks to public safety. As described below, these requirements can be tailored for test flight RLV missions that are confined to remote and sparsely populated areas. The result is a streamlined license application and licensing process.

b. Expected Casualty: Because Ec is the product of probability and consequence of failure, at least two approaches are available to the applicant to demonstrate compliance with the Ec limit (details on Ec calculations are available in AC 431.35-1).

The first is reducing the system probability of failure. This is normally achieved by a rigorous and robust design, development, and test process coupled with successful operational experience and continuous system improvement. Management planning for safety and reliability early in the development process will minimize the likelihood of various failure modes and thus reduce casualty expectations and provide enhanced operational flexibility. The second method is reducing the consequences of mission or vehicle failure. For an unproven vehicle with little or no operational history, satisfaction of the Ec criterion will most easily result from conducting initial test flight operations over uninhabited or sparsely populated locations due to the requirement for unproven vehicles to use a probability of failure equal to 1 when overflying populated areas.

Examples of such locations include uninhabited deserts or dry lakebeds as well as unused areas of the oceans or other bodies of water.

c. System Safety Process (SSP): The SSP demonstrates compliance with acceptable risk criteria of part 431, subpart C, by identifying and analyzing the probability and consequences of any reasonably foreseeable hazardous events and safety-critical system failures. To be in compliance with the SSP requirements, an applicant for an RLV mission license must use a systematic process to identify and describe all of the safetycritical systems and operations on board the vehicle as well as failure modes and their

5 consequences (details on the SSP are available in AC 431.35-2). To obtain a safety approval in support of a license to conduct test flight RLV missions in unpopulated areas, an applicant may utilize a simplified SSP, and satisfy 14 CFR § 431.35. Accordingly, an application for an RLV mission license to conduct test flight operations in unpopulated areas need only address systems that are safety-critical considering the remote location of the activity and containment of hazards. Specific requirements of the SSP that may be satisfied in a streamlined manner will be identified on a case-by-case basis to allow the review process to remain as flexible as possible.

(1) For the purposes of licensing RLV missions, a safety-critical system is one whose performance or reliability can affect public health, safety, and safety of property. It is in this step of identifying safety-critical systems that the safety review and licensing of a test flight RLV mission may differ in scope from the safety review conducted for a design reference mission due to fewer systems being deemed critical.

(2) Table 1 lists a representative group of safety-critical systems. It is by no means exhaustive but serves to provide an example of the types of systems that could impact the safety of a mission. Generally, all of the systems listed in Table 1 would be considered safety-critical in the conduct of an RLV mission. However, a determination of which systems are in fact safety-critical is completely mission dependent. Therefore, safety-critical systems on a RLV mission that passes over populated areas may differ from those safety-critical systems identified for a test flight RLV mission over unpopulated areas.

Table 1. Examples of Safety-Critical Systems for RLV Missions Involving Population Overflight

Structure/Integrity of Main Structure Thermal Protection System (TPS) Environmental Control (temperature, pressure, humidity) Propulsion: Main, Auxiliary, and Reentry Guidance Navigation & Control (GN&C), Safety-Critical Avionics (includes de-orbit targeting) Vehicle Health Monitoring Flight Safety System (FSS) Recovery and Landing Ordnance (other than Safety) Electrical and Power Telemetry, Tracking and Command Flight Control (ascent, separation, reentry) FSS Ground Support Equipment

(3) In order to clarify how the demonstration of safety-critical systems are mission dependent, a few examples are included below that detail some hypothetical test flight scenarios and identify systems that may be considered safety-critical given certain circumstances. The scenarios included here are examples for demonstration purposes only. They are not intended to represent any actual vehicle concepts, test plans, or test sites. They are intended solely to demonstrate that safety-critical systems are determined based on the details presented by a proposed RLV mission.

(a) Scenario #1 – Test Vehicle is Contained by Low-Performance: This scenario assumes that an RLV operator wants to perform a test flight RLV mission to test a scaled-down version of its Vertical Takeoff/Vertical Landing RLV. The proposed test flight RLV mission is to take place at a desert test site that is ‘Y’ miles from any population center.

i) Assume the test RLV is a scaled-down version of the planned fully operational vehicle with very limited performance. In fact, based on the weight, propellant capacity, and propulsion performance capabilities, the maximum downrange distance that the vehicle can travel based on the worst-case scenario is ‘Y/2’ miles. As a result, it is nearly impossible to endanger public safety assuming the appropriate notices and warnings are issued prior to the test. This would lead to the determination that none of the onboard systems likely would be considered safety-critical in this case.

ii) Examining Table 1, one sees that any one of the systems listed could fail and the hypothetical vehicle described in this scenario would not be able to harm the public. As a result, it may be possible to obtain a safety approval in support of a license to conduct flight-testing based on the performance calculations. In fact, it would be possible to obtain a safety approval for multiple test flight RLV missions authorized by a single license, as long as the vehicle is not altered in any way that would increase its range.

(b) Scenario #2 – Test Flight Restricted to Unpopulated Areas: This scenario assumes that an RLV operator wants to perform a test flight of a stage of its launch vehicle, that is a suborbital launch of an RLV, over a large body of water or over an area of land that is suitably unpopulated. Unlike the case presented in Scenario #1, this vehicle has the ability to leave the designated test area and reach populated areas.

i) Assuming that the operator issues the appropriate warnings to ships and aircraft that normally operate in the area, it is still possible to obtain an RLV mission license for this type of test. In this case, the vehicle has some safety-critical systems that must be addressed in the applicant’s SSP as required by 14 CFR § 431.35.

7 ii) The safety-critical systems in this example are those that could cause the vehicle to leave its designated test area and endanger public safety should they fail. As a result, the safety-critical systems are those that have to do with the guidance, navigation and control, and acceleration of the vehicle.

Specific systems could depend on whether the vehicle is piloted, controlled remotely or is autonomous.

(c) Scenario #3 – Crewed or Remotely Piloted Vehicles: In addition to demonstrating that all safety-critical on-board hardware and software meet the safety requirements of part 431, vehicles with crews or that are remotely piloted may need to consider human operators to be safety-critical.

i) In the case of a crewed vehicle, the vehicle designers may need to address the manner in which the vehicle will respond should any crew member become incapacitated.

ii) In the case of a remotely piloted vehicle, the designers may need to consider the effects of not only an incapacitated remote operator but also the effects of losing the data link between operator and vehicle. As a result, the safety-critical systems on a remotely piloted vehicle will include, among other things, the operator, the data link, the on-board flight computer and the operator’s ground computer.

For reference, Figure 1 illustrates how flight-testing in a sparsely populated area simplifies the process of demonstrating an acceptable SSP. At the top of the figure, several systems that would be classified as safety-critical for a flight over a population center are listed. Assuming Scenario #2 as described in the previous section, one sees that the number of safety-critical systems reduces to three as shown at the bottom right of the figure. The three remaining safety-critical systems are those that are required to keep the vehicle in the test area. This simplification results from moving the test away from any persons or property that could be damaged in a test failure.

8 Propulsion·Electrical Power·Primary Structure·Thermal Protection·Landing and Recovery·Payload·Flight Control Actuation·Facilities·Environmental Control· Flight Safety System·Ground Equipment·Reaction Control·Propellant Feed/ Pressurization·Pilot and Crew /Remote Operator·Telemetry, Tracking, and Command·Vehicle Health Monitoring/Management Flight Control Actuation Telemetry, Tracking, and Command Simplification for Flight Test Propulsion·Electrical Power·Primary Structure·Thermal Protection·Landing and Recovery·Payload·Flight Control Actuation·Facilities·Environmental Control· Flight Safety System·Ground Equipment·Reaction Control·Propellant Feed/ Pressurization·Pilot and Crew /Remote Operator·Telemetry, Tracking, and Command·Vehicle Health Monitoring/Management Flight Control Actuation Telemetry, Tracking, and Command Simplification for Flight Test Propulsion·Electrical Power·Primary Structure·Thermal Protection·Landing and Recovery·Payload·Flight Control Actuation·Facilities·Environmental Control· Flight Safety System·Ground Equipment·Reaction Control·Propellant Feed/ Pressurization·Pilot and Crew /Remote Operator·Telemetry, Tracking, and Command·Vehicle Health Monitoring/Management Flight Control Actuation Telemetry, Tracking, and Command Simplification for Flight Test Simplification for Flight Test Over Sparsely Populated Areas Propulsion

Figure 1. Defining Safety-critical Systems

d. Test Flight Plan: FAA regulations allow an applicant to apply for and receive a mission-specific license covering a number of defined RLV missions using one model or type of vehicle. Identified missions may therefore be authorized for flight in a single license. In an application for a license to conduct multiple flights, a formal test flight plan can be used to identify multiple missions for which the applicant seeks a license.

Minor alteration of the vehicle between test flights may be permissible under the terms of the license as long as the intended changes are specifically listed in the application and approved by the license. The FAA will grant a license for only those missions that meet the requirements set forth in the regulations and will only allow the flight of RLV missions that are authorized by the license.

Information contained in the test flight plan might include a summary of planned system ground tests and flight simulations that are to be completed before the first test flight RLV missions, test flight mission trajectories, specific test flight objectives, the approach to maintenance and/or refurbishment between tests flight missions, and milestones that will signal the vehicle’s readiness to proceed to the next level of flight-testing. In addition, laying out the planned progression from one test to the next with success criteria for each test may also help the FAA evaluate an application for future flights.

A single test flight plan may be submitted that outlines the entire flight-testing program for which the applicant seeks licensing. A detailed plan allows the FAA to provide

9 feedback and guidance concerning what it may require, based on test flight results, as a condition of the license such that authorized flights can continue to be conducted under the license without jeopardizing public health and safety and safety of property. The FAA may license a portion or all of an applicant’s submitted flight test plan.

e. Environmental Requirements: Commercial space activities to be licensed by the FAA require environmental review under the National Environmental Policy Act (NEPA). An environmental review/determination is an integral part of the FAA’s licensing process. Currently, the FAA requires the applicant to conduct the requisite environmental analysis and to prepare the basis for the FAA’s NEPA documentation.

Many people view the preparation of NEPA analyses and documentation as a lengthy and costly exercise, which requires a team of multi-disciplinary consultants. While this is sometimes the case, the actual complexity and cost of an environmental review depends in large part on the proposed project and its potential environmental impacts, as well as the amount of prior environmental documentation that may apply.

To assist the applicant, AST developed a NEPA tutorial which is available on AST’s website at http://ast.faa.gov/lrra/environmental/tutorial03.ppt and an AST NEPA Guidelines document titled Guidelines for Compliance with the National Environmental Policy Act and Related Environmental Review Statutes for Licensing of Commercial Launches and Launch Sites, which is available at http://ast.faa.gov/lrra/environmental/EPA5DKS.pdf. In addition to reviewing these resources, it is recommended that a potential applicant consult with AST as early as possible about their proposed activities.

The applicant may be able to tier from existing programmatic environmental assessments (EAs) or environmental impact statements (EISs). Programmatic environmental documents tend to be non site- or vehicle-specific and issues related to a particular site or vehicle would need to be addressed in the environmental documentation prepared to support the applicant’s proposed action. It may also be possible to incorporate by reference existing EAs or EISs for a launch site or launch vehicle. In some cases, the FAA may be able to adopt EAs or EISs developed by another Federal agency to support the applicant’s proposed launch activities and prepare appropriate Findings of No Significant Impact or Records of Decision to support a license determination. To adopt existing NEPA documentation as a means of complying with the environmental determination required to issue a license, the proposed action must be substantially the same as the action analyzed in the prior EA or EIS. For example, the proposed action might be substantially the same as actions proposed by the National Aeronautics and Space Administration (NASA) or the Department of Defense (DoD). However, if the proposed action includes an unproven vehicle to be launched from a site with no existing environmental documentation, incorporation by reference and adoption will not be a sufficient basis for making the environmental determination required for issuing a license.

Early consultation with AST is recommended to ensure that all elements of the environmental review/determination are met to support the licensing process. AST will

10 work closely with the applicant to complete the environmental review process while striving to avoid unnecessary paperwork and duplication.

6. SUMMARY:

a. The licensing process, and safety review specifically, for a test flight RLV mission may be streamlined for an applicant proposing flight exclusively (or nearly so) over unpopulated areas or within a limited range initially, and then gradually increasing the vehicle’s operating envelope as more data are gathered. By initially confining the vehicle to suitably sparsely populated locations, the actual proof of reliability of the test vehicle and its safety-critical systems in advance of flight may become less crucial to a licensing determination because removing the vehicle from populated areas significantly reduces risk of injury or property loss to the public. Based on the scenarios presented above, it is apparent that in certain situations an RLV operator can use a streamlined risk analysis, system safety process and environmental approach to qualify for an RLV mission license to operate an unproven vehicle and conduct multiple test flights. After flight-testing operations have generated sufficient data to verify reliable performance of the vehicle, including its safety-critical systems, the FAA may authorize RLV missions having an increased operational area of the vehicle and operating envelope, as long as the operator satisfies part 431 criteria for safety and other required approvals.

b. It is important to remember that the purpose of test flights typically is to gather data on systems that will become safety-critical later in the life cycle as the vehicle becomes fully operational. The fact that these systems will be safety-critical at some point in the vehicle’s life means that the vehicle designers and manufacturers need to have a comprehensive plan to identify what will and will not be safety-critical on the vehicle. Although FAA regulations do not explicitly require any test flights be performed, test flights enable an operator to test future mission safety-critical systems and gather data that can be used when determining probabilities for future mission Ec calculations. Data collection from these test flights may be used to substantiate the predicted performance of a vehicle and validate engineering analyses. This data can aid the FAA in issuing a safety approval for future vehicle operations near or over populated areas during design reference missions.

c. The methodology described in this AC provides an acceptable approach and is not the only avenue available for demonstrating compliance with part 431 requirements for RLV mission licensing of test flights. However, the reader is cautioned that the applicant is responsible for demonstrating that the inputs to its analyses and the assumptions made are appropriate for the situation under investigation. Advisory Circulars 431.35-1 and 431.35-2 provide guidance on the analyses and methodologies that support the development of some of the data used in the calculation of expected casualty (Ec). The limit of thirty expected casualties per million missions (Ec ≤ 30 x 10-6) for FAA-licensed RLV missions is a standard that reflects the FAA’s determination to protect the public from licensed commercial space missions. This standard ensures that

11 public risk from RLV missions is acceptable, as it is for expendable launch vehicle launches.