# AC 450.101-1B: High Consequence Event Protection - Type: Advisory circular (guidance, not mandatory unless a rule or AD requires it) - Status: Current - Approved: May 20, 2021 - Last reviewed: May 3, 2024 - This change: This Advisory Circular (AC) describes a method to demonstrate compliance with the high consequence event protection requirements of title 14 of the Code of Federal Regulations (14 CFR) § 450.101(c) and the requirements to evaluate the potential for high consequence events in uncontrolled areas in accordance with §§ 450.108(b) and 450.108(c)(4). This AC provides an acceptable means to demonstrate compliance with § 450.101(c)(2) and § 450.101(c)(3) and provides an acceptable means of compliance with conditional expected casualties requirements in § 450.108. This AC also provides guidance for an operator that chooses to propose an alternative method that produces an equivalent level of safety to the requirements in § 450.101(c)(2). Revision B deletes paragraph 13.3 and 13.5 and reassigns paragraph 13.4 as paragraph 13.3. - Family: AC 450.101-1 - Cancels: [450.101-1](https://openairdocs.org/ac/450.101-1), [450.101-1A](https://openairdocs.org/ac/450.101-1A) - Cancelled by: Revision B - 14 CFR parts: 450 - Pages: 30 - PDF: https://openairdocs.org/files/sha256/a5/e0/a5e037b567313983612c720c7a3985497dd414f47b1d833165fa0abf49ab5fb6 - FAA DRS: https://drs.faa.gov/browse/excelExternalWindow/DRSDOCID148168709620240506185149.0001 - DRS record last changed: November 21, 2025 - Page: https://openairdocs.org/ac/450.101-1 ## Versions - [AC 450.101-1B](https://openairdocs.org/ac/450.101-1) (Current), approved May 20, 2021, 30 pages. This Advisory Circular (AC) describes a method to demonstrate compliance with the high consequence event protection requirements of title 14 of the Code of Federal Regulations (14 CFR) § 450.101(c) and the requirements to evaluate the potential for high consequence events in uncontrolled areas in accordance with §§ 450.108(b) and 450.108(c)(4). This AC provides an acceptable means to demonstrate compliance with § 450.101(c)(2) and § 450.101(c)(3) and provides an acceptable means of compliance with conditional expected casualties requirements in § 450.108. This AC also provides guidance for an operator that chooses to propose an alternative method that produces an equivalent level of safety to the requirements in § 450.101(c)(2). Revision B deletes paragraph 13.3 and 13.5 and reassigns paragraph 13.4 as paragraph 13.3. - [AC 450.101-1A](https://openairdocs.org/ac/450.101-1A) (Historical), approved May 20, 2021, 30 pages. This Advisory Circular (AC) describes a method to demonstrate compliance with the high consequence event protection requirements of title 14 of the Code of Federal Regulations (14 CFR) § 450.101(c) and the requirements to evaluate the potential for high consequence events in uncontrolled areas in accordance with §§ 450.108(b) and 450.108(c)(4). This AC provides an acceptable means to demonstrate compliance with § 450.101(c)(2) and § 450.101(c)(3) and provides an acceptable means of compliance with conditional expected casualties requirements in § 450.108. This AC also provides guidance for an operator that chooses to propose an alternative method that produces an equivalent level of safety to the requirements in § 450.101(c)(2). ## Text Each page's text from the PDF; open the PDF at a page with #page=N. ### Page 1 U.S. Department of Transportation Federal Aviation Administration Advisory Circular Subject: High Consequence Event Protection Date: 05-03-2024 Initiated By: ASA-1 AC No: 450.101-1 Revision B Daniel Murray Executive Director, Office of Operational Safety Commercial Space Transportation This Advisory Circular (AC) describes a method to demonstrate compliance with the high consequence event protection requirements of title 14 of the Code of Federal Regulations (14 CFR) § 450.101(c) and the requirements to evaluate the potential for high consequence events in uncontrolled areas in accordance with §§ 450.108(b) and 450.108(c)(4). This AC also provides guidance for an operator that chooses to propose an alternative method that produces an equivalent level of safety to the requirements in § 450.101(c)(2). This AC describes acceptable means, but not the only means, for demonstrating compliance with the applicable regulations. It is intended to assist prospective applicants in obtaining commercial space authorizations and operating in compliance with commercial space regulations. The contents of this document do not have the force and effect of law and are not meant to bind the public in any way, and the document is intended only to provide clarity to the public regarding existing requirements under the law or agency policies. If you have suggestions for improving this AC, you may use the Advisory Circular Feedback form at the end of this AC. ### Page 2 Revision B CONTENTS Paragraph Page ii 1 Purpose … 2 2 Applicability … 3 3 Applicable Regulations and Related Documents … 3 4 Definition of Terms … 5 5 High Consequence Event Protection Overview … 5 6 High Consequence Event Protection Scope … 6 6.1 Phases of Flight … 6 6.2 Potential for High Consequence Events … 7 6.3 Uncontrolled Areas … 7 6.4 Controlled Areas … 7 7 Using Flight Abort As A Hazard Control Strategy … 8 8 Using Conditional Expected Casualty … 9 8.1 Risk Analysis … 9 8.2 Determining “Reasonably Foreseeable” Failure Modes … 9 8.2.1 Failure Modes … 10 8.2.2 Identification of Reasonably Foreseeable Events … 10 8.3 Known Failure Modes … 10 8.3.1 Loss of Thrust … 11 8.3.2 Attitude Control Failure … 11 8.3.3 Guidance and/or Navigation Failure … 11 8.3.4 On-Trajectory Explosion … 11 8.3.5 On-Trajectory Structural Failure … 11 8.3.6 On-Trajectory Tank Failure … 11 8.3.7 Failure to Perform Configuration Change … 12 8.3.8 Premature Configuration Change … 12 8.3.9 Critical Performance Failure … 12 8.3.10 Failure to Ignite … 12 8.3.11 Failure to Shutoff … 12 8.4 Determining the Significant Period of Flight … 13 ### Page 3 Revision B CONTENTS (CONTINUED) Paragraph Page iii 9 Calculating Conditional Expected Casualty … 14 9.1 Mathematics of CEC … 14 9.2 Computation of CEC … 15 9.3 Accuracy of CEC … 16 10 Approach when using Discrete Failure Simulations … 17 10.1 Event Sampling … 17 10.1.1 Minimum Sample Size … 17 10.1.2 Numerical Resolution … 17 10.1.3 Significant Samples … 18 10.2 Satisfying the CEC Criterion … 18 10.2.1 Computing Statistical Values for CEC … 19 10.2.2 Correlation between Intervals … 19 11 Evaluating CEC Results … 20 11.1 Comparison to Threshold Criteria … 20 11.1.1 CEC Evaluation Timeline … 20 11.1.2 Validating CEC … 21 11.2 FSS Requirements for High Consequence Event Protection … 21 12 Alternate Means of Compliance … 22 12.1 Using Risk Profile Curves … 22 12.2 The General Aviation Risk Profile … 23 12.3 Compliance with High Consequence Event Protection … 23 13 Demonstrated Reliability … 24 13.1 Required Reliability … 24 13.2 Demonstrating Reliability … 24 13.3 Existing Aviation Data … 24 ### Page 4 Revision B 1 Principal Changes Revision B updates AC 450.101-1A, High Consequence Event Protection, dated May 20, 2021. This AC change deletes paragraph 13.3 and 13.5 and reassigns paragraph 13.4 as paragraph 13.3. ### Page 5 Revision B 2 1 PURPOSE. 1.1 This Advisory Circular (AC) describes a method to demonstrate compliance with the high consequence event protection requirements of title 14 of the Code of Federal Regulations (14 CFR) § 450.101(c) and the requirements to evaluate the potential for high consequence events in uncontrolled areas in accordance with §§ 450.108(b) and 450.108(c)(4). This AC provides an acceptable means to demonstrate compliance with § 450.101(c)(2) and § 450.101(c)(3) and provides an acceptable means of compliance with conditional expected casualties requirements in § 450.108. This AC also provides guidance for an operator that chooses to propose an alternative method that produces an equivalent level of safety to the requirements in § 450.101(c)(2). 1.2 An operator may initiate the flight of a launch vehicle only if all risks to the public satisfy the criteria of § 450.101(a). The collective risk, measured as expected number of casualties (EC), consists of risk posed by impacting inert debris, explosive debris, toxic release, and far field blast overpressure. Individual risk, measured as probability of casualty (PC), also consists of risk posed by impacting inert debris, explosive debris, toxic release, and far field blast overpressure. Public risk due to any other hazard associated with the proposed flight of a launch vehicle is determined by the FAA Administrator on a case-by-case basis. 1.3 Section 450.101(c) requires an operator to protect against a high consequence event in uncontrolled areas for each phase of flight by using flight abort as a hazard control strategy in accordance with the requirements of § 450.108; ensuring the consequence of any reasonably foreseeable failure mode, in any significant period of flight, is no greater than 1 × 10-3 conditional expected casualties; or establishing the launch or reentry vehicle has sufficient demonstrated reliability as agreed to by the Administrator based on conditional expected casualties criteria during that phase of flight. 1.4 Throughout this document, the word “must” characterizes statements that directly flow from regulatory text and therefore reflect regulatory mandates. The word “should” describes a requirement if electing to use this means of compliance; variation from these requirements is possible, but it must be justified and approved as an alternative means of compliance. The word “may” describes variations or alternatives allowed within the accepted means of compliance set forth in this AC. In general, these alternative approaches can be used only under certain situations that do not compromise safety. 1.5 Cancellation. This AC cancels AC 450.101-1A High Consequence Event Protection, dated May 20, 2021. ### Page 6 Revision B 3 2 APPLICABILITY. 2.1 The guidance in this AC is for launch and reentry vehicle applicants and operators required to comply with 14 CFR part 450. The guidance in this AC is for those seeking a launch or reentry vehicle operator license, a licensed operator seeking to renew or modify an existing vehicle operator license, and FAA commercial space transportation evaluators. 2.2 The material in this AC is advisory in nature and does not constitute a regulation. This guidance is not legally binding in its own right and will not be relied upon by the FAA as a separate basis for affirmative enforcement action or other administrative penalty. Conformity with this guidance document (as distinct from existing statutes and regulations) is voluntary only, and nonconformity will not affect rights and obligations under existing statutes and regulations. This AC describes acceptable means, but not the only means, for demonstrating compliance with the applicable regulations. 2.3 The material in this AC does not change or create any additional regulatory requirements, nor does it authorize changes to, or deviations from, existing regulatory requirements. **3 APPLICABLE REGULATIONS AND RELATED DOCUMENTS.** 3.1 Related Statute. • 51 U.S.C. Subtitle V, Chapter 509. 3.2 Related FAA Commercial Space Transportation Regulations. The following regulations from title 14 of the CFR must be accounted for when showing compliance with § 450.101(c). The full text of these regulations can be downloaded from the U.S. Government Printing Office e-CFR. A paper copy can be ordered from the Government Printing Office, Superintendent of Documents, Attn: New Orders, PO Box 371954, Pittsburgh, PA, 15250-7954. • Section 401.7, Definitions. • Section 440.7, Determination of Maximum Probable Loss. • Section 450.108, Flight Abort. • Section 450.115, Flight Safety Analysis Methods. • Section 450.131, Probability of Failure Analysis. • Section 450.133, Flight Hazard Area Analysis. • Section 450.135, Debris Risk Analysis. • Section 450.137, Far-field Overpressure Blast Effects Analysis. • Section 450.139, Toxic Hazards for Flight. • Section 450.161, Control of Hazard Areas. ### Page 7 Revision B 4 • Section 450.165, Flight Commit Criteria. • Section 450.213, Pre-flight Reporting. 3.3 Related FAA Advisory Circulars. FAA Advisory Circulars (are or will be available through the FAA website, http://www.faa.gov). • AC 450.107-1, Hazard Control Strategies Determination, dated July 27, 2021. • AC 450.108-1, Flight Abort Rule Development, dated July 27, 2021. • AC 450.115-1A, High Fidelity Flight Safety Analysis, dated June 24, 2021. • AC 450.117-1, Trajectory Analysis for Normal Flight, dated August 19, 2021. • AC 450.123-1, Population Exposure Analysis, dated October 12, 2022. • AC 450.131-1, Probability of Failure, when published. • AC 450.137-1, De Minimus Distance Focusing Overpressure Risk Analysis, when published. • AC 450.137-2, Distance Focusing Overpressure Risk Analysis, when published. • AC 23-1309-1E, System Safety Analysis and Assessment for Part 23 Airplanes, dated November 17, 2011. • AC 25-1309-1A, System Design and Analysis, dated June 21, 1988. 3.4 Documents Related to High Consequence Event Protection. 1. Allahdadi, Firooz A., Isabelle Rongier, Tommaso Sgobba, and Paul D. Wilde, Safety Design for Space Operations, Sponsored by The International Association for the Advancement of Space Safety, Elsevier, Watham, MA, 2013. 2. Collins, J.D., C.P. Brinkman, and S.L. Carbon, Determination of Maximum Probable Loss, ACTA Inc. and Federal Aviation Administration, (2007). 3. Risk Committee, Range Safety Group, Range Commanders Council, Common Risk Criteria for National Test Ranges, RCC 321-20, White Sands, NM, May 2020. 4. Federal Register, Vol. 67, No. 146, July 30, 2002, page 49465. ### Page 8 Revision B 5 4 DEFINITION OF TERMS. For this AC, the terms and definitions from § 401.7, and this list, apply: 4.1 Failure Mode A failure mode is a category of potentially hazardous events that share significant similarity in system response, prior to consideration of mitigations or hazard control strategies. 4.2 Maximum Conditional Expected Casualty (CEC) The highest CEC value calculated for a particular phase of flight considering all reasonably foreseeable failure modes. 4.3 Multiple Casualty Event An incident that has significant likelihood of seriously injuring more than one person. 4.4 Phase of Flight A period of flight between two milestones in the vehicle flight sequence, which is not necessarily a set period of time. 4.5 Statistically Valid A “statistically valid” analysis is the result of a sound application of mathematics and accounts for the uncertainty in any statistical inference due to sample size limits, the degree of applicability of data to a particular system, and the degree of homogeneity of the data. The specific approach to establish statistical validity depends on the context of the particular analysis, as described in this AC and others. **5 HIGH CONSEQUENCE EVENT PROTECTION OVERVIEW.** In accordance with § 450.101(c), an operator may use any of the three following methods to demonstrate protection against high consequence events: • Using flight abort as a hazard control strategy in accordance with the requirements of § 450.108; • Ensuring the consequence of any reasonably foreseeable failure mode, in any significant period of flight, is no greater than 1 × 10-3 conditional expected casualties; or • Establishing the launch or reentry vehicle has sufficient demonstrated reliability as agreed to by the Administrator based on the conditional expected casualties criteria during that phase of flight. • High consequence events include incidents that could involve multiple casualties, massive toxic exposures, extensive property or environmental damage, or events that jeopardize the national security or foreign policy interests of the United States. ### Page 9 Revision B 6 6 HIGH CONSEQUENCE EVENT PROTECTION SCOPE. When evaluating the potential for high consequence events, the applicant should identify the phases of flight, the potential for high consequence events, and evaluate the potential for high consequence events in uncontrolled areas. 6.1 Phases of Flight. A phase of flight refers to a period of flight between two milestones in the vehicle flight sequence, which is not necessarily a set period of time, where the probability of failure distribution for each reasonably foreseeable failure mode is homogenous.1 For example, a stage may burn for a longer or shorter period of time depending on the performance of the rocket motor. This can be for selected periods of flight during launch and reentry that an operator will identify and analyze in a consistent manner using quantifiable measurements or observable records. In defining “phases of flight,” the operator should: • Ensure that the combination of all phases of flight covers the full duration of the flight within the scope defined in § 450.113(a). • Define new phases of flight to identify the transition where the operator plans to use different strategies for protecting against high consequence events for different portions of flight. • Not include more than one key flight safety event in each phase of flight. Key flight safety events are those flight activities that have an increased risk compared with other portions of flight. An operator’s flight safety analysis method must account for all reasonably foreseeable events and failures of safety-critical systems during nominal and non-nominal launch or reentry that could jeopardize public safety, in accordance with § 450.115(a). Additional guidance is provided in AC 450.115-1, High Fidelity Flight Safety Analysis. Key flight safety events should also include, at a minimum: 1. Ignition of any primary rocket engine or any change in the source of propulsion; 2. Any staging event or change to the outer mold line; 3. Any hardware configuration of the vehicle being altered from the previous time periods by jettisoning hardware, such as fairings or stages; 4. Any change to the control system (e.g., reaction control system vs. aero surfaces such as fins, or the guidance algorithm); 5. A significant change in dynamic pressure or aerodynamic heating to which the launch or reentry system is subjected; and 6. A significant change in the environment for any safety critical system. 1 Here, a failure probability distribution is considered homogeneous if there are no discontinuities and the failure probability distribution is defined by a single mathematical function (e.g., a linear, exponential, or uniform distribution). In accordance with § 450.131(e), a probability of failure analysis must use a constant conditional failure rate for each phase of flight, unless there is clear and convincing evidence of a different conditional failure rate for a particular vehicle, stage, or phase of flight. ### Page 10 Revision B 7 • The minimum length of a flight phase should be sufficient to allow for implementation of a risk mitigation, including adequate time buffers to account for uncertainty. Moreover, and similar to § 450.131(a), an operator should apply flight phase definitions consistently throughout a flight and base these definitions on physically observable phenomena. 6.2 Potential for High Consequence Events. Section 450.101(c) requires that an operator must protect against a high consequence event in uncontrolled areas for each phase of flight. 6.3 Uncontrolled Areas. The applicant is only required to evaluate the potential for high consequence events in uncontrolled areas, in accordance with §§ 450.101(c), 450.108(b)(1) and (2), and 450.108(c)(4). In accordance with the definition in § 401.7, an uncontrolled area is an area not controlled by a launch or reentry operator, a launch or reentry site operator, an adjacent site operator, or other entity by agreement. Typically, uncontrolled areas include all regions outside of the launch or reentry operators’ property, and outside of the site operator’s property. Adjacent operators’ property and other real estate may be excluded when there is a formal agreement between the launch or reentry operator and the owner of such real estate. An operator could satisfy the requirement to evaluate the potential for high consequence events in uncontrolled areas by evaluating the potential for high consequence events in all areas of land where there is no ability to prevent unauthorized access or otherwise by ensuring that no unauthorized persons are present during a launch or reentry operation. 6.4 Controlled Areas. An area may be considered controlled only if there is an ability: (1) to prevent unauthorized access or otherwise ensure that no unauthorized persons are present, and (2) to manage the location of any persons that are present during a launch or reentry operation. For any areas considered to be controlled for a launch or reentry operation, the licensee should coordinate any high consequence protection measures with the controlling authority. ### Page 11 Revision B 8 7 USING FLIGHT ABORT AS A HAZARD CONTROL STRATEGY. 7.1 Flight abort is intended to prevent adverse consequences in the case of a failure, which, in turn, mitigates the potential for a high consequence event. Design of flight abort criteria must address the potential for a flight abort adversely impacting public safety by triggering hazardous debris impacts in accordance with § 450.108(f)(2). Due to the potential consequences of initiating flight abort, the FAA has adopted regulations specific to its use which are codified in § 450.108. Section 450.108 applies to the use of flight abort as a hazard control strategy for the flight. In summary, it requires that an operator must use a flight safety system that meets the standards of § 450.145 or § 450.143 and meets the flight safety requirements in § 450.108. 7.2 Section 450.101(c)(1) provides that an applicant may use flight abort as a hazard control strategy in accordance with the requirements of § 450.108 to protect against a high consequence event in uncontrolled areas for a phase of flight. Guidance for meeting the requirements of § 450.108 is available in AC 450.108-1, Flight Abort Rule Development. If an applicant uses flight abort in accordance with § 450.108, it meets the requirements of § 450.101(c)(1). The flight safety limits objectives in § 450.101(c) can be met without computing CEC if, in accordance with § 450.108(c)(6), the operator uses flight safety limits that prevent debris capable of causing a casualty due to any hazard from affecting uncontrolled areas using a flight safety system that complies with § 450.145. ### Page 12 Revision B 9 8 USING CONDITIONAL EXPECTED CASUALTY. 8.1 Risk Analysis. When the risk from high consequence events must be demonstrated to comply with §§ 450.101(c)(2), 450.108(b), or 450.108(c)(4), the risk must be quantified in terms of conditional expected casualties (CEC). CEC is one way to measure the risk of a multiple casualty events, one class of high consequence events. This metric is calculated as part of the debris risk analyses in accordance with: • Section 450.135(b), as described in AC 450.115-1, High Fidelity Flight Safety Analysis, • The toxic risk analyses in accordance with § 450.139(f)(8)(ii)(1), as described in AC 450.139-1, Toxic Release Hazards Analysis, and • The far-field overpressure risk analysis in accordance with § 450.137(c), as described in AC 450.137-1, Distance Focusing Overpressure Risk Analysis. 8.1.1 Specifically, an operator must manage the risk of casualties that could arise from the exposure to toxic release by performing a toxic risk assessment in accordance with § 450.139(e), or managing the risk of any casualty from the exposure to a toxic release through containment in accordance with § 450.139(d). 8.1.2 The type of consequence that is the focus of the requirement is that of serious injury or worse, (i.e., a casualty), for any member of the public located in an uncontrolled area. In 2002, the FAA found that the use of abbreviated injury scale (AIS) Level 3 or greater is appropriate for describing a medical condition sufficiently to allow modeling of casualties for purposes of determining whether a launch satisfies the public risk criteria, as stated in reference number [4] of paragraph 3.4 of this AC. 8.1.3 The injuries do not have to occur as a direct result of the impact, but could be from secondary effects of the impact such as subsequent ground fires or nearby facility liquid tank explosions as accounted for in accordance with § 450.135(b)(3), which requires that the debris risk analysis account for any impact or effects of hazardous debris. AC 450.115-1, High Fidelity Flight Safety Analysis provides guidance on computing valid casualty areas that account for the effects of hazardous debris. 8.2 Determining “Reasonably Foreseeable” Failure Modes. An operator is not required to evaluate CEC for all conceivable failure modes, but only those that are reasonably foreseeable in accordance with §§ 450.101(c)(2), 450.108(b)(1) and (2), and 450.108(c)(4). ### Page 13 Revision B 10 8.2.1 Failure Modes. As part of § 450.115(a), the operator’s flight safety analysis, which includes the CEC analysis, must account for all reasonably foreseeable events and failures of safety-critical systems during nominal and non-nominal launch or reentry that could jeopardize public safety. Thus, one means of complying with §§ 450.101(c)(2), 450.108(b)(1) and (2), and 450.108(c)(4) is to include all reasonably foreseeable events, and the failures of safety-critical systems during nominal and non-nominal launch or reentry, as part of the CEC analysis of reasonably foreseeable failure modes. Failure modes are categories of hazardous events that share significant similarity in cause and system response, prior to consideration of mitigations or hazard control strategies. 8.2.2 Identification of Reasonably Foreseeable Events. “Reasonably foreseeable hazardous events” are events identifiable through the system safety process, including events that have occurred in the past for similar vehicles.2 The term “reasonably foreseeable” is not associated with a probability threshold. Rather, an event is “reasonably foreseeable” if it is identifiable by a methodical assessment of the entire system. In other words, “brainstorming” is not a sufficient approach, because “brainstorming” is not a methodical assessment of the entire system. Per § 450.107(b), a functional hazard analysis is required. The functional hazard analysis is primarily used to identify and classify the overall system functions and consequences of functional failure or malfunction. The objective is to identify all potential system, subsystem, and component functional failures that could impact public safety which, in turn, would identify all reasonably foreseeable hazardous events. It is important to note that the identification of potential system safety hazards and respective functional sources (i.e., subsystem functional failures) should not consider any foreseeable mitigation or predetermined hazard control strategy. 8.3 Known Failure Modes. For this means of compliance, a CEC analysis should, at a minimum, account for any applicable failures, as defined in § 450.131(b), in previous launch and reentry history, and should include any other failure modes identified as part of the system safety program hazard management under § 450.103(b). A list of failure modes that are commonly evaluated in analyses is given below. Some of these modes occur over the entire active mission duration, while others need only be evaluated for some phases of flight, or for specific moments in time. Although not listed, other failure modes may exist or be likely for specific vehicles or situations. When relevant, these failures must be included as part of an operator’s flight safety analysis, in accordance with § 450.115(a). In general, a flight safety analysis should account for all failure modes in which CEC can potentially reach threshold criteria. 2See AC 450.131-1 for additional discussion of what constitutes a similar vehicle. ### Page 14 Revision B 11 8.3.1 Loss of Thrust. The loss of thrust failure mode refers to a failure resulting from the loss of vehicle thrust due to a malfunction of the vehicle propulsion system that occurs while the vehicle is following a normal trajectory. Typical causes of loss of thrust are by a motor failure resulting in loss of propulsion or the control system shutting down thrust at an unplanned time. This commonly applies to liquid propellant motors. 8.3.2 Attitude Control Failure. The attitude control failure mode results from of an inability to control orientation. This may occur due to thrust vector control failure (e.g., actuator failure, movable nozzle failure, or hydraulics failure), attitude control thruster failure, pointing error (as in a spin stabilized vehicle), aero-surface control failure, or attitude sensor failure. Attitude control failure may include an improper control model but does not include failure of guidance computers or navigation sensors. 8.3.3 Guidance and/or Navigation Failure. The guidance or navigation failure mode refers to failure of a rocket’s guidance system, including failures due to guidance computer, navigation sensors, guidance software errors, or other sensors used for vehicle attitude guidance, but not failures due to the inability of the control system to act on guidance commands. 8.3.4 On-T rajectory Explosion. On-trajectory failures are characterized by any size explosion of the vehicle while it is following a normal trajectory. This typically results from rupturing of a solid rocket motor casing or a liquid engine explosion. It can also occur from inadvertent activation of a destruct system. 8.3.5 On-Trajectory Structural Failure. On-trajectory structural failures result from exposure of the hardware to excessive loading (loading due to thrust, aerodynamic forces, inertial loads, etc.), excessive vibration, etc. This may be caused by environmental factors or by design or manufacturing errors. This includes breakup of any portion of the structure (including the payload fairing) but does not include premature jettison of the payload fairing. This failure is intended to capture break-ups that are not pressure or combustion driven. A structural failure does not include structural breakup resulting from another failure or intentional activation of the destruct system. 8.3.6 On-Trajectory Tank Failure. The tank failure mode refers to failure of the rocket’s structure that are pressurant or cryogenic driven that do not result in combustion as a driving source for debris dispersion. A tank failure does not include structural breakup resulting from another failure or intentional activation of the destruct system. ### Page 15 Revision B 12 8.3.7 Failure to Perform Configuration Change. The failure to perform a configuration change failure mode involves failure to execute a planned configuration change of the launch or reentry system when the change is planned to occur. This includes failure to separate a stage, a solid or liquid strap-on stage, the payload fairing, or the payload. A configuration change also includes actions that substantially change the vehicle’s aerodynamics, such as deployment of a parachute or aero surface. This failure encompasses both delays in performing the configuration change and the change never occurring. 8.3.8 Premature Configuration Change. The premature configuration change failure mode is the converse of the failure to perform a configuration change failure mode. This includes failures that lead to any of the configuration changes described above occurring prior to the planned conditions. 8.3.9 Critical Performance Failure. Critical performance failure refers to a failure, as defined in § 450.131(b), of the propulsion system to provide the desired change in velocity (delta-V), typically due to design or manufacturing problems. This failure mode does not include failure to deliver the desired performance due to guidance problems. 8.3.10 Failure to Ignite. The failure to ignite failure mode refers to any failure in the entire ignition process, including failure of the igniter, start-up failures of engines, and failure of the signal to reach the igniter for reasons not caused by guidance system failure. This also includes failure to reignite. This does not include on-pad ignition failures that lead to no motion of the vehicle. 8.3.11 Failure to Shutoff. The failure to shutoff mode refers to any failure during an engine shutdown process that results in an unplanned amount of continued thrust beyond a planned point in flight. ### Page 16 Revision B 13 8.4 Determining the Significant Period of Flight. Conditional Expected Casualties may be computed to account for the entire mission, for specific failure modes, by stage of flight, for more limited time spans, etc. Sections 450.101(c)(2), 450.108(b)(1) and (2), and 450.108(c)(4) state, however, that CEC must be computed for any “significant” period of flight. A period of flight would be significant if it is long enough for a mitigation, such as flight abort, to decrease the public risks or consequences materially from any reasonably foreseeable failure mode. The time needed to accomplish flight abort should account for the time delay, including uncertainties, between the violation of a flight abort rule and the time when the flight safety system is expected to activate (i.e., the time computed to satisfy § 450.108(d)(4)). The period should be short enough that exposed population density does not significantly change (e.g., less than 10%) over the time period. To ensure the potential for multiple casualty events is not obscured by calculations utilizing unreasonably long periods of flight, the applicant should use one second time intervals, or shorter, in its calculation of CEC unless it can be demonstrated that a longer interval for a certain phase of flight will adequately capture the risks from a multiple casualty event. Note that § 450.101(c) applies separately to each phase of flight, so each interval must not extend across a boundary between phases. See paragraph 6.1 of this AC for additional guidance on valid phases of flight. ### Page 17 Revision B 14 9 CALCULATING CONDITIONAL EXPECTED CASUALTY. The applicant should specify the type of consequence measure that will be used as a metric for the potential for a “high consequence event.” The default measure in the regulations is conditional expected casualty (CEC) in uncontrolled areas, evaluated separately for each reasonably foreseeable failure mode, during any one second interval of flight. An operator can propose an alternative method for measuring high consequence events for the purposes of §§ 450.101(c)(2), 450.108(b)(1) and (2), and 450.108(c)(4), in accordance with § 450.37. 9.1 Mathematics of CEC. 9.1.1 For the discussion that follows, casualty expectation, or “expected casualty,” is normally notated simply as EC, but the more formal notation is 𝐸𝐸[𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶 | 𝑂𝑂𝑂𝑂𝐶𝐶 𝑂𝑂 𝐶𝐶𝐶𝐶𝐶𝐶𝑂𝑂 𝑂𝑂]. Expected casualty explicitly designates the expected value of the number of casualties given that the launch (or reentry) operation occurs. To generalize casualty to any consequence, the notation will use the letter C. To indicate any specific licensed operation, including launch or re-entry, the notation will use the shortened version “Op.” Thus 𝐸𝐸[𝐶𝐶|Op] means the expectation of a specific consequence (e.g., casualties) given that the operation may be initiated. To be more concise in the discussion, “consequence expectation” may be referred to as “risk.” 9.1.2 Mission risk analyses tend to focus on the total mission 𝐸𝐸[𝐶𝐶|Op]. It is possible to compute casualty expectation for a reduced set of events. An event may, for example, correspond to a particular response from a specific failure mode at a specific failure initiation, or be a planned circumstance such as stage separation or engine ignition. A reduced set of events tends to be for a period of flight, or type of occurrence. To restrict to an individual event, the notation EC (event) is used. 9.1.3 The notion of using a conditional EC measure rather than an EC measure is to avoid dependence on vehicle probability of failure. Conditional expected casualties, as the name implies, are conditional on some event occurring. So, the EC is divided out by the failure probability, hence producing such a conditional value. The casualty expectation conditional on a given event, E[C|Event], is related to the casualty expectation, EC(event), and the probability, P(event), of the event as: E[C|Event] = EC(event)P(event) 9.1.4 To satisfy § 450.101(c)(2), in order to compute CEC, an applicant should compute a set of E[C|Event] values for each foreseeable failure mode (Fm) for each significant period of flight. 9.1.5 The lowest level E[C|Event] is computed for any individual simulated outcome - a specific scenario with no uncertainty. However, the equation above holds for any definition of “event,” up to and including where whole operation defined as the event. When combining results for events to a combined event, E[C|Event1||…||EventN] is ### Page 18 Revision B 15 computed as the weighted average for each sub-event. The following example assumes two sub-events (event 1 and event 2). Therefore: E[C|Event1||Event2] = P(event1)E[C|Event1] + P(event2)E[C|Event2]P(event1) + P(event2) = EC(event1) + EC(event2)P(event1) + P(event2) This means that for the corresponding E[C|Events], EC and P account for the events in the filtered set. 9.2 Computation of CEC. 9.2.1 The process followed to compute high-fidelity E[C|Event] values is one that is referred to as a debris footprint flight safety risk analysis approach. The textbook, Safety Design for Space Operations, at reference number [1] of paragraph 3.4 of this AC, provides significant background on this approach. The current state-of-the-art for debris risk analysis is also detailed in AC 450-115-1, High Fidelity Flight Safety Analysis. 9.2.2 For this discussion, the following notional expression for E[C|Event] is sufficient: E [C|Event] = � � 𝑂𝑂𝑛𝑛𝑛𝑛casualty𝑁𝑁𝑛𝑛fragments𝑂𝑂𝑛𝑛𝑛𝑛impact𝑁𝑁𝑛𝑛p eople 𝑛𝑛=𝑁𝑁pops 𝑛𝑛=1 𝑛𝑛=𝑁𝑁dispersions 𝑛𝑛=1 9.2.3 The nature of each factor in this equation will be explained. The descriptor “notional” is used since this expression is a simplification, but it is adequate for the discussion that follows. For example, an impact in one population region may produce a hazard in another adjacent region, but that is ignored by this formula. For other cases, such as propellant explosions or toxic leaks, the impact may produce a hazard region where the risk varies depending on the distance from the impact location, so 𝑂𝑂𝑛𝑛𝑛𝑛casualty is not constant across a population center. Further, the simplified equation does not account for the possibility of multiple fragments affecting the same person. A more complete discussion is provided in AC 115-1, High Fidelity Flight Safety Analysis. 9.2.4 This surface pattern from each event is generally modeled as a set of impact distributions, where each dispersion represents one or more debris fragments. This results in impact dispersions that specify the probability of a fragment at given locations, 𝑂𝑂impact. This probability is then adjusted to account for the total number of fragments, 𝑁𝑁fragments represented by the dispersion. ### Page 19 Revision B 16 9.2.5 The dispersions are used to evaluate the expected risks to ground-based population centers, which for CEC, only account for people in uncontrolled areas. The development of the appropriate population centers is discussed in AC 450.123-1, Population Exposure Analysis. Each is defined by its population 𝑁𝑁people, area, and sheltering properties. The evaluation of risk accounts for human vulnerability modeling and injuries that require (not necessarily immediate) hospitalization, which are identified as casualties. This leads to a probability of casualty for each individual, 𝑂𝑂casualty. 9.3 Accuracy of CEC. 9.3.1 It is important to perform CEC computations with sufficient accuracy to resolve confidently whether or not the criteria are exceeded. Thus, an operator should define an approach when performing a numerical (discretized) analysis that includes enough samples. Because CEC is based on shorter intervals and specific failure modes, a statistically valid analysis often requires more samples in some regimes than are needed to compute a sufficient accurate mission EC to comply with § 450.101(g). For the CEC evaluations in §§ 450.101(c) and 450.108, an applicant should use 75% confidence that a CEC is below the criteria threshold as a standard for demonstrating compliance. Rigorous statistical methods are not always practical for meeting this standard. This AC presents an acceptable means for meeting this standard, which includes alternatives at several points in the process. These have been determined by experience and analysis to provide high confidence of meeting the regulatory standards. 9.3.2 Many factors contribute to the computed CEC. Some of the factors that are known to have significant effects are: (a) number of statistical simulations used for a failure mode for the time duration of interest (i.e., one (1) second interval), (b) accuracy and fidelity (size) of population centers, (c) representative sheltering models, (d) population models that account for time of the day variations, (e) uncertainty of break-up criteria (e.g., Q-Alpha threshold) for the vehicle, (f) accurate representation of wind for the time of flight, (g) accurate representation of fragment catalogs, etc. AC 450.115-1, High Fidelity Flight Safety Analysis, and AC 450.123-1, Population Exposure Assessment provide guidelines for factors for accurately computing an EC value for the mission. However, when CEC is calculated for a given failure mode for a one second time interval, additional details are often significant. Therefore, the applicant must demonstrate, in accordance with § 450.101(g) that the method used to compute CEC uses an accurate or conservative representation of, at a minimum, each of the factors known to have significant effects. ### Page 20 Revision B 17 10 APPROACH WHEN USING DISCRETE FAILURE SIMULATIONS. AC 450.115-1, High Fidelity Flight Safety Analysis, describes an approach in which malfunction trajectories are discretely simulated. Malfunction trajectories are simulated, for each failure mode, at an appropriate sample rate as a function of time; and other parameters of the failure are Monte Carlo sampled (such as plane of a tumble turn). For this section, each discrete simulation is an event, with a corresponding 𝐸𝐸[𝐶𝐶|Event]). A Breakup State Vector (BSV) set represents the outcome(s) predicted from a single simulated failure trajectory. A BSV includes the time, position, and velocity vectors at breakup or when the hazardous debris trajectories become ballistic and the type of breakup event (explosion, structural failure, or impact) and the associated relative probability of each outcome. There is uncertainty in the outcome; this should be handled as uncertainties in the values and carried through the calculation. Most of these are points in flight when the vehicle may fail and result in partial or total destruction of the vehicle. They may also be surface locations where the vehicle impacts while still intact, i.e., an intact impact event. When using CEC to evaluate compliance with §§ 450.101(c) and 450.108(b), the cause of the breakup (or impact) is only the failure of the vehicle, not the action of the flight safety system. 10.1 Event Sampling. 10.1.1 Minimum Sample Size. For CEC evaluation, each failure mode should include at least 300 failure trajectory samples per interval. Additional samples may be necessary in order to demonstrate compliance. 10.1.2 Numerical Resolution. A key issue with CEC is that impact probability distributions are continuous and typically are modeled as having infinite extent.3 Numerical evaluation of continuous distributions requires discretization and integration limits must be finite. This results in a practical minimum value that any particular computation reliably resolves 𝐸𝐸[𝐶𝐶|Event]. For example, a numerical evaluation will return zero for some evaluations, rather than some very small value which would be mathematically correct. 3 An infinite extent is physically unrealistic, but it is a property of most probability density functions. ### Page 21 Revision B 18 10.1.3 Significant Samples. For this approach, an operator should divide the 𝐸𝐸[𝐶𝐶|Event] values computed for a set of events into two. One will be called the set of “tiny” values, which contains all values below some threshold, Ttiny. This threshold is given as the CEC threshold divided by 100.4 However, if the integration approach in the software cannot reliably resolve to this threshold, then the integration parameters in the software5 should be adjusted so that it can be. The remainder of the 𝐸𝐸[𝐶𝐶|Event])values that are above the threshold are a set of significant values, which will be called “sig” values. 𝑁𝑁 is the total number of samples, and 𝑁𝑁𝑠𝑠𝑠𝑠𝑠𝑠 is the number of significant 𝐸𝐸[𝐶𝐶|Event] values. A key value is the ratio of these two numbers: 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠 = 𝑁𝑁𝑠𝑠𝑠𝑠𝑠𝑠𝑁𝑁 . 10.2 Satisfying the CEC Criterion. If 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠 < 0.3%, then CEC criterion is considered satisfied and no further calculations are necessary. If 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠 ≥ 0.3% but 𝑁𝑁𝑠𝑠𝑠𝑠𝑠𝑠 < 30, then more samples should be run. If 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠 ≥ 0.3% and 𝑁𝑁𝑠𝑠𝑠𝑠𝑠𝑠 ≥ 30, with the division into significant and tiny samples, the CEC criterion can be stated as: �1 − 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠,𝐿𝐿𝐿𝐿 �𝑇𝑇𝑡𝑡𝑠𝑠𝑛𝑛𝑦𝑦 + 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠,𝑈𝑈 𝐿𝐿𝐶𝐶𝐸𝐸𝐿𝐿,𝑠𝑠𝑠𝑠 𝑠𝑠 ,𝑈𝑈 𝐿𝐿 < 𝐶𝐶𝐸𝐸𝐿𝐿,𝑡𝑡ℎ𝑟𝑟𝑟𝑟𝑠𝑠ℎ𝑜𝑜𝑛𝑛𝑜𝑜 Whe re 𝑇𝑇𝑡𝑡𝑠𝑠 𝑛𝑛𝑦𝑦 is defined in 10.1.3 above, and 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠,𝐿𝐿𝐿𝐿 and 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠,𝑈𝑈 𝐿𝐿 are the lower and upper confidence bounds of 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠, as computed below. 4 For example, if evaluating compliance with § 450.101(c)(2), where the CEC criteria is 1E-3, then the threshold must be less than 1E-3 100 = 1E-5. 5 Integration parameters are typically input parameters that set the compromise between runtime and accuracy. The specific values of these parameters depend on the particular implementation of the risk calculation, and thus more detailed than is appropriate here. ### Page 22 Revision B 19 10.2.1 Computing Statistical Values for CEC The method described here provides conservatism relative to meeting the 75% confidence standard for meeting the CEC criterion, as CEC has sometimes been found to be driven by a few large samples. To find the lower bound, 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠,𝐿𝐿𝐿𝐿 the lower bound of the Wilson score interval with 95% confidence is used, 𝑅𝑅𝐶𝐶𝐶𝐶𝑠𝑠,𝐿𝐿𝐶𝐶 = 𝑁𝑁𝑁𝑁 + 3.84 �𝑅𝑅𝐶𝐶𝐶𝐶𝑠𝑠 + 1.92𝑁𝑁 � − 1.96𝑁𝑁𝑁𝑁 + 3.84 �𝑅𝑅𝐶𝐶𝐶𝐶𝑠𝑠�1 − 𝑅𝑅𝐶𝐶𝐶𝐶𝑠𝑠�𝑁𝑁 + 0.96𝑁𝑁2 , 0 ≤ 𝑅𝑅𝐶𝐶𝐶𝐶𝑠𝑠,𝐿𝐿 𝐶𝐶 ≤ 1 and 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠,𝑈𝑈 𝐿𝐿 is calculated based on the normal approximation interval, also with 95% confidence, as 𝑅𝑅𝐶𝐶𝐶𝐶𝑠𝑠,𝑈𝑈 𝐶𝐶 = 𝑅𝑅𝐶𝐶𝐶𝐶𝑠𝑠 + 1.96�𝑅𝑅𝐶𝐶𝐶𝐶𝑠𝑠�1 − 𝑅𝑅𝐶𝐶𝐶𝐶𝑠𝑠�𝑁𝑁 , 0 ≤ 𝑅𝑅𝐶𝐶𝐶𝐶𝑠𝑠,𝑈𝑈 𝐶𝐶 ≤ 1 The upper confidence bound for the significant set of CEC values is calculated as 𝐶𝐶 𝐸𝐸𝐿𝐿,𝑠𝑠𝑠𝑠 𝑠𝑠 ,𝑈𝑈 𝐿𝐿 = 𝐶𝐶 𝐸𝐸𝐿𝐿,𝑠𝑠𝑠𝑠 𝑠𝑠 ,𝜇𝜇 + 𝐶𝐶𝛼𝛼 2⁄ 𝐶𝐶𝐸𝐸𝐿𝐿,𝑠𝑠𝑠𝑠 𝑠𝑠 ,𝜎𝜎 �𝑁𝑁𝑠𝑠𝑠𝑠𝑠𝑠 where 𝐶𝐶𝐸𝐸𝑠𝑠𝑠𝑠𝑠𝑠,𝜇𝜇 and 𝐶𝐶 𝐸𝐸𝑠𝑠𝑠𝑠𝑠𝑠,𝜎𝜎 are the sample mean and sample standard deviation of the significant CEC set, and 𝐶𝐶𝛼𝛼 2⁄ is the quantile of the Student’s t-distribution with degrees of freedom of 𝑁𝑁𝐶𝐶𝐶𝐶𝑠𝑠 − 1 and two-sided 95% confidence level.6 10.2.2 Correlation between Intervals. Because the area of the Earth’s surface affected by failures in an interval largely overlaps the area affected by failures in neighboring intervals, sample sets may be combined, thus reducing the need to run additional samples. Combining is acceptable when the time history of CEC for the random attitude failure mode shows consistent statistical properties. This is especially useful when there is a consistent mean and a significant scatter of CEC with respect to time. For example, as shown in the figure below, it would be reasonable to use all the E(C|Event) data from 100s to 270s to determine the maximum CEC for the phase of flight. This approach allows for a more accurate determination of the confidence interval with fewer samples. 6 The value of 𝐶𝐶𝛼𝛼 2⁄ corresponds to the inverse of the t-distribution cumulative distribution function at 𝑃𝑃 = 1 − 𝛼𝛼 2⁄ . For example, for a confidence level of 95%, 𝛼𝛼 = 0.1, and, for ten degrees of freedom, 𝐶𝐶𝛼𝛼 2⁄ ≈ 1.8. ### Page 23 Revision B 20 Figure – 1. Example of time period of stable CEC with scatter 11 EVALUATING CEC RESULTS. 11.1 Comparison to Threshold Criteria. To demonstrate compliance with §§ 450.101(c)(2) or 450.108(b), CEC should be calculated without considering flight abort. This means that the vehicle responses to all failures are based only on the physics of the instigating event and the vehicle’s response to that event. For the default CEC measure, § 450.101(c)(2) requires evaluation against the threshold value of 1 × 10-3. If this value is not exceeded by the maximum CEC value of any reasonably foreseeable failure mode in any significant period of flight, then no additional mitigations of high consequence events are required. 11.1.1 CEC Evaluation Timeline. The evaluation of CEC should be performed during vehicle design, well before an operation takes place. It is generally not feasible to add a flight safety system during the preparation for a specific operation. Thus, the determination whether flight abort will be used as a hazard control strategy, and whether it must meet the requirements of § 450.145 or § 450.143 should be made long before a specific launch or reentry operation is planned. Therefore, such a determination should be made considering all contemplated operation profiles, vehicle variations, and environmental conditions. Thus, usually the CEC evaluation and flight abort determination is made with significant margin to allow for changes in the planned operational conditions. However, different operational conditions could require a reevaluation of the determination, such as if a flight could expose significantly more population. ### Page 24 Revision B 21 11.1.2 Validating CEC. A flight safety analysis must include risk analysis, per § 450.135(a) and § 450.137(a), that demonstrates compliance with the safety criteria of § 450.101. This includes any CEC calculations required to meet the high consequence event protection requirements of § 450.101(c). The debris risk analysis must be computed either prior to the day of the operation, accounting for all foreseeable conditions within the flight commit criteria, or during the countdown using the best available input data, including flight commit criteria and flight abort rules (§ 450.135(a)). The CEC analysis should be performed prior to the day of launch covering all foreseeable conditions. This should account for potential variations in trajectories, winds, and population. As discussed in the previous paragraph, normally the initial CEC determination includes sufficient margin that specific operations do not necessitate confirmation of meeting the requirements. In, accordance with § 450.165(a)(7), when an FSS is used as a hazard control, the operator must verify that the conditions prior to flight are consistent with the CEC analysis in order to satisfy the requirements of § 450.101. 11.2 FSS Requirements for High Consequence Event Protection. If the § 450.101(c)(2) threshold is exceeded and an operator cannot comply with § 450.101(c)(3), then an operator must protect against a high consequence event in uncontrolled areas for each phase of flight by meeting § 450.101(c)(1), which requires the operator to use flight abort as a hazard control strategy in accordance with the requirements of § 450.108. Section 450.108(b) requires an operator to use a flight safety system that meets § 450.143 if the consequence of any reasonably foreseeable failure mode in any significant period of flight is between 1 × 10-2 and 1 × 10-3 conditional expected casualties in uncontrolled areas, or § 450.145 if the consequence of any reasonably foreseeable failure mode in any significant period of flight is greater than 1 × 10-2 conditional expected casualties in uncontrolled areas. Additional guidance for flight abort is available in AC 450.108-1, Flight Abort Rule Development. ### Page 25 Revision B 22 12 ALTERNATE MEANS OF COMPLIANCE. This AC is based on the CEC measure and specific CEC thresholds specified in the regulations, including §§ 450.101(c)(2) and 450.108(b). However, § 450.37 allows applicants to propose alternative approaches to measuring high consequence events that provide an equivalent level of safety, which may be approved by the FAA without a waiver. The FAA added this flexibility because it is aware of methods other than using CEC to measure the potential for high consequence events. If an applicant chooses to propose an alternative means of measuring a high consequence event, the FAA expects the alternative means to account for the potential for any high consequence event using a method that demonstrates an equivalent level of safety to a CEC analysis. In order to demonstrate an equivalent level of safety, the operator must ensure that the alternative means accurately assesses that the operation would not exceed an acceptable threshold for high consequence events. In order to determine whether an alternative threshold for high consequence events is acceptable, the FAA will compare the alternative measurement to the CEC threshold in the regulation.7 12.1 Using Risk Profile Curves. A tool that may provide an equivalent level of safety to using CEC to measure high consequence events is a risk profile, as per reference number [2] of paragraph 3.4 of this AC. This is a curve that is sometimes used to compute maximum probable loss (MPL) to evaluate the insurance requirements of part 440, Financial Responsibility. Reference number [3] of paragraph 3.4 of this AC defines a risk profile is a plot that shows the probability of N or more casualties (vertical axis) as a function of the number of casualties, N (horizontal axis). A risk profile is discrete (i.e. no fractional casualties) and is the complementary cumulative distribution of the histogram that accounts for the aleatory uncertainty in the discrete number of casualties for each reasonably foreseeable scenario; as such the area under a risk profile is equal to the EC. Reference number [3] of paragraph 3.4 of this AC provides additional details regarding risk profile computations, including an example problem. Note that much more effort may be needed to generate a risk profile as compared to a set of CEC values. Figure 2 is an example of a risk profile showing the probability of third-party fatalities caused by general aviation (GA) accidents. 7 Alternatively, the applicant would be expected to demonstrate that the consequence of any failure during any significant period of flight is at least an order of magnitude less than the average results from a fixed-wing general aviation aircraft fatal accident, as explained below. ### Page 26 Revision B 23 Figure-2 – US General Aviation Ground Fatalities per Fatal Accident 1982-2019 12.2 The General Aviation Risk Profile. The FAA computed this risk profile using National Transportation Safety Board (NTSB) accident data8 between 1982 and 2019 for only fixed-wing aircraft operated under 14 CFR parts 91, 135, and 137, excluding aircraft types that meet Part 25. The vertical axis of Figure 2 of this AC shows the conditional probability of “N” or more fatalities given a GA aircraft accident, and the horizontal axis shows the number of fatalities “N” for third parties only (uninvolved people located on the ground). The horizontal axis does not count fatal injuries to pilots and passengers. However, to qualify as an “accident” there must have been at least one fatality, including people on-board the aircraft. This conditional risk profile shows that one or more third party fatalities results on average following every 100 GA accidents. This empirical data also indicates that GA accidents have a conditional expected fatality value near 1E-2, which equates to the area under the conditional risk profile. 12.3 Compliance with High Consequence Event Protection. An equivalent level of safety with § 450.101(c)(2) may be demonstrated by showing that the conditional risk profile for a launch or reentry mission, in terms of casualties, is at least an order of magnitude below the conditional ground fatality risk profile for GA accidents shown in Figure 2 of this AC. The empirical data from aviation accidents demonstrates that ground casualties are about three times more likely than ground fatalities; that difference is deemed appropriate given the uncertainties inherent in any physics-based model results. 8 A total of 12,644 fatal accidents, with 117 accidents that involved one or more ground fatalities. 0.0001 0.001 0.01 1 2 3 4 5 Probability of N or more Fatalities Number of Fatalities ### Page 27 Revision B 24 13 DEMONSTRATED RELIABILITY. 13.1 Required Reliability. Section 450.101(c)(3) states that one way in which an operator can protect against a high consequence event in uncontrolled areas for each phase of flight is by establishing that the launch or reentry system has sufficient demonstrated reliability as agreed to by the Administrator based on CEC criteria during that phase of flight. The FAA will use the demonstrated reliability and average ground consequence results from fatal accidents involving U.S. civil aviation aircraft with standard airworthiness certificates to establish what constitutes sufficient demonstrated reliability to protect against a high consequence event based on CEC as described in this section. More specifically, sufficiently high demonstrated reliability will be evaluated based on the principles outlined in paragraphs 13.3.1 and 13.3.2 of this AC. 13.2 Demonstrating Reliability. An applicant should demonstrate reliability based on history of the vehicle being flown, following equivalent practices to type certification for aircraft. Small modifications of a vehicle may be acceptable without being considered a new vehicle. Based on current licensed operations, the FAA anticipates that, initially, only flight phases where an aircraft carries a rocket would be able to meet the demonstrated reliability standard, and the aircraft would need an airworthiness certificate and extensive flight history. However, it is anticipated that in the future, rocket systems will also develop history and certification practices that will enable commensurate levels of reliability to be demonstrated. Because demonstrated reliability provides an alternative to flight abort when CEC is greater than 1 x 10-3, it is appropriate to assess it consistent with the approach to flight abort and FSS reliability, which depends on CEC with a 1 x 10-2 threshold. For example, a binomial approach would require data from at 87,000 flights without a failure to demonstrate a reliability corresponding to the 8E-6 failure rate (identified in paragraph 13.3.3 of this AC) at the 50% confidence level.9 13.3 Existing Aviation Data. Existing data is available and provides findings necessary to relate several classes of aircraft to consequences and reliability requirements. Reliability is simply the converse of failure probability, so reliability = 100% minus failure probability. Consequences for aircraft are not, however, available in terms of ground casualties. This information is only available in terms of ground fatalities. Conditional expected fatalities, 10 CEF, is 9 For example, see equation 13.9 in “An Introduction to Reliability and Maintainability Engineering” by Charles E. Ebeling, Waveland Press, Inc., Long Grove, IL, 2019, ISBN-13: 978-1577666257. 10 CEF represents conditional expected fatalities and is used to measure the mean number of fatalities predicted to occur given an event with a probability of 1. The FAA found that about one ground fatality resulted on average from one hundred fatal accidents involving U.S.-registered aircraft operated under Part 91 between 1984 and 2013 based on NTSB data. A comparison of CEC to CEF is appropriate here because the CEF values cited here are empirical results from aviation accidents, whereas the CEC values used here are the results of physics-based computer simulations for launch and reentry operations. In addition, the differences between aviation and space operations justify some margin in the tolerability of the conditional risks predicted for space transportation operations. ### Page 28 Revision B 25 therefore used as an equivalent level of safety to compare against CEC, as this is a conservative approach. 13.3.1 Commercial transport aircraft have large casualty areas (up to approximately one million square feet). As a result of rigorous system safety programs and high redundancy of safety critical systems, they are allowed to fly over highly concentrated population centers in large cities. They are allowed to overfly cities and have a demonstrated probability of a failure resulting in a fatal accident per flight of less than 1E-6 (8E-7). These aircraft have a CEF, as measured by fatalities per fatal accident, of approximately 1. This CEF is then compared to the CEC of the applicant’s vehicle for purposes of § 450.101(c)(3). Flight Safety Analysis should protect against high consequence events for purposes of § 450.101(c)(3) by establishing that a launch or reentry vehicle sufficiently demonstrates reliability per the failure probabilities and conditions described in AC 25.1309-1A, System Safety Analysis and Assessment for Part 23 Airplanes. 13.3.2 Fixed wing, non-commercial transport, general aviation aircraft (including business jets) are characterized by a smaller casualty area (typically up to 10,000 square feet). Their system safety programs are quite rigorous, although they lack the level of redundancy in safety critical systems that commercial transport aircraft have. They are allowed to overfly cities with a demonstrated probability of a failure resulting in a fatal accident per flight of less than 1E-5 (8E-6). These aircraft have a CEF of approximately 0.01 as measured by fatalities per fatal accident. Flight Safety Analyses should protect against high consequence events for purposes of § 450.101(c)(3) by establishing that a launch or reentry vehicle sufficiently demonstrates reliability per the failure probabilities and conditions described in AC 23.1309-1E. 13.3.3 Figure 3 of this AC connects two data points, the estimated failure probability (7.8E-6) and maximum conditional EF (0.01) for Fixed Wing General Aviation and the point with the corresponding values for Commercial Transports (failure probability = 7.8E-7, maximum conditional EF =1.) These points have been connected by a straight line indicating an assumed relationship between allowable failure probability and maximum conditional EC (CEC). ### Page 29 Revision B 26 Figure-3. Tolerable Failure Probability Per Flight vs CEC 13.3.4 If the estimated CEC falls between the CEF data for Fixed Wing General Aviation and that shown for Commercial Transports, then the tolerable failure probability for that segment may be estimated by interpolating between the failure probability for the two classes of aircraft, in logarithmic space, as illustrated in the graph in Figure 3. ### Page 30 OMB Control Number: 2120-0746 Expiration Date: 11/30/2024 FAA Form 1320-73 (09/22) SUPERSEDES PREVIOUS EDITIONS Advisory Circular Feedback Form If you find an error in this AC, have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by (1) emailing this form to 9-AST- ASZ210-Directives@faa.gov, or (2) f axing it to (202) 267-5450. Subject: (insert AC title/number here)(insert AC title/number here) Date: Click here to enter text. Please check all appropriate line items: ☐ An error (procedural or typographical) has been noted in paragraph Click here to enter text. on page Click here to enter text.. ☐ Recommend paragraph Click here to enter text. on page Click here to enter text. be changed as follows: Click here to enter text. ☐ In a future change to this AC, please cover the following subject: (Briefly describe what you want added.) Click here to enter text. ☐ Other comments: Click here to enter text. ☐ I would like to discus s the above. Please contact me. Submitted by: Date: Paperwork Reduction Act Burden Statement: A federal agency may not conduct or sponsor, and a person is not required to respond to, nor shall a person be subject to a penalty for failure to comply with a collection of information subject to the requirements of the Paperwork Reduction Act unless that collection of information displays a currently valid OMB Control Number. The OMB Control Number for this information collection is 2120-0746. Public reporting for this collection of information is estimated to be approximately 5 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. All responses to this collection of information are voluntary per FAA Order 1320.46D Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to: Information Collection Clearance Officer, 800 Independence Ave, Washington, D.C. 20590. --- OpenAirDocs.org is an independent research project of [Contrail Labs](https://contraillabs.com/). It is not affiliated with the FAA or the NTSB. Source documents are U.S. government works in the public domain.