Revision B 10
8.2.1 Failure Modes.
As part of § 450.115(a), the operator’s flight safety analysis, which includes the CEC analysis, must account for all reasonably foreseeable events and failures of safety-critical systems during nominal and non-nominal launch or reentry that could jeopardize public safety. Thus, one means of complying with §§ 450.101(c)(2),
450.108(b)(1) and (2), and 450.108(c)(4) is to include all reasonably foreseeable events, and the failures of safety-critical systems during nominal and non-nominal launch or reentry, as part of the CEC analysis of reasonably foreseeable failure modes. Failure modes are categories of hazardous events that share significant similarity in cause and system response, prior to consideration of mitigations or hazard control strategies.
8.2.2 Identification of Reasonably Foreseeable Events.
“Reasonably foreseeable hazardous events” are events identifiable through the system safety process, including events that have occurred in the past for similar vehicles.2 The term “reasonably foreseeable” is not associated with a probability threshold. Rather, an event is “reasonably foreseeable” if it is identifiable by a methodical assessment of the entire system. In other words, “brainstorming” is not a sufficient approach, because “brainstorming” is not a methodical assessment of the entire system. Per § 450.107(b), a functional hazard analysis is required. The functional hazard analysis is primarily used to identify and classify the overall system functions and consequences of functional failure or malfunction. The objective is to identify all potential system, subsystem, and component functional failures that could impact public safety which, in turn, would identify all reasonably foreseeable hazardous events. It is important to note that the identification of potential system safety hazards and respective functional sources
(i.e., subsystem functional failures) should not consider any foreseeable mitigation or predetermined hazard control strategy.
8.3 Known Failure Modes.
For this means of compliance, a CEC analysis should, at a minimum, account for any applicable failures, as defined in § 450.131(b), in previous launch and reentry history, and should include any other failure modes identified as part of the system safety program hazard management under § 450.103(b). A list of failure modes that are commonly evaluated in analyses is given below. Some of these modes occur over the entire active mission duration, while others need only be evaluated for some phases of flight, or for specific moments in time. Although not listed, other failure modes may exist or be likely for specific vehicles or situations. When relevant, these failures must be included as part of an operator’s flight safety analysis, in accordance with § 450.115(a). In general, a flight safety analysis should account for all failure modes in which CEC can potentially reach threshold criteria.
2See AC 450.131-1 for additional discussion of what constitutes a similar vehicle.
Revision B 11
8.3.1 Loss of Thrust.
The loss of thrust failure mode refers to a failure resulting from the loss of vehicle thrust due to a malfunction of the vehicle propulsion system that occurs while the vehicle is following a normal trajectory. Typical causes of loss of thrust are by a motor failure resulting in loss of propulsion or the control system shutting down thrust at an unplanned time. This commonly applies to liquid propellant motors.
8.3.2 Attitude Control Failure.
The attitude control failure mode results from of an inability to control orientation. This may occur due to thrust vector control failure (e.g., actuator failure, movable nozzle failure, or hydraulics failure), attitude control thruster failure, pointing error (as in a spin stabilized vehicle), aero-surface control failure, or attitude sensor failure. Attitude control failure may include an improper control model but does not include failure of guidance computers or navigation sensors.
8.3.3 Guidance and/or Navigation Failure.
The guidance or navigation failure mode refers to failure of a rocket’s guidance system, including failures due to guidance computer, navigation sensors, guidance software errors, or other sensors used for vehicle attitude guidance, but not failures due to the inability of the control system to act on guidance commands.
8.3.4 On-T rajectory Explosion.
On-trajectory failures are characterized by any size explosion of the vehicle while it is following a normal trajectory. This typically results from rupturing of a solid rocket motor casing or a liquid engine explosion. It can also occur from inadvertent activation of a destruct system.
8.3.5 On-Trajectory Structural Failure.
On-trajectory structural failures result from exposure of the hardware to excessive loading (loading due to thrust, aerodynamic forces, inertial loads, etc.), excessive vibration, etc. This may be caused by environmental factors or by design or manufacturing errors. This includes breakup of any portion of the structure (including the payload fairing) but does not include premature jettison of the payload fairing. This failure is intended to capture break-ups that are not pressure or combustion driven. A structural failure does not include structural breakup resulting from another failure or intentional activation of the destruct system.
8.3.6 On-Trajectory Tank Failure.
The tank failure mode refers to failure of the rocket’s structure that are pressurant or cryogenic driven that do not result in combustion as a driving source for debris dispersion. A tank failure does not include structural breakup resulting from another failure or intentional activation of the destruct system.
Revision B 12
8.3.7 Failure to Perform Configuration Change.
The failure to perform a configuration change failure mode involves failure to execute a planned configuration change of the launch or reentry system when the change is planned to occur. This includes failure to separate a stage, a solid or liquid strap-on stage, the payload fairing, or the payload. A configuration change also includes actions that substantially change the vehicle’s aerodynamics, such as deployment of a parachute or aero surface. This failure encompasses both delays in performing the configuration change and the change never occurring.
8.3.8 Premature Configuration Change.
The premature configuration change failure mode is the converse of the failure to perform a configuration change failure mode. This includes failures that lead to any of the configuration changes described above occurring prior to the planned conditions.
8.3.9 Critical Performance Failure.
Critical performance failure refers to a failure, as defined in § 450.131(b), of the propulsion system to provide the desired change in velocity (delta-V), typically due to design or manufacturing problems. This failure mode does not include failure to deliver the desired performance due to guidance problems.
8.3.10 Failure to Ignite.
The failure to ignite failure mode refers to any failure in the entire ignition process, including failure of the igniter, start-up failures of engines, and failure of the signal to reach the igniter for reasons not caused by guidance system failure. This also includes failure to reignite. This does not include on-pad ignition failures that lead to no motion of the vehicle.
8.3.11 Failure to Shutoff.
The failure to shutoff mode refers to any failure during an engine shutdown process that results in an unplanned amount of continued thrust beyond a planned point in flight.
Revision B 13
8.4 Determining the Significant Period of Flight.
Conditional Expected Casualties may be computed to account for the entire mission, for specific failure modes, by stage of flight, for more limited time spans, etc.
Sections 450.101(c)(2), 450.108(b)(1) and (2), and 450.108(c)(4) state, however, that CEC must be computed for any “significant” period of flight. A period of flight would be significant if it is long enough for a mitigation, such as flight abort, to decrease the public risks or consequences materially from any reasonably foreseeable failure mode.
The time needed to accomplish flight abort should account for the time delay, including uncertainties, between the violation of a flight abort rule and the time when the flight safety system is expected to activate (i.e., the time computed to satisfy § 450.108(d)(4)).
The period should be short enough that exposed population density does not significantly change (e.g., less than 10%) over the time period. To ensure the potential for multiple casualty events is not obscured by calculations utilizing unreasonably long periods of flight, the applicant should use one second time intervals, or shorter, in its calculation of CEC unless it can be demonstrated that a longer interval for a certain phase of flight will adequately capture the risks from a multiple casualty event. Note that § 450.101(c) applies separately to each phase of flight, so each interval must not extend across a boundary between phases. See paragraph 6.1 of this AC for additional guidance on valid phases of flight.
Revision B 14 9 CALCULATING CONDITIONAL EXPECTED CASUALTY.
The applicant should specify the type of consequence measure that will be used as a metric for the potential for a “high consequence event.” The default measure in the regulations is conditional expected casualty (CEC) in uncontrolled areas, evaluated separately for each reasonably foreseeable failure mode, during any one second interval of flight. An operator can propose an alternative method for measuring high consequence events for the purposes of §§ 450.101(c)(2), 450.108(b)(1) and (2), and
450.108(c)(4), in accordance with § 450.37.
9.1 Mathematics of CEC.
9.1.1 For the discussion that follows, casualty expectation, or “expected casualty,” is normally notated simply as EC, but the more formal notation is 𝐸𝐸[𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶 | 𝑂𝑂𝑂𝑂𝐶𝐶 𝑂𝑂 𝐶𝐶𝐶𝐶𝐶𝐶𝑂𝑂 𝑂𝑂]. Expected casualty explicitly designates the expected value of the number of casualties given that the launch (or reentry) operation occurs. To generalize casualty to any consequence, the notation will use the letter C. To indicate any specific licensed operation, including launch or re-entry, the notation will use the shortened version “Op.” Thus 𝐸𝐸[𝐶𝐶|Op] means the expectation of a specific consequence
(e.g., casualties) given that the operation may be initiated. To be more concise in the discussion, “consequence expectation” may be referred to as “risk.”
9.1.2 Mission risk analyses tend to focus on the total mission 𝐸𝐸[𝐶𝐶|Op]. It is possible to compute casualty expectation for a reduced set of events. An event may, for example, correspond to a particular response from a specific failure mode at a specific failure initiation, or be a planned circumstance such as stage separation or engine ignition. A reduced set of events tends to be for a period of flight, or type of occurrence. To restrict to an individual event, the notation EC (event) is used.
9.1.3 The notion of using a conditional EC measure rather than an EC measure is to avoid dependence on vehicle probability of failure. Conditional expected casualties, as the name implies, are conditional on some event occurring. So, the EC is divided out by the failure probability, hence producing such a conditional value. The casualty expectation conditional on a given event, E[C|Event], is related to the casualty expectation, EC(event), and the probability, P(event), of the event as:
E[C|Event] = EC(event)P(event)
9.1.4 To satisfy § 450.101(c)(2), in order to compute CEC, an applicant should compute a set of E[C|Event] values for each foreseeable failure mode (Fm) for each significant period of flight.
9.1.5 The lowest level E[C|Event] is computed for any individual simulated outcome - a specific scenario with no uncertainty. However, the equation above holds for any definition of “event,” up to and including where whole operation defined as the event.
When combining results for events to a combined event, E[C|Event1||…||EventN] is
Revision B 15 computed as the weighted average for each sub-event. The following example assumes two sub-events (event 1 and event 2). Therefore:
E[C|Event1||Event2] = P(event1)E[C|Event1] + P(event2)E[C|Event2]P(event1) + P(event2)
= EC(event1) + EC(event2)P(event1) + P(event2) This means that for the corresponding E[C|Events], EC and P account for the events in the filtered set.
9.2 Computation of CEC.
9.2.1 The process followed to compute high-fidelity E[C|Event] values is one that is referred to as a debris footprint flight safety risk analysis approach. The textbook, Safety Design for Space Operations, at reference number [1] of paragraph 3.4 of this AC, provides significant background on this approach. The current state-of-the-art for debris risk analysis is also detailed in AC 450-115-1, High Fidelity Flight Safety Analysis.
9.2.2 For this discussion, the following notional expression for E[C|Event] is sufficient:
E [C|Event] = � � 𝑂𝑂𝑛𝑛𝑛𝑛casualty𝑁𝑁𝑛𝑛fragments𝑂𝑂𝑛𝑛𝑛𝑛impact𝑁𝑁𝑛𝑛p eople 𝑛𝑛=𝑁𝑁pops 𝑛𝑛=1 𝑛𝑛=𝑁𝑁dispersions 𝑛𝑛=1
9.2.3 The nature of each factor in this equation will be explained. The descriptor “notional” is used since this expression is a simplification, but it is adequate for the discussion that follows. For example, an impact in one population region may produce a hazard in another adjacent region, but that is ignored by this formula. For other cases, such as propellant explosions or toxic leaks, the impact may produce a hazard region where the risk varies depending on the distance from the impact location, so 𝑂𝑂𝑛𝑛𝑛𝑛casualty is not constant across a population center. Further, the simplified equation does not account for the possibility of multiple fragments affecting the same person. A more complete discussion is provided in AC 115-1, High Fidelity Flight Safety Analysis.
9.2.4 This surface pattern from each event is generally modeled as a set of impact distributions, where each dispersion represents one or more debris fragments. This results in impact dispersions that specify the probability of a fragment at given locations, 𝑂𝑂impact. This probability is then adjusted to account for the total number of fragments, 𝑁𝑁fragments represented by the dispersion.
Revision B 16
9.2.5 The dispersions are used to evaluate the expected risks to ground-based population centers, which for CEC, only account for people in uncontrolled areas. The development of the appropriate population centers is discussed in AC 450.123-1, Population Exposure Analysis. Each is defined by its population 𝑁𝑁people, area, and sheltering properties. The evaluation of risk accounts for human vulnerability modeling and injuries that require (not necessarily immediate) hospitalization, which are identified as casualties. This leads to a probability of casualty for each individual, 𝑂𝑂casualty.
9.3 Accuracy of CEC.
9.3.1 It is important to perform CEC computations with sufficient accuracy to resolve confidently whether or not the criteria are exceeded. Thus, an operator should define an approach when performing a numerical (discretized) analysis that includes enough samples. Because CEC is based on shorter intervals and specific failure modes, a statistically valid analysis often requires more samples in some regimes than are needed to compute a sufficient accurate mission EC to comply with § 450.101(g). For the CEC evaluations in §§ 450.101(c) and 450.108, an applicant should use 75% confidence that a CEC is below the criteria threshold as a standard for demonstrating compliance.
Rigorous statistical methods are not always practical for meeting this standard. This AC presents an acceptable means for meeting this standard, which includes alternatives at several points in the process. These have been determined by experience and analysis to provide high confidence of meeting the regulatory standards.
9.3.2 Many factors contribute to the computed CEC. Some of the factors that are known to have significant effects are: (a) number of statistical simulations used for a failure mode for the time duration of interest (i.e., one (1) second interval), (b) accuracy and fidelity (size) of population centers, (c) representative sheltering models, (d) population models that account for time of the day variations, (e) uncertainty of break-up criteria (e.g., Q-Alpha threshold) for the vehicle, (f) accurate representation of wind for the time of flight, (g) accurate representation of fragment catalogs, etc. AC 450.115-1, High Fidelity Flight Safety Analysis, and AC 450.123-1, Population Exposure Assessment provide guidelines for factors for accurately computing an EC value for the mission.
However, when CEC is calculated for a given failure mode for a one second time interval, additional details are often significant. Therefore, the applicant must demonstrate, in accordance with § 450.101(g) that the method used to compute CEC uses an accurate or conservative representation of, at a minimum, each of the factors known to have significant effects.
Revision B 17 10 APPROACH WHEN USING DISCRETE FAILURE SIMULATIONS.
AC 450.115-1, High Fidelity Flight Safety Analysis, describes an approach in which malfunction trajectories are discretely simulated. Malfunction trajectories are simulated, for each failure mode, at an appropriate sample rate as a function of time; and other parameters of the failure are Monte Carlo sampled (such as plane of a tumble turn). For this section, each discrete simulation is an event, with a corresponding 𝐸𝐸[𝐶𝐶|Event]). A Breakup State Vector (BSV) set represents the outcome(s) predicted from a single simulated failure trajectory. A BSV includes the time, position, and velocity vectors at breakup or when the hazardous debris trajectories become ballistic and the type of breakup event (explosion, structural failure, or impact) and the associated relative probability of each outcome. There is uncertainty in the outcome; this should be handled as uncertainties in the values and carried through the calculation. Most of these are points in flight when the vehicle may fail and result in partial or total destruction of the vehicle. They may also be surface locations where the vehicle impacts while still intact, i.e., an intact impact event. When using CEC to evaluate compliance with §§ 450.101(c) and 450.108(b), the cause of the breakup (or impact) is only the failure of the vehicle, not the action of the flight safety system.
10.1 Event Sampling.
10.1.1 Minimum Sample Size.
For CEC evaluation, each failure mode should include at least 300 failure trajectory samples per interval. Additional samples may be necessary in order to demonstrate compliance.
10.1.2 Numerical Resolution.
A key issue with CEC is that impact probability distributions are continuous and typically are modeled as having infinite extent.3 Numerical evaluation of continuous distributions requires discretization and integration limits must be finite. This results in a practical minimum value that any particular computation reliably resolves 𝐸𝐸[𝐶𝐶|Event]. For example, a numerical evaluation will return zero for some evaluations, rather than some very small value which would be mathematically correct.
3 An infinite extent is physically unrealistic, but it is a property of most probability density functions.
Revision B 18
10.1.3 Significant Samples.
For this approach, an operator should divide the 𝐸𝐸[𝐶𝐶|Event] values computed for a set of events into two. One will be called the set of “tiny” values, which contains all values below some threshold, Ttiny. This threshold is given as the CEC threshold divided by
100.4 However, if the integration approach in the software cannot reliably resolve to this threshold, then the integration parameters in the software5 should be adjusted so that it can be. The remainder of the 𝐸𝐸[𝐶𝐶|Event])values that are above the threshold are a set of significant values, which will be called “sig” values. 𝑁𝑁 is the total number of samples, and 𝑁𝑁𝑠𝑠𝑠𝑠𝑠𝑠 is the number of significant 𝐸𝐸[𝐶𝐶|Event] values. A key value is the ratio of these two numbers:
𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠 = 𝑁𝑁𝑠𝑠𝑠𝑠𝑠𝑠𝑁𝑁 .
10.2 Satisfying the CEC Criterion.
If 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠 < 0.3%, then CEC criterion is considered satisfied and no further calculations are necessary.
If 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠 ≥ 0.3% but 𝑁𝑁𝑠𝑠𝑠𝑠𝑠𝑠 < 30, then more samples should be run.
If 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠 ≥ 0.3% and 𝑁𝑁𝑠𝑠𝑠𝑠𝑠𝑠 ≥ 30, with the division into significant and tiny samples, the CEC criterion can be stated as:
�1 − 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠,𝐿𝐿𝐿𝐿 �𝑇𝑇𝑡𝑡𝑠𝑠𝑛𝑛𝑦𝑦 + 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠,𝑈𝑈 𝐿𝐿𝐶𝐶𝐸𝐸𝐿𝐿,𝑠𝑠𝑠𝑠 𝑠𝑠 ,𝑈𝑈 𝐿𝐿 < 𝐶𝐶𝐸𝐸𝐿𝐿,𝑡𝑡ℎ𝑟𝑟𝑟𝑟𝑠𝑠ℎ𝑜𝑜𝑛𝑛𝑜𝑜 Whe re 𝑇𝑇𝑡𝑡𝑠𝑠 𝑛𝑛𝑦𝑦 is defined in 10.1.3 above, and 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠,𝐿𝐿𝐿𝐿 and 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠,𝑈𝑈 𝐿𝐿 are the lower and upper confidence bounds of 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠, as computed below.
4 For example, if evaluating compliance with § 450.101(c)(2), where the CEC criteria is 1E-3, then the threshold must be less than 1E-3 100 = 1E-5.
5 Integration parameters are typically input parameters that set the compromise between runtime and accuracy. The specific values of these parameters depend on the particular implementation of the risk calculation, and thus more detailed than is appropriate here.
Revision B 19
10.2.1 Computing Statistical Values for CEC The method described here provides conservatism relative to meeting the 75% confidence standard for meeting the CEC criterion, as CEC has sometimes been found to be driven by a few large samples. To find the lower bound, 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠,𝐿𝐿𝐿𝐿 the lower bound of the Wilson score interval with 95% confidence is used, 𝑅𝑅𝐶𝐶𝐶𝐶𝑠𝑠,𝐿𝐿𝐶𝐶 = 𝑁𝑁𝑁𝑁 + 3.84 �𝑅𝑅𝐶𝐶𝐶𝐶𝑠𝑠 + 1.92𝑁𝑁 � − 1.96𝑁𝑁𝑁𝑁 + 3.84 �𝑅𝑅𝐶𝐶𝐶𝐶𝑠𝑠�1 − 𝑅𝑅𝐶𝐶𝐶𝐶𝑠𝑠�𝑁𝑁 + 0.96𝑁𝑁2 , 0 ≤ 𝑅𝑅𝐶𝐶𝐶𝐶𝑠𝑠,𝐿𝐿 𝐶𝐶 ≤ 1 and 𝑅𝑅𝑠𝑠𝑠𝑠𝑠𝑠,𝑈𝑈 𝐿𝐿 is calculated based on the normal approximation interval, also with 95% confidence, as 𝑅𝑅𝐶𝐶𝐶𝐶𝑠𝑠,𝑈𝑈 𝐶𝐶 = 𝑅𝑅𝐶𝐶𝐶𝐶𝑠𝑠 + 1.96�𝑅𝑅𝐶𝐶𝐶𝐶𝑠𝑠�1 − 𝑅𝑅𝐶𝐶𝐶𝐶𝑠𝑠�𝑁𝑁 , 0 ≤ 𝑅𝑅𝐶𝐶𝐶𝐶𝑠𝑠,𝑈𝑈 𝐶𝐶 ≤ 1 The upper confidence bound for the significant set of CEC values is calculated as 𝐶𝐶 𝐸𝐸𝐿𝐿,𝑠𝑠𝑠𝑠 𝑠𝑠 ,𝑈𝑈 𝐿𝐿 = 𝐶𝐶 𝐸𝐸𝐿𝐿,𝑠𝑠𝑠𝑠 𝑠𝑠 ,𝜇𝜇 + 𝐶𝐶𝛼𝛼 2⁄ 𝐶𝐶𝐸𝐸𝐿𝐿,𝑠𝑠𝑠𝑠 𝑠𝑠 ,𝜎𝜎 �𝑁𝑁𝑠𝑠𝑠𝑠𝑠𝑠
where 𝐶𝐶𝐸𝐸𝑠𝑠𝑠𝑠𝑠𝑠,𝜇𝜇 and 𝐶𝐶 𝐸𝐸𝑠𝑠𝑠𝑠𝑠𝑠,𝜎𝜎 are the sample mean and sample standard deviation of the significant CEC set, and 𝐶𝐶𝛼𝛼 2⁄ is the quantile of the Student’s t-distribution with degrees of freedom of 𝑁𝑁𝐶𝐶𝐶𝐶𝑠𝑠 − 1 and two-sided 95% confidence level.6
10.2.2 Correlation between Intervals.
Because the area of the Earth’s surface affected by failures in an interval largely overlaps the area affected by failures in neighboring intervals, sample sets may be combined, thus reducing the need to run additional samples. Combining is acceptable when the time history of CEC for the random attitude failure mode shows consistent statistical properties. This is especially useful when there is a consistent mean and a significant scatter of CEC with respect to time. For example, as shown in the figure below, it would be reasonable to use all the E(C|Event) data from 100s to 270s to determine the maximum CEC for the phase of flight. This approach allows for a more accurate determination of the confidence interval with fewer samples.
6 The value of 𝐶𝐶𝛼𝛼 2⁄ corresponds to the inverse of the t-distribution cumulative distribution function at 𝑃𝑃 = 1 − 𝛼𝛼 2⁄ .
For example, for a confidence level of 95%, 𝛼𝛼 = 0.1, and, for ten degrees of freedom, 𝐶𝐶𝛼𝛼 2⁄ ≈ 1.8.
Revision B 20
Figure – 1. Example of time period of stable CEC with scatter 11 EVALUATING CEC RESULTS.
11.1 Comparison to Threshold Criteria.
To demonstrate compliance with §§ 450.101(c)(2) or 450.108(b), CEC should be calculated without considering flight abort. This means that the vehicle responses to all failures are based only on the physics of the instigating event and the vehicle’s response to that event. For the default CEC measure, § 450.101(c)(2) requires evaluation against the threshold value of 1 × 10-3. If this value is not exceeded by the maximum CEC value of any reasonably foreseeable failure mode in any significant period of flight, then no additional mitigations of high consequence events are required.
11.1.1 CEC Evaluation Timeline.
The evaluation of CEC should be performed during vehicle design, well before an operation takes place. It is generally not feasible to add a flight safety system during the preparation for a specific operation. Thus, the determination whether flight abort will be used as a hazard control strategy, and whether it must meet the requirements of § 450.145 or § 450.143 should be made long before a specific launch or reentry operation is planned. Therefore, such a determination should be made considering all contemplated operation profiles, vehicle variations, and environmental conditions.
Thus, usually the CEC evaluation and flight abort determination is made with significant margin to allow for changes in the planned operational conditions. However, different operational conditions could require a reevaluation of the determination, such as if a flight could expose significantly more population.
Revision B 21
11.1.2 Validating CEC.
A flight safety analysis must include risk analysis, per § 450.135(a) and § 450.137(a), that demonstrates compliance with the safety criteria of § 450.101. This includes any CEC calculations required to meet the high consequence event protection requirements of § 450.101(c). The debris risk analysis must be computed either prior to the day of the operation, accounting for all foreseeable conditions within the flight commit criteria, or during the countdown using the best available input data, including flight commit criteria and flight abort rules (§ 450.135(a)). The CEC analysis should be performed prior to the day of launch covering all foreseeable conditions. This should account for potential variations in trajectories, winds, and population. As discussed in the previous paragraph, normally the initial CEC determination includes sufficient margin that specific operations do not necessitate confirmation of meeting the requirements. In, accordance with § 450.165(a)(7), when an FSS is used as a hazard control, the operator must verify that the conditions prior to flight are consistent with the CEC analysis in order to satisfy the requirements of § 450.101.
11.2 FSS Requirements for High Consequence Event Protection.
If the § 450.101(c)(2) threshold is exceeded and an operator cannot comply with § 450.101(c)(3), then an operator must protect against a high consequence event in uncontrolled areas for each phase of flight by meeting § 450.101(c)(1), which requires the operator to use flight abort as a hazard control strategy in accordance with the requirements of § 450.108. Section 450.108(b) requires an operator to use a flight safety system that meets § 450.143 if the consequence of any reasonably foreseeable failure mode in any significant period of flight is between 1 × 10-2 and 1 × 10-3 conditional expected casualties in uncontrolled areas, or § 450.145 if the consequence of any reasonably foreseeable failure mode in any significant period of flight is greater than 1 × 10-2 conditional expected casualties in uncontrolled areas. Additional guidance for flight abort is available in AC 450.108-1, Flight Abort Rule Development.