Revision B
CONTENTS (CONTINUED) Paragraph Page iii
9 Calculating Conditional Expected Casualty14
9.1 Mathematics of CEC14
9.2 Computation of CEC15
9.3 Accuracy of CEC16
10 Approach when using Discrete Failure Simulations17
10.1 Event Sampling17
10.1.1 Minimum Sample Size17
10.1.2 Numerical Resolution17
10.1.3 Significant Samples18
10.2 Satisfying the CEC Criterion18
10.2.1 Computing Statistical Values for CEC19
10.2.2 Correlation between Intervals19
11 Evaluating CEC Results20
11.1 Comparison to Threshold Criteria20
11.1.1 CEC Evaluation Timeline20
11.1.2 Validating CEC21
11.2 FSS Requirements for High Consequence Event Protection21
12 Alternate Means of Compliance22
12.1 Using Risk Profile Curves22
12.2 The General Aviation Risk Profile23
12.3 Compliance with High Consequence Event Protection23
13 Demonstrated Reliability24
13.1 Required Reliability24
13.2 Demonstrating Reliability24
13.3 Existing Aviation Data24
Revision B 1 Principal Changes Revision B updates AC 450.101-1A, High Consequence Event Protection, dated May 20, 2021. This AC change deletes paragraph 13.3 and 13.5 and reassigns paragraph 13.4 as paragraph 13.3.
Revision B 2 1 PURPOSE.
1.1 This Advisory Circular (AC) describes a method to demonstrate compliance with the high consequence event protection requirements of title 14 of the Code of Federal Regulations (14 CFR) § 450.101(c) and the requirements to evaluate the potential for high consequence events in uncontrolled areas in accordance with §§ 450.108(b) and
450.108(c)(4). This AC provides an acceptable means to demonstrate compliance with § 450.101(c)(2) and § 450.101(c)(3) and provides an acceptable means of compliance with conditional expected casualties requirements in § 450.108. This AC also provides guidance for an operator that chooses to propose an alternative method that produces an equivalent level of safety to the requirements in § 450.101(c)(2).
1.2 An operator may initiate the flight of a launch vehicle only if all risks to the public satisfy the criteria of § 450.101(a). The collective risk, measured as expected number of casualties (EC), consists of risk posed by impacting inert debris, explosive debris, toxic release, and far field blast overpressure. Individual risk, measured as probability of casualty (PC), also consists of risk posed by impacting inert debris, explosive debris, toxic release, and far field blast overpressure. Public risk due to any other hazard associated with the proposed flight of a launch vehicle is determined by the FAA Administrator on a case-by-case basis.
1.3 Section 450.101(c) requires an operator to protect against a high consequence event in uncontrolled areas for each phase of flight by using flight abort as a hazard control strategy in accordance with the requirements of § 450.108; ensuring the consequence of any reasonably foreseeable failure mode, in any significant period of flight, is no greater than 1 × 10-3 conditional expected casualties; or establishing the launch or reentry vehicle has sufficient demonstrated reliability as agreed to by the Administrator based on conditional expected casualties criteria during that phase of flight.
1.4 Throughout this document, the word “must” characterizes statements that directly flow from regulatory text and therefore reflect regulatory mandates. The word “should” describes a requirement if electing to use this means of compliance; variation from these requirements is possible, but it must be justified and approved as an alternative means of compliance. The word “may” describes variations or alternatives allowed within the accepted means of compliance set forth in this AC. In general, these alternative approaches can be used only under certain situations that do not compromise safety.
1.5 Cancellation.
This AC cancels AC 450.101-1A High Consequence Event Protection, dated May 20, 2021.
Revision B 3 2 APPLICABILITY.
2.1 The guidance in this AC is for launch and reentry vehicle applicants and operators required to comply with 14 CFR part 450. The guidance in this AC is for those seeking a launch or reentry vehicle operator license, a licensed operator seeking to renew or modify an existing vehicle operator license, and FAA commercial space transportation evaluators.
2.2 The material in this AC is advisory in nature and does not constitute a regulation. This guidance is not legally binding in its own right and will not be relied upon by the FAA as a separate basis for affirmative enforcement action or other administrative penalty.
Conformity with this guidance document (as distinct from existing statutes and regulations) is voluntary only, and nonconformity will not affect rights and obligations under existing statutes and regulations. This AC describes acceptable means, but not the only means, for demonstrating compliance with the applicable regulations.
2.3 The material in this AC does not change or create any additional regulatory requirements, nor does it authorize changes to, or deviations from, existing regulatory requirements.
3 APPLICABLE REGULATIONS AND RELATED DOCUMENTS.
3.1 Related Statute.
• 51 U.S.C. Subtitle V, Chapter 509.
3.2 Related FAA Commercial Space Transportation Regulations.
The following regulations from title 14 of the CFR must be accounted for when showing compliance with § 450.101(c). The full text of these regulations can be downloaded from the U.S. Government Printing Office e-CFR. A paper copy can be ordered from the Government Printing Office, Superintendent of Documents, Attn: New Orders, PO Box 371954, Pittsburgh, PA, 15250-7954.
• Section 401.7, Definitions.
• Section 440.7, Determination of Maximum Probable Loss.
• Section 450.108, Flight Abort.
• Section 450.115, Flight Safety Analysis Methods.
• Section 450.131, Probability of Failure Analysis.
• Section 450.133, Flight Hazard Area Analysis.
• Section 450.135, Debris Risk Analysis.
• Section 450.137, Far-field Overpressure Blast Effects Analysis.
• Section 450.139, Toxic Hazards for Flight.
• Section 450.161, Control of Hazard Areas.
Revision B 4
• Section 450.165, Flight Commit Criteria.
• Section 450.213, Pre-flight Reporting.
3.3 Related FAA Advisory Circulars.
FAA Advisory Circulars (are or will be available through the FAA website, http://www.faa.gov).
• AC 450.107-1, Hazard Control Strategies Determination, dated July 27, 2021.
• AC 450.108-1, Flight Abort Rule Development, dated July 27, 2021.
• AC 450.115-1A, High Fidelity Flight Safety Analysis, dated June 24, 2021.
• AC 450.117-1, Trajectory Analysis for Normal Flight, dated August 19, 2021.
• AC 450.123-1, Population Exposure Analysis, dated October 12, 2022.
• AC 450.131-1, Probability of Failure, when published.
• AC 450.137-1, De Minimus Distance Focusing Overpressure Risk Analysis, when published.
• AC 450.137-2, Distance Focusing Overpressure Risk Analysis, when published.
• AC 23-1309-1E, System Safety Analysis and Assessment for Part 23 Airplanes, dated November 17, 2011.
• AC 25-1309-1A, System Design and Analysis, dated June 21, 1988.
3.4 Documents Related to High Consequence Event Protection.
1. Allahdadi, Firooz A., Isabelle Rongier, Tommaso Sgobba, and Paul D. Wilde, Safety Design for Space Operations, Sponsored by The International Association for the Advancement of Space Safety, Elsevier, Watham, MA, 2013.
2. Collins, J.D., C.P. Brinkman, and S.L. Carbon, Determination of Maximum Probable Loss, ACTA Inc. and Federal Aviation Administration, (2007).
3. Risk Committee, Range Safety Group, Range Commanders Council, Common Risk Criteria for National Test Ranges, RCC 321-20, White Sands, NM, May 2020.
4. Federal Register, Vol. 67, No. 146, July 30, 2002, page 49465.
Revision B 5 4 DEFINITION OF TERMS.
For this AC, the terms and definitions from § 401.7, and this list, apply:
4.1 Failure Mode A failure mode is a category of potentially hazardous events that share significant similarity in system response, prior to consideration of mitigations or hazard control strategies.
4.2 Maximum Conditional Expected Casualty (CEC) The highest CEC value calculated for a particular phase of flight considering all reasonably foreseeable failure modes.
4.3 Multiple Casualty Event An incident that has significant likelihood of seriously injuring more than one person.
4.4 Phase of Flight A period of flight between two milestones in the vehicle flight sequence, which is not necessarily a set period of time.
4.5 Statistically Valid A “statistically valid” analysis is the result of a sound application of mathematics and accounts for the uncertainty in any statistical inference due to sample size limits, the degree of applicability of data to a particular system, and the degree of homogeneity of the data. The specific approach to establish statistical validity depends on the context of the particular analysis, as described in this AC and others.
5 HIGH CONSEQUENCE EVENT PROTECTION OVERVIEW.
In accordance with § 450.101(c), an operator may use any of the three following methods to demonstrate protection against high consequence events:
• Using flight abort as a hazard control strategy in accordance with the requirements of § 450.108;
• Ensuring the consequence of any reasonably foreseeable failure mode, in any significant period of flight, is no greater than 1 × 10-3 conditional expected casualties; or
• Establishing the launch or reentry vehicle has sufficient demonstrated reliability as agreed to by the Administrator based on the conditional expected casualties criteria during that phase of flight.
• High consequence events include incidents that could involve multiple casualties, massive toxic exposures, extensive property or environmental damage, or events that jeopardize the national security or foreign policy interests of the United States.
Revision B 6 6 HIGH CONSEQUENCE EVENT PROTECTION SCOPE.
When evaluating the potential for high consequence events, the applicant should identify the phases of flight, the potential for high consequence events, and evaluate the potential for high consequence events in uncontrolled areas.
6.1 Phases of Flight.
A phase of flight refers to a period of flight between two milestones in the vehicle flight sequence, which is not necessarily a set period of time, where the probability of failure distribution for each reasonably foreseeable failure mode is homogenous.1 For example, a stage may burn for a longer or shorter period of time depending on the performance of the rocket motor. This can be for selected periods of flight during launch and reentry that an operator will identify and analyze in a consistent manner using quantifiable measurements or observable records. In defining “phases of flight,” the operator should:
• Ensure that the combination of all phases of flight covers the full duration of the flight within the scope defined in § 450.113(a).
• Define new phases of flight to identify the transition where the operator plans to use different strategies for protecting against high consequence events for different portions of flight.
• Not include more than one key flight safety event in each phase of flight. Key flight safety events are those flight activities that have an increased risk compared with other portions of flight. An operator’s flight safety analysis method must account for all reasonably foreseeable events and failures of safety-critical systems during nominal and non-nominal launch or reentry that could jeopardize public safety, in accordance with § 450.115(a). Additional guidance is provided in AC 450.115-1, High Fidelity Flight Safety Analysis. Key flight safety events should also include, at a minimum:
1. Ignition of any primary rocket engine or any change in the source of propulsion;
2. Any staging event or change to the outer mold line;
3. Any hardware configuration of the vehicle being altered from the previous time periods by jettisoning hardware, such as fairings or stages;
4. Any change to the control system (e.g., reaction control system vs. aero surfaces such as fins, or the guidance algorithm);
5. A significant change in dynamic pressure or aerodynamic heating to which the launch or reentry system is subjected; and
6. A significant change in the environment for any safety critical system.
1 Here, a failure probability distribution is considered homogeneous if there are no discontinuities and the failure probability distribution is defined by a single mathematical function (e.g., a linear, exponential, or uniform distribution). In accordance with § 450.131(e), a probability of failure analysis must use a constant conditional failure rate for each phase of flight, unless there is clear and convincing evidence of a different conditional failure rate for a particular vehicle, stage, or phase of flight.
Revision B 7
• The minimum length of a flight phase should be sufficient to allow for implementation of a risk mitigation, including adequate time buffers to account for uncertainty. Moreover, and similar to § 450.131(a), an operator should apply flight phase definitions consistently throughout a flight and base these definitions on physically observable phenomena.
6.2 Potential for High Consequence Events.
Section 450.101(c) requires that an operator must protect against a high consequence event in uncontrolled areas for each phase of flight.
6.3 Uncontrolled Areas.
The applicant is only required to evaluate the potential for high consequence events in uncontrolled areas, in accordance with §§ 450.101(c), 450.108(b)(1) and (2), and
450.108(c)(4). In accordance with the definition in § 401.7, an uncontrolled area is an area not controlled by a launch or reentry operator, a launch or reentry site operator, an adjacent site operator, or other entity by agreement. Typically, uncontrolled areas include all regions outside of the launch or reentry operators’ property, and outside of the site operator’s property. Adjacent operators’ property and other real estate may be excluded when there is a formal agreement between the launch or reentry operator and the owner of such real estate. An operator could satisfy the requirement to evaluate the potential for high consequence events in uncontrolled areas by evaluating the potential for high consequence events in all areas of land where there is no ability to prevent unauthorized access or otherwise by ensuring that no unauthorized persons are present during a launch or reentry operation.
6.4 Controlled Areas.
An area may be considered controlled only if there is an ability: (1) to prevent unauthorized access or otherwise ensure that no unauthorized persons are present, and
(2) to manage the location of any persons that are present during a launch or reentry operation. For any areas considered to be controlled for a launch or reentry operation, the licensee should coordinate any high consequence protection measures with the controlling authority.
Revision B 8 7 USING FLIGHT ABORT AS A HAZARD CONTROL STRATEGY.
7.1 Flight abort is intended to prevent adverse consequences in the case of a failure, which, in turn, mitigates the potential for a high consequence event. Design of flight abort criteria must address the potential for a flight abort adversely impacting public safety by triggering hazardous debris impacts in accordance with § 450.108(f)(2). Due to the potential consequences of initiating flight abort, the FAA has adopted regulations specific to its use which are codified in § 450.108. Section 450.108 applies to the use of flight abort as a hazard control strategy for the flight. In summary, it requires that an operator must use a flight safety system that meets the standards of § 450.145 or § 450.143 and meets the flight safety requirements in § 450.108.
7.2 Section 450.101(c)(1) provides that an applicant may use flight abort as a hazard control strategy in accordance with the requirements of § 450.108 to protect against a high consequence event in uncontrolled areas for a phase of flight. Guidance for meeting the requirements of § 450.108 is available in AC 450.108-1, Flight Abort Rule Development. If an applicant uses flight abort in accordance with § 450.108, it meets the requirements of § 450.101(c)(1). The flight safety limits objectives in § 450.101(c) can be met without computing CEC if, in accordance with § 450.108(c)(6), the operator uses flight safety limits that prevent debris capable of causing a casualty due to any hazard from affecting uncontrolled areas using a flight safety system that complies with § 450.145.
Revision B 9 8 USING CONDITIONAL EXPECTED CASUALTY.
8.1 Risk Analysis.
When the risk from high consequence events must be demonstrated to comply with §§ 450.101(c)(2), 450.108(b), or 450.108(c)(4), the risk must be quantified in terms of conditional expected casualties (CEC). CEC is one way to measure the risk of a multiple casualty events, one class of high consequence events. This metric is calculated as part of the debris risk analyses in accordance with:
• Section 450.135(b), as described in AC 450.115-1, High Fidelity Flight Safety Analysis,
• The toxic risk analyses in accordance with § 450.139(f)(8)(ii)(1), as described in AC 450.139-1, Toxic Release Hazards Analysis, and
• The far-field overpressure risk analysis in accordance with § 450.137(c), as described in AC 450.137-1, Distance Focusing Overpressure Risk Analysis.
8.1.1 Specifically, an operator must manage the risk of casualties that could arise from the exposure to toxic release by performing a toxic risk assessment in accordance with § 450.139(e), or managing the risk of any casualty from the exposure to a toxic release through containment in accordance with § 450.139(d).
8.1.2 The type of consequence that is the focus of the requirement is that of serious injury or worse, (i.e., a casualty), for any member of the public located in an uncontrolled area. In 2002, the FAA found that the use of abbreviated injury scale (AIS) Level 3 or greater is appropriate for describing a medical condition sufficiently to allow modeling of casualties for purposes of determining whether a launch satisfies the public risk criteria, as stated in reference number [4] of paragraph 3.4 of this AC.
8.1.3 The injuries do not have to occur as a direct result of the impact, but could be from secondary effects of the impact such as subsequent ground fires or nearby facility liquid tank explosions as accounted for in accordance with § 450.135(b)(3), which requires that the debris risk analysis account for any impact or effects of hazardous debris.
AC 450.115-1, High Fidelity Flight Safety Analysis provides guidance on computing valid casualty areas that account for the effects of hazardous debris.
8.2 Determining “Reasonably Foreseeable” Failure Modes.
An operator is not required to evaluate CEC for all conceivable failure modes, but only those that are reasonably foreseeable in accordance with §§ 450.101(c)(2),
450.108(b)(1) and (2), and 450.108(c)(4).
Revision B 10
8.2.1 Failure Modes.
As part of § 450.115(a), the operator’s flight safety analysis, which includes the CEC analysis, must account for all reasonably foreseeable events and failures of safety-critical systems during nominal and non-nominal launch or reentry that could jeopardize public safety. Thus, one means of complying with §§ 450.101(c)(2),
450.108(b)(1) and (2), and 450.108(c)(4) is to include all reasonably foreseeable events, and the failures of safety-critical systems during nominal and non-nominal launch or reentry, as part of the CEC analysis of reasonably foreseeable failure modes. Failure modes are categories of hazardous events that share significant similarity in cause and system response, prior to consideration of mitigations or hazard control strategies.
8.2.2 Identification of Reasonably Foreseeable Events.
“Reasonably foreseeable hazardous events” are events identifiable through the system safety process, including events that have occurred in the past for similar vehicles.2 The term “reasonably foreseeable” is not associated with a probability threshold. Rather, an event is “reasonably foreseeable” if it is identifiable by a methodical assessment of the entire system. In other words, “brainstorming” is not a sufficient approach, because “brainstorming” is not a methodical assessment of the entire system. Per § 450.107(b), a functional hazard analysis is required. The functional hazard analysis is primarily used to identify and classify the overall system functions and consequences of functional failure or malfunction. The objective is to identify all potential system, subsystem, and component functional failures that could impact public safety which, in turn, would identify all reasonably foreseeable hazardous events. It is important to note that the identification of potential system safety hazards and respective functional sources
(i.e., subsystem functional failures) should not consider any foreseeable mitigation or predetermined hazard control strategy.
8.3 Known Failure Modes.
For this means of compliance, a CEC analysis should, at a minimum, account for any applicable failures, as defined in § 450.131(b), in previous launch and reentry history, and should include any other failure modes identified as part of the system safety program hazard management under § 450.103(b). A list of failure modes that are commonly evaluated in analyses is given below. Some of these modes occur over the entire active mission duration, while others need only be evaluated for some phases of flight, or for specific moments in time. Although not listed, other failure modes may exist or be likely for specific vehicles or situations. When relevant, these failures must be included as part of an operator’s flight safety analysis, in accordance with § 450.115(a). In general, a flight safety analysis should account for all failure modes in which CEC can potentially reach threshold criteria.
2See AC 450.131-1 for additional discussion of what constitutes a similar vehicle.
Revision B 11
8.3.1 Loss of Thrust.
The loss of thrust failure mode refers to a failure resulting from the loss of vehicle thrust due to a malfunction of the vehicle propulsion system that occurs while the vehicle is following a normal trajectory. Typical causes of loss of thrust are by a motor failure resulting in loss of propulsion or the control system shutting down thrust at an unplanned time. This commonly applies to liquid propellant motors.
8.3.2 Attitude Control Failure.
The attitude control failure mode results from of an inability to control orientation. This may occur due to thrust vector control failure (e.g., actuator failure, movable nozzle failure, or hydraulics failure), attitude control thruster failure, pointing error (as in a spin stabilized vehicle), aero-surface control failure, or attitude sensor failure. Attitude control failure may include an improper control model but does not include failure of guidance computers or navigation sensors.
8.3.3 Guidance and/or Navigation Failure.
The guidance or navigation failure mode refers to failure of a rocket’s guidance system, including failures due to guidance computer, navigation sensors, guidance software errors, or other sensors used for vehicle attitude guidance, but not failures due to the inability of the control system to act on guidance commands.
8.3.4 On-T rajectory Explosion.
On-trajectory failures are characterized by any size explosion of the vehicle while it is following a normal trajectory. This typically results from rupturing of a solid rocket motor casing or a liquid engine explosion. It can also occur from inadvertent activation of a destruct system.
8.3.5 On-Trajectory Structural Failure.
On-trajectory structural failures result from exposure of the hardware to excessive loading (loading due to thrust, aerodynamic forces, inertial loads, etc.), excessive vibration, etc. This may be caused by environmental factors or by design or manufacturing errors. This includes breakup of any portion of the structure (including the payload fairing) but does not include premature jettison of the payload fairing. This failure is intended to capture break-ups that are not pressure or combustion driven. A structural failure does not include structural breakup resulting from another failure or intentional activation of the destruct system.
8.3.6 On-Trajectory Tank Failure.
The tank failure mode refers to failure of the rocket’s structure that are pressurant or cryogenic driven that do not result in combustion as a driving source for debris dispersion. A tank failure does not include structural breakup resulting from another failure or intentional activation of the destruct system.