AC 450.101-1B

U.S. Department of Transportation Federal Aviation Administration Advisory Circular Subject: High Consequence Event Protection Date: 05-03-2024 Initiated By: ASA-1 AC No: 450.101-1 Revision B

Daniel Murray Executive Director, Office of Operational Safety Commercial Space Transportation This Advisory Circular (AC) describes a method to demonstrate compliance with the high consequence event protection requirements of title 14 of the Code of Federal Regulations (14 CFR) § 450.101(c) and the requirements to evaluate the potential for high consequence events in uncontrolled areas in accordance with §§ 450.108(b) and 450.108(c)(4). This AC also provides guidance for an operator that chooses to propose an alternative method that produces an equivalent level of safety to the requirements in § 450.101(c)(2).

This AC describes acceptable means, but not the only means, for demonstrating compliance with the applicable regulations. It is intended to assist prospective applicants in obtaining commercial space authorizations and operating in compliance with commercial space regulations. The contents of this document do not have the force and effect of law and are not meant to bind the public in any way, and the document is intended only to provide clarity to the public regarding existing requirements under the law or agency policies.

If you have suggestions for improving this AC, you may use the Advisory Circular Feedback form at the end of this AC.

Revision B

CONTENTS Paragraph Page ii

1 Purpose2

2 Applicability3

3 Applicable Regulations and Related Documents3

4 Definition of Terms5

5 High Consequence Event Protection Overview5

6 High Consequence Event Protection Scope6

6.1 Phases of Flight6

6.2 Potential for High Consequence Events7

6.3 Uncontrolled Areas7

6.4 Controlled Areas7

7 Using Flight Abort As A Hazard Control Strategy8

8 Using Conditional Expected Casualty9

8.1 Risk Analysis9

8.2 Determining “Reasonably Foreseeable” Failure Modes9

8.2.1 Failure Modes10

8.2.2 Identification of Reasonably Foreseeable Events10

8.3 Known Failure Modes10

8.3.1 Loss of Thrust11

8.3.2 Attitude Control Failure11

8.3.3 Guidance and/or Navigation Failure11

8.3.4 On-Trajectory Explosion11

8.3.5 On-Trajectory Structural Failure11

8.3.6 On-Trajectory Tank Failure11

8.3.7 Failure to Perform Configuration Change12

8.3.8 Premature Configuration Change12

8.3.9 Critical Performance Failure12

8.3.10 Failure to Ignite12

8.3.11 Failure to Shutoff12

8.4 Determining the Significant Period of Flight13

Revision B

CONTENTS (CONTINUED) Paragraph Page iii

9 Calculating Conditional Expected Casualty14

9.1 Mathematics of CEC14

9.2 Computation of CEC15

9.3 Accuracy of CEC16

10 Approach when using Discrete Failure Simulations17

10.1 Event Sampling17

10.1.1 Minimum Sample Size17

10.1.2 Numerical Resolution17

10.1.3 Significant Samples18

10.2 Satisfying the CEC Criterion18

10.2.1 Computing Statistical Values for CEC19

10.2.2 Correlation between Intervals19

11 Evaluating CEC Results20

11.1 Comparison to Threshold Criteria20

11.1.1 CEC Evaluation Timeline20

11.1.2 Validating CEC21

11.2 FSS Requirements for High Consequence Event Protection21

12 Alternate Means of Compliance22

12.1 Using Risk Profile Curves22

12.2 The General Aviation Risk Profile23

12.3 Compliance with High Consequence Event Protection23

13 Demonstrated Reliability24

13.1 Required Reliability24

13.2 Demonstrating Reliability24

13.3 Existing Aviation Data24

Revision B 1 Principal Changes Revision B updates AC 450.101-1A, High Consequence Event Protection, dated May 20, 2021. This AC change deletes paragraph 13.3 and 13.5 and reassigns paragraph 13.4 as paragraph 13.3.

Revision B 2 1 PURPOSE.

1.1 This Advisory Circular (AC) describes a method to demonstrate compliance with the high consequence event protection requirements of title 14 of the Code of Federal Regulations (14 CFR) § 450.101(c) and the requirements to evaluate the potential for high consequence events in uncontrolled areas in accordance with §§ 450.108(b) and

450.108(c)(4). This AC provides an acceptable means to demonstrate compliance with § 450.101(c)(2) and § 450.101(c)(3) and provides an acceptable means of compliance with conditional expected casualties requirements in § 450.108. This AC also provides guidance for an operator that chooses to propose an alternative method that produces an equivalent level of safety to the requirements in § 450.101(c)(2).

1.2 An operator may initiate the flight of a launch vehicle only if all risks to the public satisfy the criteria of § 450.101(a). The collective risk, measured as expected number of casualties (EC), consists of risk posed by impacting inert debris, explosive debris, toxic release, and far field blast overpressure. Individual risk, measured as probability of casualty (PC), also consists of risk posed by impacting inert debris, explosive debris, toxic release, and far field blast overpressure. Public risk due to any other hazard associated with the proposed flight of a launch vehicle is determined by the FAA Administrator on a case-by-case basis.

1.3 Section 450.101(c) requires an operator to protect against a high consequence event in uncontrolled areas for each phase of flight by using flight abort as a hazard control strategy in accordance with the requirements of § 450.108; ensuring the consequence of any reasonably foreseeable failure mode, in any significant period of flight, is no greater than 1 × 10-3 conditional expected casualties; or establishing the launch or reentry vehicle has sufficient demonstrated reliability as agreed to by the Administrator based on conditional expected casualties criteria during that phase of flight.

1.4 Throughout this document, the word “must” characterizes statements that directly flow from regulatory text and therefore reflect regulatory mandates. The word “should” describes a requirement if electing to use this means of compliance; variation from these requirements is possible, but it must be justified and approved as an alternative means of compliance. The word “may” describes variations or alternatives allowed within the accepted means of compliance set forth in this AC. In general, these alternative approaches can be used only under certain situations that do not compromise safety.

1.5 Cancellation.

This AC cancels AC 450.101-1A High Consequence Event Protection, dated May 20, 2021.

Revision B 3 2 APPLICABILITY.

2.1 The guidance in this AC is for launch and reentry vehicle applicants and operators required to comply with 14 CFR part 450. The guidance in this AC is for those seeking a launch or reentry vehicle operator license, a licensed operator seeking to renew or modify an existing vehicle operator license, and FAA commercial space transportation evaluators.

2.2 The material in this AC is advisory in nature and does not constitute a regulation. This guidance is not legally binding in its own right and will not be relied upon by the FAA as a separate basis for affirmative enforcement action or other administrative penalty.

Conformity with this guidance document (as distinct from existing statutes and regulations) is voluntary only, and nonconformity will not affect rights and obligations under existing statutes and regulations. This AC describes acceptable means, but not the only means, for demonstrating compliance with the applicable regulations.

2.3 The material in this AC does not change or create any additional regulatory requirements, nor does it authorize changes to, or deviations from, existing regulatory requirements.

3 APPLICABLE REGULATIONS AND RELATED DOCUMENTS.

3.1 Related Statute.

• 51 U.S.C. Subtitle V, Chapter 509.

3.2 Related FAA Commercial Space Transportation Regulations.

The following regulations from title 14 of the CFR must be accounted for when showing compliance with § 450.101(c). The full text of these regulations can be downloaded from the U.S. Government Printing Office e-CFR. A paper copy can be ordered from the Government Printing Office, Superintendent of Documents, Attn: New Orders, PO Box 371954, Pittsburgh, PA, 15250-7954.

• Section 401.7, Definitions.

• Section 440.7, Determination of Maximum Probable Loss.

• Section 450.108, Flight Abort.

• Section 450.115, Flight Safety Analysis Methods.

• Section 450.131, Probability of Failure Analysis.

• Section 450.133, Flight Hazard Area Analysis.

• Section 450.135, Debris Risk Analysis.

• Section 450.137, Far-field Overpressure Blast Effects Analysis.

• Section 450.139, Toxic Hazards for Flight.

• Section 450.161, Control of Hazard Areas.

Revision B 4

• Section 450.165, Flight Commit Criteria.

• Section 450.213, Pre-flight Reporting.

3.3 Related FAA Advisory Circulars.

FAA Advisory Circulars (are or will be available through the FAA website, http://www.faa.gov).

• AC 450.107-1, Hazard Control Strategies Determination, dated July 27, 2021.

• AC 450.108-1, Flight Abort Rule Development, dated July 27, 2021.

• AC 450.115-1A, High Fidelity Flight Safety Analysis, dated June 24, 2021.

• AC 450.117-1, Trajectory Analysis for Normal Flight, dated August 19, 2021.

• AC 450.123-1, Population Exposure Analysis, dated October 12, 2022.

• AC 450.131-1, Probability of Failure, when published.

• AC 450.137-1, De Minimus Distance Focusing Overpressure Risk Analysis, when published.

• AC 450.137-2, Distance Focusing Overpressure Risk Analysis, when published.

• AC 23-1309-1E, System Safety Analysis and Assessment for Part 23 Airplanes, dated November 17, 2011.

• AC 25-1309-1A, System Design and Analysis, dated June 21, 1988.

3.4 Documents Related to High Consequence Event Protection.

1. Allahdadi, Firooz A., Isabelle Rongier, Tommaso Sgobba, and Paul D. Wilde, Safety Design for Space Operations, Sponsored by The International Association for the Advancement of Space Safety, Elsevier, Watham, MA, 2013.

2. Collins, J.D., C.P. Brinkman, and S.L. Carbon, Determination of Maximum Probable Loss, ACTA Inc. and Federal Aviation Administration, (2007).

3. Risk Committee, Range Safety Group, Range Commanders Council, Common Risk Criteria for National Test Ranges, RCC 321-20, White Sands, NM, May 2020.

4. Federal Register, Vol. 67, No. 146, July 30, 2002, page 49465.

Revision B 5 4 DEFINITION OF TERMS.

For this AC, the terms and definitions from § 401.7, and this list, apply:

4.1 Failure Mode A failure mode is a category of potentially hazardous events that share significant similarity in system response, prior to consideration of mitigations or hazard control strategies.

4.2 Maximum Conditional Expected Casualty (CEC) The highest CEC value calculated for a particular phase of flight considering all reasonably foreseeable failure modes.

4.3 Multiple Casualty Event An incident that has significant likelihood of seriously injuring more than one person.

4.4 Phase of Flight A period of flight between two milestones in the vehicle flight sequence, which is not necessarily a set period of time.

4.5 Statistically Valid A “statistically valid” analysis is the result of a sound application of mathematics and accounts for the uncertainty in any statistical inference due to sample size limits, the degree of applicability of data to a particular system, and the degree of homogeneity of the data. The specific approach to establish statistical validity depends on the context of the particular analysis, as described in this AC and others.

5 HIGH CONSEQUENCE EVENT PROTECTION OVERVIEW.

In accordance with § 450.101(c), an operator may use any of the three following methods to demonstrate protection against high consequence events:

• Using flight abort as a hazard control strategy in accordance with the requirements of § 450.108;

• Ensuring the consequence of any reasonably foreseeable failure mode, in any significant period of flight, is no greater than 1 × 10-3 conditional expected casualties; or

• Establishing the launch or reentry vehicle has sufficient demonstrated reliability as agreed to by the Administrator based on the conditional expected casualties criteria during that phase of flight.

• High consequence events include incidents that could involve multiple casualties, massive toxic exposures, extensive property or environmental damage, or events that jeopardize the national security or foreign policy interests of the United States.

Revision B 6 6 HIGH CONSEQUENCE EVENT PROTECTION SCOPE.

When evaluating the potential for high consequence events, the applicant should identify the phases of flight, the potential for high consequence events, and evaluate the potential for high consequence events in uncontrolled areas.

6.1 Phases of Flight.

A phase of flight refers to a period of flight between two milestones in the vehicle flight sequence, which is not necessarily a set period of time, where the probability of failure distribution for each reasonably foreseeable failure mode is homogenous.1 For example, a stage may burn for a longer or shorter period of time depending on the performance of the rocket motor. This can be for selected periods of flight during launch and reentry that an operator will identify and analyze in a consistent manner using quantifiable measurements or observable records. In defining “phases of flight,” the operator should:

• Ensure that the combination of all phases of flight covers the full duration of the flight within the scope defined in § 450.113(a).

• Define new phases of flight to identify the transition where the operator plans to use different strategies for protecting against high consequence events for different portions of flight.

• Not include more than one key flight safety event in each phase of flight. Key flight safety events are those flight activities that have an increased risk compared with other portions of flight. An operator’s flight safety analysis method must account for all reasonably foreseeable events and failures of safety-critical systems during nominal and non-nominal launch or reentry that could jeopardize public safety, in accordance with § 450.115(a). Additional guidance is provided in AC 450.115-1, High Fidelity Flight Safety Analysis. Key flight safety events should also include, at a minimum:

1. Ignition of any primary rocket engine or any change in the source of propulsion;

2. Any staging event or change to the outer mold line;

3. Any hardware configuration of the vehicle being altered from the previous time periods by jettisoning hardware, such as fairings or stages;

4. Any change to the control system (e.g., reaction control system vs. aero surfaces such as fins, or the guidance algorithm);

5. A significant change in dynamic pressure or aerodynamic heating to which the launch or reentry system is subjected; and

6. A significant change in the environment for any safety critical system.

1 Here, a failure probability distribution is considered homogeneous if there are no discontinuities and the failure probability distribution is defined by a single mathematical function (e.g., a linear, exponential, or uniform distribution). In accordance with § 450.131(e), a probability of failure analysis must use a constant conditional failure rate for each phase of flight, unless there is clear and convincing evidence of a different conditional failure rate for a particular vehicle, stage, or phase of flight.

Revision B 7

• The minimum length of a flight phase should be sufficient to allow for implementation of a risk mitigation, including adequate time buffers to account for uncertainty. Moreover, and similar to § 450.131(a), an operator should apply flight phase definitions consistently throughout a flight and base these definitions on physically observable phenomena.

6.2 Potential for High Consequence Events.

Section 450.101(c) requires that an operator must protect against a high consequence event in uncontrolled areas for each phase of flight.

6.3 Uncontrolled Areas.

The applicant is only required to evaluate the potential for high consequence events in uncontrolled areas, in accordance with §§ 450.101(c), 450.108(b)(1) and (2), and

450.108(c)(4). In accordance with the definition in § 401.7, an uncontrolled area is an area not controlled by a launch or reentry operator, a launch or reentry site operator, an adjacent site operator, or other entity by agreement. Typically, uncontrolled areas include all regions outside of the launch or reentry operators’ property, and outside of the site operator’s property. Adjacent operators’ property and other real estate may be excluded when there is a formal agreement between the launch or reentry operator and the owner of such real estate. An operator could satisfy the requirement to evaluate the potential for high consequence events in uncontrolled areas by evaluating the potential for high consequence events in all areas of land where there is no ability to prevent unauthorized access or otherwise by ensuring that no unauthorized persons are present during a launch or reentry operation.

6.4 Controlled Areas.

An area may be considered controlled only if there is an ability: (1) to prevent unauthorized access or otherwise ensure that no unauthorized persons are present, and

(2) to manage the location of any persons that are present during a launch or reentry operation. For any areas considered to be controlled for a launch or reentry operation, the licensee should coordinate any high consequence protection measures with the controlling authority.

Revision B 8 7 USING FLIGHT ABORT AS A HAZARD CONTROL STRATEGY.

7.1 Flight abort is intended to prevent adverse consequences in the case of a failure, which, in turn, mitigates the potential for a high consequence event. Design of flight abort criteria must address the potential for a flight abort adversely impacting public safety by triggering hazardous debris impacts in accordance with § 450.108(f)(2). Due to the potential consequences of initiating flight abort, the FAA has adopted regulations specific to its use which are codified in § 450.108. Section 450.108 applies to the use of flight abort as a hazard control strategy for the flight. In summary, it requires that an operator must use a flight safety system that meets the standards of § 450.145 or § 450.143 and meets the flight safety requirements in § 450.108.

7.2 Section 450.101(c)(1) provides that an applicant may use flight abort as a hazard control strategy in accordance with the requirements of § 450.108 to protect against a high consequence event in uncontrolled areas for a phase of flight. Guidance for meeting the requirements of § 450.108 is available in AC 450.108-1, Flight Abort Rule Development. If an applicant uses flight abort in accordance with § 450.108, it meets the requirements of § 450.101(c)(1). The flight safety limits objectives in § 450.101(c) can be met without computing CEC if, in accordance with § 450.108(c)(6), the operator uses flight safety limits that prevent debris capable of causing a casualty due to any hazard from affecting uncontrolled areas using a flight safety system that complies with § 450.145.

Revision B 9 8 USING CONDITIONAL EXPECTED CASUALTY.

8.1 Risk Analysis.

When the risk from high consequence events must be demonstrated to comply with §§ 450.101(c)(2), 450.108(b), or 450.108(c)(4), the risk must be quantified in terms of conditional expected casualties (CEC). CEC is one way to measure the risk of a multiple casualty events, one class of high consequence events. This metric is calculated as part of the debris risk analyses in accordance with:

• Section 450.135(b), as described in AC 450.115-1, High Fidelity Flight Safety Analysis,

• The toxic risk analyses in accordance with § 450.139(f)(8)(ii)(1), as described in AC 450.139-1, Toxic Release Hazards Analysis, and

• The far-field overpressure risk analysis in accordance with § 450.137(c), as described in AC 450.137-1, Distance Focusing Overpressure Risk Analysis.

8.1.1 Specifically, an operator must manage the risk of casualties that could arise from the exposure to toxic release by performing a toxic risk assessment in accordance with § 450.139(e), or managing the risk of any casualty from the exposure to a toxic release through containment in accordance with § 450.139(d).

8.1.2 The type of consequence that is the focus of the requirement is that of serious injury or worse, (i.e., a casualty), for any member of the public located in an uncontrolled area. In 2002, the FAA found that the use of abbreviated injury scale (AIS) Level 3 or greater is appropriate for describing a medical condition sufficiently to allow modeling of casualties for purposes of determining whether a launch satisfies the public risk criteria, as stated in reference number [4] of paragraph 3.4 of this AC.

8.1.3 The injuries do not have to occur as a direct result of the impact, but could be from secondary effects of the impact such as subsequent ground fires or nearby facility liquid tank explosions as accounted for in accordance with § 450.135(b)(3), which requires that the debris risk analysis account for any impact or effects of hazardous debris.

AC 450.115-1, High Fidelity Flight Safety Analysis provides guidance on computing valid casualty areas that account for the effects of hazardous debris.

8.2 Determining “Reasonably Foreseeable” Failure Modes.

An operator is not required to evaluate CEC for all conceivable failure modes, but only those that are reasonably foreseeable in accordance with §§ 450.101(c)(2),

450.108(b)(1) and (2), and 450.108(c)(4).