C
U.S. Department of Transportation Federal Aviation Administration Advisory Circular Subject: High Consequence Event Protection Date: 05/20/2021 AC No: 450.101-1 Initiated By: AST-1 Revision A
This Advisory Circular (AC) describes a method to demonstrate compliance with the high consequence event protection requirements of title 14 of the Code of Federal Regulations (14 CFR) § 450.101(c) and the requirements to evaluate the potential for high consequence events in uncontrolled areas in accordance with §§ 450.108(b) and 450.108(c)(4). This AC also provides guidance for an operator that chooses to propose an alternative method that produces an equivalent level of safety to the requirements in § 450.101(c)(2).
This AC describes acceptable means, but not the only means, for demonstrating compliance with the applicable regulations. It is intended to assist prospective applicants in obtaining commercial space authorizations and operating in compliance with commercial space regulations. The contents of this document do not have the force and effect of law and are not meant to bind the public in any way, and the document is intended only to provide clarity to the public regarding existing requirements under the law or agency policies.
If you have suggestions for improving this AC, you may use the Advisory Circular Feedback form at the end of this AC.
Wayne R. Monteith Associate Administrator Commercial Space Transportation
Revision A
CONTENTS Paragraph Page
1 Purpose2
2 Applicability3
3 Applicable Regulations and Related Documents3
4 Definition of Terms5
5 High Consequence Event Protection Overview5
6 High Consequence Event Protection Scope6
6.1 Phases of Flight6
6.2 Potential for High Consequence Events7
6.3 Uncontrolled Areas7
6.4 Controlled Areas7
7 Using Flight Abort As A Hazard Control Strategy8
8 Using Conditional Expected Casualty8
8.1 Risk Analysis8
8.2 Determining “Reasonably Foreseeable” Failure Modes9
8.2.1 Failure Modes9
8.2.2 Identification of Reasonably Foreseeable Events9
8.3 Known Failure Modes10
8.3.1 Loss of Thrust10
8.3.2 Attitude Control Failure10
8.3.3 Guidance and/or Navigation Failure10
8.3.4 On-Trajectory Explosion10
8.3.5 On-Trajectory Structural Failure11
8.3.6 On-Trajectory Tank Failure11
8.3.7 Failure to Perform Configuration Change11
8.3.8 Premature Configuration Change11
8.3.9 Critical Performance Failure11
8.3.10 Failure to Ignite11
8.3.11 Failure to Shutoff11
8.4 Determining the Significant Period of Flight12
ii
Revision A
CONTENTS (CONTINUED) Paragraph Page
9 Calculating Conditional Expected Casualty12
9.1 Mathematics of CEC12
9.2 Computation of CEC13
9.3 Accuracy of CEC14
10 Approach when using Discrete Failure Simulations15
10.1 Event Sampling15
10.1.1 Minimum Sample Size15
10.1.2 Numerical Resolution16
10.1.3 Significant Samples16
10.2 Satisfying the CEC Criterion16
10.2.1 Computing Statistical Values for CEC17
10.2.2 Correlation between Intervals17
11 Evaluating CEC Results18
11.1 Comparison to Threshold Criteria18
11.1.1 CEC Evaluation Timeline18
11.1.2 Validating CEC19
11.2 FSS Requirements for High Consequence Event Protection19
12 Alternate Means of Compliance20
12.1 Using Risk Profile Curves20
12.2 The General Aviation Risk Profile21
12.3 Compliance with High Consequence Event Protection21
13 Demonstrated Reliability22
13.1 Required Reliability22
13.2 Demonstrating Reliability22
13.3 Using the Integer Method for Consequence22
13.4 Existing Aviation Data24
13.5 Hypothetical Example of Demonstrated Reliability25
iii
Revision A Principal Changes Re vision A updates AC 450.101-1, High Consequence Event Protection, dated October 15, 2020. T his AC change includes the following principal changes.
1. For paragraph 4.1, adds definition of failure mode.
2. For paragraph 4.3, adds definition of a multiple casualty event.
3. For paragraph 4.5, adds definition of statistically valid.
4. For paragraph 5, clarifies what constitutes a high consequence event.
5. Revises paragraph 8.1 to tie high consequence to risk requirements:
6. Replaces high consequence events with CEc and expands paragraph 8.2 into paragraphs 8.2.1 and 8.2.2.
7. Adds footnote 2 to page 9.
8. Adds an explanation of significant period of flight to paragraph 8.4.
9. Added last sentence to paragraph 9.1.3 that reads: “The following example assumes two sub-events (event 1 and event 2). Therefore:”
10. M oves paragraph 10.1.4 and to new paragraph 10.2.2 with more qualitative information based on recent data from random attitude results.
11. A dds Figure 1 “Example of time period of stable CEC with scatter” to page 19.
12. A dds new paragraphs 11.1.1 “CEC Evaluation Timeline,” and 11.1.2 “Validating CEC,” while removing old paragraphs 11.1.2 and 11.1.3.
13. Replaces expected fatality with expected casualty in paragraph 13.3.2.
14. A dds sentence to end of paragraph 13.3.3 t hat regarding the upper estimates of population density of any region.
15. D eletes footnote 10.
16. Deletes paragraph 13.3.4 and previous figure 2 “CEF = f (Population Density, Fatality Area)”
17. R evises paragraph 13.4 regarding conditional expected fatalities.
18. R enumbers footnote 11 as footnote 10 on page 24.
19. R eplaces figure 3 with new figure 3, “Tolerable Failure Probability Per Flight vs CEC.”
20. A dds explanation of how CEF is compared to CEC in paragraph 13.4.1.
21. Changes CEF to CEC in paragraphs 13.4.3 and 13.4.4.
22. Changes fatality area to casualty area in paragraph 13.5.1.
23. Changes fatality area to casualty area in paragraph 13.5.2.
24. Changes CEF to CEC in paragraph 13.5.2.
25. Changes CEF to CEC in paragraph 13.5.4.
05/20/2021 A C 450.101-1 Revision A 1 PURPOSE.
1.1 This Advisory Circular (AC) describes a method to demonstrate compliance with the high consequence event protection requirements of title 14 of the Code of Federal Regulations (14 CFR) § 450.101(c) and the requirements to evaluate the potential for high consequence events in uncontrolled areas in accordance with §§ 450.1 08(b) and
450.108(c)(4). This AC provides an acceptable means to demonstrate compliance with § 450.101( c)(2) and § 45 0.101(c)(3) and provides an acceptable means of compliance with conditional expected casualties requirements in § 450.108. This AC also provides guidance for an operator that chooses to propose an alternative method that produces an equivalent level of safety to the requirements in § 450.101(c)(2).
1.2 An operator may initiate the flight of a launch vehicle only if all risks to the public satisfy the criteria of § 450.101(a). The collective risk, measured as expected number of casualties (EC), consists of risk posed by impacting inert debris, explosive debris, toxic release, and far field blast overpressure. Individual risk, measured as probability of casualty (PC), also consists of risk posed by impacting inert debris, explosive debris, toxic release, and far field blast overpressure. Public risk due to any other hazard associated with the proposed flight of a launch vehicle is determined by the FAA Administrator on a case-by-case basis.
1.3 Section 450.101(c) requires an operator to protect against a high consequence event in uncontrolled areas for each phase of flight by using flight abort as a hazard control strategy in accordance with the requirements of § 450.108; ensuring the consequence of any reasonably foreseeable failure mode, in any significant period of flight, is no greater than 1 × 10-3 conditional expected casualties; or establishing the launch or reentry vehicle has sufficient demonstrated reliability as agreed to by the Administrator based on conditional expected casualties criteria during that phase of flight.
1.4 Throughout this document, the word “must” characterizes statements that directly flow from regulatory text and therefore reflect regulatory mandates. The word “should” describes a requirement if electing to use this means of compliance; variation from these requirements is possible, but it must be justified and approved as an alternative means of compliance. The word “may” describes variations or alternatives allowed within the accepted means of compliance set forth in this AC. In general, these alternative approaches can be used only under certain situations that do not compromise safety.
R evision A 2 APPLICABILITY.
2.1 The guidance in this AC is for launch and reentry vehicle applicants and operators required to comply with 14 CFR part 450. The guidance in this AC is for those seeking a launch or reentry vehicle operator license, a licensed operator seeking to renew or modify an existing vehicle operator license, and FAA commercial space transportation evaluators.
2.2 The material in this AC is advisory in nature and does not constitute a regulation. This guidance is not legally binding in its own right and will not be relied upon by the FAA as a separate basis for affirmative enforcement action or other administrative penalty.
Conformity with this guidance document (as distinct from existing statutes and regulations) is voluntary only, and nonconformity will not affect rights and obligations under existing statutes and regulations. This AC describes acceptable means, but not the only means, for demonstrating compliance with the applicable regulations.
2.3 The material in this AC does not change or create any additional regulatory requirements, nor does it authorize changes to, or deviations from, existing regulatory requirements.
3 APPLICABLE REGULATIONS AND RELATED DOCUMENTS.
3.1 Related Statute.
• 51 U.S.C. Subtitle V, Chapter 509.
3.2 Related FAA Commercial Space Transportation Regulations.
The following regulations from title 14 of the CFR must be accounted for when showing compliance with § 450.101(c). The full text of these regulations can be downloaded from the U.S. Government Printing Office e-CFR. A paper copy can be ordered from the Government Printing Office, Superintendent of Documents, Attn: New Orders, PO Box 371954, Pittsburgh, PA, 15250-7954.
• Section 401.7, Definitions.
• Section 440.7, Determination of Maximum Probable Loss.
• Section 450.108, Flight Abort.
• Section 450.115, Flight Safety Analysis Methods.
• Section 450.131, Probability of Failure Analysis.
• Section 450.133, Flight Hazard Area Analysis.
• Section 450.135, Debris Risk Analysis.
• Section 450.137, Far-field Overpressure Blast Effects Analysis.
• Section 450.139, Toxic Hazards for Flight.
• Section 450.161, Control of Hazard Areas.
Revision A
• Section 450.165, Flight Commit Criteria.
• Section 450.213, Pre-flight Reporting.
3.3 Related FAA Advisory Circulars.
FAA Advisory Circulars (are or will be available through the FAA website, http://www.faa.gov).
• AC 450.107-1, Hazard Control Strategies, when published.
• AC 450.108-1, Flight Abort Rule Development, when published.
• AC 450.115-1, High Fidelity Flight Safety Analysis, Revision A, dated May 14, 2021.
• AC 450.117-1, Trajectory Analysis, when published.
• AC 450.123-1, Population Exposure Analysis, when published.
• AC 450.131-1, Probability of Failure, when published.
• AC 450.137-1, Distance Focusing Overpressure Risk Analysis, when published.
• AC 23-1309-1E, System Safety Analysis and Assessment for Part 23 Airplanes, dated November 17, 2011.
• AC 25-1309-1A, System Design and Analysis, dated June 21, 1988.
3.4 Documents Related to High Consequence Event Protection.
1. Allahdadi, Firooz A., Isabelle Rongier, Tommaso Sgobba, and Paul D. Wilde, Safety Design for Space Operations, Sponsored by The International Association for the Advancement of Space Safety, Elsevier, Watham, MA, 2013.
2. Collins, J.D., C.P. Brinkman, and S.L. Carbon, Determination of Maximum Probable Loss, ACTA Inc. and Federal Aviation Administration, (2007).
3. Risk Committee, Range Safety Group, Range Commanders Council, Common Risk Criteria for National Test Ranges, RCC 321-20, White Sands, NM, May 2020.
4. Federal Register, Vol. 67, No. 146, July 30, 2002, page 49465.
R evision A 4 DEFINITION OF TERMS.
For this AC, the terms and definitions from § 401.7, and this list, apply:
4.1 Failure Mode A failure mode is a category of potentially hazardous events that share significant similarity in system response, prior to consideration of mitigations or hazard control strategies.
4.2 Maximum Conditional Expected Casualty (CEC) The highest CEC value calculated for a particular phase of flight considering all reasonably foreseeable failure modes.
4.3 Multiple Casualty Event An incident that has significant likelihood of seriously injuring more than one person.
4.4 Phase of Flight A period of flight between two milestones in the vehicle flight sequence, which is not necessarily a set period of time.
4.5 Statistically Valid A “statistically valid” analysis is the result of a sound application of mathematics and accounts for the uncertainty in any statistical inference due to sample size limits, the degree of applicability of data to a particular system, and the degree of homogeneity of the data. The specific approach to establish statistical validity depends on the context of the particular analysis, as described in this AC and others.
5 HIGH CONSEQUENCE EVENT PROTECTION OVERVIEW.
In accordance with § 450.101(c), an operator may use any of the three following methods to demonstrate protection against high consequence events:
• Using flight abort as a hazard control strategy in accordance with the requirements of § 450.108;
• Ensuring the consequence of any reasonably foreseeable failure mode, in any significant period of flight, is no greater than 1 × 10-3 conditional expected casualties; or
• Establishing the launch or reentry vehicle has sufficient demonstrated reliability as agreed to by the Administrator based on the conditional expected casualties criteria during that phase of flight.
• High consequence events include incidents that could involve multiple casualties, massive toxic exposures, extensive property or environmental damage, or events that jeopardize the national security or foreign policy interests of the United States.
Revision A 6 HIGH CONSEQUENCE EVENT PROTECTION SCOPE.
When evaluating the potential for high consequence events, the applicant should identify the phases of flight, the potential for high consequence events, and evaluate the potential for high consequence events in uncontrolled areas.
6.1 Phases of Flight.
A phase of flight refers to a period of flight between two milestones in the vehicle flight sequence, which is not necessarily a set period of time, where the probability of failure distribution for each reasonably foreseeable failure mode is homogenous.1 For example, a stage may burn for a longer or shorter period of time depending on the performance of the rocket motor. This can be for selected periods of flight during launch and reentry that an operator will identify and analyze in a consistent manner using quantifiable measurements or observable records. In defining “phases of flight,” the operator should:
• Ensure that the combination of all phases of flight covers the full duration of the flight within the scope defined in § 450.113(a).
• Define new phases of flight to identify the transition where the operator plans to use different strategies for protecting against high consequence events for different portions of flight.
• Not include more than one key flight safety event in each phase of flight. Key flight safety events are those flight activities that have an increased risk compared with other portions of flight. An operator’s flight safety analysis method must account for all reasonably foreseeable events and failures of safety-critical systems during nominal and non-nominal launch or reentry that could jeopardize public safety, in accordance with § 450.115(a). Additional guidance is provided in AC 450.115-1, High Fidelity Flight Safety Analysis. Key flight safety events should also include, at a minimum:
1. Ignition of any primary rocket engine or any change in the source of propulsion;
2. Any staging event or change to the outer mold line;
3. Any hardware configuration of the vehicle being altered from the previous time periods by jettisoning hardware, such as fairings or stages;
4. Any change to the control system (e.g., reaction control system vs. aero surfaces such as fins, or the guidance algorithm);
5. A significant change in dynamic pressure or aerodynamic heating to which the launch or reentry system is subjected; and
6. A significant change in the environment for any safety critical system.
1 Here, a failure probability distribution is considered homogeneous if there are no discontinuities and the failure probability distribution is defined by a single mathematical function (e.g., a linear, exponential, or uniform distribution). In accordance with § 450.131(e), a probability of failure analysis must use a constant conditional failure rate for each phase of flight, unless there is clear and convincing evidence of a different conditional failure rate for a particular vehicle, stage, or phase of flight.
Revision A
• The minimum length of a flight phase should be sufficient to allow for implementation of a risk mitigation, including adequate time buffers to account for uncertainty. Moreover, and similar to § 450.131(a), an operator should apply flight phase definitions consistently throughout a flight and base these definitions on physically observable phenomena.
6.2 Potential for High Consequence Events.
Section 450.101(c) requires that an operator must protect against a high consequence event in uncontrolled areas for each phase of flight.
6.3 Uncontrolled Areas.
The applicant is only required to evaluate the potential for high consequence events in uncontrolled areas, in accordance with §§ 450.101(c), 450.108(b)(1) and (2), and
450.108(c)(4). In accordance with the definition in § 401.7, an uncontrolled area is an area not controlled by a launch or reentry operator, a launch or reentry site operator, an adjacent site operator, or other entity by agreement. Typically, uncontrolled areas include all regions outside of the launch or reentry operators’ property, and outside of the site operator’s property. Adjacent operators’ property and other real estate may be excluded when there is a formal agreement between the launch or reentry operator and the owner of such real estate. An operator could satisfy the requirement to evaluate the potential for high consequence events in uncontrolled areas by evaluating the potential for high consequence events in all areas of land where there is no ability to prevent unauthorized access or otherwise by ensuring that no unauthorized persons are present during a launch or reentry operation.
6.4 Controlled Areas.
An area may be considered controlled only if there is an ability: (1) to prevent unauthorized access or otherwise ensure that no unauthorized persons are present, and
(2) to manage the location of any persons that are present during a launch or reentry operation. For any areas considered to be controlled for a launch or reentry operation, the licensee should coordinate any high consequence protection measures with the controlling authority.
Revision A 7 USING FLIGHT ABORT AS A HAZARD CONTROL STRATEGY.
7.1 Flight abort is intended to prevent adverse consequences in the case of a failure, which, in turn, mitigates the potential for a high consequence event. Design of flight abort criteria must address the potential for a flight abort adversely impacting public safety by triggering hazardous debris impacts in accordance with § 450.108(f)(2). Due to the potential consequences of initiating flight abort, the FAA has adopted regulations specific to its use which are codified in § 450.108. Section 450.108 applies to the use of flight abort as a hazard control strategy for the flight. In summary, it requires that an operator must use a flight safety system that meets the standards of § 450.145 or § 450.143 and meets the flight safety requirements in § 450.108.
7.2 Section 450.101(c)(1) provides that an applicant may use flight abort as a hazard control strategy in accordance with the requirements of § 450.108 to protect against a high consequence event in uncontrolled areas for a phase of flight. Guidance for meeting the requirements of § 450.108 is available in AC 450.108-1, Flight Abort Rule Development. If an applicant uses flight abort in accordance with § 450.108, it meets the requirements of § 450.101(c)(1). The flight safety limits objectives in § 450.101(c) can be met without computing CEC if, in accordance with § 450.108(c)(6), the operator uses flight safety limits that prevent debris capable of causing a casualty due to any hazard from affecting uncontrolled areas using a flight safety system that complies with § 450.145.
8 USING CONDITIONAL EXPECTED CASUALTY.
8.1 Risk Analysis.
When the risk from high consequence events must be demonstrated to comply with §§ 450.101(c)(2), 450.108(b), or 450.108(c)(4), the risk must be quantified in terms of conditional expected casualties (CEC). CEC is one way to measure the risk of a multiple casualty events, one class of high consequence events. This metric is calculated as part of the debris risk analyses in accordance with:
• Section 450.135(b), as described in AC 450.115-1, High Fidelity Flight Safety Analysis,
• The toxic risk analyses in accordance with § 450.139(f)(8)(ii)(1), as described in AC 450.139-1, Toxic Release Hazards Analysis, and
• The far-field overpressure risk analysis in accordance with § 450.137(c), as described in AC 450.137-1, Distance Focusing Overpressure Risk Analysis.
8.1.1 Specifically, an operator must manage the risk of casualties that could arise from the exposure to toxic release by performing a toxic risk assessment in accordance with § 450.139(e), or managing the risk of any casualty from the exposure to a toxic release through containment in accordance with § 450.139(d).
Revision A
8.1.2 The type of consequence that is the focus of the requirement is that of serious injury or worse, (i.e., a casualty), for any member of the public located in an uncontrolled area. In 2002, the FAA found that the use of abbreviated injury scale (AIS) Level 3 or greater is appropriate for describing a medical condition sufficiently to allow modeling of casualties for purposes of determining whether a launch satisfies the public risk criteria, as stated in reference number [4] of paragraph 3.4 of this AC.
8.1.3 The injuries do not have to occur as a direct result of the impact, but could be from secondary effects of the impact such as subsequent ground fires or nearby facility liquid tank explosions as accounted for in accordance with § 450.135(b)(3), which requires that the debris risk analysis account for any impact or effects of hazardous debris.
AC 450.115-1, High Fidelity Flight Safety Analysis provides guidance on computing valid casualty areas that account for the effects of hazardous debris.
8.2 Determining “Reasonably Foreseeable” Failure Modes.
An operator is not required to evaluate CEC for all conceivable failure modes, but only those that are reasonably foreseeable in accordance with §§ 450.101(c)(2),
450.108(b)(1) and (2), and 450.108(c)(4).
8.2.1 Failure Modes.
As part of § 450.115(a), the operator’s flight safety analysis, which includes the CEC analysis, must account for all reasonably foreseeable events and failures of safety-critical systems during nominal and non-nominal launch or reentry that could jeopardize public safety. Thus, one means of complying with §§ 450.101(c)(2),
450.108(b)(1) and (2), and 450.108(c)(4) is to include all reasonably foreseeable events, and the failures of safety-critical systems during nominal and non-nominal launch or reentry, as part of the CEC analysis of reasonably foreseeable failure modes. Failure modes are categories of hazardous events that share significant similarity in cause and system response, prior to consideration of mitigations or hazard control strategies.
8.2.2 Identification of Reasonably Foreseeable Events.
“Reasonably foreseeable hazardous events” are events identifiable through the system safety process, including events that have occurred in the past for similar vehicles.2 The term “reasonably foreseeable” is not associated with a probability threshold. Rather, an event is “reasonably foreseeable” if it is identifiable by a methodical assessment of the entire system. In other words, “brainstorming” is not a sufficient approach, because “brainstorming” is not a methodical assessment of the entire system. Per § 450.107(b), a functional hazard analysis is required. The functional hazard analysis is primarily used to identify and classify the overall system functions and consequences of functional failure or malfunction. The objective is to identify all potential system, subsystem, and component functional failures that could impact public safety which, in turn, would identify all reasonably foreseeable hazardous events. It is important to note that the identification of potential system safety hazards and respective functional sources 2See AC 450.131-1 for additional discussion of what constitutes a similar vehicle.