Advisory U.S. Department of Transportation CircularFederal Aviation Administration Subject: System Safety Program Date: September 7, 2021 AC No: 450.103-1 Initiated By: AST-1 This Advisory Circular (AC) provides guidance on developing a system safety program in accordance with Title 14 of the Code of Federal Regulations (14 CFR) § 450.103, System Safety Program. It is intended to assist prospective applicants in obtaining commercial space authorizations and operating in compliance with commercial space safety regulations.
Section 450.103 requires an operator to implement and document a system safety program throughout the lifecycle of a launch or reentry system. The documented system safety program must maintain a safety organization pursuant to § 450.103(a), implement hazard management processes pursuant to § 450.103(b), perform configuration management and control pursuant to § 450.103(c), and employ processes for evaluating post-flight data pursuant to § 450.103(d).
The Federal Aviation Administration (FAA) considers this AC an accepted means of compliance for complying with the regulatory requirements of § 450.103. This guidance is not legally binding in its own right and will not be relied upon by the FAA as a separate basis for affirmative enforcement action or other administrative penalty. Conformity with the guidance is voluntary only and nonconformity will not affect rights and obligations under existing statues and regulations.
If you have suggestions for improving this AC, you may use the Advisory Circular Feedback form at the end of this AC.
WAYNE R MONTEITH Digitally signed by WAYNE R MONTEITH Date: 2021.09.07 16:02:16 -04'00' Wayne R. Monteith Associate Administrator Commercial Space Transportation
Contents Paragraph Page
1 Purpose1
2 Applicability1
3 Applicable Regulations and Related Documents2
4 Definition of Terms3
5 Acronyms4
6 System Safety Program5
6.1 Lifecycle System Safety5
6.2 Context for System Safety Program7
7 Safety Organization8
7.1 Required Personnel8
7.1.1 Personnel Assignment9
7.1.2 Mission Director9
7.1.3 Safety Official9
7.2 Addressing Concerns of the Safety Official10
8 Hazard Management11
8.1 System Assessment Methods11
8.1.1 Functional Hazard Analysis11
8.1.2 Reasonably Foreseeable11
8.1.3 Flight Hazard Analysis12
8.1.4 Flight Safety Analysis12
8.2 Managing Updates12
8.2.1 Organizational Structure12
8.2.2 Integration13
8.2.3 Oversight14
8.3 Tracking of FHA Data14
8.3.1 Traceability14
9 Configuration Management and Control15
10 Post-flight Data Review15
10.1 Data Collection15
10.2 Analysis Consistency15
10.3 Anomaly Reporting and Investigation16
10.4 Reporting to FAA16
11 Application Requirements17
11.1 Safety Organization17
11.2 Summary of Processes and Products17
Key Aspects of a Sound System Safety PlanA-19
ii
Contents (continued) Paragraph Page Tables Number Page
Table 1 – Example Safety Organization Personnel Table for an Operation9
Table 2 – Example of a Compliance Table18
Table 3 – Severity CategoriesA-19
Table 4 – Likelihood LevelsA-20
Table 5 – Additional System Safety-Related TasksA-22
Figures Number Page
Figure 1. Generic Lifecycle of a Launch or Reentry System6
Figure 2. Context of § 450.103 in Part 450 Safety Requirements7
Figure 3. Sample Safety Organization of § 450.103(a)8
Figure 4. Sample System Safety Organization13
iii
1 PURPOSE.
1.1 This advisory circular (AC) provides guidance and an acceptable method, but not the only method, that may be used to define an acceptable system safety program (SSP) in accordance with Title 14 of the Code of Federal Regulations (14 CFR) § 450.103 System Safety Program.
1.2 Level of Imperatives.
This AC presents one, but not the only, acceptable means of compliance with the associated regulatory requirements. The FAA will consider other means of compliance that an applicant may elect to present. In addition, an operator may tailor the provisions of this AC to meet its unique needs, provided the changes are accepted as a means of compliance by the FAA. Throughout this document, the word “must” characterizes statements that directly follow from regulatory text and therefore reflect regulatory mandates. The word “should” describes a requirement if electing to use this means of compliance; variation from these requirements is possible but must satisfy the regulation to constitute an alternative means of compliance. The word “may” describes variations or alternatives allowed within the accepted means of compliance set forth in this AC.
2 APPLICABILITY.
2.1 The guidance in this AC is for launch and reentry vehicle applicants and operators required to comply with 14 CFR part 450. The guidance in this AC is for those seeking a launch or reentry vehicle operator license, and a licensed operator seeking to renew or modify an existing vehicle operator license.
2.2 The material in this AC is advisory in nature and does not constitute a regulation. This guidance is not legally binding in its own right and the FAA will not rely upon this guidance as a separate basis for affirmative enforcement action or other administrative penalty. Conformity with this guidance document (as distinct from existing statutes and regulations) is voluntary only, and nonconformity will not affect rights and obligations under existing statutes and regulations.
2.3 The material in this AC does not change or create any additional regulatory requirements, nor does it authorize changes to, or deviations from, existing regulatory requirements.
3 APPLICABLE REGULATIONS AND RELATED DOCUMENTS.
3.1 Related United States Code Statute.
3.2 Related FAA Commercial Space Transportation Regulations.
The following 14 CFR r egulations must be accounted for when showing compliance with 14 CFR 450.103. The full text of these regulations can be downloaded from the U.S. Government Printing Office e-CFR. A paper copy can be ordered from the Government Printing Office, Superintendent of Documents, Attn: New Orders, PO Box 371954, Pittsburgh, PA, 15250-7954.
• Section 450.101, Safety criteria.
• Section 450.107, Hazard control strategies.
• Section 450.108, Flight abort.
• Section 450.109, Flight hazard analysis.
• Section 450.110, Physical containment.
• Section 450.111, Wind weighting.
• Section 450.113, Flight safety analysis requirements—scope.
• Section 450.115, Flight safety analysis methods.
• Section 450.139, Toxic hazards for flight.
• Section 450.141, Computing Systems
• Section 450.143, Safety-critical system design, test, and documentation.
• Section 450.157, Communications.
• Section 450.179, Ground safety—general.
• Section 450.181, Coordination with a site operator.
• Section 450.183, Explosive site plan.
• Section 450.185, Ground hazard analysis.
• Section 450.187, Ground safety prescribed hazards.
• Section 450.209, Compliance monitoring.
• Section 450.219, Records.
• 51 U.S.C. Subtitle V, Chapter 509.
3.3 Related FAA Advisory Circulars.
FAA Advisory Circulars (are available through the FAA website, http://www.faa.gov).
• AC 450.107-1, Hazard Control Strategy Determination, dated July 27, 2021.
• AC 450.109-1, Flight Hazard Analysis, dated August 5, 2021.
• AC 450.141-1A, Computing Systems Safety, Revision A, dated August 16, 2021.
• AC 450.173-1, Mishap Reporting, Response, and Investigation, dated August 12, 2021.
• AC 450.179-1, Ground Safety, when published.
3.4 Related Industry Documents.
• American National Standards Institute, ANSI-EIA-649C, National Consensus Standard for Configuration Management, dated February 7, 2019.
• Department of Defense Standard, MIL-STD-882E, System Safety, dated May 11, 2012, https://quicksearch.dla.mil/qsDocDetails.aspx?ident_number=36027.
• Military and Government Specifications and Standards, MIL-HDBK-61B, Configuration Management Guidance, dated April 7, 2020.
Note: The industry docum ents referenced in this chapter refer to the current revisions or regulatory authorities’ accepted revisions.
DEFINITION OF TERMS.
For this AC, the definitions from § 401.7 apply.
5 ACRONYMS.
AC – Advisory Circular CFR – Code of Federal Regulations CM – Configuration Management FAA – Federal Aviation Administration FHA – Flight Hazard Analysis FSA – Flight Safety Analysis FSS – Flight Safety System OMB – Office of Management and Budget SSP – System Safety Program U.S.C. – United States Code U.S. – United States 4
6 SYSTEM SAFETY PROGRAM.
Section 450.103, System Safety Program, requires the implementation and documentation of a system safety program (SSP) applicable throughout the lifecycle of a launch or reentry system. A documented SSP establishes the methodologies and management principles for flight safety. It should be demonstrated that an SSP has been established and documented such that compliance with FAA regulations can be determined and maintained. To demonstrate compliance with § 450.103, the documented SSP should define pertinent organizational structures, processes, and safety analysis methodologies. Advisory Circular 450.179-1, Ground Safety provides guidance on ground safety for requirements in §§ 450.179, 450.181, 450.183, 450.185, 450.187, and 450.189.
6.1 Lifecycle System Safety.
Figure 1 of this AC depicts a generic launch or reentry system lifecycle. An effective system safety process should be incorporated throughout the lifecycle of the program.
Public safety hazards associated with systems and operations of a launch or reentry vehicle are generally reliant on sound design, manufacturing, and operational processes and procedures that span the lifecycle.
• EXPLOSIVE SAFETY • SYSTEM SAFETY • FLIGHT/RANGE SAFETY Ground Hazards People/Ships/Structures Debris Impact Explosive Overpressure • Toxic Releases POST-MISSION 000 Debris Disposal Post Mission Analysis Lessons Learned AC 450.103-1 RE-ENTRY 000 Orbital Lifetime Prediction Breakup Modeling Hazards to Aircraft DEVELOP MANUFACTURE 000 Hazardous Component Manufacturing • Motors • Ordnance • Liquid Propellants Selection of Launch Site • IS Test Range • International Test Range Figure 1. Generic Lifecycle of a Launch or Reentry System Asteroids/ Meteors/ Space Debris ORBIT 000 Collision Avoidance Orbital Debris Meep Sp Bee freats Debris Hazards 000 DOT Hazard Classification Hazardous Transport • Explosives • Toxics Site Planning Quantity-Distance Quantitative Risk Assessment Peride Procession Static Fire Functional Checkout Wet Dress Rehearsal LAUNCH 000 Safe Trajectory Planning Flight Termination Systems Proximity Screening • Manned Unmanned Failure Modes Breakup Modeling Launch Hazards 09/07/2021
6.2 Context for System Safety Program.
The scope of system safety incorporates all elements of the program that contribute to achieving compliant operations. Section 450.103 specifically deals with the organizational structures and management processes and principles relied on for ensuring that hazard controls and analyses correspond to the actual system operations.
Thus, these are the core processes that ensure that the fundamental risk requirements in § 450.101 and system safety risk criteria of §§ 450.109(b)(3) and 450.185(c) are met over the lifecycle of the system. This is illustrated in Figure 2. Hazard management, in § 450.103(b), is the assessment of the system and communication of this assessment to the personnel implementing the remainder of the safety requirements. This is a continuous, iterative process throughout the lifecycle; thus, configuration management and control, in § 450.103(c), is a necessary foundation. The outcomes of the functional hazard analysis, hazard control strategy determination, flight hazard analysis (FHA), and flight safety analysis (FSA) should be implemented in the actual operation, which necessitates clear responsibility and authority, as described in § 450.103(a). Finally, each operation provides critical information for improving safety and rectifying errors before future operations, thus post-flight data review is required, per § 450.103(d), from which necessary updates to the hazard management approach and processes should be determined and implemented.
Figure 2. Context of § 450.103 in Part 450 Safety Requirements 7
7 SAFETY ORGANIZATION.
Section 450.103(a) requires an operator to maintain a safety organization. The establishment of a safety organization is a critical component of launch and mission operations and public safety. As defined in § 401.7, mishap includes a failure of the safety organization. The safety organization’s primary responsibility is to carry out the processes needed to protect public safety, as identified in the documented SSP. In addition to the typical system safety engineering organizations, the documented SSP should include a safety organization that addresses and covers all aspects of the public safety of Part 450 Launch and Reentry License Requirements. The safety organization must have clearly defined lines of communication and an approval authority for all public safety decisions associated with a licensed operation or mission, per § 450.103(a). The FAA encourages the development of an organizational chart that depicts the safety organization in the context of the larger organization. Figure 3 of this AC is an example illustration of the foundational structure of a compliant safety organization.
Company/ Organization (Operator)
- - - Mission Director Position Program/ Mission Assurance Safety Official Position *This individual can be used as an FAA Liaison.
System Safety Engineering Ground Operations Safety Engineers/ Personnel Flight Operations Safety Engineers/ Personnel Independent monitor of safety policy, safety procedure, and licensing requirements compliance Figure 3. Sample Safety Organization of § 450.103(a)
7.1 Required Personnel.
At a minimum, two specific positions are required for each launch or reentry: a Mission Director and a Safety Official, in accordance with § 450.103(a)(1) and (2). The qualifications for these specific positions should also be documented. Lessons learned from previous mishaps have identified the importance of the independence of the Mission Director and Safety Official roles to ensure that the goal of safety is primary.
To achieve this independence, these must be different persons, as indicated by § 450.103(a).
7.1.1 Personnel Assignment.
A Mission Director and Safety Official should be named and in place prior to the initiation of any licensed activity. The same persons may be used for multiple launch or reentry sites. However, it may be difficult for a single individual to serve as a Safety Official for multiple sites if launch or reentry activities were to occur close in time to each other. In those instances, multiple persons may be chosen. Table 1 of this AC provides an example format for identification of safety organization personnel.
Table 1 – Example Safety Organization Personnel Table for an Operation
POSITION NAME COMPANY & JOB TITLE CONTACT INFORMATION Mission Director - - - Safety Official - - - Note: This table should be expanded to include other directors, officials, and personnel, as necessary.
7.1.2 Mission Director.
The Mission Director is responsible for the safe conduct of all licensed activities and authorized to provide final approval to proceed with licensed activities, in accordance with § 450.103(a)(1). This includes ensuring that all of the Safety Official’s concerns are addressed, per § 450.103(a)(3). The organization should make this responsibility clear to the Mission Director.
7.1.3 Safety Official.
The Safety Official is required to have direct access to the Mission Director. The Safety Official is responsible for communicating potential safety and noncompliance issues to the Mission Director, in accordance with § 450.103(a)(2)(i). The Safety Official is authorized to examine all aspects of the ground and flight safety operations, and independently monitor compliance with safety policies, safety procedures, and licensing requirements, in accordance with § 450.103(a)(2)(ii). Thus, it is the responsibility of the Safety Official to ensure safety issues are identified across the organization and presented to the Mission Director. The Safety Official will be held responsible if a safety issue is not presented to the Mission Director. The Safety Official should ensure that these issues are presented in a timely manner so they can be addressed. The organization should make this responsibility clear to the Safety Official for each operation.