# AC 450.107-1: Hazard Control Strategies Determination - Type: Advisory circular (guidance, not mandatory unless a rule or AD requires it) - Status: Current - Approved: July 27, 2021 - Last reviewed: November 29, 2023 - Family: AC 450.107-1 - 14 CFR parts: 450 - Pages: 18 - PDF: https://openairdocs.org/files/sha256/cb/95/cb95978f136219997ada63d90365ac8d439f47d27a6038fb3d5313edab4635b7 - FAA DRS: https://drs.faa.gov/browse/excelExternalWindow/DRSDOCID173726704120231128165806.0001 - DRS record last changed: November 21, 2025 - Page: https://openairdocs.org/ac/450.107-1 ## Versions - [AC 450.107-1](https://openairdocs.org/ac/450.107-1) (Current), approved Jul 27, 2021, 18 pages ## Text Each page's text from the PDF; open the PDF at a page with #page=N. Some pages are OCR from the scanned FAA advisory circular. OCR can misread letters and numbers. Those pages are marked (OCR). ### Page 1 C AdvisoryU.S. Department of Transportation Federal Aviation Circular Administration Subject: Hazard Control Strategies Determination Date: July 27, 2021 AC No: 450.107-1 Initiated By: AST-1 This Advisory Circular (AC) provides guidance for an applicant to develop a hazard control strategy or strategies in accordance with title 14 of the Code of Federal Regulations (14 CFR) § 450.107. It is intended to assist prospective launch and reentry operators in obtaining and maintaining a vehicle operator license. The FAA considers this AC an accepted means of compliance for complying with the regulatory requirements of § 450.107. It presents one, but not the only, acceptable means of compliance with the associated regulatory requirements. The contents of this document do not have the force and effect of law and are not meant to bind the public in any way. The document is intended only to provide clarity to the public regarding existing requirements under the law or agency policies. If you have suggestions for improving this AC, you may use the Advisory Circular Feedback form at the end of this AC. WAYNE R MONTEITH Digitally signed by WAYNE R MONTEITH Date: 2021.07.27 12:26:47 -04'00' Wayne R. Monteith Associate Administrator Commercial Space Transportation ### Page 2 Contents Paragraph Page iii 1 Purpose … 1 2 Applicability … 1 3 Applicable Regulations and Related Documents … 2 4 Definition of Terms … 4 5 Overview … 4 5.1 Hazard Control Strategies … 4 5.1.1 Use of Flight Abort as a Hazard Control Strategy … 5 5.1.2 Use of Flight Hazard Analysis as a Hazard Control Strategy … 5 5.1.3 Use of Physical Containment as a Hazard Control Strategy … 5 5.1.4 Use of Wind Weighting as a Hazard Control Strategy … 5 5.2 Using a Functional Hazard Analysis for Hazard Control Strategy Determination … 6 5.2.1 Overview of Functional Hazard Analysis … 6 5.2.2 Determining which Hazard Control Strategy to Use … 6 5.2.3 Hazard Control Strategy Determination Logic … 6 5.2.4 Application Requirements … 7 6 Hazard Control Strategy Determination … 8 6.1 Functional Hazard Analysis … 8 6.2 Assistance of Flight Safety Analysis … 10 6.3 Primary Outputs of the Functional Hazard Analysis … 10 7 Potential Determination Scenarios … 10 7.1 Flight Abort with Highly Reliable Fight Safety System … 11 7.2 Flight Hazard Analysis with Flight Abort … 11 7.3 Flight Hazard Analysis … 11 7.4 Physical Containment … 11 7.5 Wind Weighting … 11 8 Hazard Control Strategy Validation … 12 8.1 Adequacy of Determined Hazard Control Strategy … 12 8.1.1 Flight Safety Analysis … 12 8.1.2 Flight Hazard Analysis … 12 8.1.3 Computing Systems … 12 ### Page 3 Contents (continued) Paragraph Page iv 8.1.4 Safety-Critical Systems Design, Test, and Documentation (DT&D) … 13 8.1.5 Highly Reliable Flight Safety System (FSS) … 13 8.1.6 Wind Weighting Safety System DT&D … 13 9 Continuing Accuracy of License Application … 13 Appendix A. System Safety Template for § 450.107 Functional Hazard Analysis … 14 ### Page 4 **1 1 PURPOSE.** 1.1 This Advisory Circular (AC) provides guidance for an applicant to determine its hazard control strategy or strategies in accordance with Title 14 of the Code of Federal Regulations (14 CFR) § 450.107(b). In accordance with § 450.107(b), the hazard control strategies must account for all functional failures associated with reasonably foreseeable hazardous events that have the capability to create a hazard to the public; safety-critical systems; and the timeline of all safety-critical events during a launch or reentry. This AC does not constitute a regulation and does not contain requirements, but is intended to assist prospective applicants in obtaining commercial space authorizations and operating in compliance with commercial space regulations. 1.2 For each phase of flight during a launch or reentry, an operator must use a functional hazard analysis to determine the hazard control strategy or strategies it will elect to use in accordance with § 450.107(b). This AC provides guidance on how to choose a hazard control strategy based on the functional hazard analysis and other sections of part 450. An applicant must submit a description of its hazard control strategy or strategies for each phase of flight and the results of its hazard strategy determination in its application in accordance with § 450.107(d). 1.3 Level of Imperatives. This AC presents one, but not the only, acceptable means of compliance with the associated regulatory requirements. The FAA will consider other means of compliance that an applicant may elect to present. Throughout this document, the word “must” characterizes statements that directly flow from regulatory text and therefore reflect regulatory mandates. The word “should” describes a requirement if electing to use this means of compliance; variation from these requirements is possible, but must be justified and approved as an alternative means of compliance. The word “may” describes variations or alternatives allowed within the accepted means of compliance set forth in this AC. In general, these alternative approaches can be used only under certain situations that do not compromise safety. **2 APPLICABILITY.** 2.1 The guidance in this AC is for launch and reentry vehicle applicants and operators required to comply with 14 CFR part 450. The guidance in this AC is for those seeking a launch or reentry vehicle operator license, a licensed operator seeking to renew or modify an existing vehicle operator license, and FAA commercial space transportation evaluators. 2.2 The material in this AC is advisory in nature and does not constitute a regulation. This guidance is not legally binding in its own right, and will not be relied upon by the FAA as a separate basis for affirmative enforcement action or other administrative penalty. Conformity with this guidance document (as distinct from existing statutes and regulations) is voluntary only, and nonconformity will not affect rights and obligations ### Page 5 2 under existing statutes and regulations. This AC describes acceptable means, but not the only means, for demonstrating compliance with the applicable regulations. 2.3 The material in this AC does not change or create any additional regulatory requirements, nor does it authorize changes to, or deviations from, existing regulatory requirements. **3 APPLICABLE REGULATIONS AND RELATED DOCUMENTS.** 3.1 Related Statute. 51 U.S.C. Subtitle V, Chapter 509. 3.2 Related Regulations. The following regulations from title 14 of the CFR must be accounted for when showing compliance with 14 CFR 450.107. The full text of these regulations can be downloaded from the U.S. Government Printing Office e-CFR. A paper copy can be ordered from the Government Printing Office, Superintendent of Documents, Attn: New Orders, PO Box 371954, Pittsburgh, PA, 15250-7954.  Section 450.101, Safety criteria.  Section 450.103, System safety program.  Section 450.107, Hazard control strategies.  Section 450.108, Flight abort.  Section 450.109, Flight hazard analysis.  Section 450.110, Physical containment.  Section 450.111, Wind weighting.  Section 450.113, Flight safety analysis requirements—scope.  Section 450.115, Flight safety analysis methods.  Section 450.133, Flight hazard area analysis.  Section 450.141, Computing systems.  Section 450.143, Safety-critical system design, test, and documentation.  Section 450.145, Highly reliable flight safety system.  Section 450.211, Continuing accuracy of license application; application for modification of license. ### Page 6 3.3 Related FAA Advisory Circulars. FAA Advisory Circulars (are available through the FAA website, http://www.faa.gov).  AC 450.101-1, High Consequence Event Protection, dated June, 2021.  AC 450.109-1, Flight Hazard Analysis, when published.  AC 450.141-1, Computing Systems and Software, dated August, 2021.  AC 450.143-1, Safety-Critical System Design, Test, and Documentation, when published. 3.4 Government Guidance Documents.  MIL-STD-882E, Department of Defense Standard Practice, System Safety, dated May 11, 2012, https://quicksearch.dla.mil/qsDocDetails.aspx?ident_number=36027. Note: The documents referenced in this section refer to the current regulatory authorities’ accepted revisions. ### Page 7 **4 4 DEFINITION OF TERMS.** For this AC, the terms and definitions from § 401.7, and this list, apply: 4.1 System Safety Hazard A real or potential condition that could lead to an unplanned event or series of events resulting in: unintentional death, injury, or occupational illness; damage to or loss of equipment or property; or damage to the environment. **5 ACRONYMS.** AC – Advisory Circular BATT – Battery CFR – Code of Federal Regulations DL – Discrete Logic DT&D – Design, Test, and Documentation ENG – Engine FAA – Federal Aviation Administration FMF – Free Molecular Flow FW – Firmware FSA – Flight Safety Analysis FSS – Flight Safety System HW – Hardware SW – Software TBD – To be determined OMB – Office of Management and Budget SRM – Solid Rocket Motor 6 OVERVIEW. 6.1 Hazard Control Strategies. One or more of the hazard control strategies defined in §§ 450.108 through 450.111 must be used to meet the safety criteria in accordance with § 450.101(a), (b), or (c). Different hazard control strategies may be utilized during any one phase of flight because a different strategy may be more appropriate for one phase of a flight or to protect different sets of people and property. The hazard control strategies are flight abort, flight hazard analysis, physical containment, and wind weighting. The appropriate hazard control strategy is determined by conducting a functional hazard analysis. ### Page 8 6.1.1 Use of Flight Abort as a Hazard Control Strategy. Flight abort is the traditional safety approach for expendable launch vehicles. It is a process to limit or restrict the hazards to public safety and the safety of property presented by a launch vehicle or reentry vehicle, including any payload, while in flight by initiating and accomplishing a controlled ending to vehicle flight. With the exception of phases of flight where the launch or reentry vehicle has sufficient demonstrated reliability, flight abort is required as a hazard control strategy if the potential for a high consequence event is above a certain threshold in accordance with § 450.101(c). 6.1.2 Use of Flight Hazard Analysis as a Hazard Control Strategy. Flight hazard analysis is the traditional safety approach for reusable launch vehicles, and is the most flexible hazard control strategy because it allows for deriving specific hazard controls unique to the launch or reentry vehicle system and operations concept. Flight hazard analysis may be utilized as a hazard control strategy, but is mandated by § 450.107(c) if the hazards to the public cannot be mitigated adequately to meet the safety criteria of § 450.101(a), (b), and (c) using physical containment, wind weighting, or flight abort. 6.1.3 Use of Physical Containment as a Hazard Control Strategy. Physical containment is used for low energy test flights when a launch vehicle does not have sufficient energy for any hazards associated with its flight to reach the public or critical assets. 6.1.3.1 Per § 450.110(b)(1), to use physical containment as a hazard control strategy, a flight hazard area must be developed in accordance with § 450.133. 6.1.3.2 The operator must ensure that the launch vehicle does not have sufficient energy for any hazards associated with its flight to reach outside the flight hazard area in accordance with § 450.110(b)(2). 6.1.3.3 The hazard area should be clear of the public and critical asset in accordance with § 450.110(b)(3). 6.1.3.4 An operator must apply other mitigation measures necessary to ensure no public or critical asset exposure to hazards, via methods such as control of public access or wind placards in accordance with § 450.110(b)(4). 6.1.4 Use of Wind Weighting as a Hazard Control Strategy. Wind weighting is traditionally used in the launch of unguided suborbital launch vehicles, otherwise known as sounding rockets, where launcher azimuth and elevation settings are adjusted to correct for the effects of wind conditions at the time of flight to provide a safe impact location for the launch vehicle or its components. ### Page 9 6.2 Using a Functional Hazard Analysis for Hazard Control Strategy Determination. Section 450.107(b) requires an operator to use a functional hazard analysis to determine the hazard control strategy or strategies for each phase of flight during a launch or reentry that account for (1) all functional failures associated with reasonably foreseeable hazardous events that have the capability to create a hazard to the public, (2) safetycritical systems, and (3) a timeline of all safety-critical events. 6.2.1 Overview of Functional Hazard Analysis. A functional hazard analysis is a critical element for ensuring public safety during flight. At a foundational level, the analysis provides a holistic, systematic approach to identifying potential hazards. Second, the analysis supports the validation of adequacy for determined hazard control strategies. Third, the analysis supports a justification for use of historical flight outcome data in the probability of failure analysis. Development of prior launch and reentry vehicles has included a structured system safety process, and thus this foundational system safety analysis is one necessary element in defining similar vehicles in accordance with § 450.131, Probability of Failure Analysis. Fourth, it provides a basis for developing quantitative models of debris, in accordance with § 450.121, and malfunction trajectories, in accordance with § 450.119. Fifth, the analysis is a basis for a flight hazard analysis if that hazard control strategy is used. 6.2.2 Determining which Hazard Control Strategy to Use. There are two constraints to hazard control strategy determination for any phase of flight. First, § 450.107(c) requires a flight hazard analysis to be conducted in accordance with § 450.109, if the public safety hazards cannot be mitigated adequately to meet the public risk criteria of § 450.101(a), (b), and (c) using physical containment, wind weighting, or flight abort. Second, in accordance with § 450.101(c), if the consequence of any reasonably foreseeable failure mode, in any significant period of flight, is greater than 1 × 10-3 conditional expected casualties, then flight abort must be used as a hazard control strategy in accordance with the requirements of § 450.108, or the launch or reentry vehicle must have sufficient demonstrated reliability as agreed to by the FAA Administrator based on conditional expected casualties during that phase of flight. AC 450.101-1, High Consequence Event Protection, provides additional guidance on conditional expected casualty. 6.2.3 Hazard Control Strategy Determination Logic. The approach to determining and validating hazard control strategies is a process, which is iterative, as illustrated in Figure 1 of this AC. The functional hazard analysis is utilized to ensure that all potential hazards to the public have a determined hazard control strategy. Generally, the applicant will determine a hazard control strategy based on engineering and program considerations. If the hazards to the public are potentially mitigated, then the selected strategies are developed, and the supporting data is used as general input for the flight safety analysis. If adequate mitigation is not validated by supporting data, then the hazard control strategy should be revisited. If validation is successful, then the flight safety analysis is used to demonstrate whether the safety criteria are satisfied. If the safety criteria cannot be met, then additional hazard controls must be implemented, in accordance with 450.107(c). ### Page 10 (OCR) Program Considerations: judgment and Engineering System Safety Program Design Design Selection Cost & Schedule Concept of Ops Preference with similar experience vehicles Program, Hazard Management [103(b)] Postulate Hazard Functional Hazard Hazards Yes Control Analysis potentially Strategies [107(b)] mitigated? No ......... Map all functional failures to reasonably foreseeable hazards and failure modes (107 and 115) Wind- System Design & Analysis Windweighting weighting (111) Malfunction Trajectory Analysis (119) Abort Flight Abort Analysis (108) Probability of Which Failure Analysis control (131) and Debris strategies? Hazard Flight Hazard Analysis (121) Mitigation Analysis (109) Physical Physical containment* containment (110) Successful Risk Review/Revise Validation of yes → Flight safety criteria Yes Functional Adequacy? Analysis met? Hazard Analysis [107(c)] (subpart C) (101) No No Proceed with operations Figure 1. Flow of Hazard Control Strategy Determination 6.2.4 Application Requirements. In its application, in accordance with § 450.107(d), an applicant must submit the results of the hazard control strategy determination and a description of strategies for each phase of flight in its application. ### Page 11 **8 7 HAZARD CONTROL STRATEGY DETERMINATION.** 7.1 Functional Hazard Analysis. 7.1.1 Section 450.107(b) requires the use of a functional hazard analysis for each phase of flight during a launch or reentry to determine a hazard control strategy or strategies. In accordance with §§ 450.107(b)(1) through (3), the hazard control strategies must account for all functional failures associated with reasonably foreseeable hazardous events that have the capability to create a hazard to the public, safety-critical systems, and a timeline of all safety-critical events. The functional hazard analysis should be completed as early as possible in the launch or reentry system’s lifecycle. Note: The term “reasonably foreseeable” is not associated with probability or likelihood, but is inherent to a methodical assessment of the entire system. “Reasonably foreseeable hazardous events” are those identifiable through the system safety process, beyond those that could be determined solely by “brainstorming.” Thus, a functional hazard analysis is required by §450.107(b). 7.1.2 A functional hazard analysis is used to analyze system functions associated with the proposed operation (mission). The functional hazard analysis is primarily used to identify and classify the overall system functions and consequences of functional failure or malfunction. The objective is to identify all potential system, subsystem, and component functional failures that could impact public safety. Any foreseeable mitigations or predetermined hazard control strategies should not affect the identification of potential system safety hazards and respective functional sources (i.e. subsystem functional failures). 7.1.3 Prior to performing a functional hazard analysis, an operator should have sufficient understanding of the mission. Subsequently, the functional hazard analysis, at a minimum, should provide the following:1 a. A decomposition of the overall system to its next-level systems and related subsystems to the major component level. Further decomposition may be necessary if relevant to public safety. Note: The FAA expects the depth of system decomposition within the functional hazard analysis to be variable depending on the level necessary to adequately discern and mitigate impacts to public safety. For example, the FAA may accept a decomposition of a “system – avionics – main computer” that may not need to go any further if all related impacts to public safety are confined, and all potential failure mitigations are applied, at that level. Alternatively, lower level mitigations such as an electronic circuit mitigation would require decomposition down to “system – avionics – main computer – circuit board assembly,” to demonstrate hazard mitigation at the appropriate level of the system. The level of detail and completeness of the analysis should be comparable to or better than the system safety analyses performed during 1 This list adapts the guidance of MIL-STD-882E. ### Page 12 9 development of the vehicles used as similar vehicles in the probability of failure assessment (§ 450.131). b. A functional description of each next-level system, subsystem, and component identified, to include interfaces between subsystems and components. c. A designation of the implementation method for each function (e.g., hardware, software, etc.). d. Identification of phases of system operation (e.g., captive carry, rocket-powered flight, landing). e. Identification of failure modes, to include at a minimum: i. Failure to function; ii. Functions early or late; iii. Functions out-of-sequence or time; iv. Functions inadvertently; or v. Degrade function or malfunction. f. Assessment of the “end-effect” resulting from failure of each function during each phase under each failure mode, excluding mitigation. Assessment should be based on the best available data, including mishap data (if obtainable) from similar systems and other lessons learned. g. Assignment of functional failure identification to allow for traceability. h. Assessment of the severity associated with each failure end-effect. i. A level of rigor determination for logic-based functions based on severity of the failure “end-effect” and degree of control. j. Assessment of whether each failure end-effect poses a potential system or mission hazard to the public. Note: Grouping of different component or subsystem failures that may lead to the same end-effect allows for identification of potential hazards to the public for the overall system. k. Traceability between each functional failure and associated hazards during each phase of flight to respective hazard control strategies that should mitigate the hazard at the system and mission level, as per § 450.103(b)(1). Note: Appendix A of this AC provides a template for packaging the data above in an acceptable functional hazard analysis format. ### Page 13 7.2 Assistance of Flight Safety Analysis. 7.2.1 The flight safety analysis (FSA) assists in understanding the end-effect of functional failures prior to mitigation. Thus, assistance from an initial FSA is important for identifying system and mission level hazards to the public from functional failures. 7.2.2 Section 450.113(a) requires that an FSA be performed and documented for all phases of flight, except as specified in § 450.113(b) regarding demonstrated reliability. 7.2.3 Section 450.115(a) requires the FSA method to account for all reasonably foreseeable events and failures of safety-critical systems during nominal and non-nominal launch or reentry that could jeopardize public safety. 7.3 Primary Outputs of the Functional Hazard Analysis. 7.3.1 Functional Failures and Safety-Critical Systems. In accordance with § 450.107(b), the functional hazard analysis accounts for: 1. Identification of all functional failures associated with reasonably foreseeable hazardous events that have the capability to create a hazard to the public” (see paragraphs 7.1.3 ‘a’ thru ‘h’ of this AC). 2. Identification of safety-critical systems (see paragraphs 7.1.3 ‘f, h, and j’ of this AC). By identifying each system carrying an assessed failure “end effect” resulting from failure of each system function during each phase under each failure mode, excluding mitigation, posing a potential system or mission hazard to the public. 3. Timeline of safety-critical events (see paragraphs 7.1.3 ‘f, h, & j’ of this AC). By merging a given mission’s timeline of flight events with the assessment of whether each failure “end effect” resulting from failure of each function during each phase under each failure mode, excluding mitigation, poses a potential system or mission hazard to the public. **8 POTENTIAL DETERMINATION SCENARIOS.** Per § 450.107(b), a hazard control strategy must be determined for each potential hazard to the public identified by the functional hazard analysis. A different strategy or multiple strategies may be employed in a single phase of flight, sufficient to ensure the safety criteria of § 450.101(a), (b), and (c) are met. In accordance with § 450.107(d), application submittal must include the results of the hazard control strategy determination, including all functional failures, the identification of all safety-critical systems, and a timeline of all safety-critical events. A description of the hazard control strategy or strategies for each phase of flight must be provided. Although not all encompassing, the scenarios outlined in this section are potentially expected outcomes of determined hazard control strategies. Note: Per § 450.143(a), documenting compliance to § 450.143 must be performed for all safety-critical systems, except for: 1. Highly reliable flight safety systems covered under § 450.145; or ### Page 14 2. Safety-critical systems for which an operator demonstrates through its flight hazard analysis that the likelihood of any hazardous condition specifically associated with the system that may cause death or serious injury to the public is extremely remote, pursuant to § 450.109(b)(3). Note: AC 450.103-1 provides guidance on “extremely remote” criteria. 8.1 Flight Abort with Highly Reliable Flight Safety System (FSS). An FSS that meets the highly-reliable flight safety requirements specified in § 450.145 may be utilized during any phase of flight. The flight abort strategy should adequately mitigate hazards to the public identified by the functional hazard analysis, during the specified phase of flight in which it is utilized. 8.2 Flight Hazard Analysis with Flight Abort. An FSS that does not meet the highly-reliable flight safety requirements specified in § 450.145 may be utilized during any phase of flight. If necessary, a combined hazard control strategy of flight abort and flight hazard analysis should identify all necessary mitigations and support documentation of compliance to § 450.143 for safety-critical systems. The combined flight abort and flight hazard analysis strategies should adequately mitigate hazards to the public identified by the functional hazard analysis, during the specified phase of flight in which they are utilized. 8.3 Flight Hazard Analysis. A flight hazard analysis may be utilized during any phase of flight. In accordance with § 450.107(c), a flight hazard analysis must be conducted if the hazards to the public cannot be mitigated adequately to meet the safety criteria of § 450.101(a), (b), and (c) using physical containment, wind weighting, or flight abort. The flight hazard analysis strategy should identify all necessary mitigations and support documentation of compliance to § 450.143 for safety-critical systems. The flight hazard analysis strategy should adequately mitigate hazards to the public identified by the functional hazard analysis, during the specified phase of flight in which it is utilized. 8.4 Physical Containment. The hazards to the public identified by the functional hazard analysis may be assessed as physically contained within an operating area during any phase of flight, without further decomposition of system mitigations via the flight hazard analysis. This mission level mitigation should be shown to contain all hazards. In such a scenario, the physical containment strategy should adequately mitigate hazards to the public as identified by the functional hazard analysis, during the specified phase of flight in which it is utilized. 8.5 Wind Weighting. A wind weighting safety system compliant with § 450.111 may be utilized for missions involving an unguided suborbital launch vehicle. The wind weighting strategy should adequately mitigate hazards to the public identified by the functional hazard analysis. ### Page 15 **12 9 HAZARD CONTROL STRATEGY VALIDATION.** In accordance with § 450.107(a), the safety criteria of 450.101(a), (b), and (c) must be met by using hazard control strategies. In accordance with § 450.107(c), if an operator cannot adequately mitigate the public safety hazards to meet the public risk criteria of § 450.101(a), (b), and (c) using physical containment, wind weighting, or flight abort, then the operator must conduct a flight hazard analysis in accordance with § 450.109. To demonstrate adequate mitigation of the public safety hazards using physical containment, wind weighting, or flight abort, an operator should demonstrate the following: (1) The hazard control strategy should mitigate system safety hazards to the public such that the likelihood of any hazardous condition that may cause death or serious injury to the public is extremely remote; (2) Hazards and hazard control strategies are characterized with fidelity commensurate with the flight safety analysis, per § 450.115(b), such that they are valid for use in debris data development (§ 450.121) and malfunction trajectory analysis (§ 450.119), and are consistent with the probability of failure analysis (§ 450.131); and (3) The flight safety analysis incorporating the hazard control strategy satisfies the safety criteria of § 450.101(a), (b), and (c). If an operator using the means of compliance in this AC is unable to demonstrate the three criteria above as applied to physical containment, wind weighting, or flight abort, then the operator would need to perform a flight hazard analysis or utilize another means of compliance to demonstrate the hazard control strategy adequately mitigates the hazard. 9.1 Adequacy of Determined Hazard Control Strategy. Compliance data from the following items will support the validation of adequacy: 9.1.1 Flight Safety Analysis. As discussed in paragraph 7.2 of this AC, assistance from the initial FSA is important for identifying system and mission hazards to the public. Additionally, FSA data assists in understanding the effectiveness of mitigations. Thus, the final FSA should inform the validation of any hazard control strategy for a phase of flight. 9.1.2 Flight Hazard Analysis. Documenting compliance to § 450.109 for a flight hazard analysis produces data that should inform the validation of a flight hazard analysis strategy for each phase of flight in which it is used. Reference AC 450.109-1 for further guidance on flight hazard analyses. 9.1.3 Computing Systems. Documenting compliance to § 450.141 for computing systems produces data that should inform the validation of a flight abort and flight hazard analysis strategy for each phase of flight in which it is used. Reference AC 450.141-1 for further guidance on computing systems and software safety. ### Page 16 9.1.4 Safety-Critical Systems Design, Test, and Documentation (DT&D). Documenting compliance to § 450.143 for safety-critical systems produces data that should inform the validation of a flight abort and flight hazard analysis strategy for each phase of flight in which it is used. Reference AC 450.143-1 for further guidance on safety-critical systems DT&D. 9.1.5 Highly Reliable Flight Safety System (FSS). Documenting compliance to § 450.145 for a highly reliable FSS produces data that should inform the validation of a flight abort strategy for each phase of flight in which it is used. 9.1.6 Wind Weighting Safety System DT&D. Documenting compliance to § 450.111 for a wind weighting safety system should produce data that validates the adequacy of a wind weighting strategy for each phase of flight in which it is used. **10 CONTINUING ACCURACY OF LICENSE APPLICATION.** The functional hazard analysis and adequacy of the determined hazard control strategy must be updated or re-validated as the system design and operation mature in accordance with § 450.211(a)(2). ### Page 17 14 Appendix A. System Safety Template for § 450.107 Functional Hazard Analysis. Top-Level System [TBD] Next-Level System Subsystem Component Function Implementation Function ID Phase Failure Mode Failure End Effect Functional Failure ID or NSI1 Severity SW/FW/DL Level of Rigor2 Potential Hazard to Public3 Hazard Control Strategy4 Launch Vehicle Stage 1 [LVS1] Avionics System (AVI) Computer [COMP] Function 1 Hardware (HW); Software (SW); Firmware (FW); Discrete Logic (DL) LVS1-AVI-COMP-001 Launch Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Flight Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Abort/Reentry Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Landing Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Function 2; and so on… Hardware (HW); Software (SW); Firmware (FW); Discrete Logic (DL) LVS1-AVI-COMP-001; and so on… Launch; Flight; Abort/Reentry; Landing Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Battery [BATT]; and so on… Function 1 Hardware (HW); Software (SW); Firmware (FW); Discrete Logic (DL) LVS1-AVI-BATT-001 Launch; Flight; Abort/Reentry; Landing Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Function 2; and so on… Hardware (HW); Software (SW); Firmware (FW); Discrete Logic (DL) LVS1-AVI-BATT-001; and so on… Launch; Flight; Abort/Reentry; Landing Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Propulsion System [PROP]; Engine(s) [ENG]; and so on… Function(s) TBD; and so on… Hardware (HW); Software (SW); Firmware (FW); Discrete Logic (DL) LVS1-PROP-ENG-001; and so on… Launch; Flight; Abort/Reentry; Landing Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Control System [CONT]; Reaction Control System [RCS]; and so on… Function(s) TBD; and so on… Hardware (HW); Software (SW); Firmware (FW); Discrete Logic (DL) LVS1-CONT-RCS-001; and so on… Launch; Flight; Abort/Reentry; Landing Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Flight Safety System [FSS]; and so on… Safe & Arm [S&A]; and so on… Function(s) TBD; and so on… Hardware (HW); Software (SW); Firmware (FW); Discrete Logic (DL) LVS1-FSS-S&A-001; and so on… Launch; Flight; Abort/Reentry; Landing Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Launch Vehicle Stage 2 [LVS2] Avionics System; Propulsion System; Control System; Flight Safety System; and so on… Component(s) TBD; and so on… Function(s) TBD; and so on… Hardware (HW); Software (SW); Firmware (FW); Discrete Logic (DL) LVS2-TBD-TBD-001; and so on… Launch; Flight; Abort/Reentry; Landing Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Spacecraft/ Payload [S/P]; and so on… Avionics System; Propulsion System; Control System; and so on… Component(s) TBD; and so on… Function(s) TBD; and so on… Hardware (HW); Software (SW); Firmware (FW); Discrete Logic (DL) S/P-TBD-TBD-001; and so on… Launch; Flight; Abort/Reentry; Landing Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD NOTES: (1) NSI = No Safety Impact; (2) Level of Rigor [LOR] per MIL-STD-882, or Design Assurance Level [DAL] per DO-178, or other software safety method; (3) Identify potential hazard to the public at the system and mission level; (4) Per § 450.107 and guidance of AC 450.107-1 ### Page 18 OMB Control Number: 2120-0746 (Expiration Date: 08/31/2023) FAA Form 1320-73 (06-2020) Advisory Circular Feedback Form If you find an error in this AC, have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by (1) emailing this form to ASTApplications@faa.gov, or (2) faxing it to (202) 267-5450. Subject: (insert AC title/number here) Date: Click here to enter text. Please check all appropriate line items: ☐ An error (procedural or typographical) has been noted in paragraph Click here to enter text. on page Click here to enter text.. ☐ Recommend paragraph Click here to enter text. on page Click here to enter text. be changed as follows: Click here to enter text. ☐ In a future change to this AC, please cover the following subject: (Briefly describe what you want added.) Click here to enter text. ☐ Other comments: Click here to enter text. ☐ I would like to discuss the above. Please contact me. Submitted by: Date: Paperwork Reduction Act Burden Statement: A federal agency may not conduct or sponsor, and a person is not required to respond to, nor shall a person be subject to a penalty for failure to comply with a collection of information subject to the requirements of the Paperwork Reduction Act unless that collection of information displays a currently valid OMB Control Number. The OMB Control Number for this information collection is 2120 -0746. Public reporting for this collection of information is estimated to be approximately 5 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. All responses to this collection of information are voluntary to obtain or retain benefits per 14 CFR 77. Send comments regarding this burden estimate or any other aspect of this collection of information, includ ing suggestions for reducing this burden to: Information Collection Clearance Officer, Federal Aviation Administration, 10101 Hillwood Parkway, Fort Worth, TX 76177-1524. --- OpenAirDocs.org is an independent research project of [Contrail Labs](https://contraillabs.com/). It is not affiliated with the FAA or the NTSB. Source documents are U.S. government works in the public domain.