7.2 Assistance of Flight Safety Analysis.
7.2.1 The flight safety analysis (FSA) assists in understanding the end-effect of functional failures prior to mitigation. Thus, assistance from an initial FSA is important for identifying system and mission level hazards to the public from functional failures.
7.2.2 Section 450.113(a) requires that an FSA be performed and documented for all phases of flight, except as specified in § 450.113(b) regarding demonstrated reliability.
7.2.3 Section 450.115(a) requires the FSA method to account for all reasonably foreseeable events and failures of safety-critical systems during nominal and non-nominal launch or reentry that could jeopardize public safety.
7.3 Primary Outputs of the Functional Hazard Analysis.
7.3.1 Functional Failures and Safety-Critical Systems.
In accordance with § 450.107(b), the functional hazard analysis accounts for:
1. Identification of all functional failures associated with reasonably foreseeable hazardous events that have the capability to create a hazard to the public” (see paragraphs 7.1.3 ‘a’ thru ‘h’ of this AC).
2. Identification of safety-critical systems (see paragraphs 7.1.3 ‘f, h, and j’ of this AC). By identifying each system carrying an assessed failure “end effect” resulting from failure of each system function during each phase under each failure mode, excluding mitigation, posing a potential system or mission hazard to the public.
3. Timeline of safety-critical events (see paragraphs 7.1.3 ‘f, h, & j’ of this AC). By merging a given mission’s timeline of flight events with the assessment of whether each failure “end effect” resulting from failure of each function during each phase under each failure mode, excluding mitigation, poses a potential system or mission hazard to the public.
8 POTENTIAL DETERMINATION SCENARIOS.
Per § 450.107(b), a hazard control strategy must be determined for each potential hazard to the public identified by the functional hazard analysis. A different strategy or multiple strategies may be employed in a single phase of flight, sufficient to ensure the safety criteria of § 450.101(a), (b), and (c) are met. In accordance with § 450.107(d), application submittal must include the results of the hazard control strategy determination, including all functional failures, the identification of all safety-critical systems, and a timeline of all safety-critical events. A description of the hazard control strategy or strategies for each phase of flight must be provided. Although not all encompassing, the scenarios outlined in this section are potentially expected outcomes of determined hazard control strategies.
Note: Per § 450.143(a), documenting compliance to § 450.143 must be performed for all safety-critical systems, except for:
1. Highly reliable flight safety systems covered under § 450.145; or
2. Safety-critical systems for which an operator demonstrates through its flight hazard analysis that the likelihood of any hazardous condition specifically associated with the system that may cause death or serious injury to the public is extremely remote, pursuant to § 450.109(b)(3).
Note: AC 450.103-1 provides guidance on “extremely remote” criteria.
8.1 Flight Abort with Highly Reliable Flight Safety System (FSS).
An FSS that meets the highly-reliable flight safety requirements specified in § 450.145 may be utilized during any phase of flight. The flight abort strategy should adequately mitigate hazards to the public identified by the functional hazard analysis, during the specified phase of flight in which it is utilized.
8.2 Flight Hazard Analysis with Flight Abort.
An FSS that does not meet the highly-reliable flight safety requirements specified in § 450.145 may be utilized during any phase of flight. If necessary, a combined hazard control strategy of flight abort and flight hazard analysis should identify all necessary mitigations and support documentation of compliance to § 450.143 for safety-critical systems. The combined flight abort and flight hazard analysis strategies should adequately mitigate hazards to the public identified by the functional hazard analysis, during the specified phase of flight in which they are utilized.
8.3 Flight Hazard Analysis.
A flight hazard analysis may be utilized during any phase of flight. In accordance with § 450.107(c), a flight hazard analysis must be conducted if the hazards to the public cannot be mitigated adequately to meet the safety criteria of § 450.101(a), (b), and (c) using physical containment, wind weighting, or flight abort. The flight hazard analysis strategy should identify all necessary mitigations and support documentation of compliance to § 450.143 for safety-critical systems. The flight hazard analysis strategy should adequately mitigate hazards to the public identified by the functional hazard analysis, during the specified phase of flight in which it is utilized.
8.4 Physical Containment.
The hazards to the public identified by the functional hazard analysis may be assessed as physically contained within an operating area during any phase of flight, without further decomposition of system mitigations via the flight hazard analysis. This mission level mitigation should be shown to contain all hazards. In such a scenario, the physical containment strategy should adequately mitigate hazards to the public as identified by the functional hazard analysis, during the specified phase of flight in which it is utilized.
8.5 Wind Weighting.
A wind weighting safety system compliant with § 450.111 may be utilized for missions involving an unguided suborbital launch vehicle. The wind weighting strategy should adequately mitigate hazards to the public identified by the functional hazard analysis.
12 9 HAZARD CONTROL STRATEGY VALIDATION.
In accordance with § 450.107(a), the safety criteria of 450.101(a), (b), and (c) must be met by using hazard control strategies. In accordance with § 450.107(c), if an operator cannot adequately mitigate the public safety hazards to meet the public risk criteria of § 450.101(a), (b), and (c) using physical containment, wind weighting, or flight abort, then the operator must conduct a flight hazard analysis in accordance with § 450.109.
To demonstrate adequate mitigation of the public safety hazards using physical containment, wind weighting, or flight abort, an operator should demonstrate the following:
(1) The hazard control strategy should mitigate system safety hazards to the public such that the likelihood of any hazardous condition that may cause death or serious injury to the public is extremely remote;
(2) Hazards and hazard control strategies are characterized with fidelity commensurate with the flight safety analysis, per § 450.115(b), such that they are valid for use in debris data development (§ 450.121) and malfunction trajectory analysis (§ 450.119), and are consistent with the probability of failure analysis (§ 450.131); and
(3) The flight safety analysis incorporating the hazard control strategy satisfies the safety criteria of § 450.101(a), (b), and (c).
If an operator using the means of compliance in this AC is unable to demonstrate the three criteria above as applied to physical containment, wind weighting, or flight abort, then the operator would need to perform a flight hazard analysis or utilize another means of compliance to demonstrate the hazard control strategy adequately mitigates the hazard.
9.1 Adequacy of Determined Hazard Control Strategy.
Compliance data from the following items will support the validation of adequacy:
9.1.1 Flight Safety Analysis.
As discussed in paragraph 7.2 of this AC, assistance from the initial FSA is important for identifying system and mission hazards to the public. Additionally, FSA data assists in understanding the effectiveness of mitigations. Thus, the final FSA should inform the validation of any hazard control strategy for a phase of flight.
9.1.2 Flight Hazard Analysis.
Documenting compliance to § 450.109 for a flight hazard analysis produces data that should inform the validation of a flight hazard analysis strategy for each phase of flight in which it is used. Reference AC 450.109-1 for further guidance on flight hazard analyses.
9.1.3 Computing Systems.
Documenting compliance to § 450.141 for computing systems produces data that should inform the validation of a flight abort and flight hazard analysis strategy for each phase of flight in which it is used. Reference AC 450.141-1 for further guidance on computing systems and software safety.
9.1.4 Safety-Critical Systems Design, Test, and Documentation (DT&D).
Documenting compliance to § 450.143 for safety-critical systems produces data that should inform the validation of a flight abort and flight hazard analysis strategy for each phase of flight in which it is used. Reference AC 450.143-1 for further guidance on safety-critical systems DT&D.
9.1.5 Highly Reliable Flight Safety System (FSS).
Documenting compliance to § 450.145 for a highly reliable FSS produces data that should inform the validation of a flight abort strategy for each phase of flight in which it is used.
9.1.6 Wind Weighting Safety System DT&D.
Documenting compliance to § 450.111 for a wind weighting safety system should produce data that validates the adequacy of a wind weighting strategy for each phase of flight in which it is used.
10 CONTINUING ACCURACY OF LICENSE APPLICATION.
The functional hazard analysis and adequacy of the determined hazard control strategy must be updated or re-validated as the system design and operation mature in accordance with § 450.211(a)(2).
14 Appendix A. System Safety Template for § 450.107 Functional Hazard Analysis.
Top-Level System [TBD] Next-Level System Subsystem Component Function Implementation Function ID Phase Failure Mode Failure End Effect Functional Failure ID or NSI1 Severity SW/FW/DL Level of Rigor2 Potential Hazard to Public3 Hazard Control Strategy4 Launch Vehicle Stage 1 [LVS1] Avionics System (AVI)
Computer [COMP] Function 1
Hardware (HW);
Software (SW);
Firmware (FW);
Discrete Logic (DL) LVS1-AVI-COMP-001 Launch
Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Flight
Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Abort/Reentry
Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Landing Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Function 2;
and so on… Hardware (HW);
Software (SW);
Firmware (FW);
Discrete Logic (DL) LVS1-AVI-COMP-001;
and so on… Launch;
Flight;
Abort/Reentry;
Landing Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Battery [BATT];
and so on…
Function 1
Hardware (HW);
Software (SW);
Firmware (FW);
Discrete Logic (DL) LVS1-AVI-BATT-001 Launch;
Flight;
Abort/Reentry;
Landing Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Function 2;
and so on… Hardware (HW);
Software (SW);
Firmware (FW);
Discrete Logic (DL) LVS1-AVI-BATT-001;
and so on… Launch;
Flight;
Abort/Reentry;
Landing Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Propulsion System [PROP];
Engine(s) [ENG];
and so on… Function(s) TBD;
and so on… Hardware (HW);
Software (SW);
Firmware (FW);
Discrete Logic (DL) LVS1-PROP-ENG-001;
and so on… Launch;
Flight;
Abort/Reentry;
Landing Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Control System [CONT];
Reaction Control System [RCS];
and so on… Function(s) TBD;
and so on… Hardware (HW);
Software (SW);
Firmware (FW);
Discrete Logic (DL) LVS1-CONT-RCS-001;
and so on… Launch;
Flight;
Abort/Reentry;
Landing Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Flight Safety System [FSS];
and so on… Safe & Arm [S&A];
and so on… Function(s) TBD;
and so on… Hardware (HW);
Software (SW);
Firmware (FW);
Discrete Logic (DL) LVS1-FSS-S&A-001;
and so on… Launch;
Flight;
Abort/Reentry;
Landing Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Launch Vehicle Stage 2 [LVS2] Avionics System;
Propulsion System;
Control System;
Flight Safety System;
and so on… Component(s) TBD;
and so on… Function(s) TBD;
and so on… Hardware (HW);
Software (SW);
Firmware (FW);
Discrete Logic (DL) LVS2-TBD-TBD-001;
and so on… Launch;
Flight;
Abort/Reentry;
Landing Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD Spacecraft/ Payload [S/P];
and so on…
Avionics System;
Propulsion System;
Control System;
and so on… Component(s) TBD;
and so on… Function(s) TBD;
and so on… Hardware (HW);
Software (SW);
Firmware (FW);
Discrete Logic (DL) S/P-TBD-TBD-001;
and so on… Launch;
Flight;
Abort/Reentry;
Landing Failure to function TBD TBD TBD TBD TBD TBD Functions early / late TBD TBD TBD TBD TBD TBD Functions out-of-sequence / time TBD TBD TBD TBD TBD TBD Functions inadvertently TBD TBD TBD TBD TBD TBD Degraded function or Malfunction TBD TBD TBD TBD TBD TBD NOTES: (1) NSI = No Safety Impact; (2) Level of Rigor [LOR] per MIL-STD-882, or Design Assurance Level [DAL] per DO-178, or other software safety method; (3) Identify potential hazard to the public at the system and mission level; (4) Per § 450.107 and guidance of AC 450.107-1
OMB Control Number: 2120-0746 (Expiration Date: 08/31/2023)
FAA Form 1320-73 (06-2020)
Advisory Circular Feedback Form
If you find an error in this AC, have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by (1) emailing this form to ASTApplications@faa.gov, or (2) faxing it to (202) 267-5450.
Subject: (insert AC title/number here) Date: Click here to enter text.
Please check all appropriate line items:
☐ An error (procedural or typographical) has been noted in paragraph Click here to enter text.
on page Click here to enter text..
☐ Recommend paragraph Click here to enter text. on page Click here to enter text. be changed as follows:
Click here to enter text.
☐ In a future change to this AC, please cover the following subject:
(Briefly describe what you want added.)
Click here to enter text.
☐ Other comments:
Click here to enter text.
☐ I would like to discuss the above. Please contact me.
Submitted by: Date:
Paperwork Reduction Act Burden Statement: A federal agency may not conduct or sponsor, and a person is not required to respond to, nor shall a person be subject to a penalty for failure to comply with a collection of information subject to the requirements of the Paperwork Reduction Act unless that collection of information displays a currently valid OMB Control Number. The OMB Control Number for this information collection is 2120 -0746. Public reporting for this collection of information is estimated to be approximately 5 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. All responses to this collection of information are voluntary to obtain or retain benefits per 14 CFR 77. Send comments regarding this burden estimate or any other aspect of this collection of information, includ ing suggestions for reducing this burden to: Information Collection Clearance Officer, Federal Aviation Administration, 10101 Hillwood Parkway, Fort Worth, TX 76177-1524.