C AdvisoryU.S. Department of Transportation Federal Aviation Circular Administration Subject: Hazard Control Strategies Determination Date: July 27, 2021 AC No: 450.107-1 Initiated By: AST-1 This Advisory Circular (AC) provides guidance for an applicant to develop a hazard control strategy or strategies in accordance with title 14 of the Code of Federal Regulations (14 CFR) § 450.107. It is intended to assist prospective launch and reentry operators in obtaining and maintaining a vehicle operator license.
The FAA considers this AC an accepted means of compliance for complying with the regulatory requirements of § 450.107. It presents one, but not the only, acceptable means of compliance with the associated regulatory requirements. The contents of this document do not have the force and effect of law and are not meant to bind the public in any way. The document is intended only to provide clarity to the public regarding existing requirements under the law or agency policies.
If you have suggestions for improving this AC, you may use the Advisory Circular Feedback form at the end of this AC.
WAYNE R MONTEITH Digitally signed by WAYNE R MONTEITH Date: 2021.07.27 12:26:47 -04'00' Wayne R. Monteith Associate Administrator Commercial Space Transportation
Contents Paragraph Page iii
1 Purpose1
2 Applicability1
3 Applicable Regulations and Related Documents2
4 Definition of Terms4
5 Overview4
5.1 Hazard Control Strategies4
5.1.1 Use of Flight Abort as a Hazard Control Strategy5
5.1.2 Use of Flight Hazard Analysis as a Hazard Control Strategy5
5.1.3 Use of Physical Containment as a Hazard Control Strategy5
5.1.4 Use of Wind Weighting as a Hazard Control Strategy5
5.2 Using a Functional Hazard Analysis for Hazard Control Strategy Determination6
5.2.1 Overview of Functional Hazard Analysis6
5.2.2 Determining which Hazard Control Strategy to Use6
5.2.3 Hazard Control Strategy Determination Logic6
5.2.4 Application Requirements7
6 Hazard Control Strategy Determination8
6.1 Functional Hazard Analysis8
6.2 Assistance of Flight Safety Analysis10
6.3 Primary Outputs of the Functional Hazard Analysis10
7 Potential Determination Scenarios10
7.1 Flight Abort with Highly Reliable Fight Safety System11
7.2 Flight Hazard Analysis with Flight Abort11
7.3 Flight Hazard Analysis11
7.4 Physical Containment11
7.5 Wind Weighting11
8 Hazard Control Strategy Validation12
8.1 Adequacy of Determined Hazard Control Strategy12
8.1.1 Flight Safety Analysis12
8.1.2 Flight Hazard Analysis12
8.1.3 Computing Systems12
Contents (continued) Paragraph Page iv
8.1.4 Safety-Critical Systems Design, Test, and Documentation (DT&D)13
8.1.5 Highly Reliable Flight Safety System (FSS)13
8.1.6 Wind Weighting Safety System DT&D13
9 Continuing Accuracy of License Application13
Appendix A. System Safety Template for § 450.107 Functional Hazard Analysis14
1 1 PURPOSE.
1.1 This Advisory Circular (AC) provides guidance for an applicant to determine its hazard control strategy or strategies in accordance with Title 14 of the Code of Federal Regulations (14 CFR) § 450.107(b). In accordance with § 450.107(b), the hazard control strategies must account for all functional failures associated with reasonably foreseeable hazardous events that have the capability to create a hazard to the public;
safety-critical systems; and the timeline of all safety-critical events during a launch or reentry. This AC does not constitute a regulation and does not contain requirements, but is intended to assist prospective applicants in obtaining commercial space authorizations and operating in compliance with commercial space regulations.
1.2 For each phase of flight during a launch or reentry, an operator must use a functional hazard analysis to determine the hazard control strategy or strategies it will elect to use in accordance with § 450.107(b). This AC provides guidance on how to choose a hazard control strategy based on the functional hazard analysis and other sections of part 450.
An applicant must submit a description of its hazard control strategy or strategies for each phase of flight and the results of its hazard strategy determination in its application in accordance with § 450.107(d).
1.3 Level of Imperatives.
This AC presents one, but not the only, acceptable means of compliance with the associated regulatory requirements. The FAA will consider other means of compliance that an applicant may elect to present. Throughout this document, the word “must” characterizes statements that directly flow from regulatory text and therefore reflect regulatory mandates. The word “should” describes a requirement if electing to use this means of compliance; variation from these requirements is possible, but must be justified and approved as an alternative means of compliance. The word “may” describes variations or alternatives allowed within the accepted means of compliance set forth in this AC. In general, these alternative approaches can be used only under certain situations that do not compromise safety.
2 APPLICABILITY.
2.1 The guidance in this AC is for launch and reentry vehicle applicants and operators required to comply with 14 CFR part 450. The guidance in this AC is for those seeking a launch or reentry vehicle operator license, a licensed operator seeking to renew or modify an existing vehicle operator license, and FAA commercial space transportation evaluators.
2.2 The material in this AC is advisory in nature and does not constitute a regulation. This guidance is not legally binding in its own right, and will not be relied upon by the FAA as a separate basis for affirmative enforcement action or other administrative penalty.
Conformity with this guidance document (as distinct from existing statutes and regulations) is voluntary only, and nonconformity will not affect rights and obligations
2 under existing statutes and regulations. This AC describes acceptable means, but not the only means, for demonstrating compliance with the applicable regulations.
2.3 The material in this AC does not change or create any additional regulatory requirements, nor does it authorize changes to, or deviations from, existing regulatory requirements.
3 APPLICABLE REGULATIONS AND RELATED DOCUMENTS.
3.1 Related Statute.
51 U.S.C. Subtitle V, Chapter 509.
3.2 Related Regulations.
The following regulations from title 14 of the CFR must be accounted for when showing compliance with 14 CFR 450.107. The full text of these regulations can be downloaded from the U.S. Government Printing Office e-CFR. A paper copy can be ordered from the Government Printing Office, Superintendent of Documents, Attn: New Orders, PO Box 371954, Pittsburgh, PA, 15250-7954.
Section 450.101, Safety criteria.
Section 450.103, System safety program.
Section 450.107, Hazard control strategies.
Section 450.108, Flight abort.
Section 450.109, Flight hazard analysis.
Section 450.110, Physical containment.
Section 450.111, Wind weighting.
Section 450.113, Flight safety analysis requirements—scope.
Section 450.115, Flight safety analysis methods.
Section 450.133, Flight hazard area analysis.
Section 450.141, Computing systems.
Section 450.143, Safety-critical system design, test, and documentation.
Section 450.145, Highly reliable flight safety system.
Section 450.211, Continuing accuracy of license application; application for modification of license.
3.3 Related FAA Advisory Circulars.
FAA Advisory Circulars (are available through the FAA website, http://www.faa.gov).
AC 450.101-1, High Consequence Event Protection, dated June, 2021.
AC 450.109-1, Flight Hazard Analysis, when published.
AC 450.141-1, Computing Systems and Software, dated August, 2021.
AC 450.143-1, Safety-Critical System Design, Test, and Documentation, when published.
3.4 Government Guidance Documents.
MIL-STD-882E, Department of Defense Standard Practice, System Safety, dated May 11, 2012, https://quicksearch.dla.mil/qsDocDetails.aspx?ident_number=36027.
Note: The documents referenced in this section refer to the current regulatory authorities’ accepted revisions.
4 4 DEFINITION OF TERMS.
For this AC, the terms and definitions from § 401.7, and this list, apply:
4.1 System Safety Hazard A real or potential condition that could lead to an unplanned event or series of events resulting in: unintentional death, injury, or occupational illness; damage to or loss of equipment or property; or damage to the environment.
5 ACRONYMS.
AC – Advisory Circular BATT – Battery CFR – Code of Federal Regulations DL – Discrete Logic DT&D – Design, Test, and Documentation ENG – Engine FAA – Federal Aviation Administration FMF – Free Molecular Flow FW – Firmware FSA – Flight Safety Analysis FSS – Flight Safety System HW – Hardware SW – Software TBD – To be determined OMB – Office of Management and Budget SRM – Solid Rocket Motor 6 OVERVIEW.
6.1 Hazard Control Strategies.
One or more of the hazard control strategies defined in §§ 450.108 through 450.111 must be used to meet the safety criteria in accordance with § 450.101(a), (b), or (c).
Different hazard control strategies may be utilized during any one phase of flight because a different strategy may be more appropriate for one phase of a flight or to protect different sets of people and property. The hazard control strategies are flight abort, flight hazard analysis, physical containment, and wind weighting. The appropriate hazard control strategy is determined by conducting a functional hazard analysis.
6.1.1 Use of Flight Abort as a Hazard Control Strategy.
Flight abort is the traditional safety approach for expendable launch vehicles. It is a process to limit or restrict the hazards to public safety and the safety of property presented by a launch vehicle or reentry vehicle, including any payload, while in flight by initiating and accomplishing a controlled ending to vehicle flight. With the exception of phases of flight where the launch or reentry vehicle has sufficient demonstrated reliability, flight abort is required as a hazard control strategy if the potential for a high consequence event is above a certain threshold in accordance with § 450.101(c).
6.1.2 Use of Flight Hazard Analysis as a Hazard Control Strategy.
Flight hazard analysis is the traditional safety approach for reusable launch vehicles, and is the most flexible hazard control strategy because it allows for deriving specific hazard controls unique to the launch or reentry vehicle system and operations concept.
Flight hazard analysis may be utilized as a hazard control strategy, but is mandated by § 450.107(c) if the hazards to the public cannot be mitigated adequately to meet the safety criteria of § 450.101(a), (b), and (c) using physical containment, wind weighting, or flight abort.
6.1.3 Use of Physical Containment as a Hazard Control Strategy.
Physical containment is used for low energy test flights when a launch vehicle does not have sufficient energy for any hazards associated with its flight to reach the public or critical assets.
6.1.3.1 Per § 450.110(b)(1), to use physical containment as a hazard control strategy, a flight hazard area must be developed in accordance with § 450.133.
6.1.3.2 The operator must ensure that the launch vehicle does not have sufficient energy for any hazards associated with its flight to reach outside the flight hazard area in accordance with § 450.110(b)(2).
6.1.3.3 The hazard area should be clear of the public and critical asset in accordance with § 450.110(b)(3).
6.1.3.4 An operator must apply other mitigation measures necessary to ensure no public or critical asset exposure to hazards, via methods such as control of public access or wind placards in accordance with § 450.110(b)(4).
6.1.4 Use of Wind Weighting as a Hazard Control Strategy.
Wind weighting is traditionally used in the launch of unguided suborbital launch vehicles, otherwise known as sounding rockets, where launcher azimuth and elevation settings are adjusted to correct for the effects of wind conditions at the time of flight to provide a safe impact location for the launch vehicle or its components.
6.2 Using a Functional Hazard Analysis for Hazard Control Strategy Determination.
Section 450.107(b) requires an operator to use a functional hazard analysis to determine the hazard control strategy or strategies for each phase of flight during a launch or reentry that account for (1) all functional failures associated with reasonably foreseeable hazardous events that have the capability to create a hazard to the public, (2) safetycritical systems, and (3) a timeline of all safety-critical events.
6.2.1 Overview of Functional Hazard Analysis.
A functional hazard analysis is a critical element for ensuring public safety during flight. At a foundational level, the analysis provides a holistic, systematic approach to identifying potential hazards. Second, the analysis supports the validation of adequacy for determined hazard control strategies. Third, the analysis supports a justification for use of historical flight outcome data in the probability of failure analysis. Development of prior launch and reentry vehicles has included a structured system safety process, and thus this foundational system safety analysis is one necessary element in defining similar vehicles in accordance with § 450.131, Probability of Failure Analysis. Fourth, it provides a basis for developing quantitative models of debris, in accordance with § 450.121, and malfunction trajectories, in accordance with § 450.119. Fifth, the analysis is a basis for a flight hazard analysis if that hazard control strategy is used.
6.2.2 Determining which Hazard Control Strategy to Use.
There are two constraints to hazard control strategy determination for any phase of flight. First, § 450.107(c) requires a flight hazard analysis to be conducted in accordance with § 450.109, if the public safety hazards cannot be mitigated adequately to meet the public risk criteria of § 450.101(a), (b), and (c) using physical containment, wind weighting, or flight abort. Second, in accordance with § 450.101(c), if the consequence of any reasonably foreseeable failure mode, in any significant period of flight, is greater than 1 × 10-3 conditional expected casualties, then flight abort must be used as a hazard control strategy in accordance with the requirements of § 450.108, or the launch or reentry vehicle must have sufficient demonstrated reliability as agreed to by the FAA Administrator based on conditional expected casualties during that phase of flight. AC 450.101-1, High Consequence Event Protection, provides additional guidance on conditional expected casualty.
6.2.3 Hazard Control Strategy Determination Logic.
The approach to determining and validating hazard control strategies is a process, which is iterative, as illustrated in Figure 1 of this AC. The functional hazard analysis is utilized to ensure that all potential hazards to the public have a determined hazard control strategy. Generally, the applicant will determine a hazard control strategy based on engineering and program considerations. If the hazards to the public are potentially mitigated, then the selected strategies are developed, and the supporting data is used as general input for the flight safety analysis. If adequate mitigation is not validated by supporting data, then the hazard control strategy should be revisited. If validation is successful, then the flight safety analysis is used to demonstrate whether the safety criteria are satisfied. If the safety criteria cannot be met, then additional hazard controls must be implemented, in accordance with 450.107(c).
Program Considerations: judgment and Engineering System Safety Program Design Design Selection Cost & Schedule Concept of Ops Preference with similar experience vehicles Program, Hazard Management [103(b)] Postulate Hazard Functional Hazard Hazards Yes Control Analysis potentially Strategies [107(b)] mitigated?
No .........
Map all functional failures to reasonably foreseeable hazards and failure modes (107 and 115) Wind- System Design & Analysis Windweighting weighting (111) Malfunction Trajectory Analysis (119) Abort Flight Abort Analysis (108) Probability of Which Failure Analysis control (131) and Debris strategies? Hazard Flight Hazard Analysis (121) Mitigation Analysis (109) Physical Physical containment* containment
(110) Successful Risk Review/Revise Validation of yes → Flight safety criteria Yes Functional Adequacy? Analysis met?
Hazard Analysis [107(c)] (subpart C) (101) No No Proceed with operations Figure 1. Flow of Hazard Control Strategy Determination
6.2.4 Application Requirements.
In its application, in accordance with § 450.107(d), an applicant must submit the results of the hazard control strategy determination and a description of strategies for each phase of flight in its application.
8 7 HAZARD CONTROL STRATEGY DETERMINATION.
7.1 Functional Hazard Analysis.
7.1.1 Section 450.107(b) requires the use of a functional hazard analysis for each phase of flight during a launch or reentry to determine a hazard control strategy or strategies. In accordance with §§ 450.107(b)(1) through (3), the hazard control strategies must account for all functional failures associated with reasonably foreseeable hazardous events that have the capability to create a hazard to the public, safety-critical systems, and a timeline of all safety-critical events. The functional hazard analysis should be completed as early as possible in the launch or reentry system’s lifecycle.
Note: The term “reasonably foreseeable” is not associated with probability or likelihood, but is inherent to a methodical assessment of the entire system. “Reasonably foreseeable hazardous events” are those identifiable through the system safety process, beyond those that could be determined solely by “brainstorming.” Thus, a functional hazard analysis is required by §450.107(b).
7.1.2 A functional hazard analysis is used to analyze system functions associated with the proposed operation (mission). The functional hazard analysis is primarily used to identify and classify the overall system functions and consequences of functional failure or malfunction. The objective is to identify all potential system, subsystem, and component functional failures that could impact public safety. Any foreseeable mitigations or predetermined hazard control strategies should not affect the identification of potential system safety hazards and respective functional sources (i.e.
subsystem functional failures).
7.1.3 Prior to performing a functional hazard analysis, an operator should have sufficient understanding of the mission. Subsequently, the functional hazard analysis, at a minimum, should provide the following:1
a. A decomposition of the overall system to its next-level systems and related subsystems to the major component level. Further decomposition may be necessary if relevant to public safety.
Note: The FAA expects the depth of system decomposition within the functional hazard analysis to be variable depending on the level necessary to adequately discern and mitigate impacts to public safety. For example, the FAA may accept a decomposition of a “system – avionics – main computer” that may not need to go any further if all related impacts to public safety are confined, and all potential failure mitigations are applied, at that level. Alternatively, lower level mitigations such as an electronic circuit mitigation would require decomposition down to “system – avionics – main computer – circuit board assembly,” to demonstrate hazard mitigation at the appropriate level of the system. The level of detail and completeness of the analysis should be comparable to or better than the system safety analyses performed during
1 This list adapts the guidance of MIL-STD-882E.
9 development of the vehicles used as similar vehicles in the probability of failure assessment (§ 450.131).
b. A functional description of each next-level system, subsystem, and component identified, to include interfaces between subsystems and components.
c. A designation of the implementation method for each function (e.g., hardware, software, etc.).
d. Identification of phases of system operation (e.g., captive carry, rocket-powered flight, landing).
e. Identification of failure modes, to include at a minimum:
i. Failure to function;
ii. Functions early or late;
iii. Functions out-of-sequence or time;
iv. Functions inadvertently; or
v. Degrade function or malfunction.
f. Assessment of the “end-effect” resulting from failure of each function during each phase under each failure mode, excluding mitigation. Assessment should be based on the best available data, including mishap data (if obtainable) from similar systems and other lessons learned.
g. Assignment of functional failure identification to allow for traceability.
h. Assessment of the severity associated with each failure end-effect.
i. A level of rigor determination for logic-based functions based on severity of the failure “end-effect” and degree of control.
j. Assessment of whether each failure end-effect poses a potential system or mission hazard to the public.
Note: Grouping of different component or subsystem failures that may lead to the same end-effect allows for identification of potential hazards to the public for the overall system.
k. Traceability between each functional failure and associated hazards during each phase of flight to respective hazard control strategies that should mitigate the hazard at the system and mission level, as per § 450.103(b)(1).
Note: Appendix A of this AC provides a template for packaging the data above in an acceptable functional hazard analysis format.