݊ఙ ටെ2 ln൫1 െ ಿ ξܥ൯ where N
10 ~:~1~5------- ~ ------- -'- Distance, miles 20 25 One sigma Two sigma ~- 97% confi~hree sigma -ence, N=Ni ~ 30 07/27/2021 AC 450.108-1
6.2.3 Confidence of Containment.
The region for confidence of containment is computed by integrating the impact probability over area, in order of increasing probability density, until the integral is one minus the specified confidence is reached. All the area included in this integrated region is outside the containment region, thus defining a boundary. This boundary then occurs at an equi-probability contour, but the probability is not known without integration. For a bivariate normal distribution, the integration can be performed analytically. In this case, the relationship between sigma level, n, and confidence of containment, C, is given by = is the number of impacts.
6.2.4 Example.
Let us consider 4 fragment groups, with index I and N୧ fragment impacts, each with a bivariate normal distribution, with standard deviations, ɐ୶,୧ and ɐ୷,୧, in miles, as shown in Table 1 of this AC.
Table 1. Example Fragment Groups ࢞࣌, ࢟࣌, ࡺ Group 1 1.0 1.0 2 Group 2 0.5 0.5 5 Group 3 1.5 1.3 20 Group 4 1.0 0.5 100
6.2.4.1 Sigma and confidence.
The sigma levels and 97% containment are shown in Figure 6-1, with groups 1 to 4 proceeding from left to right:
Figure 6-1: Comparison of Sigma Levels to Confidence Example 7
97% confidence, N=N; -- 97% confidence N=sum N; - Debris Footprint -- -S L.--------'--------'--------'--------'--------'--------'--------'- --' .5 10 15 20 25 30 Distance . miles 07/27/2021 AC 450.108-1 Note: The 97% confidence ellipse is slightly inside the three sigma level for group 1, where N୧ is 2, but significantly outside for groups 3 and 4, where N୧ is much larger.
6.2.4.2 Debris Footprint.
This example uses a simple approach to compute the debris footprint, which is guaranteed to be conservative. Instead of using the number of fragments for each group, the ݊ఙ, for each group is computed using the sum of ܰ. This accounts for the fact that fragment group distributions may overlap.1 In this example, the sum is 127. The footprint is then the region bounding all of these, or for simplicity, the convex hull surrounding them, as shown in Figure 6-2. For the left three fragment groups, the change from ܰ to the sum of ܰ has a significant effect, because the right group has 80% of the fragments. The containment ellipse for the right group, with ܰ increasing from 100 to 127, increases in size only slightly.
Figure 6-2: Debris Footprint Example
6.2.4.3 Hazard Footprint.
The hazard footprint is then computed by adding a distance around the debris footprint to account for hazards radiating from the impact point.
In this example, 0.2 miles is used for illustration (see paragraph 13.4 for more discussion), as shown in Figure 6-3.
1 Using the sum may appear excessively conservative. However, imagine the simple case of two identical fragment groups; in this case the containment of each is the same, but the containment of both is found with the equation where N is the sum of the number of fragments in each group. The conservatism is also limited because the N is used in taking the root of the confidence and then the natural log of this result.
-2 -4 97% confiden ce, N=N; - Debris Footprint - Hazard Footprint -- -6 '-----------'---------'---------'--------'-----------'---------'---------'--' -5 10 15 20 25 3 0 Distance, miles 07/27/2021 AC 450.108-1 Figure 6-3: Hazard Footprint Example 7 FLIGHT ABORT APPLICABILITY.
7.1 Use of Flight Abort as a Hazard Control Strategy.
The operator is responsible for the safe conduct of all licensed activities and authorized to provide final approval to proceed with licensed activities. One method of limiting collective risk is a flight safety system, and in many cases such a system is required to protect against high consequence events in accordance with § 450.101(c). In accordance with § 450.108(a), the requirements in § 450.108 apply to any operation that uses a flight safety system as a hazard control strategy for the flight, or phase of flight, of a launch or reentry vehicle to meet the safety criteria of § 450.101. These requirements apply to all phases of flight for which the abort system is used to meet the risk requirements and may be necessary to protect against a high consequence event in uncontrolled areas; see AC 450.101-1, High Consequence Event Protection, regarding clarification on phases of flight. In accordance with § 450.101(c) an operator must use flight abort as a hazard control strategy if the consequence of any reasonably foreseeable vehicle response mode, for any significant period of flight, is greater than 1 × 10-3 CEC for uncontrolled areas, unless § 450.101(c)(3) is satisfied. A period of flight would be significant if it is long enough for a mitigation, such as flight abort, to decrease the public risks or consequences materially from any reasonably foreseeable failure mode.
Note: Sections 450.101(c)(2) and (c)(3) allow an operator to demonstrate it has sufficiently protected against a high consequence event by demonstrating CEC values of any reasonably foreseeable failure mode, in any significant period of flight below 1 x 10-3 or by establishing the launch or reentry vehicle has sufficient demonstrated reliability as agreed to by the Administrator based on conditional expected casualties criteria during that phase of flight.
Note: If an operator cannot ensure by means other than flight abort that it has sufficiently protected against a high consequence event (as measured by CEC), the way to satisfy § 450.101(c) is to use flight abort consistent with the requirements in § 450.108.
7.2 Focus on Protecting the Public.
A flight abort may be implemented in a variety of ways, as diverse as a pilot choosing a contingency landing site to an autonomous termination system destroying the vehicle.
In all cases of abort, the primary objective changes from accomplishing the mission goals to ending flight in a way to avoid adverse consequences. There are limits to the capability of an abort system to mitigate risk. When control continues after abort the objective is to redirect the flight so landing or impact minimizes the exposed population. In this case, the potential for a secondary failure that results in hazards should be considered. When control (and thrust) are terminated the objective is to minimize the hazard posed by the vehicle, although the absolute minimum can never be positively identified (no known system exists that, for example, vaporizes all possible debris). Thus, it is assumed that flight abort results in some hazardous impacts. In accordance with § 450.115(b)(1), the demonstration of acceptable risk must include the use of mitigations. Thus, the flight safety analysis should account for post-abort physical processes that influence flight of a controlled vehicle and the effective casualty area, such as subsequent aerothermal breakup, melting, or vaporization, as well as the potential for structural failure and breakup of a falling object. Flight abort in the context of part 450 is focused on protecting the public and critical assets. An operator may choose to use flight abort to protect personnel on-board the vehicle as well, but that is not covered by these regulations, except to the extent that the pilot may be a component of the flight safety system. Therefore, whenever risk or high consequence events are discussed in the regulations or this document, they do not consider personnel on-board the vehicle. The primary objective for flight abort in the context of this AC is protecting the public and critical assets.
7.3 Clarity of Flight Abort Rules.
It is critically important that flight abort rules be clearly defined in advance of initiating flight. More specifically, in accordance with § 450.108(g)(2), an applicant must describe how each flight safety limit and flight abort rule is evaluated and implemented during vehicle flight, including the critical parameters and quantitative criteria that will be used. When humans are a part of the flight safety system, they should have a very clear understanding of the flight abort rules, and the human-system interface needs to be accounted for in accordance with § 450.108(d)(4) when establishing the time delay between the violation of a flight abort rule and the time when the flight safety system is expected to activate.
8 FLIGHT SAFETY SYSTEM REQUIREMENTS.
The flight safety system requirements for a phase of flight are prescribed by the magnitude of the risk of high consequence events, in accordance with § 450.108(b)(1) and (b)(2). Consequence is measured by the maximum conditional expected casualties (CEC) in uncontrolled areas of any reasonably foreseeable failure mode in any significant period of flight within the phase. As discussed in the AC 450.101-1, High Consequence Event Protection, an alternate measure of the risk may be used to evaluate high consequence risk, such as a risk profile, if the measure and threshold are approved by the FAA Administrator.
8.1 Highly-reliable Flight Safety System (FSS).
If the maximum CEC is greater than 1 × 10-2, § 450.108(b)(1) requires a highly-reliable flight safety system (FSS) that meets the requirements of § 450.145. The FAA has identified Range Commanders Council, Range Safety Group, Flight Termination System Commonality Standard, RCC 319 (see first reference in paragraph 3.4 of this AC) as an existing means of compliance to demonstrate high-reliability of an FSS. The FAA will work with applicants to tailor RCC 319 in order to comply with § 450.145.
Section 450.35(a)(3) requires an operator to obtain acceptance from the FAA for a means of compliance for § 450.145(b) in advance of submitting an application.
Therefore, a tailored RCC 319 used as a means of compliance for § 450.145(b) must be submitted to the FAA for acceptance prior to being included in a license application.
8.2 Safety-critical FSS.
Section 450.108(b)(2) states that if the maximum CEC is between 1 × 10-2 and 1 × 10-3 an operator must use a flight safety system that meets the requirements of § 450.143 and discussed in AC 450.143-1 Safety-Critical Systems. Historically, the FAA has found that operations launching or reentering in remote locations or for stages that only overfly sparsely populated regions have a CEC between 1 × 10-2 and 1 × 10-3.
8.3 FSS Requirements.
An operator usually determines which FSS system to use early in a vehicle design process. Therefore, it is generally helpful to identify early which set of requirements the FSS must meet. If an applicant chooses to use a highly-reliable FSS, an applicant must meet the requirements of § 450.145, and no CEC analysis is required to determine the FSS requirements in accordance with § 450.108(b). This is because meeting the requirements of § 450.145 also satisfies the requirements of § 450.143. Alternatively, an applicant may compute the CEC to determine whether an FSS is required, in accordance with § 450.101(c)(2), and, if so, the reliability standards the FSS must be met, per § 450.108(b). The CEC analysis must be performed without consideration of the FSS, as the results will determine the requirements for the FSS. Paragraphs 8.1 and 8.2 of this AC describe how this CEC analysis affects the FSS requirements. An approach to determine CEC is described in AC 450.101-1 High Consequence Event Protection. For evaluation of the effectiveness of the flight abort rules, per § 450.108(d)(5), the reliability of the flight safety system should be determined. For a highly-reliability FSS, meeting the requirements of § 450.145, a reliability of 99.9% may be used.
9 FLIGHT SAFETY LIMITS OBJECTIVES.
9.1 Introduction.
In accordance with § 450.108(f)(2), the FSS must abort flight when valid, real-time data indicate the vehicle has violated any flight safety limit developed in accordance with § 450.108. An operator must define when a flight abort must be initiated in order to achieve objectives listed in § 450.108(c), including to ensure compliance with the public safety criteria of § 450.101(a) and (b). An operator must develop flight safety limits that meet the constraints set in § 450.108(d). For example, an operator must determine flight safety limits that account for the reliability of the FSS, in accordance with § 450.108(d)(5). This is a necessary aspect of a flight safety limits analysis because a critical objective is to ensure that the public and critical assets are protected from high consequence events given any intended flight abort action, and the reliability of the FSS can have a substantial influence on the predicted consequences of a flight abort action.
There are several conditions that must be captured in the development of flight safety limits in accordance with § 450.108(c).
Note: In accordance with § 450.115(a), an operator’s flight safety analysis method must account for all reasonably foreseeable events and failures of safety-critical systems during nominal and non-nominal launch or reentry that could jeopardize public safety.
9.2 Compliance with Risk Requirements.
In accordance with § 450.108(c)(1), the first objective is to develop flight safety limits to achieve compliance with the requirements of § 450.101(a) and (b). This, of course, includes collective risk criteria for expected casualties in § 450.101(a) for launch and in § 450.101(b) for reentry. In addition, flight safety limits also influence individual risk protection. For example, flight safety limits may be used to limit the region that exceeds the threshold for individual probability of casualty. This may be a better approach than evacuating a region, especially if the region is uncontrolled or a difficult-to-clear marine area. Regardless, it is critical that hazard areas be developed taking the flight safety limits into account; in accordance with § 450.133(a)(2) the flight hazard area analysis must account for any hazard controls implemented, which of course includes flight abort.
Note: Section 450.101(c) requires an operator to protect against a high consequence event only in uncontrolled areas, whereas the safety requirements in § 450.101(a) and
(b) are not limited to uncontrolled areas, but instead apply to both controlled and uncontrolled areas. Thus, there are different considerations for developing flight safety limits based on where the exposed population is located.
9.3 Prevent Increased Risk.
The second objective of the flight safety limits, in accordance with § 450.108(c)(2), is to prevent continued flight from increasing risk in uncontrolled areas if the vehicle is unable to achieve a useful mission. It has been general practice in the safety community to contain debris, and this is an option via § 450.108(c)(6). Section 450.108(c)(2) captures the same intent, but with the recognition that a vehicle may deviate from the limits of a useful mission during a period where hazard containment is not possible. In this case, the requirement is to define a flight safety limit that prevents continued flight from increasing public risks, though some risk from either flight abort or continued flight may be unavoidable. Flight safety limits must be placed to ensure the lower-risk strategy is used, per § 450.108(d)(6), whether aborting flight once the vehicle has departed from the limits of a useful mission or allowing the flight to continue, at least until a location is reached where abort would reduce the risk. The concepts of “useful mission” and “limits of a useful mission” are discussed in AC 450.117-1, Trajectory Analysis. Evaluation of increased risk in § 450.108(c)(2) should consider risks of casualty from any hazard, including debris, toxic release, or explosions, including far-field blast overpressure (FFBO) effects.
9.4 Prevent Anomalous Flight over Populated Areas.
The third objective of the flight safety limits, in accordance with § 450.108(c)(3), is to prevent the vehicle from entering a period of materially increased public exposure in uncontrolled areas, including before orbital insertion, if a critical vehicle parameter is outside its pre-established expected range or indicates an inability to complete flight within the limits of a useful mission. The intent of this regulation is to prevent unnecessarily exposing the general public to hazards when degraded vehicle health is identified. This flight abort situation commonly has been called a “gate,” but since the definition of a gate varies, the regulations state a clearer, performance-based requirement. In this document, the term “conditional limit” is used to refer to abort rules of this type. If the critical vehicle parameters fail to remain within the pre-established expected range or indicate an inability to complete flight within the limits of a useful mission at the location of a conditional limit, then the operator is required to initiate flight abort to accomplish a controlled ending to flight at the conditional limit.
9.4.1 Materially Increased Exposure.
A period of materially increased public exposure includes the beginning of a period when the vehicle will pose a hazard to a populated landmass prior to orbital injection.
Overflight of continental areas and islands with substantial population generally constitutes a period of materially increased public exposure, while overflight of islands with small populations or other areas of sparse population generally do not. An applicant may use a CEC greater than 1 × 10-2 as a threshold for materially increased risk in any significant period of flight from any on-trajectory failure mode. In general, a standoff from the landmass is advised to avoid hazards within several miles of a shore, due to high coastal vessel traffic. Orbital insertion also results in a material increase in public exposure due to the possibility of a random reentry from a vehicle that cannot achieve a minimum safe orbit. A vehicle that must reach orbit to achieve a useful 13
mission would require flig ht abort in accordance with § 450.108(c)(3) if a minimum safe orbit cannot be reached.
9.4.2 Selecting Appropriate Critical Vehicle Parameters.
The critical vehicle parameters used to evaluate whether abort should be initiated generally depend on the vehicle type and mission. Ideally, critical parameters would determine that no anomaly exists that would prevent a successful mission at the time of validation. However, this perfect test is not practically possible. Therefore, critical parameters must be compared against pre-established expected ranges, per § 450.108(c)(3). The ranges are those whose values (individually or collectively) can indicate the inability to complete the upcoming phase of flight within the limits of a useful mission. For the final conditional limit for orbital missions, an important test is whether the vehicle is capable of reaching an orbit with a perigee greater than 70 nautical miles altitude.
9.4.2.1
9.4.2.2
9.4.2.3
9.4.2.4 The criteria used for determining whether to allow passage through a conditional limit or to terminate flight at the limit should use at least the same vehicle flight status parameters as the criteria used for determining whether to terminate flight at flight safety limits for this flight phase. For example, if a flight safety limit is a function of instantaneous impact point (IIP) location, the criteria for determining whether to allow passage through a conditional limit should also be a function of IIP (and potentially other parameters).
The flight abort rules should permit the vehicle to cross the conditional limit only if there is no indication that the vehicle's performance has become erratic and the vehicle is flying within the limits of a useful mission.
Erratic behavior should be assessed through quantitative metrics, such as angular velocity, growing vehicle oscillation, and stagnant IIP. In addition, if a human is making the flight abort decision, then a flight rule should also permit flight abort if the vehicle is erratic due to any other data. Human application of the erratic flight rule, however, is subject to significant judgment, and sufficient quantitative rules are a far more reliable solution, both for safety and for mission assurance. The operator must select parameters and their acceptable ranges that are appropriate for the vehicle and mission, with consideration of the ability to measure and act on the parameters, in accordance with § 450.108(c)(3).
Specific examples of critical vehicle parameters and associated pre-established expected ranges include:
• IIP latitude and longitude, as compared to a pre-established polygon;
• Direction of motion of the IIP (i.e. parallelism or convergence);
• Minimum impact range that the last suborbital stage must achieve, if the succeeding stage is to attain a useful orbit and a minimum orbit (perigee > 70 nautical miles);
• Pressure of a tank, as compared to minimum thresholds (e.g.
verifying pressurized fluid will flow when required) or maximum thresholds (e.g. avoiding rupture);
• Motor chamber pressure;
• Orientation and/or angular velocity;
• Acceleration of the vehicle, verifying that motor is producing anticipated thrust; and
• Altitude at perigee, given the current position and velocity, verifying that minimum orbit can be achieved with remaining thrust.
9.4.2.5 The ex pected range for each critical vehicle parameter (or parameter set) should also be determined. The analysis should assess if a variety of trajectories, including all normal trajectories, are acceptable for passing through the conditional limit. The values of each critical parameter should be determined at the conditions when the validation will occur. The predefined expected range should encompass the range of values each of which are typically extended by a 20% margin to account for uncertainty, though this margin may vary on a case-by-case basis.
9.5 Preventing High Consequence Events.
The fourth objective of flight safety limits, in accordance with § 450.108(c)(4), is to prevent conditional expected casualties greater than 1 × 10-2 in uncontrolled areas due to flight abort or due to flight outside the limits of a useful mission from any reasonably foreseeable off-trajectory failure mode in any significant period of flight. Many of the phrases here match § 450.101(c), and AC 450.101-1 High Consequence Event Protection, provides guidance on the terminology used to define what constitutes a failure mode. This objective requires that abort actions do not produce high consequence events. This requirement does not apply to failure modes that lead to already minimized consequence before a vehicle exits the limits of a useful mission. For example, in a simple case, this requirement does not apply to an on-trajectory engine explosion. Also, loss-of-thrust is not considered an off-trajectory failure mode. Nor does it apply to a failure which causes breakup soon after initiation, such as a malfunction turn at high dynamic pressure that quickly causes structural failure before the vehicle exits the limits of a useful mission. In this context, breakup soon after initiation of a failure includes any breakup expected to occur before the minimum period necessary to implement a risk mitigation, such as flight abort or propellant dispersal. The CEC limit in § 450.108(c)(4) applies to failures where vehicle begins to exit the limits of a useful mission and the vehicle would not be expected to breakup prior to this.
9.6 Abor t Prior to Failure of Flight Safety System (FSS).
The fifth objective of the flight safety limits, in accordance with § 450.108(c)(5), is to initiate flight abort to prevent the vehicle state from reaching identified conditions that are anticipated to compromise the capability of the flight safety system if further flight has the potential to violate a flight safety limit. A real-time determination of whether a particular failure may evolve to violate a flight safety limit is not always possible. The operator must determine in preflight analyses (system safety analysis, link analysis, etc.)
which failure modes can compromise the capability of the FSS, in accordance with § 450.108(c)(5). The operator should then perform analysis to determine if those failure modes can potentially violate a flight safety limit. If it finds a failure mode that can potentially violate a flight safety limit, the operator must develop flight safety limits and abort rules that protect against those modes in accordance with § 450.108(c)(5). If the ability to reach a flight safety limit via a particular failure mode is uncertain, the assumption should be made that it is possible during any phase of flight where flight abort is used as a hazard control strategy. In addition, flight safety limits and abort rules should be established to prevent the vehicle from exceeding the acceptable environments of the abort system in accordance with § 450.108(c)(5). For example, if the abort system is qualified to withstand a certain vibration environment, then limits and rules should be in place to abort in order to prevent the system from exceeding the established vibration level.
9.7 Containment Alternative.
An alternative objective, in accordance with § 450.108(c)(6), is to initiate flight abort to prevent debris capable of causing a casualty due to any hazard from affecting uncontrolled areas using a flight safety system that complies with § 450.145, in lieu of meeting §§ 450.108(c)(2) and (4). Containment means no hazard footprint (see definition 4.3) from any event, ignoring failures of the flight safety system, will impact an uncontrolled area. This containment strategy relieves the operator of needing to perform a consequence analysis but may be incompatible with mission requirements.
Hazard containment achieves the goals of §§ 450.108(c)(2) and (4) because neither risk nor high consequence will be present in uncontrolled areas when hazard containment is provided. This can be achieved by complying with the legacy § 417.213. This strategy is not an option when hazard containment is not possible during a phase of flight. For example, if overflight of uncontrolled areas occurs on a useful mission trajectory during a phase of flight when flight abort is used as a hazard control strategy, an operator cannot claim containment during this phase and must meet §§ 450.108(c)(2) and (c)(4).
To comply with § 450.108(c)(6), flight abort capability must be maintained until § 450.108(e) is applicable.
10 FLIGHT SAFETY LIMITS CONSTRAINTS.
Section 450.108(d) describes the constraints of flight safety limits. An operator must determine flight safety limits that satisfy each of the constraints identified in § 450.108(d).
10.1 Extent of Flight Safety Limits Analysis.
Section 450.108(d)(1) requires that flight safety limits account for temporal and geometric extents on the Earth’s surface of any reasonably foreseeable vehicle hazards under all reasonably foreseeable conditions during normal and malfunctioning flight.
The intent of this requirement is that the flight safety limits account for any area that could potentially be hazarded for any phase of flight that uses flight abort as a hazard control strategy. This includes the duration and region that could be affected by malfunction or abort. The entire region of the Earth’s surface that could be hazarded must be considered until the time the hazard has ended.
10.2 Consideration of Hazards.
Section 450.108(d)(2) requires that flight safety limits account for physics of hazard generation and transport, including uncertainty. This is further discussed in AC 450.115-1 High Fidelity Flight Safety Analysis. Hazard generation refers to the process by which a vehicle produces a hazard. Transport is how the hazard moves from the source to an exposed person or a critical asset. For debris risk from an in-air breakup, hazard generation includes the fragmentation of a vehicle and uncertainty in fragment properties. Transport of debris is the propagation from each breakup location to impact accounting for all foreseeable forces that can influence any debris impact location and all foreseeable sources of impact dispersion in accordance with § 450.121(c)(1) and (2). For a loss-of-thrust or lift vector control, this includes modeling of the fall of the intact vehicle; consideration of whether it will structurally fail during the fall and if so, the associated fragments; the explosion, toxic release, fire, etc. at impact (generating a new hazard); then, the propagation of that hazard (e.g. a blast wave or toxic cloud). Also, for intact impact scenarios, the potential for FFBO hazards must be considered in accordance with § 450.137. For an in-air toxic release, hazard generation would account for the time-release history of the toxic species, and transport would be how the toxic species spread through the air.
10.2.1 Debris Dispersion.
For most of flight, the particulars of hazard generation and transport are of minimal importance in the development of flight safety limits. Outside of the launch or landing area, it is typically sufficient to consider debris dispersion effects to determine the extent of the hazard. Risk calculations account for all consequences, such as if there is undispersed propellant, but this has little effect on the size of the region that is hazarded. In the launch or landing area however, the size of the region hazarded, such as due to toxics or FFBO, can be significantly expanded beyond the debris dispersion area (which may be small in these areas) due to the transport of these hazards. Likewise, typically wind effects have a negligible effect on risk outside the launch or landing area.
Generally, wind cannot affect the impact location of hazardous debris by more than a few miles and any wind effects are typically insignificant compared to dispersions from 17
other sources.
Outside of the launch or landing a buffer may be used to account for this variability when developing flight safety limits, provided the analysis demonstrates the adequacy of the buffer to meet the flight safety limits objectives. In the near launch or landing area, the acceptability of flight safety limits is determined through the flight safety analysis, where risks must be evaluated using latest winds or a prelaunch availability study in accordance with §§ 450.135(a) and 450.137(a). It is not generally necessary for flight safety limits to vary based on wind conditions, but it is conceivable that mission flexibility could be enhanced if they were in some situations.
10.3 Considering Data Loss.
Section 450.108(d)(3) requires that flight safety limits account for the potential to lose valid data necessary to evaluate the flight abort rules. The development of suitable limits is a precursor to meeting the requirement in § 450.108(f)(2)(iii). This AC uses the term “Duration of Acceptable Data Loss (DADL)” to encompass various approaches used previously to develop data loss flight times (DLFT), green numbers, or no data destruct times (NDDT). To implement a DADL limit, if at any point in flight all tracking data are lost, the abort system begins a data loss countdown timer with a duration predefined based on vehicle parameters at the time of data loss. When the countdown timer reaches zero, flight abort action is taken. Historically, the duration has typically been a function of only the flight time at data loss, but more sophisticated functions based on more parameters (e.g. position or IIP) may be used. Of course, this section only applies to periods in flight where the abort system is active.
10.3.1 Background.
A particular challenge in determining data loss criteria is the uncertainty as to the cause of data loss. If the data loss is the only failure, and the vehicle continues to fly normally, then taking abort action would result in increased risk (even in open ocean areas due to ships and aircraft). But if data loss is related to a failure that also causes deviation from a flight path, then risk may be reduced by aborting flight. In many cases, data loss is not a safety concern, such as due to:
• Expected behavior, such as communication gaps or sensor drop-out, from which the data stream is expected to return;
• Unexpected sensor or communication problems where no failure affecting flight has occurred; or
• Vehicle break up, such that flight abort would have no effect.
However, data loss could also indicate a safety issue, such as a sensor or communication failure that leads to bad data to the guidance system, or partial vehicle breakup where there is still a free-flying motor. Malfunction flight can also be a cause of data loss. The challenge is that in real-time, when data loss occurs, it is not known whether the vehicle is still operating correctly or not.