10.3.2 Partial Data Loss.
In most situations, the minimum required data are position and velocity of the vehicle.
However, sometimes, different data may be sufficient to continue flight if it can be used to demonstrate that the vehicle is still normal. If this is the case, clear rules should define which parameters are required, and the flight conditions under which the set of required parameters changes.
10.3.3 Core Principles.
Because the vehicle state is unknown, it cannot be determined in real-time as to whether termination or continued flight is the better choice. The goals of flight safety action are still the same: reduce risk (especially high consequence events) and terminate before the ability to terminate is lost.2 Every active motor should either have an Inadvertent Separation Destruct System (ISDS) or a flight safety system based on the state of the motor, in order to prevent free-flying motors, unless the motor can be physically contained outside of uncontrolled areas. The following principles should be used to develop data loss flight times.
a. If the vehicle is outside the limits of a useful mission, termination should occur immediately (subject to paragraph 10.3. of this AC).
b. Termination should occur before the vehicle could reach the following (any of these options is acceptable), accounting for the state of the vehicle at the time of data loss:
i. Violating a position or IIP-based flight safety limit (e.g. the former part 417 approach for DLFTs), ii. Reaching the limits of a useful mission, or iii. Having a hazard footprint that reaches an uncontrolled area.
c. If data is lost while the vehicle is within the normal flight envelope, data loss flight times should be long enough to allow for reasonably expected data loss scenarios.
d. If uncontrolled populated regions are hazarded at the time of data loss, termination should be delayed until hazards from the vehicle would no longer hazard the uncontrolled area if the vehicle were operating normally. Additional study would be appropriate if this would lead to increased likelihood of impacting regions of higher population density.
e. No abort action should be taken based on data loss whenever the vehicle is no longer able to reach a flight safety limit, including having reached orbital insertion.
2 Terminating quickly upon data loss also helps reduce the potential hazard area, which is helpful for post-accident response. However, this is not as relevant for on-board autonomous safety systems, as loss of data to the flight termination decision computer may or may not indicate loss of data to external systems. And only those external systems are relevant for post-accident response.
f. The oper ator may choose not to implement data loss flight abort limits at any state where:
i. The only reachable flight safety limits are not required in order to meet § 450.108.
ii. The vehicle's state vector has reached a state where a flight safety system would not materially decrease the collective risk or the risks from a high consequence event.
10.4 Consideration of Time Delay.
Part 450.108(d)(4) requires that flight safety limits account for the time delay, including uncertainties, between the violation of a flight abort rule and the time when the FSS is expected to activate. Time delays are important in a flight safety limits analysis because the decision to abort flight must be made in time to achieve the flight safety limits objectives in accordance with § 450.108(d)(4). This is not possible unless the time delay between the violation of a flight abort rule and the time when the FSS is expected to activate is known. The delay is the total time from the actual violation of a flight safety limit until the abort action is finally accomplished, also called the latency of the abort action. Examples of flight abort being finally accomplished are (1) when the IIP stops moving following a destruct action, and (2) when the net thrust reaches zero following a thrust termination action. The delay may include hardware, software, communication, and human-in-the-loop contributions from tracking systems, data processing systems, display systems, command control systems, and flight safety systems.
10.4.1 Hardware Delays .
Hardware delays are typically less than one second unless intentionally lengthened, and may include:
• Processing time of the navigation unit (e.g. delay of the GPS receiver to determine position);
• Time on the vehicle to activate the abort. This is the time from terminate signal received on the vehicle until the thrust or controlled glide is stopped. For example, on a thrust termination system this includes the time to fully shutdown a turbopump and end any residual thrusting; and
• Intentional delays to allow escape of a vehicle component prior to abort.
10.4.2 Software Delays.
Software delays include:
• The time to process received data (e.g. decommutation), to transform the data to other formats and coordinate systems,
• Filter delays;
• For systems with a person on the ground to initiate a destruct, the time to generate displays;
• For automated systems, the time to process rules and issue a terminate signal; and 20
• Intentional delays to allow escape of a vehicle component prior to abort.
10.4.3 Communication Delays.
Communication delays consider the transmission time of data. This includes both tra nsmission from the measurement system to the abort rule system and from the abort rule system to the system that effects the abort.
10.4.4 Safety Officer Decision Duration.
When a human is in the loop, the human delay is usually the most significant, and also has significant uncertainty. For a safety officer, this is the time to process the decision and send the abort. The delay depends on the training of the safety officer, and the verification sources they are tasked to monitor (confirming violation across multiple tracking sources, hearing violations through multiple communications, or similar). In some cases, safety officers are trained to activate the abort before a flight safety limit violation, and thus the effective latency for their action may be negative. However, in most cases, safety officers react when a vehicle violates a limit, and thus the latency is slightly positive. There is also a typical constraint that safety officers have a longer delay when the vehicle appeared nominal prior to the failure. The decision delay, including uncertainty, should be based on studies of safety officer responses to simulated malfunction flight. The appropriate measurement is the delay should be between the time the displays show a violation and the safety officer initiates abort.
This should be evaluated considering noise and different types of failures.
10.4.5 Pilot Abort Action Duration.
When a pilot is implementing the abort, there is a delay between making the abort decision or receiving the direction to abort and completing the action to initiate abort.
This process must be considered and must account for the entire time until the abort initiation sequence is completed in accordance with § 450.108(d)(4).
10.5 Consideration of FSS Reliability.
Section 450.108(d)(5) requires that an operator must determine flight safety limits that account in individual, collective, and conditional risk evaluations, both for proper functioning of the flight safety system and failure of the flight safety system. Thus, the risks from a failed abort must be considered in evaluation of § 450.101(a) and (b) and § 450.108(c)(4). Thus, the outcomes of malfunction flight where the FSS fails should be included in the residual risk, with a conditional probability of one minus the reliability of the FSS. The conditional probability of risks from proper function of the FSS should either be the reliability of the FSS or one. Note, however, that § 450.108(c)(6) obviates the need for a conditional risk analysis per § 450.108(c)(4) if the FSS complies with § 450.145 and abort prevents debris capable of causing a casualty due to any hazard from affecting uncontrolled areas, in accordance with § 450.108(c)(6). While § 450.108(d)(5) requires that an operator account in its conditional risk evaluation both for the proper functioning of the FSS and the failure of the FSS, an operator would not be required to perform a conditional risk evaluation if it is in compliance with § 450.108(c)(6), because § 450.108(c)(4) would not apply. In this case, the applicant 21
should still assess the collective and individual risk from a failur e of the flight safety system in accordance with § 450.108(d)(5).
10.6 Abort Should Never Increase Risk.
Section 450.108(d)(6) requires that flight safety limits be designed to avoid flight abort that results in increased collective risk to the public in uncontrolled areas, compared to continued flight. This is a common-sense requirement that taking abort action should not present a higher risk to the public than not taking abort action. This can affect the location of the flight safety limits. A best practice is that flight safety limits analysis would minimize all foreseeable consequences, not just those to people on the ground or to the extent necessary to meet the public safety criteria.
10.6.1 Best Practice For Flight Safety Limit Locations.
For example, placing flight safety limits in areas where flight abort might place debris on a busy shipping lane or air corridor is not a best practice when other locations for the limits could meet the public safety criteria and consequence criteria, and still provide space for the vehicle to execute a useful mission. Also, as a malfunctioning vehicle’s hazard footprint migrates towards a populated area, the consequence to people on the ground from a flight abort will increase from a low number and possibly reach the proposed consequence limit. The best practice for identifying the location for a flight safety limit on such trajectory is not at the last location where an abort would still result in meeting the consequence criteria, which would presumably result in a consequence close to the limit, but at a location that minimizes the consequence. This approach could result in flight safety limits that provide debris containment, or nearly so, while also allowing normal flight and flight within the limits of a useful mission without triggering an abort.
10.6.2 Selecting Lowest Risk Alternative.
It is not possible to evaluate every possible location of flight safety limits, so it is impossible to determine with certainty the absolute minimum risk location for limits.
However, it is possible to evaluate for each malfunction trajectory that the risks from aborting due to flight safety limits are equal to or less than the risks from not aborting at all. This should be done by comparing the CEC between abort action, and allowing continued flight. It is also possible to qualitatively assess the impact areas resulting from abort action and identify areas where risks might be reduced through a modification to the flight safety limits. If there is potential for a material reduction in risk, then alternative flight safety limits should be evaluated and the lowest risk alternative selected.
10.7 Risk on any Useful Mission Trajectory.
Section 450.108(d)(7) requires an operator to ensure any trajectory within the limits of a useful mission that is permitted to fly without abort would meet the collective risk criteria of § 450.101(a)(1) or (b)(1) when analyzed as if it were the planned mission in accordance with § 450.213(b)(2). This analysis should, at a minimum, account for the collective risk due to planned hazardous debris as well as the potential for on-trajectory failure modes. The philosophy behind § 450.108(d)(7) is to allow a non-normal flight to 22
continue as long as the mission does not pose an unacceptable conditional risk given the present trajectory. An example of missions that fall into this category are missions that lift-off on an incorrect flight azimuth, usually due to a software input error, such as the Ariane 5 failure on January 25, 2018. Apart from the programming error, these vehicles may be healthy and are not expected to fail more frequently than a flight without the programming error, so these flights should be allowed to continue if they meet the collective risk criteria on the present azimuth (including the risk from planned debris impacts on the present flight azimuth). If they do not, such flights would be required, in accordance with § 450.108(d)(7), to implement an abort before the point in flight where the collective risk criteria would be exceeded.
10.7.1 Variety of Trajectories.
It is of course, impossible to evaluate every possible trajectory within the limits of a useful mission to meet § 450.108(d)(7). Instead, this requirement should be met by evaluating the risk for a variety of trajectories in the envelope, each with normal trajectory dispersions and accounting for all failure modes and planned events. The requirement states that the risk criteria must be met for any trajectory within the limits.
This does not require every possible trajectory within the limits to be examined. Instead a sufficient set is one that includes the edges of the limits and those identified, by inspection or analysis, that overfly population centers that could result in risks exceeding the criterion.
10.7.2 Risk Evaluation.
Risk evaluation must follow a methodology for flight safety analysis consistent with § 450.115, but need only evaluate collective risk metrics. Usually risks are not significantly changed within the useful mission envelope for failures very early in flight, when the useful mission envelope is small compared to the distance to exposed population. Thus, FFBO and toxic risks are often not relevant for this analysis.
Analyzing a variety of trajectories is most important for examining debris risks when a vehicle has a larger limit of useful missions. It is best practice to optimize flight abort rules to define a minimal set that provides adequate protection while eliminating duplicate or unnecessary rules that add complexity to the flight safety system implementation. Further, flight safety limits can help to reduce financial responsibility obligations determined in accordance with 14 CFR Part 440 requirements. This includes preventing intact impacts with non-trivial remaining explosive or toxic materials.
11 END OF FLIGHT ABORT.
For some mission scenarios, at some point in flight, abort can no longer mitigate risk.
Section 450.108(e) states that a flight does not need to be aborted to protect against high consequence events in uncontrolled areas beginning immediately after critical vehicle parameters are validated, if the vehicle is able to achieve a useful mission and certain conditions are met for the remainder of flight. Specifically, the conditions which must be present are: (1) flight abort would not materially decrease the risk from a high consequence event, and (2) there are no key flight safety events. In these situations, flight abort no longer provides any effective mitigation of high consequence events.
This addresses a common occurrence during a period of planned overflight of an uncontrolled area immediately preceding orbital insertion.
11.1 Key Flight Safety Events.
In order to comply with § 450.108(e)(2) key flight safety events must be identified. The definition in § 401.7 states that a “key flight safety event” means a flight activity that has an increased probability of causing a failure compared with other portions of flight.
Additional guidance is provided in AC 450.101-1, High Consequence Event Protection, in the discussion of phases of flight (a phase of flight cannot include a key flight safety event).
11.2 Material Decrease in Risk of High Consequence Events.
The evaluation of § 450.108(e)(1) requires definition of material decrease. A material decrease does not include cases where the risks are already two orders of magnitude below the threshold of interest. A material decrease does not include small reductions, specifically a reduction smaller than coefficient of variation of irreducible uncertainty in input data. Typically, the two most significant irreducible uncertainties are the population distribution and the outcome of a failure. For population, it is impossible to obtain data on the exact location (including sheltering) of every individual affected by a launch or reentry. For failure outcomes, there is uncertainty in the dynamics of breakup and in the flight of a vehicle between failure and impact. Thus, if CEC is used as a metric, a reduction in CEC by a factor of less than two is not a material decrease (based on empirical evidence). And likewise, if CEC is below 1E-3, it is not a material decrease.
11.3 Evaluation of Critical Parameters.
If the two conditions above are valid for the remainder of flight, then flight abort may be disabled. When flight abort is disabled, a conditional limit—a flight safety limit which includes validation of critical parameters—should be used. This is identical to that described in paragraph 9.4 of this AC.
12 FLIGHT ABORT RULES.
Flight safety limits as developed to meet the Part 450 regulations are implemented as rules for flight. These rules must be implemented as part of flight, in accordance with § 450.108(f), to ensure that a determination can be made on whether flight abort must be implemented.
12.1 Data Availability.
In accordance with § 450.108(f)(1) vehicle data required to evaluate flight abort rules must be available to the flight safety system under all reasonably foreseeable conditions during normal and malfunctioning flight. Flight abort rules are not useful if the data to evaluate them is not available to inform the flight abort decision during flight. There are three examples of situations that challenge the availability of vehicle data needed to facilitate flight abort rule evaluation. First, that a flight abort rule (or limit) could rely on knowledge of the future. An example would be a rule that states that flight abort should occur if a vehicle will pose a hazard to a location. The point of the analysis above is to develop limits that achieve this goal with available information. Second, a rule could be based on subjective judgment that is either impossible to evaluate in the case of an autonomous system or too reliant on discretion of the safety officer. An example of this is the “obviously erratic” rule. While this is an important safety precaution for failures that have not been foreseen, it cannot be relied on to terminate a vehicle for any failure that is foreseeable. Third, a rule could rely on data, which is no longer available to the decision system where the rule might be violated. An example of this would be a downrange flight safety limit, which the vehicle might violate when it is below the horizon of a tracking system critical to the evaluation of a flight abort rule.
12.2 When Flight Abort Must Occur.
12.2.1 Implementing Flight Safety Limits.
The FSS must abort flight when valid, real-time data indicates the vehicle has violated any flight safety limit developed in accordance with § 450.108(f)(2)(i). This is simply the requirement that in real-time, flight parameters must be evaluated relative to the flight safety limits developed above and abort action taken when violated. It is, of course, insufficient to develop limits, but then ignore them during an actual mission.
12.2.2 When Flight Safety System nears Incapacitance.
Section 450.108(f)(2)(ii) requires that the FSS must abort flight when the vehicle state approaches identified conditions that are anticipated to compromise the capability of the FSS and further flight has the potential to violate a flight safety limit. This is the implementation of the flight safety limit developed to meet the objective in § 450.108(c)(5).
12.2.3 Invalid Track Data.
Section 450.108(f)(2)(iii) requires that the FSS must abort flight in accordance with methods used to satisfy § 450.108 (d)(3), if tracking data is invalid and further flight has the potential to violate a flight safety limit. This is the implementation of the flight safety limit developed to meet the constraint in § 450.108(d)(3), and the approach is discussed in paragraph 10.3 of this document.
13 FLIGHT SAFETY LIMITS MEANS OF COMPLIANCE.
This chapter describes a means of achieving all the requirements for flight safety limits, both objectives and constraints. These steps are expected to be applied for evaluation of a single intended flight or a small set of similar flights. The analysis results for the full range of licensed operations do not need to be submitted with the application. To comply with § 450.108(f)(2), the applicant needs to demonstrate their process for a representative mission, then use the same process during a flight. The following steps provide a methodology:
1. Start with an envelope of trajectories sufficient to characterize variability and uncertainty during normal flight in accordance with § 450.117 and that encompass the limits of a useful mission, per § 450.119(a)(3).
2. Evaluate and adjust the envelope, so § 450.108(d)(7) can be satisfied, reducing the envelope if some portions do not meet acceptable risk criteria. During this step, portions of the envelope which could lead to debris on uncontrolled areas are also identified.
3. Evaluate the potential for ending flight abort, applying § 450.108(e).
4. Identify potential flight safety limit types, based on system capabilities, so § 450.108(f)(1) can be satisfied.
5. Perform time delay analysis (system latency), satisfying § 450.108(d)(4).
6. Determine buffers accounting for credible malfunction flight, satisfying § 450.108(d)(1).
7. Define candidate quantitative criteria for each limit type, satisfying §§ 450.108(c)(2), (4), and (5). Note that compliance with § 450.108(c)(6) is an alternative to §§ 450.108(c)(2) and (4).
8. Define conditional limits,3 satisfying § 450.108(c)(3).
9. Validate that rules as defined can be supported by the system, satisfying § 450.108(f)(1).
10. Adjust the limits to reduce risk, in accordance with § 450.108(d)(6), and/or better meet mission secondary objectives.
11. Assess residual risk, including CEC, and refine as necessary, verifying that all objectives of § 450.108(c) and constraints of § 450.108(d)(6) are satisfied, using flight safety analysis per subpart C, satisfying §§ 450.108(d)(1) and (2), subject to the requirements of § 450.108(d)(5).
12. Compute durations of acceptable data loss, satisfying § 450.108(d)(3).
3 A “conditional limit” is a performance-based requirement similar to a “gate” concept. See paragraph 9.4 of this AC.
13.1 Trajectory Envelope.
The initial “trajectory envelope” should describe the extent of where the vehicle may fly and still be within the limits of a useful mission, in accordance with § 450.119(a)(3).
According to § 401.7, a useful mission is one that can attain one or more objectives.
The limits of a useful mission means the trajectory data or other parameters that bound the performance of a useful mission, including flight azimuth limits. These must incorporate all uncertainty and variability that exists, in accordance with §§ 450.117(a)(1) and (2). This should include, but not be limited to, wind variability, performance uncertainty, mission initiation time variability, and launch platform variability. The variability should encompass just the planned operations for which the flight safety limits are intended to be applied. Trajectories that fly on an unplanned guidance program (e.g. incorrect azimuth) may still be useful if an objective can be met.
These are examples of unintended trajectories. These trajectories may become the boundaries of what is considered useful; however, their extents must be separated from the extents of normal flight including only uncertainty and variability (not failures), in accordance with § 450.117(a).
13.1.1 Trajectories That Characterize Variability.
When an operator develops flight safety limits for a family of missions, they must also incorporate the variability in mission objectives in accordance with § 450.117(a)(1).
AC 450.117-1, Trajectory Analysis describes the development of such trajectories. For flight abort rule development, the maximum extent in time, position, and impact point should be considered. The traditional three-sigma trajectories (as described in the former 14 CFR Part 417) about the nominal trajectory may be a starting point.
However, the analysis should use actual trajectory simulations rather than constructed trajectories,4 unless the use of actual trajectories is operationally prohibitive and it is shown that use of constructed trajectories produce equal or higher risk estimates and hazard areas for all mission profiles. Numerous trajectories should be simulated to reflect the extremes of normal flight in all phases of flight. In some cases, intermediate trajectories are also necessary to ensure that risk is acceptable across the range of useful missions, especially when a large fan of possible trajectories is considered useful. The intermediate trajectories should be identified as those that overfly population centers where the population density divided by IIP rate is comparatively high.
13.2 Trajectory Envelope Evaluation.
The second step, in accordance with § 450.108(d)(7) is to ensure that all trajectories within the envelope described in paragraph 13.1 of this AC meet the risk criteria of § 450.101(a)(1) or (b)(1) when analyzed as if it were the planned mission in accordance with § 450.213(b)(2), but applying the special conditions described here. This requirement should be met by evaluating the risk for a variety of normal and unintended trajectories, each with normal trajectory dispersions and accounting for failure modes 4 The distinction between simulated and constructed is as follows: a simulated trajectory is a self-consistent physically-realizable trajectory, whereas a constructed (or “synthetic”) trajectory may be assembled by using state vectors from different trajectories at different times to define extremes, and thus is not necessarily physically realizable.
and planned events. The specific trajectories should be selected with the method described in paragraph 13.2 of this AC. Risk evaluation must follow a methodology for flight safety analysis consistent with § 450.115, with three special conditions. First, each selected trajectory should be evaluated as if it were the nominal trajectory, and risk should be computed considering normal trajectory dispersions. Second, this analysis need only evaluate collective risk metrics, not individual risks or high consequence events. Third, the failure probability may be allocated only to on-trajectory failures, as described in paragraph 13.2 of this AC. The third condition is a simplification that facilitates efficient analyses, which should only be used in cases where the “on-trajectory” failures occur on a trajectory that is the result of a malfunction (e.g.
incorrect azimuth).
13.2.1 Trajectory Selection.
This analysis normally begins by analyzing the nominal, the edges of the envelope, and those trajectories which can lead to debris on the most densely populated areas. The assessment should also analyze trajectories th at may concentrate hazards on significant populated areas, by having the slowest impact point traverse rate (longest dwell time) for the ballistic coefficients of fragments with significant consequence, a short time span of high probability of failure, etc. Particular attention should be paid to the impact areas associated with jettisoned items, especially if an unintended trajectory could place them over land instead of water, in accordance with § 450.133.
complex envelope (e.g. gaps or special restrictions) may require a more extensive analysis to satisfy § 450.108(d)(7). For example, for overflight, an envelope analysis could be performed to show that a series of windows of azimuth are available, but flight is not allowed over the most densely populated cities. An even more complex example is an inland suborbital air-drop mission, where the envelope analysis could be performed to show that the drop point and ignition locations should be constrained to a certain volume, and then later in flight, trajectories can include larger volumes.
• In order to accomplish § 450.108(c)(3), the analysis should also identify the portions of the envelope that approach an uncontrolled area with materially increased public exposure. It is often clear which areas are likely to be affected: overflight of continents and significant islands within the geographic extent of the useful missions.
13.2.2 Fa ilure Probability Allocation.
There are different approaches to assessing a particular useful mission trajectory with respect to § 450.108(d)(7).
separately, or just the most hazardous on-trajectory failure mode, while retaining the allocation with respect to the mission timeline for each failure mode being studied.
This reduces the extent of the analysis compared to including off-trajectory failure modes but may require a different approach if conservatism results in noncompliance with § 450.1 08(d)(7). If any on-trajectory failure mode is excluded, the 28
• · In most cases, the envelope analysis is likely to be straightforward, but a more
• The total failure probability may be allocated to each on-trajectory failure mode
operator should provide evidence why the included failure mode(s) provide conservative results.
• An operator may distribute the total failure probability across just the on-trajectory failure modes, while retaining the allocations with respect to the mission timeline and relative likelihoods of each of these failure modes. This reduces the extent of the analysis compared to including off-trajectory failure modes but may require a different approach if conservatism results in non-compliance with § 450.108(d)(7).
• All on-trajectory and off-trajectory failures modes may be considered, retaining their allocations with respect to the mission timeline and relative likelihoods.
Note: For all three approaches, allocation of the failure probability to flight time should be performed with the consideration for variability in the mission timeline.5 When critical events on an examined useful mission trajectory differ from the nominal timeline, the allocation with respect to time should be adjusted to correspond correctly to the events.
13.3 Evaluat ing Ending Flight Abort.
An applicant frequently wishes to turn off the capability for flight abort for some period towards the end flight, such as in the period before reaching orbit. Normally, flight abort is ended prior to reaching orbit, in order to prevent accidental initiation of abort resulting in orbital debris. For landings, flight abort may also be ended prior to touchdown, in order to prevent accidental abort on the ground.
13.3.1 Determining When Abort Can Be Ended.
Determination of when flight abort may be ended should be evaluated by first selecting a set of trajectories that span the acceptable envelope identified in paragraph 13.2 of this AC. For each trajectory, the CEC vs. time (see AC 450.101-3 High Consequence Event Protection) should be computed for all foreseeable failure modes, back to the last key flight safety event, per § 450.108(e)(2). For each significant period of flight, the CEC should be computed as if the termination system acted immediately upon failure, ܧܥ best(ݐ) ,where t represents the time of failure. This is the minimum CEC that can be reasonably expected from taking abort action. Likewise, the maximum CEC over all other(ݐ).other failure modes should be identified for each significant period of flight, ܧܥ Per the discussion in paragraph 11.2 of this AC, evaluation should be performed to determine if, at any time, abort would result in a material decrease in CEC. This occurs other(ݐ)>1E-3 and ܧܥ other(ݐ)>2 ܧܥat any time that ܧܥ best(ݐ) .This time, ݐௗ represents the earliest possible nominal time that abort could be ended.
5 For example, for a failure where the vehicle thrust is degraded and engine shutdown may occur later than normal, the failure probability rate during the period of degraded thrust should consider that the total thrusting time is longer than for a normal flight. Also, failure rates for subsequent phases of flight should not be transitioned to until those phases begin on the new mission timeline.
13.3.2 Establishing a Conditional Limit.
This time, ݐௗ, is then used to develop a conditional limit for the criteria where the flight abort will be ended. A conditional limit is based on other parameters, such as IIP or position. These should be established so that the nominal trajectory crosses them after ݐௗ. The conditional limit thus usually should be placed so that a nominal vehicle would cross it later in flight than the nominal time, and so that the failure trajectories that led to reducible CEC do not cross the conditional limit and potentially end the abort capability. These flight safety limits should then be evaluated to ensure that the CEC criteria for materially decreased, as discussed in the previous paragraph, are satisfied.
This is especially important for failures that occur in the period just preceding the conditional limit. Conditional limits are further discussed in paragraph 13.9 of this AC.
13.4 Acceptable Envelope Definition.
The acceptable mission envelope is then determined by starting with the envelope of the limits of a useful mission and eliminating portions that would violate the collective risk criteria of §§ 450.101(a)(1) or 450.101(b)(1). The trajectories from the selection above that violate the risk criteria are used to describe what portions of the initial envelope should be removed. The remaining acceptable trajectory envelope encompasses only trajectories that meet the collective risk requirement, either when intentionally designated as the planned mission in accordance with § 450.213(b) or when the “nominal trajectory” is in fact an unintended trajectory that is the result of a malfunction
(e.g. incorrect azimuth).
13.4.1 African Overflight Example.
A simple example of the application of this are missions from the Eastern Range that fly over Africa. Trajectories which overfly the coastal areas of Western Africa may meet mission objectives, but the risks associated with flying over these densely populated areas may exceed the risk criteria. Thus, the allowed envelope may need to be restricted to only trajectories which avoid overflight of these regions.
13.4.2 Hazard Footprints and Debris Footprints.
For evaluating hazard extent, a hazard footprint should be used. A hazard footprint is an extension of a debris footprint. A debris footprint is a geographic region containing, with at least 97% confidence, all the hazardous debris impacts resulting from an event.
The debris footprint should be computed from the probability density distribution of debris impacts from an event (e.g. a breakup scenario). For flight safety limit evaluation, the debris footprint may be computed either by using a mean wind, and adding a ten-mile radius to account for wind variability, or using a more physically accurate modeling approach. A hazard footprint extends the debris footprint to include the region where the probability of casualty exceeds 1% from any impact included in the footprint (conditional on each impact), considering all hazards. The extended area is based on the distance from the impact location where a casualty could occur. For inert debris, one thousand feet may be assumed, or an analysis could demonstrate a smaller value. If propellant could remain at impact, the explosive radius and/or toxic cloud drift distance should be accounted for (these require analysis to identify the distance to the 30