1% probability of casualty). This distance should then be applied to expand the debris footprint polygon in each direction.
13.4.3 Potential for Hazards in Uncontrolled Areas.
The analysis must determine the specific limits that describe the portions of the envelope that lead to debris on such areas, in accordance with § 450.108(d)(2), which must consider all hazardous debris (as defined in § 401.7), in accordance with § 450.135(b)(1). For downrange overflight of a continental area, the first state vector in a trajectory where a hazard footprint from an on-trajectory failure reaches an uncontrolled area defines the minimum state vector. It is best practice to leave a “near-shore gap” of at least 10 miles between the shoreline and the hazard footprint to protect local ship and boat traffic. These state vectors should be determined across the acceptable envelope of useful trajectories. Also, for an island or land overflight, the last state vectors for which the hazard footprint includes the landmass (including a near-shore gap) should also be identified. This identification includes development of a hazard footprint that accounts for all sources of dispersion. For an island, left and right extents of trajectories that would affect the island should be determined as well, again accounting for debris uncertainty.
13.4.4 Categorizing State Vectors.
The product of this analysis is the set of state vectors from all trajectories describing a useful mission that have acceptable risk. These will be used in the subsequent parts of this analysis to define the flight safety limits. Each state vector of the selected trajectories should then be identified in two ways.
1. If it is in the portion of a trajectory that causes exceedance of the collective risk criteria.
2. Whether a breakup at the state vector would lead to debris in an uncontrolled area.
13.5 Identify Potential Flight Safety Limit Types.
Federal Ranges have used different types of flight safety limits and flight abort rules depending on instrumentation available, the dynamics of the vehicle, and the geography of the region(s) being protected. Execution of the flight abort rules can be via a ground-based safety officer (e.g. Mission Flight Control Officer), an automated groundbased system, an on-board autonomous flight safety system (AFSS), and/or a pilot. The flight abort rule types described in paragraph 13.5 of this AC apply to any of these types of systems.
13.5.1 Flight Abort Rule Types.
Flight abort rules fall into two categories. Rules monitor either vehicle health, regardless of the geographic position, or vehicle state vector (and their associated instantaneous impact point) relative to the environment. Flight safety limits are the quantitative criteria on which either type of rule is evaluated.
13.5.2 Vehicle Health Based Rules.
Rules that are based on vehicle health must be used in order to ensure that the abort system is not compromised before an abort can be achieved and before reaching a flight safety limit, in accordance with § 450.108(c)(5), (d)(3), (f)(2)(ii), and (f)(2)(iii).
Example metrics for this category include electrical power stability, vibration limits, thermal limits, acceleration limits, vehicle angular rate limits, sensor quality requirements, chamber pressure, and data loss. For qualified abort systems, the applicant should identify the vibration, thermal, and motion-based limits based on the qualification standards. Identification of such rules for a pilot-in-the-loop abort system is outside the scope of this advisory circular. Paragraph 13.13 of this AC discusses the development of the duration of acceptable data loss. Data consistency rules define the approach for dealing with inconsistent input data. This approach should include a voting scheme. In cases where all navigation data (GPS, IMU, etc.) is lost, abort must occur in accordance with the duration of acceptable data loss, in accordance with § 450.108(f)(2)(iii).
13.5.3 Vehicle State Vector Guidelines.
Rules based on vehicle state vector and associated IIP should aim to meet the following pragmatic guidelines to achieve the flight safety limits objectives and constraints. It is also helpful for the applicant to allow for accurate prediction of the hazard location with adequate time to allow rerouting of aircraft, when real-time aircraft hazard mitigation is used.
1. Ensure the vehicle moves downrange (when applicable).
2. Prevent significant cross-range deviations.
3. Prevent intact impact with significant remaining propellant.
13.5.4 Most Common Flight Safety Limit Types.
The most common types of flight safety limits are the following. In many cases, debris containment and risk requirements can be met with a combination of only these three types.
1. Maximum altitude vs. downrange limits, to meet guideline 1.
2. Fixed Termination Line base d on Instantaneous Impact Points (IIP), either based on vacuum or drag-corrected prediction, to meet guideline 2.
3. Minimum altitude vs downrange distance, to meet guideline 3 and assist with realtime aircraft hazard mitigation.
13.5.5 Less Common Flight Safety Limit Types.
Other types of flight safety limits are less commonly used:
1. Moving termination lines based on IIP6, to meet guidelines 1, 2, 3, and assist with real-time aircraft hazard mitigation.
2. Azimuth limits, based on vehicle velocity vector to meet guideline 2.
3. Flight path angle limits, to meet guideline 3 and assist with real-time aircraft hazard mitigation.
4. Fixed minimum altitude, if the vehicle is falling, to meet guideline 3.
5. Optical tracking systems (skyscreens) to meet guidelines 1, 2, and 3 in the launch area.
13.5.6 Flight Safety Limits Constraints.
In accordance with § 450.108, there are also two constraints that must be considered when developing flight safety limits of any of the types above, when containment is not achieved. Conditional limits (see paragraph 13.9) are usually also a part of the strategy to meet these constraints:
1. In accordance with § 450.108(d)(6), do not abort in areas that would increase the collective risk (measured with CEC) to the public in uncontrolled populated areas, compared to continued flight.
2. In accordance with § 450.108(c)(4), do not abort in areas that would exceed 1 x 10-2 conditional expected casualties for off-trajectory failure modes.
13.5.7 Flight Safety Limit Types not addressed in this AC.
The above types are described in this document and explained in more detail in paragraph 13.8 of this AC. Other types of limits include seawalls, retrograde IIP, and present-position-based termination lines, but these are not common and not further discussed. Vertical plane charts and straight up times are not discussed. They are only used for historical reasons and have generally been found to be redundant with other simpler or more versatile rules. Finally, “obviously erratic” rules are usually in place when abort action is initiated by a human, which can help to prevent loss of command capability for ground-based systems to meet § 450.108(c)(5) and (f)(2)(ii), but these cannot be relied on in a safety analysis, due to the ambiguity as to when they would be violated. Any similar rule should be based on parameters that can be measured (such as body rates) with limits based on negative outcomes when exceeded (such as loss of FSS control). The selection of the flight abort rule types typically depends on range equipment or AFSS design, but the collective set must meet the requirements of § 450.108.
6 An example of moving IIP limits are what has historically been called “chevrons.”
13.6 Determining Abort System Latency.
A time delay analysis must determine the abort system latency, including uncertainties, in accordance with § 450.108(d)(4). See paragraph 10.4 of this document for the considerations in determining latency. The delays should be determined through system testing and should consider any changes during flight, such as longer communication paths or retransmission points. An adequate analysis should diagram all steps in the process and determine delays from each part, with a resolution of 0.1 second or better.
The uncertainty in the delay must also be determined to meet § 450.108(d)(4). For autonomous systems, a one-sigma uncertainty in the total time delay of 0.1 seconds is typical. When a human is in the loop, the uncertainty is much larger.
13.7 Buffer Development.
Mission assurance is benefited when there is margin between flight safety limits and vehicles on a potentially useful mission. Therefore, a buffer between the trajectories that define the limits of a useful mission and any flight safety limit may be used when the hazard footprint does not intersect populated areas. When the hazard footprint from the normal trajectory does intersect populated areas, then risk evaluation should be done to determine the optimal location for flight safety limits.
13.7.1 Malfunction Trajectories.
To determine the buffer, malfunction trajectories for the failure mode that leads to the most rapid credible deviation of the vehicle from the normal flight envelope should be used. The failure that generates this is typically a guidance system failure that aims the vehicle in a new direction and turns the vehicle as fast as physically possible in that direction. Ideally, in that simulation, the vehicle attitude is controlled to ensure that structural limits are not exceeded during the failure. In many cases a simpler model is used that simply turns the vehicle as fast as the control system will allow (or even immediately). The initiation times for trajectory generation should occur at sufficiently frequent intervals from launch until the vehicle is orbital or returns to ground. Sufficient frequency for low thrust-to-weight ratio (e.g. less than three) flight periods is typically one second or less near significant exposure areas or any maneuvers, and five seconds or less during steady state—but may need to have higher frequency for high thrust-toweight vehicles in accordance with § 450.119(b)(3). See AC 450.117-1, Trajectory Analysis, for more information on malfunction trajectory generation.
13.7.2 Determining Minimum Buffer.
The buffer is based on the minimum malfunction duration. This minimum should always be accounted for—that is flight safety limits should always include this buffer, but sometimes it is not necessary to explicitly follow the process described below. To determine the minimum buffer, use the following steps:
1. Define a target time delay duration between the onset of a failure and the initiation of flight abort. Typically, no less than the desired minimum data loss flight time, e.g.
5 seconds.
2. Generate failure trajectories that deviate as rapidly as physically possible (i.e. the vehicle could fly and remain substantially intact) from the envelope of trajectories 34
as described above. The duration of the failure trajectories after failure initiation should extend at least up to the maximum time delay duration from step one.
3. Capture all the potential mid-flight state vectors that are predicted during each failure trajectory flyout, with a frequency of one hertz or better, typically at intervals shorter than the minimum time delay duration divided by ten. State vector data to be captured should include any data that is expected to be tested in a flight safety limit
(e.g. position, velocity, acceleration, orientation, and angular velocity, as required by the selected flight abort rules).
4. If flight safety limits are based on instantaneous impact points (IIP), compute the IIP for all captured state vectors using an equivalent algorithm and parameters as will be used in the real-time mission to evaluate the flight abort rule. IIP prediction may be a Kepler propagation (although this is significantly different from the actual impact point), a vacuum propagator accounting for the J2 term of gravity, or with a three-degree-of-freedom (position but no orientation) simulation accounting for drag (either with constant ballistic coefficient or with a drag coefficient depending on speed). Importantly, the applicant should use the same methodology in planning as will be used by the real-time system to evaluate any flight abort rules based on IIP.
13.7.3 Determining Maximum Buffer.
The maximum buffer is for periods of flight when the hazard footprints from normal trajectories are not close to uncontrolled areas. When they are close to uncontrolled areas, a risk based approach should be used to identify good placement of flight safety limits, i.e. “contain if you can, otherwise use risk.” Hazard footprints should be computed for sufficient failure trajectory state vectors to enable identification of the region that could lead to hazards reaching uncontrolled areas. The steps are:
1. Generate failure trajectories that deviate as rapidly as physically possible from the edges of the envelope of trajectories as described above. Adequate sampling should be used both in failure time and in the plane of the turn failure.
2. Identify the last state vector in each failure trajectory where the hazard footprint does not reach an uncontrolled area. Failure trajectories which would result in structural failure of the vehicle prior to the footprint reaching uncontrolled areas may be discarded.
3. This set of last state vectors should be used when developing a maximum buffer for flight safety limits.
13.8 Defining the Quantitative Parameters of the Flight Safety Limits.
The general process for determining quantitative parameters of flight safety limits is to identify an envelope in the appropriate projection/transformation of state vectors for each limit type (recall that one limit type is not generally sufficient to meet all of the flight abort objectives and constraints). This envelope, which should define a continuous line (e.g. defined by IIP), becomes a flight safety limit.
13.8.1 F our Types of Trajectory State Vectors.
There are four types of trajectory state vectors that result from paragraph 13.2, Trajectory Envelope Evaluation of this AC. (For this discussion, the “uncontrolled areas” also includes the near-shore gap discussed in paragraph 13.4 of this AC).
1. Within normal flight (as defined in § 401.7) which:
a. Do not result in hazardous debris effects in uncontrolled areas with 97% confidence of containment (“Type 1a: normal/no risk”).
b. May result in hazards in uncontrolled areas (“Type 1b: normal/with risk”).
2. Outside normal flight but inside the acceptable useful mission envelope which:
a. Do not result in hazardous debris effects in uncontrolled areas (“Type 2a:
useful/no risk”) with 97% confidence of containment.
b. May result in hazards in uncontrolled areas (“Type 2b: useful/with risk”).
13.8.2 Three Sets of State Vectors.
There are (potentially) three sets of state vectors from paragraph 13.7 of this AC (Buffer Development).
• Set A: Within a short duration failure from the normal envelope, inside the minimum buffer, from paragraph 13.7 of this AC (but not also in set C).
• Set B: From extreme failures that lead to debris in uncontrolled areas from paragraph 13.8 of this AC (but not also in set C).
• Set C: That meet both conditions.
13.8.3 State Vectors Project ed onto Planes.
An applicant should project or transform the state vectors in these datasets on to two-dimensional planes corresponding to the independent variable(s) and metrics of the flight safety limits identified in paragraph 13.5 of this AC. Examples of all of these are shown in the following figures for an sample mission from Wallops Flight Facility that flies over a portion of South America.
13.8.3.1 Figure 13-1 of this AC illustrates the trajectories for Types 1a and 1b, within the expected normal trajectory variation, i.e. due to guidance and performance uncertainty. The green points are from Type 1a: normal/no risk, for which the vehicle hazards do not affect an uncontrolled area, and the blue are for state vectors were the hazards do intersect uncontrolled areas (Type 1b: normal/with risk). These are shown projected in two ways;
the left one is an altitude vs downrange distance plot, and the right one shows instantaneous impact points on a map. Both views could be used for defining abort limits. For this trajectory set, no hazardous debris impacts affect uncontrolled areas early in flight, but only during this segment of overflight of South America. This demonstrates where to locate the conditional limit. It should be near the latest green state vector that is the last one before the blue points adjusted for the abort system latency. For 36
500000 400000 2 ;- 300000 ;:
·:C ~ 200000 100000 Present Position Downrange vs Altitude IIP 200 400 600 800 1000 Of\ Distance (mi) 07/27/2021 AC 450.108-1 ex ample, if the latest green state vector is for T+230 seconds and the latency is 2 seconds, the conditional limit would be placed at the state vector at T+228 seconds for this trajectory on this azimuth.
Figure 13-1: Projected points in the Normal Trajectory Range
13.8.3.2 The points from Type 2 are shown in Figure 13-2 of this AC and represent the range of useful missions. The mission spread is much wider, presuming that a later correction could allow the payload to reach the correct orbit or that a range of orbital inclinations would still result in a useful mission. An applicant would analyze these trajectories in accordance with paragraph 13.2 of this AC to determine that the collective risks for each one is acceptable. The orange points are those that do not have hazards impacting in uncontrolled areas (Type 2a: useful/no risk), whereas the red ones do (Type 2b: useful/with risk).
Present Position Downrange vs Altitude 500000 400000 ii -;; 300000 I 200000 100000 200 400 600 800 1000 OR Distance (m1) 07/27/2021 AC 450.108-1 Figure 13-2: Projected points in the Range of Useful Missions
13.8.3.3 The sets that result from failure trajectories (sets A, B and C) are shown in Figure 13-3 and Figure 13-4. Figure 13-3 shows the launch area. In this example, the uncontrolled area includes a 10 mile offset from the coast, except there is a gap directly off the coast of the launch facility. There are many failures (purple dots, set B & C) that can reach uncontrolled areas.
The IIP (right plot) shows that these are outside the short duration failures (yellow, set A), thus it is possible to use IIP limits that provide a sufficient buffer around useful missions while still protecting uncontrolled areas.
This would not be possible using only altitude versus distance limits. This is illustrated by the yellow dots overlapping the purple dots. This of course occurs since failures that reach uncontrolled areas are primarily going crossrange, which this projection cannot depict. This is the reason that elevation limits are typically coupled with azimuth limits or with IIP-based limits. Altitude vs. distance limits can be developed to control failures in some directions, provided they do not abort trajectories within the normal envelope.
Present Position Downrange vs Altitude 250000 / / . • ..
200000 . . . . ... . . .. . .
150000 . ,;:!
g ' ~ .. ....
'O ... , a ·= .. < 100000 ,i _ _.
50000 !·: ...
0 .. , -20 0 20 ;o 60 80 100 120 140 OR Distance (mil Present Position Downrange vs Altitude 1000000 ...,,, ---,..-~---------------------, !IOOOOO ..
800000 • 700000 g i 600000 ~ 500000 400000 300000 . .
..
. . . .. . .. , .
• • ..
200000 +---.,...--.,...--.,...--.,...--.,....--.,....--.,....--"-I 300 500 600 700 800 900 1000 uoo OR Olstlnce '""' IP IP 07/27/2021 AC 450.108-1 Figure 13-3: Projected points for Failure Trajectories, Launch Area
13.8.3.4 Figure 13-4 shows the same sets as the previous figure, but now for the downrange area. The uncontrolled region through which useful missions pass has been excluded. These figures would allow setting flights safety limits for both IIP and range versus altitude.
Figure 13-4: Projected points for Failure Trajectories, Downrange 39
13.8.4 Establishing Flight Safety Limits from State Vector Projections.
For all flight safety limits (FSLs) a piecewise continuous series of line segments should be created using the data shown in the plots above. For mission assurance purposes, the line segments would typically be outside the points for normal and useful trajectories (sets 1 and 2) and short duration failures (set A). The FSL line segments should also be inside the set of points for extreme failures (set B), but in some cases this is inconsistent with being outside the first group; in this case a combination of flight safety limits should be used in conjunction. This process prevents continued flight from increasing risk in uncontrolled areas if the vehicle is unable to achieve a useful mission, in accordance with § 450.108(c)(2). If there are points inside the normal or useful missions that impact uncontrolled areas with materially increased public exposure (sets 1b and 2b), a conditional limit must be established, in accordance with § 450.108(c)(3).
Conditional Limits are discussed in paragraph 9.4 of this AC. The number of line segments may be limited by the system used to evaluate the rule (display or automated algorithm, where limits may be due to memory space, computation time, or complexity of display).
13.8.5 Maximum Altitude.
A maximum altitude limit is simply a limit where the vehicle’s position must be below a line which is a function of downrange distance. The trajectory points described above are converted into the altitude vs. downrange coordinate system (as illustrated in the figures above). The definition of downrange should correspond to the algorithm that will be used to evaluate the rule in real-time; it may be either a tangent-plane downrange distance or a great circle arc-distance. The envelope is the line drawn above the normal trajectory points, subject to the rules in the conditions above.
13.8.6 Minimum Altitude.
The minimum altitude limit is analogous to the maximum altitude limit, and a similar process is used to create it, but with a few additional considerations. There are competing objectives on how low of an altitude to set the flight safety limit. For a termination that results in an explosive destruct, which leads to significant imparted velocities, activation in the upper atmosphere or above can cause a large spread of debris, thus subjecting a larger area to hazardous debris impacts, contrary to safety goals. However, allowing a wayward, but controlled, vehicle (such as due to a guidance programming error) to descend leads to inability to predict the location for a very hazardous object in time to warn aircraft. In this situation, it is likely better to terminate flight, so that the hazarded region can be better predicted, in order that aircraft can be moved. The minimum altitude rule can be effective at mitigating the hazards from an intact impact with significant remaining propellant, including near-field and far-field blast overpressure.
13.8.6.1 If a vehicle is falling and no longer thrusting and without significant lift capability, and the abort is destructive, then it is usually better to let it continue to fall and terminate at a low altitude. Thus, in these situations an operator should have separate rules for vehicles that have lost thrust than those that are thrusting. For non-destructive abort (e.g. fuel venting), there 40
is no need to wait to terminate flight, because the resulting debris will not significantly spread, and therefore abort should occur as soon as a violation occurs.
13.8.6.2 The minimum altitude rule can be effective at mitigating the hazards from an intact impact with significant remaining propellant, including near-field and far-field blast overpressure.
13.8.7 Fixed IIP Limit.
A fixed IIP limit is a geographic boundary where the vehicle’s instantaneous impact point (vacuum or accounting for drag) must remain inside. To create fixed IIP-based limits, the process is similar to the altitude limits, except now a closed “hull” is created.
The collection of IIPs associated with the appropriate sets of state vectors is used. The IIPs should be transformed to an azimuthal equidistant projection, with the origin at some point along the nominal trajectory (normally the launch point), in order to adequately account for the curvature of the Earth’s surface. A polygon containing all the IIPs defines the hull. A limited number of vertices are used, in order to not cause problems for computation time or displays. Usually the created hull is convex but this is not required. The vertices are translated to geodetic coordinates and the flight safety limits are great circles that connect these coordinates.
13.8.8 Moving IIP Limit.
A moving IIP limit is an extension of the fixed IIP limit concept. Moving IIP limits are simply a set of fixed IIP limits that are each active for a specific time period (or other independent variable). Chevron lines, as have been used at the Eastern Range for many years, are an example of moving IIP limits. Moving IIP limits have the advantage that they can meet nearly all the guidelines described above and could in some situations be sufficient to meet § 450.108(c)(1), (c)(2), (c)(3), (c)(4) and (c)(6) without any other flight safety limits. They contain the IIP at a specific location as a function of time, vehicle speed, or other variable. Thus, an uprange deviation, a downward (or slow) vehicle, and cross-range deviations all may violate the limit, depending on how the moving IIP limits are designed. To develop moving IIP limits, a similar process may be used as for fixed IIP limits except that time filtering is now performed (reference paragraph 13.8 of this AC). Therefore, the analyst should first define the time interval between moving IIP limits. This is normally the same as the time delay duration identified in paragraph 13.7 of this AC. For each time interval, all the points which have a flight time in the interval are used, then a hull surrounding the points is created (usually in an equidistant azimuthal projection). The moving IIP limits then are activated by the real-time system during the relevant interval.
13.8.9 Azimuth Limit.
An azimuth limit constrains the azimuth (angle in the horizontal plane) of the vehicle’s velocity vector to be within predefined limits during a specified duration of flight. The limits are given as “left” and “right” azimuths and are calculated in an equidistant azimuthal coordinate system with the origin at the launch point. Usually the limits are given relative to the nominal trajectory azimuth but may be given as azimuth from 41
north. The azimuth limit is usually constant, starting from vehicle tip-over and extending until the vehicle has reached a certain downrange distance or a certain time of flight, usually just in the launch area. The same process as is used for other limits can also be used, where the limit azimuths are found by plotting the vehicle azimuth as a function of flight time or downrange distance.
13.8.10 Flight Path Angle Limit.
A flight path angle limit references the angle of the vehicle’s velocity vector relative to the local horizontal and is usually defined as a function of flight time or downrange distance. There may be both minimum and maximum flight path angle limits. This limit type is very helpful after a vehicle has pitched over to quickly identify a malfunction that causes the vehicle to accelerate downward, which is useful for protecting aircraft.
This limit type may be more effective than a minimum altitude limit for early flight loss-of-thrust events. A flight path angle limit is created in the same method as above on a two-dimensional surface where flight path angle is a piecewise continuous function of either time or downrange distance below (and/or above) the nominal flight path.
13.8.11 Skyscreen.
A skyscreen is a human visual observation facility that is arranged to constrain the vehicle’s azimuth and elevation as viewed from a particular location(s). A skyscreen is also referred to as “the wire.” The observer’s viewpoint is aligned through a physical guide, toward the expected flight field, with the bounds of an acceptable flight demarcated across this field of view (by using wires or ropes strung across a truss structure, ink lines drawn on a transparent plate, or similar physical cues for the flight envelope). Usually a back azimuth observer is used, viewing along the vehicle launch azimuth, while a cross-range observer verifies that the vehicle has initiated the pitch program properly, is moving downrange, and is flying between its upper and lower altitude bounds.
13.8.11.1 The skyscreen method is usually a backup or supplement to more technological systems, as it only works when weather, distance, and vehicle acceleration are compatible with the human eye’s ability to track the vehicle. The abort instruction is usually communicated to the safety officer with a handheld radio, so this method may also have a slower response than some flight safety systems (such as AFSS), while potentially having a faster response than other flight safety systems (such as when multiple tracking screens and multiple telemetry sources should be double-checked, before abort).
13.8.11.2 To develop the limit, for each observer location the azimuth and elevation angles for the state vector sets are computed. Then a set of connected line segments, one to the left and one to the right (which transition to above and below for a cross-range observer) of the points is identified. These bounds are represented on the observer’s physical view field, allowing visual identification of a flight, which is violating this envelope.