13.9 Conditional Limits.
There are three purposes of conditional limits: 1) to avoid aborting a vehicle in a region of elevated public risk, 2) to prevent a vehicle that cannot achieve a useful mission from hazarding uncontrolled areas, when the option exists to abort the vehicle before such a hazard is possible, and 3) to avoid discontinuation of flight abort capability prematurely during the flight of an malfunctioning vehicle. A conditional limit is a flight safety limit for which abort occurs only if the vehicle is not performing within expected parameters and should be used to comply with § 450.108(c)(3) and (e). If a critical vehicle parameter is outside its pre-established expected range or indicates an inability to complete flight within the limits of a useful mission, then flight abort is initiated.
Conditional limit replaces the term “gate,” which does not have a consensus definition.
13.9.1 Placement of Conditional Limits.
In accordance with § 450.108(c)(3), conditional limits should be placed prior to a period of materially increased public exposure, as discussed in paragraph 9.4 of this AC. The trajectories used to compute the CEC and collective risk should be selected to pass directly over the region of exposure but treated as though they were the planned trajectory, consistent with the technique described in paragraph 13.2 of this AC.
A minimum requirement of § 450.108(c)(3) is that the vehicle must be able to achieve a useful mission where risk is acceptable after passing through the limit (see paragraph
13.2 of this AC).
13.9.1.1 When a conditional limit is used, the conditional limit segment should be located so that all acceptable useful mission trajectories pass through the conditional limit prior to the period of materially increased public exposure or achieving orbit. Similarly, in accordance with § 450.108(d)(7) all unacceptable useful mission trajectories must reach a flight safety limit prior to the period of materially increased public exposure if the period of exposure would cause the entire trajectory to exceed the risk limits in § 450.101(a)(1) or (b)(1). This may result in some trajectories in a fan of useful mission trajectories reaching a conditional limit while others reach hard flight safety limits that are contiguous with the conditional limits. An operator may choose to abort some vehicles outside of the normal mission envelope but within the limits of a useful mission if a conservative approach is preferred when approaching a period of materially increased public exposure, even if the trajectory does not require abort in accordance with § 450.108(d)(7). In accordance with § 450.108(d)(6), such aborts, like all aborts, must not increase collective risk to the public in uncontrolled areas compared to continued flight. Paragraph 13.7 of this AC discusses how to identify the range of state vectors within the trajectory envelope, which can hazard uncontrolled areas. A conditional limit should be located in advance of these state vectors for each trajectory in accordance with § 450.108(c)(3).
13.9.1.2 For an orbital launch, the conditional limit to determine the ability of a vehicle to reach a minimum safe orbit should be placed as late as possible but may be influenced by factors such as the imminent loss of flight abort control; the narrow range during which to evaluate the flight against the criteria used to judge performance; the presence of a period of materially increased public exposure just prior to orbital insertion, etc.
13.9.2 Extents of Conditional Limits.
Conditional limits should be no wider than the extent of the acceptable useful mission trajectories plus the uncertainty in tracking (which is typically very small), and not include any buffer from paragraph 13.7 of this AC. This is consistent with § 450.108(c)(2) which requires flight abort in order to prevent continued flight from increasing risk in uncontrolled areas if the vehicle is unable to achieve a useful mission.
For some unique mission profiles, it may be possible for vehicles outside the limits of a useful mission (for example, outside of the useful azimuth range) to pose a smaller risk through continued flight than through flight abort when approaching a period of materially increased public exposure. Such trajectories would have to have some exposure to the public at the location of the conditional limit, otherwise abort would reduce the risk prior to the period of increased exposure. An operator should search for better locations to place the conditional limit, before deciding that continued flight presents the lowest risk for a trajectory that can no longer achieve an objective.
13.9.3 Fundamental Geometries of Conditional Limits.
A conditional limit can occur in four fundamental geometries.
13.9.3.1 No Flight Safety Limits Subsequent to Conditional Limit.
A first geometry is when there are no flight safety limits subsequent to the conditional limit, which is the typical case when ending flight abort in accordance with § 450.108(e). This is a typical “head-on gate” or “orbital gate”, such as those used for flights from the Eastern Range that overfly Europe or Africa. The flight safety limits typically have a significant buffer around normal flight while over broad ocean areas, but then come together where there is a narrow conditional limit, as shown in Figure
13-5. This conditional limit should be placed prior to any of the state vectors that can lead to hazardous debris effects in uncontrolled areas.
When a conditional limit of this type is reached, the flight safety system is usually safed. The point in the trajectory where the vehicle performance and health are assessed may be prior to the conditional limit, or the conditional limit may be moved uprange, if the ability of a vehicle to reach orbit is best measured at a location other than at a flight safety limit placed to contain debris. In this case, the location where the parameters used as metrics for the ability to reach orbit are measured may be followed by flight safety limits that provide debris containment up until a period of overflight, when the flight safety limits would cease and no abort would occur. The significant buffer around normal flight is acceptable over the broad ocean areas because continued flight does not increase risk to 44
uncontrolled areas in this case, and because the vehicle could potentially recover from a perturbation and resume flight within the limits of a useful mission.
Note: All lines are in impact point space. Brown is nominal, blue is envelope of useful missions, red are fixed IIP limits, and green is the conditional limit.
Figure 13-5: Example of head-on Conditional Limit
13.9.3.2 Conditional Limits for Uncontrolled Areas Encompassed by Limits of a Useful Mission.
A second geometry is when the uncontrolled area is completely encompassed by the envelope of useful missions, such as an island. This is typically used by the Eastern Range around Bermuda. In this case, the entire island is surrounded by a conditional limit where abort occurs when entering the region if the vehicle is not within expected parameters. Inside this region is a region where no abort should occur because continued flight is likely to reduce risk as compared to aborting near Bermuda.
Normal flight safety limits still exist further to the left and right of the region. This is illustrated in Figure 13-6 of this AC.
Figure 13-6: Example of Conditional Limit Around an Island
13.9.3.3 Conditional Limits for Limits of a Useful Mission Encompassed By Uncontrolled Areas.
A third geometry is when the uncontrolled area has greater lateral extent than the range of useful missions, but the vehicle will traverse the uncontrolled area before reaching orbit or ground impact as illustrated in Figure 13-7 of this AC. In this case, there should be a conditional limit prior to the uncontrolled area crossing, a region where limits are carefully examined to ensure abort reduces risk over continued flight, and then return to a typical abort region after the uncontrolled area crossing is complete. The exact location of flight safety limits in this example should be established in such a way as to minimize the possibility of an abort increasing risk over allowing continued flight, in order to meet§ 450.108(d)(6). This may require additional analysis, and the best approach may be to allow the flight to continue if it exits the limits of a useful mission after it passes the conditional limit. The best approach may vary depending on the direction that the vehicle deviates.
J/ '< \ / f • / \ ( j' I ( ' ,' ( I 5 \ I I } ' ' /\ ( ' I
• 07/27/2021 AC 450.108-1 Figure 13-7: Conditional Limit Region around Uncontrolled Area
13.9.3.4 Mixed Conditional Limits.
The fourth geometry is a combination of geometries two and three. One way this occurs is when an uncontrolled area extends only to one side of the envelope. This has been used by the Eastern Range for northerly azimuth flights that fly along the coast of North America and is commonly called a “lateral gate.” This is illustrated in Figure 13-8 of this AC, where the hashed box shows an area where flight safety limits should be carefully evaluated to ensure abort reduces risk.
• • • • ~ -,.,_ ~•-.. I ; I \ ,, 5 r ~ (
• I' • \ } / r r ' ( \ r I l 07/27/2021 AC 450.108-1 Figure 13-8: Mixed Conditional Limits
13.9.3.5 Mixed Conditional Limits where Flight Safety Limits Should be Expanded.
A similar situation occurs when an island is near the edge of the range of useful mission trajectories. Effectively this results in the same geometry results. However, in this case the flight safety limit should typically be expanded (unless it is protecting other uncontrolled areas) to avoid debris impacting on the island from an abort, in accordance with § 450.108(d)(6).
13.9.4 Multiple Conditional Limits.
A mission may have more than one period of overflight over an uncontrolled area, and in these cases, conditional limits may need to be drawn at the start of each uncontrolled area crossing to meet § 450.108(c)(3). Periods of materially increased public exposure should be separated depending on whether it is possible to initiate flight abort between them while not increasing risk to uncontrolled areas through abort. For example, a series of islands may be too closely spaced to implement abort as the hazard footprint moves from island to island, until the hazard moves away from the last island. These islands should be assessed collectively when deciding if they represent a period of materially increased public exposure. If there is an opportunity to initiate abort between periods of materially increased public exposure without increasing risk to uncontrolled areas, the regions of exposure should be assessed separately when deciding whether to protect them with conditional limits. While the above examples have all been represented geographically, conditional limits may be developed for other types of flight safety limits using the same approach.
13.9.5 Parameters Used for Flight Abort Decision.
In accordance with § 450.108(c)(3), abort action is taken at a conditional limit to prevent the vehicle from entering a period of materially increased public exposure in uncontrolled areas, including before orbital insertion, if a critical vehicle parameter is outside its pre-established expected range or indicates an inability to complete flight within the limits of a useful mission. Likewise, § 450.108(e) requires the equivalent verification of critical parameters prior to ending abort. Paragraph 9.4 of this AC discusses an acceptable means for selecting critical parameters and their associated values.
13.10 Validating Rules.
It is critical to validate the rules to satisfy § 450.108(f)(1) and (d)(6). There are two important validations.
input data and effect the abort in accordance with § 450.108(f)(1). To verify that the system can support the rules, if the abort decision is not on the vehicle, then the communication of an abort signal to the vehicle must be ensured. For telemetry data, the ability of the ground station to receive the data, including geometry considerations and atmospheric and plume attenuation effects should be accounted for.
• Second, although it is rarely an issue with modern measurement systems, it should be ensured that the uncertainty in the measurements does not pose an unacceptable possibility of rule violation for an acceptable useful mission. An unnecessary abort caused by measurement error would potentially violate § 450.108(d)(6).
• Each rule should be validated following a testing plan to ensure that their implementation within software or incorporation with hardware systems is functional. This testing should be repeated at various stages of development and 49
• First, the rules must be able to be implemented by the system used to obtain the
imple mentation to ensure that they remain functional as operations commence.
Testing of software should be performed in accordance with AC 450.141-1.
13.11 Verifying Risk Reduction.
This paragraph and its subparagraphs discuss two approaches to verifying that limits are not increasing risk, to meet § 450.108(d)(6): by inspection (i.e. when hazardous debris from abort at flight safety limits is contained with at least 97% confidence with respect to uncontrolled areas) and by numerical analysis (compare CEC of each failure trajectory with and without abort).
13.11.1 Verification by Inspection.
In many cases, it can be easily shown that flight safety limits do not increase risk, and in fact reduce risk. For most missions, most of the hazards from abort are contained to broad ocean or controlled areas. Except in the launch and landing area, this can be demonstrated by examination of the debris ellipses resulting from abort scenarios. If they are clearly separated from uncontrolled areas, then the risk is de minimis, and then risk has clearly not been increased. In some situations, a similar approach can be used, even if the debris ellipses slightly impinge on uncontrolled areas, when it is clear that risks would be increased (or at least cannot be reduced) if the safety limits were moved.
An example of this is near overflight of Bermuda from the Eastern Range. If the limit of a useful mission pass over the island, flight abort would increase risk if action were taken as soon as the vehicle departed from the limits of a useful mission. In this case, flight safety limits could be moved further away from the normal flight envelope without exposing additional uncontrolled areas. The figure below illustrates how the debris footprints can be confirmed to not touch the island after flight is aborted using flight safety limits that are designed to avoid abort over Bermuda. In this example, the margin between the island and the footprint is minimal, and could be improved with further edits to the flight safety limits.
Figure 13-9: Risk Reduction by Inspection
13.11.2 Verification by Numerical Analysis.
For other situations, a numerical analysis should be used to meet § 450.108(d)(6) because inspection is not conclusive. In this case, for each simulated failure trajectory used in the risk analysis, the risk with the abort system activating and with it failing should be compared. The conditional risk for each trajectory should be equal to or less than allowing flight to continue. If the abort has higher risk than continued flight, then the flight safety limits should be adjusted. If these cases are found, the process should return to at least paragraph 13.8, or if there is no solution with the flight abort rule set chosen, paragraph 13.5 of this AC.
13.12 Assessing Residual Risk.
The rules then should be incorporated into the flight safety analysis, where the limits are applied to all trajectories, and the residual risk computed. Residual risk is the risk that remains after all hazard controls have been accounted for in the flight safety analysis.
Accounting for flight abort includes accounting for the flight safety limits (paragraphs
13.8 and 13.10 of this AC), the reliability of the flight safety system (paragraph 10.5), and the outcome of the abort action (paragraph 10.2).
13.12.1 Compliance with Flight Safety Criteria.
There are several risk metrics that must be verified in accordance with § 450.115(a), using the flight safety analysis method appropriate to the determined level of fidelity:
including people in both controlled and uncontrolled areas, and both the general public and neighboring operations personnel,
• That the individual risk criteria in § 450.101(a)(2) or (b)(2) can be met through acceptable mitigations (such as keep-out areas), including people in both controlled and uncontrolled areas, and both the general public and neighboring operations personnel, and
• That critical assets are adequately protected, in accordance with § 450.101(a)(4) or
(b)(4).
mission, including debris (§ 450.135), far-field blast overpressure (§ 450.137), and toxic (§ 450.139) risk analyses. These analyses aggregate results from all phases of flight. If the risk criteria are not satisfied, the limits of a useful mission and/or flight safety limits may be modified, and the flight safety limits analysis described in this paragraph should then be performed again.
13.12.1.2 To ensure compliance wi th individual risk and aircraft risk requirements (§ 450.101(a)(2) and (3) or § 450.101(b)(2) and (3)), the development of flight hazard areas must also account for flight abort for each phase of flight where it is used in accordance with § 450.133(a)(2). If practical flight hazard areas cannot be developed such that these safety criteria are met, the limits of a useful mission and/or flight safety limits may be modified, and the flight safety limits analysis described in this paragraph should then be performed again.
13.12.2 High Consequence Event Protection.
In addition, for each phase of flight, the residual risk analysis must either demonstrate containment with a highly-reliable FSS in accordance with § 450.108(c)(6) or be in compliance with high consequence event protection requirements in accordance with § 450.108(c)(4), as discussed in paragraph 9.5 of this AC.
13.12.2.1 Containment.
To demonstrate containment for a phase of flight, the analysis must demonstrate that no flight abort or other event results in hazardous effects in uncontrolled areas, per § 450.108(c)(6). For phases including overflight of uncontrolled areas, this option cannot be used, as hazards cannot be contained. It may also be impossible in launch or landing areas, as containment may not be achieved. To demonstrate compliance with this approach, an analysis should compute hazard footprints for the worst-case breakup scenario. The hazard footprints should be computed for failure 52
• That the collective casualty expectation in § 450.101(a)(1) or (b)(1) is not exceeded,
13.12.1.1 These are accomplished by performing a flight safety analysis for the
trajectories that initiate at a maximum of one second intervals and approach flight safety limits at the most rapid pace (i.e. random attitude trajectories where the IIP trace is most perpendicular to an IIP-based flight safety limit). The state vector for the abort along each failure trajectory should be determined by considering the time the limit is violated plus the time delay of the FSS with a three-sigma uncertainty. If none of the polygons overlap uncontrolled areas, then the hazards are contained. If they do overlap, then the more sophisticated analysis in the following paragraph should be used.
13.12.2.2 Analysis.
If hazardous effects cannot be demonstrated to be contained, then prevention of high consequence events must be demonstrated through a conditional expected casualty analysis, in accordance with § 450.108(c)(4). For this, the first step is to compute the CEC in each significant period of flight where flight abort or flight outside the limits of a useful mission may be an outcome for each reasonably foreseeable offtrajectory failure mode. The CEC results from various end states, such as break-up due to aerodynamic loads or FSS activation, from flight abort and flight outside the limits of a useful mission should be averaged together to compute the mean CEC for each significant period of flight. In part 450, CEC only considers population in uncontrolled areas. The risks associated with a failure of the abort system (accounting for its failure probability) must be accounted for in the CEC analysis in accordance with § 450.108(d)(5). If the maximum CEC developed through this method is not greater than 1 × 10-2, then high consequence event protection is demonstrated. If this analysis does not demonstrate compliance with high consequence event protection, the limits of a useful mission and/or flight safety limits may be modified, and the flight safety limits analysis should then be updated accordingly.
13.13 Determining Durations of Acceptable Data Loss.
To determine the duration of acceptable data loss, the principles described in paragraph 10.3 of this AC need to be applied to the particular operation. This discussion first will apply to the situation where the flight abort decision system can identify whether the vehicle was within the normal envelope, on an unintended trajectory, or outside the limits of the useful mission. This is the preferred situation, as it leads to more informed decisions and provides more margin. Paragraph 13.14 of this AC discusses development of data loss flight times when the decision system does not know this information (e.g. some current autonomous systems). While a real-time footprint could also be used, that is outside the scope of this AC.
13.13.1 Outside the Limits of a Useful Mission.
The first rule regarding data loss is simple: if the vehicle is outside the limits of a useful mission (see AC 450.119-1) when data loss occurs, flight should be terminated, unless the hazard footprint of the vehicle is over a populated area.
13.13.2 Baseline Data Loss Durations.
The baseline situation is for vehicles that are within the normal trajectory envelope and the hazard footprint does not intersect an uncontrolled populated area. To compute durations of acceptable data loss, the same malfunction trajectories are generated as for the buffer analysis in paragraph 13.7 of this AC, where failure trajectories initiate from sample states within the normal trajectory envelope. Each trajectory is evaluated for when it either intersects a flight safety limit, leaves the limits of a useful mission (hereinafter called “boundary”), or has a hazard footprint intersecting a populated uncontrolled area. The applicant may choose which of these types of boundaries to use.
13.13.2.1 Trajectory Evaluation.
The trajectories are analyzed to determine when structural limits would be exceeded and when a boundary is reached. All trajectories where a structural limit is reached first are discarded. For each trajectory where this does not occur, the duration from the failure initiation to the time the flight safety limit is reached is calculated (as illustrated in Figure 13-10).
The trajectories are then grouped by time of failure (or another suitable independent parameter, such as down range distance at failure). For each group, the minimum duration is then the maximum allowable duration of data loss. Usually, the durations are simplified, both using constant values for intervals of failure initiation time (not linear interpolation) and truncating to whole seconds.