Failure Trajectory tvataLoss = tviol - tinit Figure 13-10: Data Loss Calculation for Normal Envelope
13.13.2.2 Cannot Reach Terminate Lines.
If the vehicle is approaching a conditional limit and there are no flight safety limits after the conditional limit, data loss flight abort limits should not be used once the vehicle reaches a point where the time to the conditional limit is less than the time required to reach a flight safety limit.
13.13.2.3 Comparison to Expected Data Loss.
These data loss durations should be compared to the anticipated data loss scenarios while a flight is otherwise normal. An example of this situation is reacquisition of GPS signal, but other demonstrated data loss scenarios could also apply. Since it is higher risk to abort flight than allow normal flight to continue, abort should not occur unless there is reasonable likelihood that a failure has occurred. Thus, evidence of expected data loss should be examined, and the abort duration should be no less than the 99% confidence of the duration for which data should have been restored. If the duration is not within this limit, then the approach to developing data loss durations could be refined, the flight safety limits adjusted, and/or the mission adjusted.
13.13.3 Durations during Overflight of Populated Areas.
If the planned mission features overflight of populated uncontrolled areas, and subsequently exits this situation where abort is still used as hazard mitigation, there are additional considerations. This is because the consequence of aborting a vehicle that has not failed, except for data loss, to uncontrolled areas is higher than allowing continued flight. Abort is still usually an appropriate safety mitigation however, if the vehicle has deviated from normal flight and propellant has not been dispersed. The determination of how long to allow a vehicle to continue to fly in this situation is then based on when a vehicle was expected to complete the overflight. If it has not completed overflight within the time that was within the range of a useful mission, then the vehicle can be 55
presumed to have failed during this time. Since the vehicle’s position may have significant uncertainty, it is not known whether continued flight will reduce risk relative to flight abort in a given situation. However, when abort reduces consequences (e.g.
casualty area), as it normally does, the average risk of all data loss scenarios is reduced by taking abort action.
Note: In order to determine the acceptable duration of data loss, if the overflight resulted in materially increased exposure, an operator should use the conditional limit regions developed per paragraph 13.9 of this AC. In this case, the duration of acceptable data loss while a vehicle is inside a conditional limit region should be equal to the maximum expected time of exiting the region minus the current flight time, plus a few seconds of buffer, unless this is shorter than the values determined in the paragraphs below. If the overflight of uncontrolled populated areas does not materially increase exposure, then regions equivalent to the conditional limit regions should be determined in order to determine the duration of acceptable data loss.
13.13.4 Durations When Data Loss Occurs on Unintended Trajectory.
When data is lost after a vehicle has departed the normal envelope but remains within the limits of a useful mission, the analysis should take into account that the vehicle could now reach flight safety limits more quickly than if it were within the nominal envelope. An applicant should choose to use either a simple approach or to perform an analysis to determine data loss times as a function of location. The simple approach is to set the data loss duration to be the duration over which signal reacquisition is expected take place if it is lost (normally one second or less). The more complex approach expands on the baseline method described above. In this case, regions are defined at progressively further distances from the normal trajectory envelope, out to the boundary. Each failure trajectory is then analyzed for when it exits each region, as illustrated in Figure 13-11. For each region, the trajectories are then grouped by the time they exit the region. For each group, the minimum duration is the maximum allowable duration of data loss for that region for that time interval. In the region closest to the boundary, the duration is the signal reacquisition time.
Nominal Trajectory & Normal Env~-1-~:-_:::::·,:> , , , , ,,---::::·::::::,- , ,," ,,"' ,,"' ,,,."' ~,,,-' Flight Safety Limit Populated Area Failure Trajectory tDataLoss = tviol - tFSL 07/27/2021 AC 450.108-1 Figure 13-11: Data Loss Calculation for Unintended Flight Regions
13.13.5 Durations When Envelopes Are Not Known For systems that do not have the capability to determine if the vehicle is within the normal envelope or the limits of a useful mission when data is lost, additional consideration is needed. In this case, the locations of the flight safety limits and populated areas are important. Because the vehicle could be anywhere inside the flight safety limits when data is lost, the duration of allowed data limits should be the minimum time from the vehicle could travel from a limit to populated area, as illustrated in Figure 13-12. In order to obtain reasonable data loss durations, the flight safety limits may need to be adjusted to provide more standoff from populated areas.
Figure 13-12: Data Loss Calculation when Envelopes Are Not Known 57
13.13.6 Extending the Durations.
There are certain situations where an appropriate risk reduction strategy is to have longer durations of acceptable data loss. Both of these require more extensive risk analysis to demonstrate that risk criteria are met and the lowest risk approach has been chosen.
13.13.6.1 The first occurs due to the distribution of the exposed public. One situation is when there is significant risk to the public within the limits of a useful mission, but then a large region with little to no population. In this case, since the abort location is not known when there is data loss, it is likely higher risk to abort inside the region of a useful mission than to have the vehicle potentially fly further and abort in an area with little to no population.
13.13.6.2 It may be possible in some scenarios to extend the data loss durations based on assessment of the trajectories that are first to produce areas of predicted casualty, rather than the trajectories that are first to reach flight safety limits or the limits of useful mission. This is a more exhaustive analysis, but would result in longer durations.
14 APPLICATION REQUIREMENTS.
14.1 Document Compliance with Flight Safety Limits Objectives and Constraints.
In order to comply with § 450.108(g)(1), a description of the methods used to comply with § 450.108(c) is required, to include descriptions of how each analysis constraint in § 450.108(d) is satisfied in accordance with § 450.115. Chapter 13 of this AC provides a template for a means of compliance for this. The applicant should indicate which paragraphs from chapter 13 of this AC were used with no modifications, and where deviations were made. Where deviations were made, the applicant should describe the process used with at least the level of detail contained in chapter 13 of this AC. Specific examples for a representative mission should be provided to demonstrate compliance.
14.2 Document each Flight Safety Limit and Flight Abort Rule.
For § 450.108(g)(2), the applicant should provide a list of flight safety limits and abort rules, and associated quantitative criteria and critical parameters. Each limit should define the parameters that are obtained from sensors, and the actual parameters that are evaluated. For example, sensors commonly provide position and velocity in three components in an Earth-centered inertial frame in metric units. An actual evaluation might be that the vacuum impact point (VacIP) on the surface of the earth is contained in a polygon defined by a series of geodetic vertices connected by great circles.
References for the algorithms used to translate from the sensor data to VacIP and for the polygon evaluation should then be provided. This qualifies as a full description of the evaluation and implementation of that particular flight safety limit. A similar precise specification for other limits should also be provided.
14.3 Document Critical Parameters.
Likewise, for § 450.108(g)(2), the list of critical parameters used to evaluate a vehicle prior to entering a period of increased exposure, corresponding to § 450.108(c)(3), or ending flight abort, corresponding to § 450.108(e), must be provided, along with identification of how these ranges of values are identified. This identification should include the rationale for why each parameter is helpful for assessing the vehicle, and indicate if parameters described in this AC for this purpose were not selected and why.
The description should provide evidence for how these ranges of values are identified.
An example analysis of the determination of the expected range of critical parameters should be provided to demonstrate compliance. This should be based on a representative mission, including corresponding data and graphics to clearly illustrate the range of parameters.
14.4 Graphic Depiction of Flight Safety Limits.
For § 450.108(g)(3), the applicant must provide graphical depiction(s) of flight safety limits with relevant context as specified in that requirement. This must be provided as part of the application for a representative mission and should be consistent with the submission of trajectory data in § 450.117(d)(4). There must be a graphical depiction in the projection of each flight safety limit. For example, IIP-based limits should be shown on a map that shows the vertices of the limits and the segments between them. The segments should be shown as they are actually evaluated (great circles, straight lines on 59
a particula r projection, etc.). This map should include uncontrolled areas that are relevant, as well as the IIP traces of the nominal trajectory, extents of normal flight and limits of a useful mission.
• A Cartesian plot should be used for many other parameters where the limit is defined by two variables. For example, to depict a range vs. altitude limit, a plot with axes of range and altitude in the units of the evaluation should be provided. It is not possible to show uncontrolled areas on this projection, but the launch point, the nominal trajectory, and the extent of normal trajectories and the limits of useful mission must be shown. An applicant may show both maximum and minimum limits on the same set of depictions.
• Usually depictions at different scales are necessary to show the limits in sufficient detail—all vertices of limits should be visually identifiable on at least one depiction.
Labels of the vertices or a corresponding data table for each limit should be provided as well.
14.5 Docu ment Vehicle Data.
For § 450.108(g)(4), a description of the vehicle data that will be available to evaluate flight rules under all reasonably foreseeable conditions during normal and malfunctioning flight must be provided. These correspond to the sensor data discussed above to comply with § 450.108(g)(2), but in addition the conditions under which the data are available to the flight safety system must be specified. This is particularly important for ground-based flight safety systems where data may be available for only portions of flight.
OMB Control Number: 2120-0746 (Expiration Date: 08/31/2021)
FAA Form 1320-73 (06-2020)
Advisory Circular Feedback Form
If you find an error in this AC, have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by (1) emailing this form to ASTApplications@faa.gov, or (2) faxing it to (202) 267-5450.
Subject: (insert AC title/number here) Date: Click here to enter text.
Please check all appropriate line items:
An error (procedural or typographical) has been noted in paragraph Click here to enter text.
on page Click here to enter text..
Recommend paragraph Click here to enter text. on page Click here to enter text. be changed as follows:
Click here to enter text.
In a future change to this AC, please cover the following subject:
(Briefly describe what you want added.)
Click here to enter text.
Other comments:
Click here to enter text.
I would like to discuss the above. Please contact me.
Submitted by: Date:
Paperwork Reduction Act Burden Statement: A federal agency may not conduct or sponsor, and a person is not required to respond to, nor shall a person be subject to a penalty for failure to comply with a collection of information subject to the requirements of the Paperwork Reduction Act unless that collection of information displays a currently valid OMB Control Number. The OMB Control Number for this information collection is 2120-0746. Public reporting for this collection of information is estimated to be approximately 5 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completin g and reviewing the collection of information. All responses to this collection of information are voluntary to obtain or retain benefits per 14 CFR 77. Send comments regarding this burden estimate or any other aspect of this collection of information, inc luding suggestions for reducing this burden to: Information Collection Clearance Officer, Federal Aviation Administration, 10101 Hillwood Parkway, Fort Worth, TX 76177-1524.