C AdvisoryU.S. Department of Transportation Federal Aviation Circular Administration Subject: Flight Abort Rule Development Date: July 27, 2021 AC No: 450.108-1 Initiated By: AST-1 This Advisory Circular (AC) provides guidance for demonstrating compliance with the use of flight abort as a hazard control strategy for the flight, or phase of flight, of a launch vehicle to meet the safety criteria of Title 14 of the Code of Federal Regulations (14 CFR) 450.101 and
405.108.
This AC describes an accepted means of compliance for complying with the regulatory requirements of § 450.108. It presents one, but not the only, acceptable means for demonstrating compliance with the associated regulatory requirements. This AC assists applicants with meeting the requirements associated with developing a flight abort hazard control strategy. This AC also provides guidance for an operator that chooses to propose its own means of compliance with the requirements in § 450.108. The contents of this document do not have the force and effect of law and are not meant to bind the public in any way. The document is intended only to provide clarity to the public regarding existing requirements under the law or agency policies.
If you have suggestions for improving this AC, you may use the Advisory Circular Feedback form at the end of this AC.
WAYNE R MONTEITH Digitally signed by WAYNE R MONTEITH Date: 2021.07.27 14:05:15 -04'00' Wayne R. Monteith Associate Administrator Commercial Space Transportation
Contents Paragraph Page
1 Purpose1
2 Applicability1
3 Applicable Regulations and Related Guidance Documents2
4 Definition of Terms4
5 Acronyms5
6 Introduction6
6.1 Overview6
6.2 Footprints6
6.2.1 Debris Footprint6
6.2.2 Hazard Footprint6
6.2.3 Confidence of Containment7
6.2.4 Example7
7 Flight Abort Applicability9
7.1 Use of Flight Abort as a Hazard Control Strategy9
7.2 Focus on Protecting the Public10
7.3 Clarity of Flight Abort Rules10
8 Flight Safety System Requirements11
8.1 Highly-reliable Flight Safety System (FSS)11
8.2 Safety-critical FSS11
8.3 FSS Requirements11
9 Flight Safety Limits Objectives12
9.1 Introduction12
9.2 Compliance with Risk Requirements12
9.3 Prevent Incr eased Risk13
9.4 Prevent Anomalous Flight over Populated Areas13
9.4.1 Materially Incr eased Exposure13
9.4.2 Selecting Appropriate Critical Vehicle Parameters14
9.5 Preventing High Consequence Events15
9.6 Abort Prior to Failure of Flight Safety System (FSS)16
9.7 Containment Alternative16
ii
Contents (continued) Paragraph Page
10 Flight Safety Limits Constraints17
10.1 Extent of Flight Safety Limits Analysis17
10.2 Consideration of Hazards17
10.2.1 Debris Dispersion17
10.3 Considering Data Loss18
10.3.1 Background18
10.3.2 Partial Data Loss19
10.3.3 Core Principles19
10.4 Consideration of Time Delay20
10.4.1 Hardware Delays20
10.4.2 Software Delays20
10.4.3 Communication Delays21
10.4.4 Safety Officer Decision Duration21
10.4.5 Pilot Abort Action Duration21
10.5 Consideration of FSS Reliability21
10.6 Abort Should Never Increase Risk22
10.6.1 Best Practice For Flight Safety Limit Locations22
10.6.2 Selecting Lowest Risk Alternative22
10.7 Risk on any Useful Mission Trajectory22
10.7.1 Variety of Trajectories23
10.7.2 Risk Evaluation23
11 End of Flight Abort24
11.1 Key Flight Safety Events24
11.2 Material Decrease in Risk of High Consequence Events24
11.3 Evaluation of Critical Parameters24
12 Flight Abort Rules24
12.1 Data Availability25
12.2 When Flight Abort Must Occur25
12.2.1 Implementing Flight Safety Limits25
12.2.2 When Flight Safety System nears Incapacitance25
iii
Contents (continued) Paragraph Page
12.2.3 Invalid Track Data25
13 Flight Safety Limits Means of Compliance26
13.1 Trajectory Envelope27
13.1.1 Trajectories That Characterize Variability27
13.2 Trajectory Envelope Evaluation27
13.2.1 Trajectory Selection28
13.2.2 Failure Probability Allocation28
13.3 Evaluating Ending Flight Abort29
13.3.1 Determining When Abort Can Be Ended29
13.3.2 Establishing a Conditional Limit30
13.4 Acceptable Envelope Definition30
13.4.1 African Overflight Example30
13.4.2 Hazard Footprints and Debris Footprints30
13.4.3 Potential for Hazards in Uncontrolled Areas31
13.4.4 Categorizing State Vectors31
13.5 Identify Potential Flight Safety Limit Types31
13.5.1 Flight Abort Rule Types31
13.5.2 Vehicle Health Based Rules32
13.5.3 Vehicle State Vector Guidelines32
13.5.4 Most Common Flight Safety Limit Types32
13.5.5 Less Common Flight Safety Limit Types33
13.5.6 Flight Safety Limits Constraints33
13.5.7 Flight Safety Limit Types not addressed in this AC33
13.6 Determining Abort System Latency34
13.7 Buffer Development34
13.7.1 Malfunction Trajectories34
13.7.2 Determining Minimum Buffer34
13.7.3 Determining Maximum Buffer35
13.8 Defining the Quantitative Parameters of the Flight Safety Limits35
13.8.1 Four Types of Trajectory State Vectors36
iv
Contents (continued) Paragraph Page
13.8.2 Three Sets of State Vectors36
13.8.3 State Vectors Projected onto Planes36
13.8.4 Establishing Flight Safety Limits from State Vector Projections40
13.8.5 Maximum Altitude40
13.8.6 Minimum Altitude40
13.8.7 Fixed IIP Limit41
13.8.8 Moving IIP Limit41
13.8.9 Azimuth Limit41
13.8.10 Flight Path Angle Limit42
13.8.11 Skyscreen42
13.9 Conditiona l Limits43
13.9.1 Placement of Conditional Limits43
13.9.2 Extents of Conditional Limits44
13.9.3 Fundamental Geometries of Conditional Limits44
13.9.4 Multiple Conditional Limits49
13.9.5 Parameters Used for Flight Abort Decision49
13.10 Validating Rules49
13.11 Verifying Risk Reduction50
13.11.1 Verification by Inspection50
13.11.2 Verification by Numerical Analysis51
13.12 Assessing Residual Risk51
13.12.1 Compliance with Flight Safety Criteria52
13.12.2 High Consequence Event Protection52
13.13 Determining Durations of Acceptable Data Loss53
13.13.1 Outside the Limits of a Useful Mission53
13.13.2 Baseline Data Loss Durations54
13.13.3 Durations during Overflight of Populated Areas55
13.13.4 Durations When Data Loss Occurs on Unintended Trajectory56
13.13.5 Durations When Envelopes Are Not Known57
13.13.6 Extending the Durations58
v
Contents (continued) Paragraph Page
14 Application Requirements59
14.1 Document Compliance with Flight Safety Limits Objectives and Constraints59
14.2 Document each Flight Safety Limit and Flight Abort Rule59
14.3 Document Critical Parameters59
14.4 Graphic Depiction of Flight Safety Limits59
14.5 Document Ve hicle Data60
Figures Number Page
Figure 6-1 Comparison of Sigma Levels to Confidence Example7
Figure 6-2 Debris Footprint Example8
Figure 6-3 Hazard Footprint Example9
Figure 13-1 Projected points in the Normal Trajectory Range37
Figure 13-2 Projected points in the Range of Useful Missions38
Figure 13-3 Projected points for Failure Trajectories, Launch Area39
Figure 13-4 Projected points for Failure Trajectories, Downrange39
Figure 13-5 Example of head-on Conditional Limit45
Figure 13-6 Example of Conditional Limit Around an Island46
Figure 13-7 Conditional Limit Region around Uncontrolled Area47
Figure 13-8 Mixed Conditional Limits48
Figure 13-9 Risk Reduction by Inspection51
Figure 13-10 Data Loss Calculation for Normal Envelope55
Figure 13-11 Data Loss Calculation for Unintended Flight Regions57
Figure 13-12 Data Loss Calculation when Envelopes Are Not Known57
vi
1 P URPOSE.
This advisory circular (AC) provides guidance and a comprehensive method to demonstrate compliance with the requirements for the flight abort hazard control strategy in § 450.108, Flight Abort. Flight abort is one of the hazard control strategies identified in § 450.107.
1.1 Level of Imperatives.
This AC presents one, but not the only, acceptable means of compliance with the associated regulatory requirements. The FAA will consider other means of compliance that an applicant may elect to present. Throughout this document, the word “must” characterizes statements that directly flow from regulatory text and therefore reflect regulatory mandates. The word “should” describes a requirement if electing to use this means of compliance; variation from these requirements is possible, but must be justified and approved as an alternative means of compliance. The word “may” describes variations or alternatives allowed within the accepted means of compliance set forth in this AC. In general, these alternative approaches can be used only under certain situations that do not compromise safety.
2 APPLICABILITY.
2.1 The guidance in this AC is for launch and reentry vehicle applicants and operators required to comply with 14 CFR part 450. The guidance in this AC is for those seeking a launch or reentry vehicle operator license, and a licensed operator seeking to renew or modify an existing vehicle operator license.
2.2 The material in this AC is advisory in nature and does not constitute a regulation. This guidance is not legally binding in its own right, and will not be relied upon by the FAA as a separate basis for affirmative enforcement action or other administrative penalty.
Conformity with this guidance document (as distinct from existing statutes and regulations) is voluntary only, and nonconformity will not affect rights and obligations under existing statutes and regulations. This AC describes acceptable means, but not the only means, for demonstrating compliance with the applicable regulations.
2.3 The material in this AC does not change or create any additional regulatory requirements, nor does it authorize changes to, or deviations from, existing regulatory requirements.
3.1
3.2 APPLICABLE REGULATIONS AND RELATED GUIDANCE DOCUMENTS.
Related U.S.C. Statute.
• 51 U.S.C. Subtitle V, Chapter 509.
Related FAA Commercial Space Transportation Regulations.
The following regulations from title 14 of the CFR must be accounted for when showing compliance with § 450.108. You can download the full text of these regulations from the U.S. Government Printing Office e-CFR or order a paper copy from the Government Printing Office, Superintendent of Documents, Attn: New Orders, PO Box 371954, Pittsburgh, PA, 15250-7954.
• Section 450.101, Safety Criteria.
• Section 450.107, Hazard Control Strategies.
• Section 450.113, Flight Safety Analysis Requirements.
• Section 450.115, Flight Safety Analysis Methods.
• Section 450.117, Trajectory Analysis for Normal Flight.
• Section 450.119, Trajectory Analysis for Malfunction Flight.
• Section 450.121, Debris Analysis.
• Section 450.123, Population Exposure Analysis.
• Section 450.131, Probability of Failure Analysis.
• Section 450.135, Debris Risk Analysis.
• Section 450.137, Far-field Overpressure Blast Effects.
• Section 450.139, Toxic Hazards for Flight.
• Section 450.143, Safety-Critical System Design, Test, and Documentation.
• Section 450.145, Highly-Reliable Flight Safety System.
3.3 Related FAA Advisory Circulars.
• AC 450.101-1A, High Consequence Event Protection, Revision A, dated May 20, 2021.
• AC 450.109-1, Flight Hazard Analysis, when published.
• AC 450-113-1, Flight Safety Analysis: Levels of Fidelity, when published.
• AC 450.115-1A, High Fidelity Flight Safety Analysis, Revision A, dated June 24, 2021.
• AC 450.115-2, Medium Fidelity Flight Safety Analysis, when published.
• AC 450.117-1, Trajectory Analysis, when published.
• AC 450.123-1, Population Exposure Analysis, when published.
• AC 450.131-1, Probability of Failure Analysis, when published.
• AC 450.123-1, Far-field Overpressure Blast Effects Analysis, when published.
• AC 450.139-1, Toxic Hazards for Flight, when published.
• AC 450.143-1, Safety-Critical System Design, Test, and Documentation, when published.
3.4 Do cuments Related to Subject AC.
• Range Commanders Council (RCC) 319 Flight Termination Systems Commonality Standard, June 2019, https://www.wsmr.arm
y.mil/RCCsite/Documents/319- 19_FTS_Commonality/319-19_FTS_Commonality.pdf.
• Ricketson, Tom, P. D. Wilde, and E. Larson, Proposed Flight Abort Criteria to Ensure Public Safety during Commercial Launch and Reentry Operations, 10th International Association for the Advancement of Space Safety Conference, Los Angeles, California, May 2019.
• Range Commanders Council (RCC) 321-20 Common Risk Criteria Standards For National Test Ranges, May 2020, https://www.wsmr.arm
y.mil/RCCsite/Documents/321- 20_Common_Risk_Criteria_Test_Ranges/321- 20_Common_Risk_Criteria_Test_Ranges.pdf.
• Range Commanders Council (RCC) 321-20 Common Risk Criteria Standards for National Test Ranges: Supplement, May 2020, https://www.wsmr.arm
y.mil/RCCsite/Documents/321- 20_Common_Risk_Criteria_Supplement/321-20_Supplement.pdf.
• Joint Advanced Range Safety System Algorithm Document, Millennium Engineering and Integration Company.
• CASS Steering Committee, Software Design Description (SDD) for the Core Autonomous Safety Software (CASS), USSF 30SW/SEAE, Vandenberg Space Force Base, CA.
4 DEFINITION OF TERMS.
For this AC, the following terms and definitions apply:
4.1 Conditional Limit A flight safety limit through which a vehicle may fly, unless a critical vehicle parameter is outside its pre-established expected range or indicates an inability to complete flight within the limits of a useful mission.
4.2 Debris Footprint A geographic region containing, with at least 97% confidence, all the hazardous debris impacts resulting from an event. See paragraph 6.2 of this AC for further explanation.
4.3 Hazard Footprint A debris footprint extended to include at least the region where the probability of casualty exceeds 1% from any impact included in the footprint, conditional on each impact, considering all hazards.
4.4 Residual Risk The risk that remains after all hazard controls are accounted for in the flight safety analysis.
4.5 State Vector A set comprised, at minimum, of the three-component position and three-component velocity associated with a point in time along a vehicle’s trajectory. A state vector may also include vehicle mass, thrust, orientation, angular velocity, and other parameters.
4.6 Unintended Trajectory A trajectory outside the normal trajectory envelope but within the limits of a useful mission.
5 ACRONYMS.
• AC – Advisory Circular
• AFSS – Autonomous Flight Safety System
• CEC – Conditional Expected Casualties
• DADL – Duration of Acceptable Data Loss
• DLFT – Data Loss Flight Time
• FFBO – Far-Field Blast Overpressure
• FSL – Flight Safety Limit
• FSS – Flight Safety System
• GPS – Global Positioning System
• IIP – Instantaneous Impact Point
• RCC – Range Commanders Council
• U.S.C. – United States Code 5
6 INTRODUCTION.
6.1 Overview.
This AC provides guidance for a launch operator to develop flight safety limits and flight abort rules for launch of a space vehicle. It provides further explanation of the requirements in § 450.108(a) through (f), in chapters 7 through 12 of this AC.
Chapter 13 contains a description of an acceptable procedure for a means of compliance that meets the regulations, organized as a series of steps in an analysis. Chapter 14 contains further explanation of the application requirements in § 450.108(g).
6.2 Footprints.
6.2.1 Debris Footprint.
Per paragraph 4.2, a debris footprint is a geographic region containing, with at least 97% confidence, all the hazardous debris impacts resulting from an event.
6.2.1.1 An event is the outcome of a breakup, where the uncertainties that are considered are those that exist at the time of the breakup event. It is probabilistic because there is uncertainty in the vehicle state vector due to measurement uncertainty, the fragmentation resulting from the breakup and associated physical properties of the debris, the environmental conditions, modeling approximations, and numerical simulation limitations.
6.2.1.2 There are several important aspects to understand when considering the footprint. First, this definition means ALL impacts from every fragment group should be contained for 97% of realizations of the event. Addition of more fragments or fragment groups always expands the region. This is a much higher threshold than simply containing 97% of impacts for every event. The debris footprint includes ALL fragment groups, bounding all the distributions.
6.2.2 Hazard Footprint.
Per paragraph 4.3, a hazard footprint is: A debris footprint extended to include the at least the region where the probability of casualty exceeds 1% from any impact included in the footprint (conditional on each impact), considering all hazards. This effectively means the debris footprint is expanded to include area surrounding the fragment impact where a casualty is possible. This casualty radius incorporates the extent of the area affected, such as due to bounce and roll of an inert fragment or the blast wave from an explosive fragment. There is uncertainty in the consequence modeling due to impact conditions, modeling approximations, and human response. For inert debris, energy for hazards at the surface of the Earth, 11 ft-lbf of impact kinetic may be used for the 1% threshold, and, for aircraft, one gram may be used.