4 DEFINITION OF TERMS.
For this AC, the terms and definitions from § 401.7, and this list, apply:
4.1 Event Scenario A specific failure of a vehicle defined by its failure response mode and breakup list.
4.2 Failure Mode A failure mode is a category of potentially hazardous events that share significant similarity in system response, prior to consideration of mitigations or hazard control strategies.
4.3 Fragment Class A fragment or set of fragments with similar characteristics that is defined by a representative fragment and the number of fragments it represents.
4.4 Hazard Any real or potential condition that could cause injury, illness, or death of people; or damage to or loss of equipment, or property.
4.5 Hazardous Debris Any object or substance capable of causing a casualty or loss of functionality to a critical asset. Hazardous debris includes inert debris and explosive debris such as an intact vehicle, vehicle fragments, any detached vehicle component whether intact or in fragments, payload, and any planned jettison bodies.
4.6 Intact A vehicle or any detached motor or engine that is substantially intact during ballistic flight, even though there may be some missing pieces.
4.7 Malfunction Turn Failures Events that can lead to the vehicle deviating outside of its normal trajectory bounds including all behavior ranging from gradual turns to rapid turns.
4.8 Mission The launch or reentry vehicle description and its intended operation, the flight profile, the flight safety system, and the flight abort rules under which the operation will be conducted.
4.9 Monte Carlo Simulation A simulation in which random statistical sampling techniques are employed to determine estimates for unknown values. Monte Carlo methods include computational algorithms that, for example, repeatedly sample from probability distributions that characterize input parameters (such as the weight, thrust, and drag of a vehicle) and perform physics-based simulations to obtain numerical results (such as a set of trajectories that characterize flight under normal or malfunction conditions).
4.10 Statistically Valid A “statistically valid” analysis is the result of a sound application of mathematics and accounts for the uncertainty in any statistical inference due to sample size limits, the degree of applicability of data to a particular system, and the degree of homogeneity of the data. The specific approach to establish statistical validity depends on the context of the particular analysis, as described in this AC and others.
4.11 Uncertainty The absence of perfectly detailed knowledge of input to the risk analysis models, but not in the definition of the models. Uncertainty includes incertitude (the exact value is unknown) and variability (the value is changing). Uncertainty may also include other forms such as vagueness, ambiguity, and fuzziness (in the sense of border-line cases).
5 ACRONYMS.
AC – Advisory Circular AFB – Air Force Base CAD – Computer Aided Design CAS – Cylindrical Annulus Sector CF – Continuum Flow CFR – Code of Federal Regulations COSPAR – Committee on Space Research DFO – Distant Focusing Overpressure DOF – Degree of Freedom FAA – Federal Aviation Administration FMF – Free Molecular Flow FSA – Flight Safety Analysis FSS – Flight Safety System FTS – Flight Termination System GAR – Glass-to-Area Ratio GFS – Global Forecast System GI - Gastrointestinal GPS – Global Positioning System HD – Hazard Division IIP – Instantaneous Impact Point KDE – Kernel Density Estimation LHA – Land Hazard Area NAM – North American Mesoscale NOAA – National Oceanic and Atmospheric Administration NOTAMs – Notices to Airmen NOTMARs – Notices to Mariners OMB – Office of Management and Budget PAVM – Probabilistic Aircraft Vulnerability Models SRM – Solid Rocket Motor TNT – Trinitrotoluene 9
6 OVERVIEW.
In accordance with § 450.115(a), an operator’s flight safety analysis method must account for all reasonably foreseeable events and failures of safety-critical systems during nominal and non-nominal launch or reentry that could jeopardize public safety.
AC 450.113-1 can be used to determine the level of fidelity for flight safety analysis.
Once an operator has determined that a high fidelity flight safety analysis is required, the method in paragraph 6.1 of this AC can be used.
6.1 High-fidelity Flight Safety Analysis Method.
6.1.1 The first step in performing a high-fidelity flight safety analysis is to collect existing relevant input, and define and create input unique to the high-fidelity analysis. Input should include the following:
• Mission information identified in paragraph 7.1 of this AC.
• A probability of failure analysis that must be performed to comply with § 450.131;
see AC 450.131-1 Probability of Failure Analysis.
• All vehicle normal and malfunction trajectories as specified in §§ 450.117 and
450.119; see AC 450.117-1 Trajectory Analysis and AC 450.119-1 High Fidelity Malfunction Trajectory Analyis.
• The flight abort rules required by § 450.108; see AC 450.108-1 Flight Abort Rule Development.
• The vehicle break-up limits that are required by § 450.121(d)(2).
6.1.2 The second step is to identify hazards and hazard producing events. The operator should apply the flight abort rules and vehicle break-up limits to the normal and malfunction trajectories to obtain a set of failure events, in accordance with the requirements of § 450.108(f). These failure events, and all planned events, should be specified by state vectors that are defined by mean time of failure, position and velocity at the failure event point, and the probability of the failure occurring. An operator should follow the hazard identification analysis of paragraph 7.2 of this AC.
6.1.3 The third step is to develop a debris list, in accordance with the debris analysis requirements of § 450.121(a) and (b), which has two parts:
1. Characterization of the hazardous debris resulting from a hazard producing event using chapter 7 of this AC.
2. Quantitative description of the hazardous debris in terms of aerodynamic and harmful characteristics using chapter 8 of this AC.
6.1.4 The fourth step is to perform a risk analysis that computes individual risk, collective risk, risk to aircraft, and risk to any critical assets. Computing risk can be an iterative process if the computed risk exceeds the risk thresholds of § 450.101 and then additional mitigations are identified. To compute risk, an operator should perform the following steps:
1. Propagate the hazardous debris to impact to comply with § 450.121(c) using the procedure in chapter 9 of this AC.
2. Calculate a probability of impact distribution in accordance with § 450.117(a)(1) using chapter 10 of this AC.
3. Determine the population exposure to hazards resulting from hazard producing events using the consequence modeling approach of chapter 11 of this AC.
4. Compute risk using chapter 12 of this AC.
6.1.5 The fifth step is to use the results of the risk analysis to define flight hazard areas using chapter 13 of this AC. The operator should provide information to construct:
• Waterborne vessel hazard areas, i.e., Notices to Mariners (NOTMARs) in accordance with § 450.133(b),
• Land hazard areas in accordance with § 450.133(c), and
• Airspace hazard volumes, i.e., Notices to Airmen (NOTAMs), to comply with § 450.133(d) requirements.
6.1.6 The sixth step is to document all previous steps to comply with § 450.113(a).
7 MISSION DEFINITION AND HAZARD IDENTIFICATION.
For the flight safety analysis discussion, the term “mission” is defined to include the launch or reentry vehicle description, the flight profile, the flight safety system, and the flight abort rules under which the operation will be conducted. The hazard control strategy determination involves the description of all functional failures associated with reasonably foreseeable hazardous events that have the capability to create a hazard to the public, in accordance with the functional failure analysis required by § 450.107(b)(1). These hazardous events should be described in terms of the type of vehicle breakup. A discussion of types of vehicle breakups appears in paragraph 8.1 of this AC. When an operator uses flight hazard analysis as a hazard control strategy, a flight hazard analysis must identify, describe, and analyze all reasonably foreseeable hazards to public safety resulting from the flight of a launch or reentry vehicle, in accordance with § 450.109(b). The following subparagraphs address the factors and requirements for defining a mission, and the approach for identifying hazardous events that could create hazardous debris.
7.1 Mission Description.
Prior to the start of a flight safety analysis, several aspects of the mission should be described a manner that conveys an understanding of the launch or reentry vehicle, its performance, and its potential modes of failure. The objective and details of the mission must be identified in accordance with §§ 450.41(e)(4), 450.117, and 450.213(b). The flight safety analysis is constrained by a set of flight abort rules, if an operator is using this hazard control strategy, when flight abort is used in accordance with § 450.108 as a hazard control strategy for the flight or phase of flight of a launch or reentry vehicle to meet the safety criteria of § 450.101. In accordance with § 450.108(f), the mission description must include all flight abort rules and the specific steps that will be followed to implement a flight abort.
7.1.1 Defining the Vehicle/System.
Details of the vehicle configuration must be documented in accordance with § 450.45(e)(3), including all vehicle systems, such as structural, thermal, pneumatic, etc. In accordance with § 450.167, this also includes instrumentation used to track the position and velocity of the vehicle. Such instrumentation can include telemetry, GPS receivers, and transponders, as well as the associated tracking rates, and the accuracy of these data.
7.1.1.1 Vehicle Propellants.
In accordance with § 450.45(e)(3)(i) all propellants must be described, including their type, quantity, and the characteristics of these propellants.
It may be appropriate to include propellant mass and density, rate of burning – at both operating pressures and ambient pressures, propellant shape within the motor for solid propellants, and previous flight history including potential variations in the thrust (average, maximum, and minimum) as part of the propellant identification required by § 450.45(e)(3)(i). The state of the vehicle and the accounting for all 12
propellants should be specified by its mass properties as a function of flight time.
7.1.1.2 Sources of Hazardous Debris and Trajectory Analysis for Malfunction Flight.
The actions of the guidance and control systems that affect a vehicle’s performance and responses must be quantified if those parameters meet the condition set in accordance with § 450.119(b)(3). This quantification should include details of the thrust vector control actions, attitude control thrusters, aerodynamic surfaces or fins. In accordance with § 450.119(a), the vehicle deviation capability in the event of a malfunction must be identified. This should be defined in terms of velocity turn data or malfunction turn trajectories, and should include turning capability over a range of thrust offsets and/or aerodynamic surface displacements, including the maximum values of these parameters. As applicable, turn data for failures such as nozzle burn through, solid rocket motor (SRM) case burn through, or structural failure of an aerodynamic surface should be included. For additional detail regarding trajectory analysis, refer to AC 450.117-1, Normal Trajectory Analysis and AC 450.119-1, High- Fidelity Malfunction Trajectory Analysis.
7.1.2 Defining the Mission Scenario.
To perform a high-fidelity flight safety analysis, it is necessary to define a launch or reentry mission in sufficient detail to meet §§ 450.41(e)(4), 450.117, and 450.213(b).
This includes the mission objectives, a description of the launch or reentry vehicle, a description of the intended vehicle flight profile and potential variations, and identification of the locations and regions that will be affected by a normal mission.
7.1.2.1 Launch and Reentry Mission Activities.
Launch begins when hazardous pre-flight operations commence at a U.S.
launch site that may pose a threat to the public. Hazardous pre-flight operations that may pose a threat to the public include pressurizing or loading of propellants into the vehicle, operations involving a fueled launch vehicle, the transfer of energy necessary to initiate flight, or any hazardous activity preparing the vehicle for flight. Hazardous pre-flight operations do not include the period between the end of the previous launch and launch vehicle reuse, when the vehicle is in a safe and dormant state, in accordance with § 450.3(b). A reentry mission includes activities conducted in Earth orbit or outer space to determine reentry readiness and that are critical to ensuring public health and safety and the safety of property during reentry flight. Reentry also includes activities necessary to return the reentry vehicle, or vehicle component, to a safe condition on the ground after impact or landing, in accordance with § 450.3(c).
7.1.2.2 Mission Objectives and Constraints.
An applicant must define the primary mission objectives and constraints in accordance with § 450.213(b). This includes a thorough description of the payload or reentry vehicle; including the class and function, physical dimensions and weight, payload owner and operator, intended payload operations during its lifetime, amounts and types of hazardous and radioactive materials in the payload, and the explosive potential of materials in the payload. For an orbital mission, mission objectives should also include the range of intermediate and final orbits of each vehicle upper stage and payload, and estimated orbital lifetimes, including the parameters defining parking, transfer and final orbits, approximate transit times to final orbit, and designated reentry site(s) for each object to be deorbited.
7.1.2.3 Mission-specific Description.
In accordance with § 450.45(e)(3) must provide a written description of the vehicle or family of vehicles, which should include the model, type, configuration, and characteristics of the launch vehicle, or family of vehicles, proposed for launch or reentry. In accordance with § 450.45(e)(3), this written description includes, but is not limited to structural, thermal, pneumatic, propulsion, electrical, and avionics and guidance systems used in each vehicle, and all propellants. The description must include a table specifying the type and quantities of all hazardous materials on each vehicle and must include propellants, explosives, and toxic materials. For pressurized tanks and motors, it should include data specifying pressure versus flight time. For all periods of thrust, the description should include thrust versus flight time, with relevant uncertainties, and nozzle inlet, throat and exit areas. In accordance with § 450.45(e)(3) the vehicle description must include drawings that identify each stage, including strap-on motors; physical dimensions, which should include enough lengths, widths, thicknesses, angles of curvature to produce a fully dimensioned outer-mold line and relevant material response to external loads; location of all safety-critical systems; location of all major vehicle control systems, propulsion systems, pressure vessels, and any other hardware that contains potential hazardous energy or hazardous material. In accordance with § 450.117(d)(2), the applicant must submit quantitative input data, including uncertainties, sufficient to model the vehicle’s normal flight in 6 degrees-of-freedom, which includes mass properties such as the nominal center of gravity and moments of inertia versus flight time with relevant uncertainties. In accordance with § 450.121(d)(2), the applicant must submit a description of the methods used to perform the vehicle impact and breakup analysis, which should include the vehicle’s structural limits. For an unguided suborbital launch vehicle, the description should identify the location of the center of pressure in relation to its center of gravity for the entire flight profile. For a guided launch vehicle, the description must include a complete set of 14
relevant aerodynamic coefficients, including uncertainties, sufficient to describe a 6 degree-of-freedom simulation for normal flight in accordance with § 450.117(d)(2).
7.1.2.4 Intended Vehicle Flight Profile and Potential Variations.
For each proposed vehicle flight profile, the flight azimuths, trajectories, associated ground tracks and instantaneous impact points must be defined for the duration of the licensed activity, including any contingency abort profiles, in accordance with § 450.41(e)(4). To comply with § 450.117(a), the trajectory data must include the nominal trajectory as well as sets of trajectories sufficient to characterize variability in accordance with § 450.117(a)(1) and uncertainty in accordance with § 450.117(a)(2) during normal flight. Variability should describe how the intended trajectory could vary due to conditions known prior to initiation of flight.
Uncertainty should describe how the actual trajectory could differ from the intended trajectory due to random uncertainties in all parameters with a significant influence on the vehicle’s behavior throughout normal flight.
7.1.2.5 Trajectory Analysis Outputs and Abort Flight Profiles.
The trajectory data should provide a fuel exhaustion trajectory that produces instantaneous impact points with the greatest range for any given time after liftoff for any stage that has the potential to impact the Earth.
Vehicles using flight abort as a hazard control strategy require trajectory data or parameters that describe the limits of a useful mission in accordance with § 450.119(a)(3). Also, any contingency abort flight profiles should be defined. The trajectory analysis outputs required by § 450.117(d) should include the position, velocity, and vacuum instantaneous impact point for each second of flight, and the planned sequence of events or maneuvers during flight.
7.1.2.6 Flight Mission Limits.
Under § 450.119(c)(4)(iii), the description must also provide the trajectory data that characterize the limits of a useful mission, i.e., one that can attain one or more mission objectives. This should include specification of the worst wind conditions under which flight might be attempted, and a description of how the operator will evaluate the wind conditions and uncertainty in the wind conditions prior to initiating the operation.
7.1.2.7 Wind Weighting.
For an unguided suborbital launch vehicle, under § 450.111(b), the wind weighting safety system must describe how the launcher azimuth and elevation settings will be wind weighted to correct for the effects of wind conditions at the time of flight to provide a safe impact location.
7.1.2.8 Affected Locations and Regions.
The launch or reentry site should be defined, including any contingency abort locations. This includes the boundaries of the launch and landing (or impact) point locations for all mission hardware, including latitude and longitude, as well as identification of any facilities at the sites that will be used for pre- or post-flight ground operations. For all launch, reentry, or disposal sites, this should include all regions of sea, land, or air that contain, with 97 percent probability of containment, all hazardous debris resulting from normal flight events capable of causing a casualty, in accordance with §§ 450.133(b)(1), (c)(1), and (d)(1). Also, all areas of land that could be overflown by a normal mission, including variations and uncertainty in the trajectory, must be depicted in accordance with § 450.108(g)(3) whenever flight abort is used as a hazard control strategy.
7.1.3 Defining Flight Safety Systems.
In accordance with § 450.119(b)(4), a high-fidelity flight safety analysis must account for the potential for failure of a flight safety system (FSS), if any. An FSS may be required to control, contain, or mitigate hazards to satisfy the flight safety criteria of § 450.101. In accordance with § 450.101(c)(1), an operator can protect against a high consequence event in uncontrolled areas for each phase of flight by using flight abort as a hazard control strategy with an FSS that meets the requirements of § 450.108 if any reasonably foreseeable failure response mode could result in conditional expected casualties for uncontrolled areas, as defined in § 401.7, that exceed 1 x 10-2 .
7.1.3.1 Mitigating Risk of a Flight Safety System.
The FSS may need to be used for each stage of flight that poses a hazard in accordance with § 450.108(a), and its response should be correlated with the nature of the abort and the hazards to be mitigated. The FSS may result in termination of vehicle thrust by cutting the flow of propellants, resulting in a landing or other non-destructive outcomes. This is usually the case for pilot initiation of the FSS. Alternately, it may be a destruct system that terminates thrust using charges to cut open the propellant tanks and disperse liquid propellants or to depressurize solid propellant motors, which will likely result in the breakup of the vehicle and potentially yield an explosion.
7.1.3.2 Use of a Time Delay Analysis.
The design of the FSS must include a time delay analysis, in accordance with § 450.108(d)(4). This analysis should establish the mean and uncertainty distribution for the elapsed time between the violation of a flight abort rule and the time when the flight safety system is capable of aborting flight for use in establishing flight safety limits. Considerations for the FSS design should include whether it is activated by remote command, e.g., a Missile Flight Control Officer (including a pilot), triggered by a premature separation system such as lanyard pull, or automatically triggered by an on-board autonomous flight safety system.
7.2 Identifying Hazards and Hazard Producing Events.
In accordance with § 450.107(b), an operator must identify all functional failures associated with reasonably foreseeable hazardous events that have the capability to create a hazard to the public. This should include evaluating the hazards from hazardous debris if an undesirable situation occurs during flight, and quantification of the subsequent risk to people and assets. Following the identification of the hazardous debris hazard producing events, a thorough review should be performed to confirm that all events have been identified and that these events are reasonable and foreseeable for the specific launch or reentry vehicle and mission plan.
7.2.1 Vehicle Impact and Breakup Analysis.
The hazardous debris generating hazardous events must include the potential for structural breakup of the vehicle pursuant to § 450.121(b), which can include explosive events that occur during a malfunction due to aerodynamic, inertial, and heating loads acting on the vehicle. Destruct breakup of the vehicle resulting from activation of the flight safety system due to violation of a mission flight abort rule should also be considered under § 450.121(b). Potential events that could result in vehicle breakup while following a normal trajectory include: an explosion, rupture of a motor case or other pressure vessel, SRM burn-through, or structural failure due to loads (thrust, aerodynamic, inertial). Events that could lead to a vehicle deviating outside of its normal trajectory bounds are referred to as malfunction turn failures and include all behavior ranging from gradual turns to rapid turns resulting in a tumbling vehicle. They may also include gravity turns wherein the vehicle attitude is controlled to maintain a zero or near zero angle of attack.
7.2.2 Failed Vehicle Event Hazards.
Potential hazards from failed vehicle events should be identified. This includes inadvertent separation between stages of a vehicle or of a strap-on SRM. This should be addressed during normal flight and during a vehicle malfunction. The analysis should consider if any motors or engines can fail to ignite during staging or fail to shut down at the planned event times.
7.2.3 Planned Jettisoned Hazardous Debris.
In accordance with § 450.109(b), if an operator is conducting a flight hazard analysis for this phase of flight, all reasonably foreseeable hazards to public safety for a planned mission must be identified. This can include planned jettisoned hazardous debris such as discarded stages, inter-stage hardware, hardware ejected prior to igniting a stage such as nozzle closures, support struts or rings, payload fairing pieces, and (for a sub-orbital launch) the payload. It can also include a planned intercept of the launch vehicle or vehicle payload with another launch vehicle or its payload.
7.3 Hazard Management to Minimize Public Risk.
The ideal way to manage risk and minimize the hazards in the region of a launch or reentry is to conduct the operation in a remote area. In that case, hazards can be isolated and risks to the public can be minimized or possibly eliminated. However, complete containment of hazards generated by even a suborbital vehicle is usually not possible, because populated areas tend to encroach on even the most remote sites, and areas at risk become too large to accommodate reasonable surveillance and access control measures. In these situations, a flight safety system often becomes necessary in accordance with § 450.108(c)(6) to protect the public from the potential hazards associated with a launch or reentry activity. A flight safety system may be destructive or non-destructive. A traditional flight safety system designed to terminate a vehicle’s thrust and disperse its remaining propellants, resulting in falling vehicle breakup that results in inert fragments, is an example of a destructive system. Non-destructive flight safety systems include abort systems designed to render a vehicle non-propulsive, leading to potential recovery of an intact vehicle or its components. In either case, hazards to the public may still exist.
7.3.1 Risk Management of High Risk Areas.
Risk management often includes the evacuation of people from high risk areas or the sheltering of people to minimize their exposure to the hazards. This includes the development of hazard areas (or corridors) from which pedestrian, motorized vehicle, train, waterborne vessel, and/or aircraft traffic are cleared.
7.3.2 Minimizing Risk using Timing and Scheduling of Mission.
Another method often used to manage risk is to limit occurrence of a mission to a time when the risks are low. This includes restricting a mission to be initiated during favorable meteorological conditions during which dispersions of hazards will not reach populated areas, or the likelihood of causing casualties is sufficiently low to meet risk acceptance criteria. It also may include restrictions to specified times during the day or days of the week when population exposure is minimized.
7.3.3 Minimizing Risk by Modifying the Mission Profile.
If the risk to the public or critical assets cannot be mitigated by containment of the hazards, or sheltering of people, the operator should modify the mission profile.
Modifications to the mission profile can include: