10 GROUND HAZARD ANALYSIS.
In accordance with § 450.185, the documented SSP must specify that, a GHA be performed, documented, and continually maintained throughout the life cycle of the launch or reentry system. A GHA should include an assessment of the launch or reentry vehicle, the launch or reentry integrated systems, ground support equipment, and other relevant site hardware and software. In its analysis, an applicant must identify hazards;
assess the associated risk; and document mitigations, controls, and provisions for hazard control validation and verification, in accordance with § 450.185.
Note: All regulated operators, including hybrid launch or reentry systems operators, need to prepare a ground hazard analysis to ensure public safety is protected. Hybrid launch or reentry vehicles may pose a risk to the public; therefore, the FAA also imposes these ground hazard analysis requirements on hybrid launch vehicles in order to identify and mitigate those risks.
10.1 Identifying Hazards.
The ground safety hazards referred to in a GHA generally result from:
• Ground and flight system hazards existing due to the current configuration or operationally induced [ref § 450.185(a)(1)]; and
• Operation hazards unique to ground processing at a launch and reentry site [ref § 450.185(a)(2)].
10.1.1 Identification and Decomposition of A ll System and Operation Failures.
Anal ysis and supplemental data routinely utilized to identify system failures and their causes include:
10.1.1.1 Functional Hazard Analysis for Flight System – A starting point for identifying flight system hazards is a functional hazard analysis. A functional hazard analysis is required for a flight system per § 450.107(b) and AC 450.107-1, Hazard Control Strategies Determination, provides guidance on conducting the analysis for phases of flight, which can be modified to account for ground phases. A functional hazard analysis is used to analyze system functions associated with the proposed operation.
The functional hazard analysis is primarily used to identify and classify the overall system functions and consequences of functional failure or malfunction. The objective is to identify all potential system, subsystem, and component functional failures that could impact public safety. It is important to note that the identification of potential system safety hazards and respective functional sources (i.e., subsystem functional failures) should not consider any foreseeable or predetermined mitigation.
10.1.1.2 Functional Hazard Analysis for Ground System – Similarly to a flight system, a starting point for identifying ground system hazards may utilize a functional hazard analysis. The guidance of AC 450.107-1, Hazard Control Strategies Determination, on conducting a functional hazard analysis for a flight system during phases of flight, can be modified to 13
account for identifying functional failures of a ground system during phases of ground operations.
10.1.1.3 Fault Tree Analysis (FTA) – A reliability engineering analysis that uses a logic diagram to identify and map causes of top-level events. Additionally, an FTA allows for: quantification of system failure probability, determination of fault tolerance, identification of common causes and single point failures, etc.
10.1.1.4 Failure Modes and Effects Analysis (FMEA) – A reliability engineering analysis used to identify low-level component failures and their causes and assess their effects on higher-level systems.
10.1.1.5 Human Error Analysis (HEA) – A systematic method of considering the possible errors and other human failures that may occur when performing a task.
10.1.2 Documenting a Ground Hazard Analysis.
GHAs are typically documented by identifying an assessing the hazards introduced by ground safety operational and support activities, systems, processes, and equipment similar to those outlined in Task 206, Operating and Support Hazard Analysis of MIL-STD 882. An example of how system requirement risks are mitigated and documented is found in Table A–1 System Safety Template of Appendix A. An O&SHA analyzes the processes and procedures of the entire operation while considering the source data discussed in the section above.
10.1.2.1 Thus, the O&SHA allows for detailing all ground safety hazards due to potential system functional failures and operation failures associated with ground operations involving ground and flight systems.
10.1.2.2 In accordance with § 450.185(a), the potential causes of all system and operation hazards should be identified as a precursor to apply mitigations to reduce or eliminate the ground safety hazards to the public and property. There will likely be multiple potential causes for each hazard.
Each potential cause of a hazard should be specified to a level of detail where it is possible to apply a mitigation and the required level of verification.
10.1.3 Hazard Traceability .
Traceability ensures proper identification of ground safety hazards to the public for § 450.185(a) and should be demonstrated from:
1. Subsystem functional failures and operator failures to their causes; and
2. Subsystem functional failures and operator failures to respective ground safety hazards to the public and property at the integrated system and operation level.
10.2 Hazard Assessment.
The severity and likelihood of each ground safety hazard to the public and property must be assessed, in accordance with § 450.185(b), in order to determine the associated ground safety risk. The characterization of each ground safety risk allows for determining the necessity, and proper application, of any additional mitigation actions.
10.2.1 Resources for Qualitative Assessment.
Suitable assessment severity categories and likelihood level criteria should be determined for each specific program to demonstrate compliance with § 450.185(b) and (c). The risk assessment with respect to ground safety hazards to the public and property will utilize qualitative statements. AC 450.103-1, System Safety Program, provides guidance on severity categories and likelihood levels in Table A-1 of Appendix A.
10.2.2 Utilizing a Systematic Assessment Process.
10.2.2.1 The FAA encourages, but does not require, an operator to utilize a systematic development process that allows for a baseline assessment of pre-mitigation risk for each hazard. It is common system safety practice to assess risk prior to the implementation of a mitigation in order to deliberately design a mitigation strategy for each hazard. Pre-mitigation risk assessment also facilitates greater traceability from hazard cause through mitigation and verification. The FAA recognizes that some operators will not utilize a pre-mitigation risk assessment as is common in rapid development and experimental programs. The FAA recommends that operators who choose not to utilize a pre-mitigation risk assessment strategy discuss the appropriateness of their development process and any risk assessment assumptions during pre-application consultation. This strategy may not be acceptable with all programs. Irrespective of the applicant’s development process, post-mitigation risk assessment is required to determine the residual risk to the public and property posed during licensed ground operations to demonstrate compliance with § 450.185(c).
10.2.2.2 Additionally to ensure proper mitigatio n of system safety hazards to the public for § 450.185(d), risk assessment should be performed at the appropriate levels, primarily the: (1) subsystem and operator level; and (2) integrated system and operation level. Risk assessment at these levels allows for greater insight into the effectiveness of mitigations and verifications specific to each cause of each failure resulting in a ground safety hazard to the public and property and appropriate application of subsystem, integrated system and operation mitigations and verifications.
10.2.3 Risk Assessment Traceability .
Traceability ensures proper assessment for § 450.185(b) and should be demonstrated from the subsystem and operator level risk assessment to the integrated system and operation level risk assessment.
10.3 Risk Acceptability Criteria.
10.3.1 Developing Risk Acceptance Criteria.
Risk acceptance is determined by comparison of final assessed ground safety risk against established acceptance criteria. Suitable risk acceptance criteria must be determined for each specific program and documented in the SSP utilizing the guidance of AC 450.103-1, System Safety Program. To ensure proper acceptance of risks associated with ground safety hazards to the public for § 450.185(c), the associated residual risk should meet the established acceptance criteria and the rationale for acceptance should be documented.
10.3.2 Baseline of Risk Acceptability.
In accordance with § 450.185(c), the FAA considers the baseline standard for risk acceptability or ground safety hazards to the public and property to be the following:
• The likelihood of any hazardous condition that may cause death or serious injury to the public must be extremely remote.
Note: As documented in AC 450.103-1, System Safety Program, extremely remote should be considered “so unlikely, it can be assumed occurrence may not be experienced, with a likelihood of occurrence less than 10-6 in any one mission.”
• The likelihood of any hazardous condition that may cause major property damage to the public not associated with the launch or reentry, must be remote.
Note: As documented in AC 450.103-1, System Safety Program, remote is considered “unlikely but possible to occur in the life of an item, with a likelihood of occurrence less than 10-5 but greater than 10-6 in any one mission.”
Note: The standards for risk acceptability are intentionally strict to ensure protection of the public. Sufficient mitigation to control the hazard should be demonstrated.
10.4 Risk Mitigation.
Risk elimination or mitigation measures must be identified and fully described to reduce the risk to an acceptable level as required by § 450.185(d).
10.4.1 Proper Risk Mitigation Process.
Mitigating risk does not change severity of the hazard, only the likelihood. If there is a change in severity, it should be documented as a new risk. For example, a fill/drain valve mechanical failure may have a high probability of significant leakage resulting in a toxic release. The hazard risk was determined to have a consequence of “Catastrophic” and a likelihood of “Occasional.” That valve was replaced with a more reliable valve as a mitigation. The mitigation is determined to change the likelihood to “Extremely Remote,” but the new valve cannot impact the consequence of the failure, which remains “Catastrophic.”
10.5 Considerations for Risk Mitigation Measures.
Consideration should be given as to whether proposed risk mitigation measures introduce new hazards. To allow flexibility, the FAA has not mandated any particular mitigation approach. Selection of a risk elimination or mitigation measure is usually based on a number of factors, such as the type of operation, feasibility of implementation, effectiveness, and impact on system performance. Where possible, the FAA expects the utilization of existing industry standards for mitigations.
10.5.1 Risk Mitigation Traceability .
Traceability ensures proper application of mitigations for § 450.185(d) and should be demonstrated from:
1. Subsystem and operator failures to their causes to respective mitigations;
2. Subsystem and operator failures to respective ground safety hazards to the public and property at the integrated system and operation level;
3. Subsystem and operator level risk assessment to integrated system and operation level risk assessment; and
4. Ground safety hazards to the public and property at the integrated system and operation level to their respective mitigations.
10.5.2 System Safety Design Order of Precedence.
In order to mitigate risk from system safety hazards to the public, an operator should follow a process using a systematic order of precedence. An applicant may follow the “System Safety Design Order of Precedence” documented in MIL-STD-882.
10.6 Validation and Verification.
Risk mitigations of ground safety hazards to the public and property applied at various levels (subsystem, operator, integrated system, or operation) must be validated and verified as required by § 450.185(e).
10.6.1 Validating Risk Mitigations.
The validation process evaluates that each mitigation measure and respective verification is well understood and operationally and technically feasible. In accordance with § 450.185(e), validation evidence must be documented and it must demonstrate that the risk elimination and mitigation measures achieve the risk acceptability criteria defined in paragraph § 450.185(c). This documented evidence [e.g., Validation and Verification (V&V) Tracking Log] must be provided to the FAA in accordance with § 450.185(f)(3).
Validation determines whether the implemented mitigation measures and respective verifications are sound. To do this, the validation effort ensures that each mitigation and verification is unambiguous, correct, complete, and consistent.
10.6.2 Verifying Risk Mitigations.
Verification is the process of identifying and producing verifiable and measurable evidence for ensuring that the respective mitigation measures adequately support the documented reduction of ground safety risk to the public and property. Where possible, 17
the FAA expects verification of mitigation measures utilizing existing industry standards.
Essential information for verification includes:
• Identification of specific method(s) used to verify the mitigation measure,
• Identification of specific evidence to be produced, and
• Indication of closure based on successful completion of specified method with production of adequate, verifiable, and measurable evidence.
10.6.2.1 Verification Artifacts.
Per § 450.185(e), verification evidence must be documented and demonstrate that the risk elimination and mitigation measures achieve the risk level of paragraph § 450.185(c). This documented evidence (e.g., design analyses, test data, inspection reports) must be provided to the FAA in accordance with § 450.185(f)(3). Ideally, all mitigation measures should be validated and verified by the time of application submittal. The FAA recognizes that applicants may not have the ability to verify all mitigations prior to submission of an application. In those instances, an acceptable verification closure strategy should be documented with expected completion dates (which must be closed prior to licensed operation pursuant to any relevant terms and conditions of the license). This strategy should be provided to the FAA with adequate time to review the closure status of verification evidence prior to the initiation of the applicable licensed activity.
10.6.2.2 Verification Traceability.
Traceability ensures proper application of verifications for § 450.185(e) and should be demonstrated from:
1. Subsystem and operator failures to their causes to respective mitigations to adequate verifications;
2. Subsystem and operator failures to respective ground safety hazards to the public and property at the integrated system and operation level;
3. Subsystem and operator level risk assessment to integrated system and operation level risk assessment; and
4. Ground safety hazards to the public and property at the integrated system and operation level to their respective mitigations to adequate verifications.
10.6.2.3 Verification Methods.
The FAA encourages discussion on proposed verification methods early in the licensing process. Four acceptable methods of verifying safety measures include:
• Analysis – Technical or mathematical evaluation, mathematical models, simulations, algorithms, and circuit diagrams.
• Component, subsystem, or system test – Actual operation to evaluate performance of system elements during ambient conditions or in operational environments at or above expected levels to measure safety margins. These tests include functional tests and environmental tests.
• Demonstration – Actual operation of the system or subsystem under specified scenarios, often used to verify reliability, transportability, maintainability, serviceability, and human engineering factors.
• Inspection – Physical examination of hardware, software, or documentation to verify compliance of the feature with predetermined criteria.
10.6.3 I terative Approach of Validation and Verification.
The V&V process is a comprehensive, closed-looped, iterative process to be used in all phases of the lifecycle of a launch or reentry system. Any mitigation that fails V&V cannot be relied on for elimination or reduction of ground safety risks to the public and property.
10.7 Identifying New Hazards and Updating the Ground Hazard Analysis.
Data gained during design, manufacture, test, and operation, including the discovery of anomalies and faults, usually impacts a GHA. Necessary data should be identified, and approaches should be implemented, to detect anomalies and failures in order to improve the GHA. Additionally, information gained during assembly and operation of components, subsystems, and next-level systems contributes to the further understanding of the overall integrated system and operation and may lead to additional updates to the GHA. A process should be implemented to update the GHA and final ground safety risk assessment to reflect knowledge gained during the life of the integrated system and operation.
11 TOXIC HAZARDS MITIGATION FOR GROUND OPERATIONS.
In accordance with § 450.187(a)(1), ground safety hazards to the public associated with the use of toxic propellants or other toxic chemical must be mitigated. In accordance with § 450.187, an operator must: conduct a TRHA per § 450.187(c); manage the risk of casualties that could arise from the exposure to a toxic release, either per toxic containment of § 450.187(d) or per toxic risk assessment of § 450.187(e); and establish ground hazard controls based on the results of its TRHA and toxic containment or toxic risk assessment, per § 450.187(b)(3). Section 11 of AC 450.139-1, Toxic Release Hazard Analysis, provides additional guidance specific to mitigating toxic hazards during licensed ground operations.
12 GROUND SAFETY PRESCRIBED HAZARD CONTROLS.
12.1 General.
In addition to an operator’s specific hazard controls derived by an operator’s GHA and TRHA, an operator must comply with § 450.189(b) through (e). Implementation of the following prescribed hazard controls should be verified and validated to demonstrate compliance with § 450.189(b) through (e).
12.2 Protection of Public on the Site.
An operator is required to document how it protects members of the public who enter areas that are under their control, in accordance with § 450.189(b).
12.2.1 Limiting Access.
In order to protect the public, the operator should be cognizant of all members of the public who enter an area under the operator’s control. In accordance with § 450.189(b), the operator must document, distribute, and adhere to an acceptable process to protect members of the public from ground safety hazards. The public access control (no entry, limited entry, etc.) should be coordinated with security, other site coordinators, management, and any other potential areas of concern. An applicant must submit the process for protecting members of the public who enter any area under the control of a launch or reentry operator in accordance with § 450.189(f). The process to protect the public should include at a minimum:
1. Access requirements (including approvals required),
2. Sign In/Sign Out documentation (POC, location, duration, etc.),
3. Required escorting,
4. Definition of applicable clear zones,
5. Required personnel protection equipment (PPE) (ear plugs, mask, hard hat, steel toed shoes, etc.), and
6. Advise the public on site of the potential hazards.
12.2.2 Notification.
The process should also document the public’s notification of the applicable policies, procedures, and hazard controls required for entry into the operator’s area. This includes the following:
1. Safety Briefing (including hazard areas/clear zones),
2. Emergency phone numbers and procedures,
3. Departing or evacuating (e.g ., during emergencies, launch aborts, mishaps, etc.), and
4. Violation policy/reprimands.
12.3 Countdown Abort.
The GHA should consider and assess a launch countdown abort or recycle operation. In accordance with § 450.189(c), procedures to be performed must be established, maintained throughout the life cycle, and validated to ensure the control of ground safety hazards to the public and property and to return the integrated system and site facilities to a safe condition after a countdown abort or delay in launch. Thus, the known safe state for the integrated system and the launch site must be defined in the event of a countdown abort or recycle operation. There may be several procedures required depending on the phase of the integrated system operation at the time the event occurs. Specifically, in accordance with § 450.189(a) through (c), the procedures must:
1. Ensure the vehicle and payload are in a safe configuration;
2. Prohibit entry of the public into any identified hazard areas until the site is returned to a safe condition; and
3. Maintain and verify that any flight safety system remains operational until verification that the launch vehicle does not represent a risk of inadvertent flight.
The timing of safing the flight safety system should be fed directly into the timeline for return to safe condition state and determining an “all clear.”
12.4 Fire Suppression.
In accordance with § 450.189(d), the operator must have in place reasonable precautions for reporting and controlling any fires. Reporting procedures for a fire should be defined, and documented, as well as coordinated with the site operator. Reasonable precautions include: documentation of emergency fire phone number, fire suppression devices, evacuation procedures, notification to nearby facilities, and isolation measures if available. Meeting industry standards and fire codes are expected.
Note: Fire suppression chemicals should be assessed in the TRHA.
12.5 Emergency Procedures.
In accordance with § 450.189(e), applicant must have general emergency procedures to protect the public and property that are not covered by a § 450.173 mishap plan.
Emergency procedures should exist for a fire event, a toxic release event, and any other event that may create a hazard to the public, including weather conditions and any unique emergency procedures identified by the GHA and TRHA.
12.5.1 Mishap reporting, response, and investigation requirements are documented in § 450.173.
Additional information for mishap reporting can be found in AC 450.173-1, Mishap Reporting, Response, and Investigation.
13 APPLICATION REQUIREMENTS.
If required by § 450.179, an applicant must provide documentation and data, as outlined in §§ 450.181(c), 450.183(b), 450.185(f), 450.187(f), and 450.189(f).
Appendix A A.1 SYSTEM SAFETY TEMPLATE FOR § 450.185 GROUND HAZARD ANALYSIS.
Table A-1 conveys the types of data that should be provided by an acceptable system safety analysis, including a method for traceability between all aspects of ground safety hazards to the public and property. It is intended as a guide to show what information should be provided within a GHA. It also shows how logical tracking for each item can be used to show the relationships between the different pieces of information. A hazard analysis format conveying the information of Table A-1, such as similar tables or traditional worksheets, should be utilized.
Table A-1: System Safety Template for § 450.185 Ground Hazard Analysis Integrated System and Operation Level1 Verification Evidence1 H1.M1.V1 – Documented evidence specific to H1.M1 mitigation H1.M1.V2, and so on… H1.M2.V1, and so on… H2.M1.V1 – Documented evidence specific to H2.M1 mitigation H2.M1.V2, and so on… H2.M2.V1, and so on… H3.M1.V1 – and so on… Risk After Mitigation Measures1 R TBD S TBD L TBD Risk Elimination / Mitigation Measures1 H1.M1 - Specific to mitigation of H1 [Clear areas, operational restrictions, etc…] H1.M2, and so on… H2.M1 - Specific to mitigation of H2 [Clear areas, operational restrictions, etc…] H2.M2, and so on… H3.M1 -a n d s o o n … Hazard to Public1 H1 Fire/Explosion H2 Toxic Release H3, and so on… Subsystem and Operator Level Verification Evidence C1.M1.V1 – Documented evidence specific to performed C1.M1 mitigation C1.M1.V2, and so on… C1.M2.V1, and so on… C2.M1.V1 – Documented evidence specific to performed C2.M1 mitigation C2.M1.V2, and so on… C2.M2.V1, and so on… C3.M1.V1 – and so on… C1.M1.V1 – Documented evidence specific to performed C1.M1 mitigation C1.M1.V2, and so on… C1.M2.V1, and so on… C2.M1.V1 – Documented evidence specific to performed C2.M1 mitigation C2.M1.V2, and so on… C2.M2.V1, and so on… C3.M1.V1 – and so on… Risk After Mitigation Measures
R TBD TBD
S TBD TBD
L TBD TBD Risk Elimination / Mitigation Measures C1.M1 – Specific to mitigation of C1 [design, test, manufacturing process, etc.] C1.M2, and so on… C2.M1 – Specific to mitigation of C2 [design, test, manufacturing process, etc.] C2.M2, and so on… C3.M1 – and so on C1.M1 – Specific to mitigation of C1 [design, procedures, training etc.] C1.M2, and so on C2.M1 – Specific to mitigation of C2 [design, procedures, training etc.] C2.M2, and so on… C3.M1 – and so on Risk Before Mitigation Measures
R TBD TBD
S TBD TBD L Initial or no data Initial or no data Possible Cause(s) C1 TBD C2 TBD C3, and so on… C1 TBD C2 TBD C3, and so on… IDs Functional Failure ID;
Fault Tree ID Human Error Assessment ID;
Fault Tree ID Component(s) / Item(s) Local Processor N/A Failure Description and End Effect Fuel Servicing Ground Support Equipment[Function TBD] during [Operations Phase(s) TBD] fails [Failure TBD], possibly resulting in fire/ explosion [End Effect TBD] [Basic Event TBD] during [Operations Phase(s) TBD] possibly results in fire/ explosion [Top-Level TBD] Subsystem Fuel Servicing Ground Support Equipment Human Systems Integration Operation [Fuel Servicing - TBD] Next-Level pe ratio n [Pad Servic ing - TBD] Top-Lev el O NOTES:
1 – “Integrated System and Operation Level” may be captured as shown or in a separate table or spreadsheet with traceability to “ Subsystem and Operator Level” 2 – “C1.M1.V1” is only an example. Key is to demonstrate traceability by a suitable method 3 – L = Likelihood; S = Severity; R = Risk 4 – Typically within system safety and ground safety, Likelihood (L) = Probability (P); Severity (S) = Consequence (C); L & S = R A-1
OMB Control Number: 2120-0746 (Expiration Date: 08/31/2023) Advisory Circular Feedback Form Paperwork Reduction Act Burden Statement: A federal agency may not conduct or sponsor, and a person is not required to respond to, nor shall a person be subject to a penalty for failure to comply with a collection of information subject to the requirements of the Paperwork Reduction Act unless that collection of information displays a currently valid OMB Control Number. The OMB Control Number for this information collection is 2120-0746. Public reporting for this collection of information is estimated to be approximately 5 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. All responses to this collection of information are voluntary to obtain or retain benefits per 14 CFR 77. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to: Information Collection Clearance Officer, Federal Aviation Administration, 10101 Hillwood Parkway, Fort Worth, TX 76177-1524.
If you find an error in this AC, have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by (1) emailing this form to ASTApplications@faa.gov, or (2) faxing it to (202) 267-5450.
Subject: (insert AC title/number here) Date: Click here to enter text.
Please check all appropriate line items:
□ An error (procedural or typographical) has been noted in paragraph Click here to enter text.
on page Click here to enter text..
□ Recommend paragraph Click here to enter text. on page Click here to enter text. be changed as follows:
Click he re to enter text.
□ In a future change to this AC, please cover the following subject:
(Briefly describe what you want added.)
Click here to enter text.
□ Other comments:
Clic k here to enter text.
□ I would like to discuss the above. Please contact me.
Submitte d by: Date:
FAA Form 1320-73 (06-2020)