# Licensing and Safety Requirements for Launch

> Briefs, arguments, decisions, and more.

URL: https://www.frixlaw.com/law-library/documents/fr%3A00-24472

## Record

- **Collection:** Federal Register
- **Document type:** Proposed Rule
- **Published:** October 25, 2000
- **Citation:** 65 FR 63922

## Text

DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration
14 CFR Parts 413, 415, and 417
[Docket No. FAA-2000 ; Notice No. 00-10]
RIN 2120-AG37
Licensing and Safety Requirements for Launch

AGENCY:

Federal Aviation Administration (FAA), DOT.

ACTION:

Notice of proposed rulemaking (NPRM).

SUMMARY:

The Associate Administrator for Commercial Space Transportation of the Federal Aviation Administration (FAA), Department of Transportation (DOT), is proposing to amend the FAA's commercial space transportation regulations. The FAA proposes to amend its regulations to codify its license application process for launch from a non-federal launch site. A non-federal launch site is a launch site not located on a federal launch range. The proposed regulations are also intended to codify the safety requirements for launch operators regarding license requirements, criteria, and responsibilities in order to protect the public from the hazards of launch for launch from a federal launch range or a non-federal launch site.

DATES:

Send your comments on or before February 22, 2001.

ADDRESSES:

Address your comments to the Docket Management System, U.S. Department of Transportation, Room Plaza 401, 400 Seventh Street, SW., Washington, DC 20590-0001. You must identify the docket number FAA-2000-7953 at the beginning of your comments, and you should submit two copies of your comments. If you wish to receive confirmation that FAA received your comments, include a self-addressed, stamped postcard. You may submit and review comments through the Internet at http://dms.dot.gov. You may review the public docket containing comments to these proposed regulations in person in the Dockets Office between 9:00 a.m. and 5:00 p.m., Monday through Friday, except Federal holidays. The Dockets Office is on the plaza level of the NASSIF Building at the Department of Transportation at the above address.

FOR FURTHER INFORMATION CONTACT:

Michael Dook, Licensing and Safety Division (AST-200), Associate Administrator for Commercial Space Transportation, Federal Aviation Administration, DOT, Room 331, 800 Independence Avenue, SW., Washington, DC 20591; telephone (202) 267-8462; or Laura Montgomery, Office of the Chief Counsel (AGC-200), Federal Aviation Administration, DOT, Room 915, 800 Independence Avenue, SW., Washington, DC 20591; telephone (202) 267-3150.

SUPPLEMENTARY INFORMATION:

Comments Invited

Interested persons are invited to participate in the making of the proposed action by submitting such written data, views, or arguments as they may desire. Comments relating to the environmental, energy, federalism, or economic impact that might result from adopting the proposals in this document also are invited. Substantive comments should be accompanied by cost estimates. Comments must identify the regulatory docket or notice number and be submitted in duplicate to the DOT Rules Docket address specified above.

All comments received, as well as a report summarizing each substantive public contact with FAA personnel concerning this proposed rulemaking, will be filed in the docket. The docket is available for public inspection before and after the comment closing date.

The Administrator will consider all comments received on or before the closing date before taking action on this proposed rulemaking. Late-filed comments will be considered to the extent practicable, and consistent with statutory deadlines. The proposals in this document may be changed in light of the comments received.

Commenters wishing the FAA to acknowledge receipt of their comments submitted in response to this document must include a pre-addressed, stamped postcard with those comments on which the following statement is made: “Comments to Docket No. FAA-2000-7953.” The postcard will be date stamped and mailed to the commenter.

Availability of Rulemaking Documents

You can get an electronic copy using the Internet by taking the following steps:

(1) Go to the search function of the Department of Transportation's electronic Docket Management System (DMS) Web page (http://dms.dot.gov/search).

(2) On the search page type in the last four digits of the Docket number shown at the beginning of this notice. Click on “search.”

(3) On the next page, which contains the Docket summary information for the Docket you selected, click on the document number of the item you wish to view.

You can also get an electronic copy using the Internet through FAA's web page at http://www.faa.gov/avr/arm/nprm/nprm.htm or the
Federal Register's
web page at http://www.access.gpo.gov/su_docs/aces/aces140.html.

You can also get a copy by submitting a request to the Federal Aviation Administration, Office of Rulemaking, ARM-1, 800 Independence Avenue SW., Washington, DC 20591, or by calling (202) 267-9680. Make sure to identify the docket number, notice number, or amendment number of this rulemaking.

I. Introduction

By this notice of proposed rulemaking, the FAA proposes licensing and safety requirements for the conduct of a launch. The proposed requirements for obtaining a license would apply to a launch operator planning to launch from a non-federal launch site. A non-federal launch site is a launch site that is not located at a federal launch range. The proposed regulations for obtaining a license would not, however, apply to any launch from a non-federal launch site where a federal launch range performs the safety functions. For such a launch, the licensing requirements of 14 CFR part 415, subpart C applies. The proposed regulations are also intended to codify the safety requirements that a launch operator must satisfy to protect the public from the hazards of launch. The safety requirements contained in this proposed regulation apply to all licensed launches of expendable launch vehicles whether from a federal launch range or a non-federal launch site. This notice provides information regarding the criteria for obtaining a launch license, the responsibilities with which a launch licensee must comply, and operational requirements.

II. Background

The Commercial Space Launch Act of 1984, as codified and amended at 49 U.S.C. Subtitle IX—Commercial Space Transportation, ch. 701, Commercial Space Launch Activities, 49 U.S.C. 70101-70121 (the Act), authorizes the Department of Transportation and thus the FAA, through delegations,
1

to oversee, license and regulate commercial launch and reentry activities and the operation of launch and reentry sites as carried out by U.S. citizens or within the United States. 49 U.S.C. 70104, 70105. The Act directs the FAA to exercise this responsibility consistent with public health and safety,

safety of property, and the national security and foreign policy interests of the United States. 49 U.S.C. 70105. The FAA is also responsible for encouraging, facilitating and promoting commercial space launches by the private sector. 49 U.S.C. 70103. A 1996 National Space Policy recognizes the Department of Transportation as the lead federal agency for regulatory guidance regarding commercial space transportation activities.

1
See Commercial Space Transportation Licensing Regulations, 64 FR 19586 (Apr. 21, 1999).

The FAA licenses commercial launches, the subject of this notice of proposed rulemaking in accordance with the Act and 14 CFR Ch. III. Until recently, all commercial launches took place under the cognizance of federal launch range safety organizations, which impose comprehensive safety requirements on launch operators. The FAA has been able to rely significantly on the safety oversight activities of the federal launch ranges. Consequently, many safety issues did not need to be addressed explicitly in the FAA's regulations. That has now changed.

The commercial space transportation industry continues to grow and diversify. Between the first licensed commercial launch in March 1989 and July 2000, 130 licensed launches have taken place from five different launch sites, including launches from a non-federal launch site, and from launch sites operated by licensed launch site operators. The vehicles have included traditional orbital expendable launch vehicles, such as the Atlas, Titan, and Delta, and sub-orbital Black Brant boosters, new expendable launch vehicles using traditional launch techniques, such as Athena and Conestoga, and unique vehicles, such as the air-borne Pegasus. The commercial launch industry has evolved from one relying on traditional orbital and sub-orbital launch vehicles to one with a diverse mix of vehicles using new technology and new concepts. A number of international ventures involving U.S. companies have also formed, further adding to this diversity.

Developments in cost savings and innovation are not confined to the launch industry. The launch site industry has also made progress. Commercial launch site operators are coming on line with the goal of providing flexible and cost-effective facilities both for existing launch vehicles and for new vehicles. When the commercial launch industry began, commercial launch companies based their launch operations at federal launch ranges operated by the Department of Defense (DOD) and the National Aeronautics and Space Administration (NASA). The Eastern Range, where the 45th Space Wing provides launch safety services, located at Cape Canaveral Air Station in Florida (CCAS), and the Western Range, where the 30th Space Wing provides launch safety services, located at Vandenberg Air Force Base (VAFB), in California are Federal launch ranges that support licensed launches. Both are operated by the U.S. Air Force. Wallops Flight Facility in Virginia, operated by NASA; White Sands Missile Range (WSMR) in New Mexico and Kwajalein Missile Range, both operated by the U.S. Army; and the Kauai Test Facility in Hawaii, operated by the U.S. Navy are other federal launch ranges that support licensed launches. Federal launch ranges provide the advantage of existing launch infrastructure and range safety services. Launch companies are able to obtain a number of services from a federal launch range, including radar, tracking and telemetry, flight termination and other launch services.

Today, most commercial launches still take place from federal launch ranges. However, the FAA anticipates that this pattern will change, as non-federal launch sites become more prevalent. On September 19, 1996, the FAA granted the first license to operate a launch site to Spaceport Systems International (SSI) to operate California Spaceport. That launch site is located within VAFB. Three other launch site operators have received licenses. The Spaceport Florida Authority (SFA) received an FAA license to operate Launch Complex 46 at CCAS as a launch site. Virginia Commercial Space Flight Authority (VCSFA) received a license to operate Virginia Spaceflight Center (VSC) within NASA's Wallops Flight Facility. Most recently, Alaska Aerospace Development Corporation (AADC) received a license to operate Kodiak Launch Complex (KLC) on Kodiak Island, Alaska as a launch site.

Whether launching from a federal launch range, a launch site located on a federal range, or a non-federal launch site, a launch operator is responsible for ground and flight safety under its FAA license. At a federal launch range a launch operator must comply with the rules and procedures of the federal range. The safety rules, procedures and practices, in concert with the safety functions of the federal launch ranges, have been assessed by the FAA, and found to satisfy the majority of the FAA's safety concerns. In contrast, when launching from a non-federal launch site, a launch operator's responsibility for ground and flight safety takes on added importance. In the absence of federal launch range oversight, it will be incumbent upon each launch operator to demonstrate the adequacy of its ground and flight safety to the FAA.

An NPRM containing licensing and safety requirements for the operation of a launch site was issued in June 1999, and that notice makes clear that a licensed launch site operator will not be playing the same role as a federal launch range. Licensing and Safety Requirements for Operation of a Launch Site, Notice of Proposed Rulemaking, 64 FR 34315 (Jun. 25, 1999) (“Launch Site NPRM”). That notice proposes specific requirements for operating a launch site, including the operation of a non-federal launch site; however, the notice proposes more limited launch site operator licensee requirements with respect to flight safety of a launch from a non-federal site. A launch site operator is not required to perform in a similar capacity as the current federal launch ranges. The FAA holds a launch licensee, not a launch site operator, responsible for flight safety, even in those cases where a launch site operator provides services in support of a launch. In that context, a launch site operator acts as a contractor or subcontractor to a licensed launch operator. The majority of public safety requirements for launch related ground and flight operations fall upon the launch licensee.

In addition to licensing the operation of the first non-federal launch site, the FAA issued, as of March 1999, its first launch license for launch from a non-federal launch site, which was, in this case, the Pacific Ocean. For this launch, no federal launch range safety review was available. Sea Launch Limited Partnership (Sea Launch), the licensee, was successful in conducting its first launch of a commercial rocket from a modified mobile oil rig located in the Pacific Ocean. Because Sea Launch does not plan to offer its launch platform or location to others for launch, the FAA did not require it to obtain a license to operate a launch site; accordingly, it needed only obtain a launch license. The FAA's approach to Sea Launch's license application was to ensure an equivalent level of safety as has been sought at the federal launch ranges. Although the foreign safety system, technology, procedures, and operations create a number of differences, the FAA was able to use the federal launch range approach as a benchmark to achieving safety for the FAA's safety determination.

The current regulations, 14 CFR part 415, governing launch primarily address launches as they take place from Department of Defense or National Aeronautics and Space Administration (NASA) launch ranges, and treat

launches from a non-federal launch site on a case by case basis. The licensing regulations for launch from a federal launch range are designed to avoid duplication of effort between the FAA and the federal launch ranges in overseeing the safety of launches at the federal ranges. Although the FAA does require information and analyses not required by federal ranges to ensure that all flight safety issues are addressed, and imposes certain additional requirements derived from recommendations arising from a National Transportation Safety Board investigation, the FAA does not duplicate the safety assessments performed by federal launch ranges. The ranges require compliance with their safety rules as a condition of using their facilities and services. The federal ranges act, in effect, both as landlords and as providers of launch facilities and services. Under this notice of proposed rulemaking, that licensing approach will continue. A launch operator license applicant proposing to launch from a federal launch range will continue to be governed by subpart C of part 415. A launch operator proposing to launch from a non-federal launch site would be subject to the requirements proposed by subpart F which are, because of the lack of federal launch range involvement, more detailed in order to permit the FAA to adequately review the safety of each proposed launch.

A federal launch range requires a launch operator to provide data regarding its proposed launch. The range evaluates the data to ascertain whether the launch operator will comply with range requirements. The range also uses the data to prepare range support for the mission. DOD ranges require that a launch operator apply for and obtain specific mandatory approvals from the range in order to conduct certain specified operations. For example, the Air Force's “Eastern and Western Range Requirements 127-1,” (Mar. 1995)
2

(“EWR 127-1”) require a launch operator to obtain approvals for hazardous and safety critical procedures before the range will allow those operations to proceed. In the event that a launch operator's proposal does not fully comply with range requirements, a range may issue a deviation or a waiver if the mission objectives of the launch operator could not otherwise be achieved. A range may issue a deviation to allow a launch even when a launch operator's designs or proposed operations do not comply with range requirements. A range may issue a waiver when it is discovered after production that hardware does not satisfy range requirements or when it is discovered that operations do not meet range requirements after operations have begun at a federal range. A range will allow a deviation or grant a waiver only under unique and compelling circumstances.

2
The latest version of these requirements may be found at http://www.pafb.mil/45SW/rangesafety/ewr97.htm.

The FAA performed baseline assessments of various federal launch ranges and found their safety services adequate. Under FAA regulations, the FAA does not require an applicant to demonstrate the adequacy of the range services it proposes to employ if the applicable baseline assessment included those federal launch range services and if those services remain adequate. Certain showings regarding the applicant's own capabilities are still required. The FAA requires specific information regarding the interface between the safety organizations of a federal launch range and of an applicant. In the event that a service or procedure upon which an applicant proposes to rely is not within the documented experience of the federal launch range that the applicant proposes to utilize, the applicant would have to demonstrate the safety of that particular aspect of its launch. This is also true if a documented range safety service has changed significantly or has experienced a recent failure. In those cases, the burden of demonstrating safety shifts to the applicant.

III. Discussion of Proposed Licensing and Safety Regulations for Launch

A. Proposed Revisions to Parts 415 and 417

The approach the FAA followed in developing technical requirements for this proposed rule is to build on the safety success of federal launch ranges and to seek the same high level of safety that the federal ranges have achieved. Wherever appropriate for public safety, federal launch range practices were used as the basis for the development of the FAA's regulatory regime. Additionally, this proposed rule would allow for flexibility through the use of performance standards where appropriate, and identifies specific technical requirements where necessary to ensure safety. The FAA worked extensively with federal launch range safety personnel to refine and adapt many of the federal range requirements to a performance standard approach for incorporation into this proposed rule. The text responds to the complexity of space launch systems and the potential for negative consequences to public safety. The proposed regulations specify detailed processes, procedures, analyses, and general safety system design requirements. Where necessary, for critical safety hardware and software, this proposed rule provides design and detailed test requirements. In every case, the proposed regulations define the material that must be prepared and submitted as part of a license application or by a licensee before launch. The FAA also proposes to build flexibility into its requirements. Although the proposed regulations would provide the requirements with which a licensee must comply, the FAA anticipates that a launch operator might wish to employ alternative means of achieving the same safety goal. In that case, if a launch operator can clearly and convincingly demonstrate an equivalent level of safety, the FAA would consider accepting that alternative, and describing it for the benefit of others through the notice, the FAA's advisory circular process or some other method.

This notice of proposed rulemaking proposes safety requirements for licensed launch, whether from a non-federal launch site or a federal launch range. It is the FAA's understanding that the U.S. Air Force launch ranges intend eventually to cross-reference the same requirements for flight for government launches. In the course of creating the requirements for this proposed rule, the FAA consulted with the federal launch ranges. As a result of these consultations, what the FAA understands to be a general sentiment within the launch community in favor of consistent requirements, and the recommendations contained in the White House's report, The Future of the Space Launch Bases and Ranges, (2000) the FAA and the Air Force plan to establish common safety standards for the flight of a launch vehicle. The FAA will implement its requirements through rulemaking, and launch operators using Air Force ranges for commercial launch would have to abide by the FAA regulations for flight safety in proposed part 417. Because the Air Force's ground safety requirements still provide greater specificity than what the FAA proposes through this notice, the Air Force does not, at this time, plan to substitute the FAA's proposed ground safety requirements for its own, but, because a launch operator will have to comply with the requirements of part 417, that launch operator will have to ensure that it complies with the FAA's proposed ground safety requirements as well. The FAA anticipates that, in most instances, satisfaction of the Air Force

requirements will satisfy the FAA's ground safety requirements. In the event of conflicts, the FAA's requirements will govern licensed launch operators.

Both the Air Force and the FAA anticipate tangible benefits to having common safety standards. Because the FAA is building upon the requirements of the federal launch ranges, this proposed rule is meant to preserve the best of the Air Force public safety experience and expertise. The Air Force, which has subjected its own requirements to the scrutiny and comments of its range users in the past, will be able to rely on the fact that the FAA's proposed requirements will undergo the public notice and comment period mandated by the Administrative Procedure Act. This proposed rule will provide a forum for public participation on the proposed standards and economic impacts. An FAA rulemaking requires a cost benefit analysis, which is also subject to public comment, and ensures that issues regarding cost are taken into account. The FAA, in turn, is able to leverage the technical expertise of the Air Force legacy in promulgating its requirements. The FAA and the Air Force foresee greater ease of administration for launch operators and the government, as well as greater uniformity of treatment, with a common set of national standards.

This notice proposes to establish requirements for a flight safety analysis that covers the hazards of normal and non-normal flight. The results of the analysis will be used to develop and implement flight safety rules and procedures that govern the licensed launch. The flight safety analysis is a critical tool for determining that public safety is being adequately addressed. The analysis must accurately reflect the true circumstances of each launch. Consequently, the proposed rules would specify performance standards for each critical part of a flight safety analysis as well as identifying the specific safety criteria that must be met.

This notice would cover a number of major flight safety analysis issues. Flight control lines are necessary for a flight safety analysis. Establishing flight control lines involves the identification of those areas that must be protected from potential adverse effects of a launch vehicle's flight. Flight control lines are material input to the flight safety analysis and the determination of flight safety limits. They depend on the location of population centers, foreign territorial boundaries, and other areas that must be protected. Flight safety limits are used during a launch to determine when a malfunctioning vehicle's flight must be terminated to ensure that any adverse effects are contained. Flight safety limits may be a function of time and depend on the vehicle's debris footprint.

This notice of proposed rulemaking addresses other flight safety measures. For example, wind weighting is a technique used to determine launch azimuth and elevation settings for unguided launch vehicles, which are typically sub-orbital sounding rockets. Wind weighting predicts the wind effects on impact point displacement during the thrusting phases of flight as well as the ballistic free-fall phase of each launch vehicle stage.

Hazard areas must be established for both preflight processing of a launch vehicle and flight. Hazard areas are established to provide protection from both normal and anomalous launch events. The presence of the public in a hazard area is a constraint on preflight processing and flight, and must be controlled, typically by controlling access to the area or through flight commit criteria that depend on real-time surveys of the area at the time of flight. This notice proposes to specify the analysis that a license applicant must perform to define the appropriate hazard areas for each launch. These hazard areas generally include a launch hazard area that accounts for people, aircraft, and any ships, impact hazard areas for planned debris resulting from normal flight, and hazard areas for unique hazards such as toxic or radiological materials.

An applicant must demonstrate satisfaction of the FAA's risk criteria. This may be accomplished if a launch operator is able to show that the risk of casualties to the general public is acceptably low. An applicant must show that the collective casualty expectancy (E
C
) risk of the proposed launch is equal to or less than the FAA's established criteria of 30×10
−6
. This is a critical measure used to evaluate potential public risk due to a proposed launch. An applicant must also show that its proposed launch will be conducted without exceeding an individual casualty probability (P
C
) of 1×10
−6
. Not all federal launch ranges require an individual risk analysis. In most cases, if 30×10
−6
is met, individual risk is also less than 1×10
−6
. This is not, however, always the case. The need to evaluate individual risk varies depending on the specifics of the launch and the launch site. Because FAA regulations must address the broad range of non-federal launch sites and launch vehicle combinations, the FAA proposes to require a launch operator to demonstrate that the individual risk criteria will not be exceeded for each launch regardless of whether the launch occurs from a non-federal launch site or a federal launch range. This notice will provide a method for accomplishing these analyses and allow for variations and possible simplifications to the analysis based on the applicant's specific situation. The applicant would perform risk analysis to demonstrate that each proposed launch will not exceed established criteria for the impact probability of hitting aircraft and ships.

The other essential component for flight safety is a flight safety system. The primary purpose of a flight safety system is to monitor a launch vehicle's flight status and provide the positive control needed to prevent the launch vehicle from impacting populated or other protected areas in the event of a vehicle failure. The requirements for properly qualifying the proposed flight safety system and validating its performance are critical. Comprehensive flight safety system requirements will be provided that are designed to ensure that a launch operator implements a highly reliable, acceptable system.

This proposed rulemaking addresses important components of and major issues related to a flight safety system. A typical flight safety system is composed of a flight termination system and a command control system. This notice proposes to define a flight termination system (FTS) as consisting of all components that are on board a launch vehicle and are needed to control the termination of a launch vehicle's flight. An FTS may also include automatic destruct system components designed to activate upon vehicle breakup or premature separation of individual powered stages or strap-on motors. This notice proposes requirements for the FTS components onboard a launch vehicle as well as command control components that are typically ground based, including associated software. A highly reliable FTS is critical to ensuring public safety. This notice would define a process for obtaining the necessary reliability. That process would consist of specific FTS design standards and criteria, a reliability analysis of the FTS design, and comprehensive testing to qualify the FTS design and certify and accept FTS components.

The proposed requirements would also address other elements of the flight safety system. This notice of proposed rulemaking would include requirements for compatible vehicle tracking, visual data sources, telemetry, communications, display, and recording systems that are necessary as part of the flight safety system to support a flight

termination decision. The licensee would be responsible for ensuring that these required systems are available to support the launch. A flight safety system must be complemented with, and operated by a qualified flight safety crew that includes a flight safety official and support personnel. This proposed rule would identify the flight safety crew positions and the personnel qualifications required for each position. The FAA's proposed training and qualification approach is an adaptation of federal launch range practices.

This notice also addresses ground safety issues related to the preparation of a launch vehicle for flight. Many issues related to the safety of ground operations at a launch site are subject to regulation by other federal agencies. This notice would address ground safety issues, not otherwise addressed by other federal regulations, that are unique to space launch processing and that could affect the general public. A launch operator licensee would be responsible for developing and implementing a ground safety program in compliance with the specified standards, and should note that this proposed rulemaking does not supersede the ground safety requirements of other regulatory agencies.

Ground safety issues may be addressed through a number of measures in this notice. This proposed rulemaking includes a hazard assessment to ensure the safety of ground operations. A launch operator would be required to perform a hazard analysis for all hazardous operations to identify the potential of each hazard for affecting public safety. This proposed rulemaking would define requirements, processes, and procedures for mitigating identified public safety hazards. Launch processing typically involves the use of toxic and hazardous materials. This proposed rule would define ground safety program requirements designed to protect the public from these substances. The use of non-ionizing radiation in the form of communications and radar systems is also typical of launch processing. Proper control of such sources of energy is of particular concern due to the many explosives that could be inadvertently initiated and that are often present at a launch site. This proposed rulemaking would define ground safety program requirements designed to protect the public from non-ionizing radiation. A launch vehicle or payload may include materials that give off ionizing radiation. The presence of ionizing radiation is a safety issue that must be reviewed for each launch and requires that proper procedures be followed. There are many ground safety issues involving explosives associated with launch processing. The NPRM on licensing and safety requirements for the operation of a launch site addresses locating explosive substances at a launch site, and identifies appropriate safety separation distances, based on quantity, between facilities at the site and the public. In most cases, maintaining proper separation distances will provide protection for the general public. This proposed rulemaking would define ground safety program requirements for protecting the public from explosives through the maintenance of proper separation distances during operations and preventive explosive safety processes and procedures, including prevention of inadvertent initiation of explosives and propellants.

B. Payload Review and Determination

The proposed requirements address hazards that a payload may create during launch. This proposed rulemaking continues the agency's practice of addressing hazards presented by payloads during the flight of a launch vehicle. This includes payloads otherwise exempt from a payload review. The FAA wishes to clarify that flight safety analysis includes even those payloads exempted by 14 CFR 415.53, and is proposing to amend the text of § 415.51 to clarify accordingly. As is evident from inspection of the neighboring provisions, sections 415.51 (“the FAA reviews a payload proposed for launch to determine whether its launch would jeopardize public health and safety”) and 415.53 (“each payload is subject to compliance monitoring to determine whether its launch would jeopardize public health and safety”), the FAA intended to include safety issues within a payload review. Nonetheless, in order to avoid confusion, the FAA proposes to amend § 415.51 to state that all payloads, exempt or not, are subject to the safety requirements of subparts C and F of this part and of part 417. This should make clear that the exemption of Federal Communications Commission (FCC) or National Oceanic & Atmospheric Administration (NOAA) regulated payloads or those owned or operated by the U.S. Government applies to the payload determination and not to the safety reviews or requirements.

The Act provides the FAA authority over payloads.
See
49 U.S.C. 70104; Commercial Space Transportation; Licensing Regulations, Interim Final Rule, 51 FR 6870, 6871 (Feb. 26, 1986) (“The Act gives the [agency] authority to determine whether the launch of a payload is inimical to the national interests specified in the Act and does not exclude any relevant factor from the [agency's] consideration.”) The commercial space transportation regulations implemented this authority, first, through a mission review,
see
14 CFR 415.21-415.25 (1988), and then through the payload review adopted in 1999,
see
14 CFR 415.51-415.63 (1999).

The Act also contains provisions describing the authority of various agencies with regard to certain payloads. The Act does not affect the authority of the FCC or the Secretary of Commerce under the Land Remote-Sensing Commercialization Act of 1984. 49 U.S.C. 70117(b). This means that these agencies may continue in their regulation of communications satellites and land remote sensing satellites. Accordingly, the FAA does not conduct a payload review of payloads that are subject to regulation by the Federal Communications Commission or the Department of Commerce, National Oceanic and Atmospheric Administration, or that are owned or operated by the U.S. government. This means that the FAA does not review those payloads for their impact on the national interests identified in the Act.

The FAA does, however, possess and exercise safety authority over issues presented by payload hazards during flight of a launch vehicle. The FAA recognizes that the legislative history accompanying the requirement in 49 U.S.C. 70104(b) that a licensee may launch a payload only if the payload complies with the requirements of the laws of the United States related to launching a payload, indicates that Congress did not want communications or land remote sensing satellites subjected to a duplicative regulatory process. See Commercial Space Launches, Sen. Committee Rep. No. 656, 98th Cong., 2d Sess., 15 (1984). The Committee recognized, for example, that the FCC provided authorization for the launch of a communications satellite and would therefore require no separate “documentation or certification” by the FAA.
Id.
Nor did Congress intend that the FAA obtain the authority “to override or modify any decision by the FCC to authorize the launch or operations of a communications satellite.”
Id.
at 16. The FAA does not purport to authorize the operation of communications satellites. That is why the exemption in § 415.53 exists. What the FAA does require, however, is information sufficient to evaluate the safety of a proposed launch. The FCC and NOAA do not analyze the launch safety of communications or land remote sensing satellites. Accordingly,

the FAA's proposed safety requirements would not constitute duplicative regulation.

If the payload hazards dictate a change in commit criteria, trajectory or other safety related decision, the launch operator and the FAA need to be able to assess and respond to the hazards posed by the satellite. A satellite's hazards may consist of fuel, debris or both. In this regard the FAA notes that the Senate Committee, in discussing the agency's authority to issue an emergency order stopping a launch, recognized that the agency could have concerns “that may relate to the launch vehicle or its payload.”
Id.
at 24. This explicit recognition of the FAA's ability to respond to payload concerns supports the FAA's interpretation of the Act: subsection 70117(b) provides that the authority of the FCC and NOAA remain unaffected by the Act, but means nothing more than that. Although the FAA should not duplicate the roles of the FCC or NOAA, it may address areas not otherwise encompassed by their regulatory schemes, namely, the safety issues surrounding any particular launch. Accordingly, the FAA will continue to address payload safety issues that relate to the transport, or launch, of a payload, regardless of whether the payload is within the jurisdiction of the FCC or NOAA or whether it is owned or operated by the U.S. Government.

C. Safety Review for Launch From a Non-Federal Launch Site

Under current practice, the FAA requires a safety review for launch from a non-federal launch site. By this proposed rulemaking, the FAA proposes to codify its requirements for the safety review. Proposed part 417 contains the safety requirements with which a licensee must comply. Part 415, subpart F, would require a license applicant to demonstrate how it will satisfy the requirements of part 417 in order to obtain a license. The FAA would issue a safety approval if an applicant demonstrated that it would meet the safety responsibilities and requirements for launch. The safety review would require an applicant to submit data, prepare test plans, conduct and supply analyses and do so in accordance with specified timetables.

Not unlike what a launch operator must submit to a federal launch range in order to launch from a site such as Cape Canaveral or Vandenberg Air Force Base, a launch operator must demonstrate that it will satisfy the FAA's regulatory requirements. A launch operator will notice some differences. The same work will be performed, but by different entities. Where, for example, a federal launch range will perform much of the flight safety analysis for a launch operator to launch, the lack of a federal range and the proposed requirements would settle that task upon the launch operator. In the course of its safety review, the FAA will review the launch operator's information for validity and accuracy.

D. Part 417, Launch Safety

This proposed rulemaking clarifies the roles and responsibilities of a launch operator licensee. It specifies that a launch operator is responsible under an FAA license for the safety of the flight of its launch vehicle and the launch processing, or preparation of that launch vehicle for flight, at a U.S. launch site.

A launch license encompasses both the flight of a launch vehicle, referred to in common parlance as “launch,” and the launch processing of that vehicle. One of the idiosyncrasies of the Act is its definition of “launch.” The Act defines launch not only as including the flight of a launch vehicle, but as including activities “involved in the preparation of a launch vehicle or payload for launch, when those activities take place at a launch site in the United States.” 49 U.S.C. 70102(3). Accordingly, a launch license covers flight and launch processing, and a launch operator is responsible for the safety of both.

This proposed rulemaking also clarifies a number of issues of which a launch operator must be cognizant. A launch license does not relieve a licensee of other legal obligations. Under 49 U.S.C. 70105(b), unless otherwise provided by that subsection, all requirements of the laws of the United States applicable to the launch of a launch vehicle are license requirements as well. Additionally, this proposed rulemaking would impose on a launch operator the requirement to coordinate with a launch site operator in order for the launch site operator to satisfy its regulatory obligations.

The proposed requirements also highlight the interplay between the application process and compliance with the obligations of a licensee. Because the FAA grants a license based on the representations contained in a launch operator's license application, part of a licensee's obligations under its license are to ensure the continuing accuracy of all material representations. The FAA proposes to impose affirmative verification measures in order to ensure that a launch operator is operating as it represented it would.

In order to outline the proposed regulations, proposed subpart B of part 417 would serve as a guide to other parts of the regulations. It summarizes what a launch operator needs to address to achieve public safety and refers to the particular subpart, section and appendices that contain detailed requirements. This subpart would address a launch operator's safety organization, safety personnel and codify various criteria for the risks and hazards associated with launch.

E. Flight Safety Analysis

1. Introduction

A launch operator would be required to perform flight safety analysis to demonstrate how it would monitor and control risk to the public from hazards associated with normal launch vehicle flight and the potential hazards associated with the flight of a malfunctioning launch vehicle. The proposed regulations would require that a launch operator's analysis consist of a number of separate analyses, both deterministic and probabilistic in content and intent. For all expendable launch vehicles, a launch operator's flight safety analysis would determine the conditions under which the vehicle could be launched safely by demonstrating that the risk associated with the launch satisfied the public risk criteria. In addition, for a launch vehicle flown with a flight safety system as a means of ensuring public safety, the flight safety analysis would define the conditions that would dictate whether or not the flight of the launch vehicle had to be terminated due to safety considerations.

During the licensing process, the FAA would require a launch operator to submit the products of its analysis to demonstrate that the launch operator performed the required analyses properly and has the ability to conduct a launch safely. After licensing, the FAA would also require a launch operator to submit analysis products for each individual launch to provide the data that the FAA would use to verify a launch operator's compliance with the regulations and the terms of the license for each launch. The proposed analyses would thus demonstrate both capability and specific compliance. This has proved to be a successful process historically. The FAA does not, however, foreclose the possibility that a launch operator could dispense with one or more of the proposed analyses through innovation or the applicability of a previously performed analysis for a past mission to a planned mission. Nonetheless, the FAA would require the products of each of these analyses to verify their validity for those launch

operators employing the more traditional approaches, and to serve as a benchmark against which to measure any alternative approach that a launch operator proposes.

2. Flight Safety Analysis for Launch Vehicles That Use a Flight Safety System to Achieve Public Safety

A launch operator would perform a series of analyses to define the extent of its launch vehicle's capabilities and hazards, both during normal flight and in the event of a malfunction. A launch operator would perform a trajectory analysis to determine a launch vehicle's planned nominal trajectory and the potential three-sigma trajectory dispersions about the nominal trajectory. The three-sigma dispersions, which routinely include the effects of winds on a launch vehicle, about the nominal trajectory define the extent of normal flight. A launch operator would perform a malfunction turn analysis to determine how far a launch vehicle's instantaneous impact point can deviate from the nominal trajectory when a malfunction occurs. A launch operator would perform a debris analysis that identifies inert, explosive, and other hazardous launch vehicle debris, such as toxic debris or debris that produces ionizing radiation, resulting from a launch vehicle malfunction and from any planned jettison of launch vehicle components. A launch vehicle's capabilities and hazards may be significantly affected by winds experienced during flight. A launch operator would perform a wind analysis to determine wind magnitude and direction as a function of altitude for the air space through which the launch vehicle will fly and for the airspace through which any malfunction and jettisoned debris may fall.

The launch operator would perform an analysis to establish flight control lines that define where a launch vehicle would be allowed to fly. As part of this analysis, the launch operator would assess the surroundings of its proposed launch site and trajectory to identify the boundaries of populated and other areas requiring protection from the potential adverse effects of the launch vehicle's flight, including, its possible breakup, whether commanded or accidental. The proposed regulations would require a launch operator to border the identified populated and other areas requiring protection with flight control lines, thus defining the region within which the launch vehicle and any breakup and jettisoned debris must be contained.

The FAA reviewed a recent National Academy of Sciences (the Academy) study that recommended that the federal launch ranges create their impact limit lines, which correlate fairly closely to the FAA's own proposed flight control lines, on the basis of risk. Streamlining Space Launch Range Safety, 22, National Research Council (Apr. 2000) (”Streamlining Safety”). The Academy recommended, among other things, that destruct lines be defined and implemented in a way that is directly traceable to accepted risk standards, including collective (E
C
) and individual risk. The Academy took exception to the creation of impact limit lines on the basis of risk avoidance.
Id.
at 20 (citing EWR 127-1, par. 2.3.6: “Whenever possible, the overflight of any inhabited landmasses is discouraged and is approved only if operational requirements make overflight necessary, and risk studies indicate probability of impact and casualty expectancy are acceptable.”) The FAA finds that it cannot pursue this recommendation. In the context of impact limit lines, the report makes no case for basing a decision as to what requires protection on the basis of risk. Instead, it ignores the portion of EWR 127-1 that permits overflight on the basis of risk through the creation of gates, which are the width of a destruct line opened for a normally performing vehicle,. Gates are acceptable only if risk levels are acceptable. EWR 127-1 at par. 2.3.6. The FAA proposes, like the federal launch ranges, to require the protection of populated areas, and permit the creation of gates as an exception to the flight control lines requirement. If the Academy means to suggest that impact limit lines or flight control lines should be created on the basis of risk, the Academy did not suggest how this should be accomplished or provide a justification. The FAA is also troubled by the possibility that the Academy recommendation could mean that certain populated areas and members of the public near a launch site would no longer benefit from being protected from a malfunctioning launch vehicle. The FAA does not believe that the Academy intended to distinguish between the levels of protection some members of the public are afforded. Accordingly, the FAA will not seek to deviate from the federal launch range approach to the creation of either impact limit lines or, as the FAA proposes, flight control lines.

The launch operator would perform a series of analyses to determine the conditions that would require termination of a launch vehicle's flight and to establish flight termination rules. Unless otherwise approved during the licensing process, the proposed regulations would require a launch operator to employ a traditional U.S. flight safety system where flight termination is accomplished by destroying the launch vehicle and ensuring that any resulting hazards are contained within an area that is isolated from the public. In general, if a launch vehicle strays off course, it must be destroyed or its thrust terminated before the vehicle, payload, or resulting debris is able to impact any populated or other protected area outside the established flight control lines.

A launch operator would perform a flight safety limits analysis and institute flight termination rules to establish the conditions under which the launch operator would have to terminate a malfunctioning launch vehicle's flight to ensure that the launch vehicle's debris impact dispersion does not extend beyond the flight control lines, or conflict with the risk criteria. A launch operator's flight safety limits analysis would have to account for any time delay that exists between recognizing that a malfunction has occurred, the point in time that a flight termination command is sent and the launch vehicle's destruction. A launch operator would perform a time delay analysis to determine the elapsed time, including an allowance for the flight safety official's decision and reaction time, between the start of a launch vehicle malfunction or violation of flight safety limits and the final motion of the vehicle's impact point or commanded flight termination.

Additional proposed analyses would address other conditions requiring termination of flight. If a launch vehicle malfunctions and flies a vertical or near vertical trajectory, usually referred to as a straight-up trajectory, rather than following a normal trajectory downrange, a launch operator would perform a straight-up time analysis to determine the latest time-after-liftoff by which flight termination must be initiated. If a launch operator lost all launch vehicle tracking data and did not regain tracking data for an amount of time sufficient for a launch vehicle to reach a populated or other protected area, the launch operator would have to terminate flight. A launch operator would perform a data loss flight time analysis to determine the shortest elapsed thrusting time during which a launch vehicle could move from its normal trajectory to a condition where the public might become endangered.

The FAA would permit flight over any populated or other protected area if a launch operator establishes a gate through a flight control line or other flight safety limit boundary. A launch

operator would perform an analysis to determine any gate in a flight control line or other flight safety limit boundary, through which a launch vehicle would be allowed to pass without a launch operator being required to terminate flight. A launch operator would have to perform a risk analysis to determine whether the overflight permitted by the gate was acceptable and satisfied the risk criteria.

The FAA wishes to caution its licensees that proposed changes in the African gate may affect certain launches, and requests comments from its licensees on the possible impacts. A licensed launch operator would have to satisfy the requirements of proposed part 417. That would include the requirements governing the creation of a gate. The National Academy of Sciences report recommended that the Air Force consider not retaining downrange equipment and facilities in support of the African or other gates. Streamlining Safety at 24. If such a move conflicted with the FAA requirements governing creation and use of a gate, a launch operator would have to provide its own support for any launch employing the gate.

The FAA's proposed requirements would require a launch operator to terminate the flight of an abnormally performing launch vehicle prior to permitting land overflight. The Academy pointed out, without quantifying the costs, that the current downrange equipment that supports a termination decision is expensive. Streamlining Safety at 20. The Academy also noted that coordinating launches with remote facilities complicates range safety operations and increases the risk of delay.
Id.
The Academy also maintained that the need for downrange facilities was not necessary from a safety perspective. The FAA requests public comment on the Academy's position in light of the considerations addressed below.

The Academy argued for removal of the downrange facilities from a safety perspective. It stated that several factors suggested that the risk standard could still be satisfied with fewer facilities. In pursuit of this argument, the Academy reviewed the collective risk associated with launch of an Atlas. Streamlining Safety at 20-22. It did not, however, address launches that might present worst case scenarios such as the evolved expendable launch vehicles, whose flight time and opportunity for some type of malfunction between last contact and the commencement of overflight will be correspondingly greater, and whose instantaneous impact point range rate will be slower and whose dwell time over Africa or Europe will increase proportionately. Accordingly, the FAA believes that before it is possible to determine whether downrange facilities are superfluous to safety that a good analysis would consider the contribution of the overflight of launch vehicles other than an Atlas to the total mission risk, and whether those contributions would result in E
C
being exceeded.

Additionally, although Streamlining Safety quantifies the probability of impact to Africa, it does not provide the expected casualty contribution of that overflight. Instead, it cites a report regarding downrange risks created by an Athena or Titan launch vehicle for the proposition that “the risks from flying over Africa appear to be well within the standard acceptable for the U.S. population.”
Id.
at 21 (citing “Estimation of Downrange Risks for Northeast Titan and Athena Launches,” Research Triangle Inst., Ward (1997)). Whether these conclusions apply to an Atlas launch vehicle as well is unclear. Additionally, it is unclear whether the Academy's observations regarding the risks associated with the remainder of a launch mean that the Academy is aggregating the mission risks as it should, or applying different E
c
thresholds to the populations of different continents. The FAA would appreciate any available clarification to this possible ambiguity.

Additionally, the FAA believes that the relationship of downrange risk analysis and the African Gate needs further clarification. When performing a risk study, the federal launch ranges do not look at regions of overflight unconstrained, but rather narrows their analysis to a hazard corridor defined in part by the width of the African or European Gate. In fact, because most launches are over the less densely populated southern half of Africa, moving the gate uprange could enlarge the hazard corridor for overflight and include higher population centers. Determining a gate, which is the width of a destruct line opened for a normally performing vehicle, would become dependent on the region of overflight for which risk has been accepted and the modes of failures considered in the risk analysis. Thus, by moving the gate further uprange, a concern over the proper gate width is created and needs to be defined. Should this be based on some limited vehicle performance, such as three-sigma performance, as suggested by the Academy's references to Western Range restrictions of flight azimuths, or more in terms of the maximum performance that will still allow orbital insertion as implemented by the Eastern Range? The latter is less restrictive than three-sigma vehicle performance requirements and allows larger overflight regions than if based strictly on three-sigma performance.

In accordance with this notice of proposed rulemaking, a launch operator would also perform a series of analyses to determine the safety conditions and criteria under which the flight of a launch vehicle might be initiated. A launch operator would perform a flight hazard area analysis to determine the land, sea, and air regions that would have to be publicized, monitored, controlled, or evacuated at the time of flight in order to inform the public and comply with the risk criteria in the event of planned and unplanned launch vehicle flight events. The hazard area analyses would contain both probabilistic and deterministic elements and would provide the launch operator the information necessary to establish exclusion, notice and surveillance zones, as well as other information required for flight commit criteria, which are the criteria which must be satisfied prior to flight. In order to meet flight commit criteria, a launch must comply with both the individual and collective risk criteria during planned and unplanned launch vehicle flight events. Hazard area analysis would include a blast hazard area analysis and determination of ship, aircraft, and individual risk hazard areas. A launch operator would perform a debris risk analysis to determine the expected average number of casualties to the collective and individual members of the public exposed to inert and explosive debris hazards from the proposed flight of a launch vehicle. This analysis would include an evaluation of risk to populations on land, including regions of launch vehicle flight following passage through any gate in a flight safety limit boundary. A launch operator would perform a toxic release analysis to determine the extent and amount of any public hazard resulting from any potential toxic release during preflight processing and flight of a nominal or non-nominal launch vehicle and to develop launch safety rules, including flight commit criteria to protect the public from any potential toxic release. A launch operator would perform a distant focus overpressure blast effects risk analysis to demonstrate that the potential public hazard resulting from impacting explosive debris would not cause windows to break with related injuries. This analysis would also contribute to any flight commit criteria necessary to comply with the public risk criteria.

Further discussion on the distant focus overpressure blast effects risk analysis is provided in section III.E.5 of this discussion.

A launch operator would obtain a conjunction on launch assessment performed by United States Space Command to identify any periods of time, referred to as “waits,” within a planned launch window, during which period flight would not be permitted in order to maintain a 200-kilometer separation between the launch vehicle and any inhabitable orbiting object.

3. Aircraft and Ship Hazard Areas for Guided Launch Vehicle and Unguided Suborbital Rocket Launches

The proposed regulations would require a launch operator to determine aircraft and ship hazard areas. Near the launch point, these hazard areas would constitute part of a flight hazard area. Outside the flight hazard area, aircraft and ship hazard areas would be necessary to protect against planned stage impacts and other intentionally ejected debris such as a fairing, payload, or other component. The FAA proposes requirements for launch operators to provide information for public notification of aircraft and ship hazard areas, and proposes requirements for when such hazard areas would have to be surveyed to ensure that the public risk criteria are satisfied for each launch.

a.
Aircraft hazard areas.
For the protection of aircraft during flight of a guided launch vehicle or an unguided suborbital rocket, the FAA proposes to require that a launch operator initiate flight only if the probability of the launch vehicle or debris impacting any individual aircraft that is not operated in direct support of the launch does not exceed an individual probability of impact of 0.00000001 (P
i
≤1×10
−8
).

For the immediate area around the launch point, the proposed regulations would require a launch operator launching a guided launch vehicle to establish an aircraft hazard area. The aircraft hazard area would consist of and encompass the air space region defined by the flight hazard area, which would, in turn, encompass an aircraft-hit contour that shows where the probability of impacting an unrelated aircraft would exceed 1×10
−8
, with an altitude extending from zero to 60,000 feet. For an unguided suborbital rocket, for the protection of aircraft, a launch operator's flight hazard area would be required to encompass the unguided suborbital rocket's three-sigma trajectory dispersion in the air space region from the Earth's surface at the launch point to an altitude of 60,000 feet.

For each downrange planned impact of a launch vehicle stage or component, the proposed regulations would require a launch operator to establish aircraft impact hazard areas to ensure that the 1×10
−8
criterion is satisfied. The proposed regulations would also require that an aircraft hazard area for a planned impact encompass the three-sigma dispersion of the impacting launch vehicle stage or component. This requirement is intended to provide a high level of assurance both that a hazard area encompass the planned debris within the hazard area and that risk remains at acceptable levels. The FAA proposes that a launch operator ensure that an aircraft hazard area encompasses an air space region that contains the larger of the three-sigma impact dispersion ellipse or an ellipse, where, if an aircraft were located on the boundary of the ellipse, the probability of hitting the aircraft would be less than or equal to 1×10
−8
and the debris path from an altitude of 60,000 feet to impact on the Earth's surface. This would ensure that a hazard area encompasses where the debris would fall and confines the area of risk. This requirement would apply to planned impacts from both guided launch vehicles and unguided suborbital rockets. A launch operator would have to ensure through communication with the FAA's air traffic control (ATC) facility having jurisdiction over the affected airspace that notices to airmen were issued and in effect at the time of flight for each aircraft hazard area.

Although an aircraft hazard area serves, through notices to airmen, to exclude or warn away aircraft from travelling too close to a launch, the size of that hazard area is usually determined through probabilistic means, and the FAA proposes to continue that practice. In other words, no aircraft would be allowed where the risks of impact are too great. Under current practice the federal launch ranges provide the air traffic control facility the outlines of an aircraft hazard area of which aircraft are notified. The federal launch ranges determine those aircraft hazard areas on the basis of the risk presented. NASA's Wallops Flight Facility implements an aircraft hit probability that equates to an individual aircraft hit probability of 1×10
−8
.
See
Range Safety Manual for Goddard Space Flight Center/Wallops Flight Facility, RSM-93, 24 (1993) (applying 1×10
−7
criteria to 10 aircraft). Although EWR 127-1 does not contain an impact probability criteria, the Western Range employs an aircraft hit probability of 1×10
−8
for planned impact hazard areas. Through this notice, and consistent with current practice as articulated by Wallops and the Western Range, the FAA proposes to follow the same course.

In its report on space launch range safety, the National Academy of Sciences suggested 1×10
−6
as the appropriate measure of probability of impact. Streamlining Safety at 38. The Academy maintained that its proposal was more consistent with the individual ship hit impact probability criteria and E
c
.
Id.
The FAA understands that the 1×10
−6
aircraft hit criterion is used by some federal ranges for aircraft that support a launch such as weather and launch surveillance aircraft. This criterion does not account for the large numbers of people that may be aboard an aircraft not involved in the launch. Because the FAA wishes to maintain the same level of public safety as achieved by the federal launch ranges, the FAA is not proposing the suggested measure, which constitutes an increase in risk to the public.

There is one special situation that arises in the context of suborbital rockets, and that has led the FAA to consider permitting a launch operator to propose the creation of alternate aircraft hazard areas. The large dispersions of some unguided suborbital rockets' planned impact points create a conundrum. The requirements for creating an aircraft hazard area unearthed certain incongruities where, on the one hand, satisfaction of the probability of impact criteria would create a hazard area of no significant size at all; while, at the same time, employing the criteria for the aircraft hazard area to contain the three-sigma impact dispersion could result in a hazard area that is prohibitively large to implement. The FAA proposes to resolve this difficulty through creation of an alternate hazard area.

For the launch of an unguided suborbital rocket, if the impact of a stage or component has a three-sigma dispersion that results in an aircraft hazard area that is prohibitively too large to implement with the ATC, a launch operator may employ an alternate aircraft hazard area. The FAA proposes that a launch operator provide a clear and convincing demonstration, through the licensing process, that any alternate aircraft hazard area provides an equivalent level of safety based on further analysis of the proposed launch and potential air traffic in the launch area.

b.
Ship hazard areas.
Through this notice of proposed rulemaking, the FAA proposes requirements designed to keep a launch vehicle and its components

from impacting ships when launching over water. A launch operator must identify where its launch vehicle's stages or other planned ejected debris or debris from a launch vehicle failure will impact, the corresponding ship hazard areas, whether the launch operator needs to survey the hazard areas for ships, and whether risks at the time of flight require that a launch operator wait until any ships have passed from a ship hazard area before initiating flight.

The standards governing the identification, surveillance and notice requirements for hazard areas for ships differ among the federal launch ranges based on their individual needs. The FAA's proposed requirements are an adaptation of the approaches used at the federal ranges resulting in a universally applicable approach. In accordance with the proposed requirements a launch operator would determine the collective probability of impacting a ship in the flight hazard area around the launch point and for each planned downrange impacting stage or component. The launch operator would perform a collective ship-hit analysis to determine the ship hazard areas and flight commit criteria and to determine whether the launch operator must survey the ship hazard areas. A launch operator would be permitted to initiate flight under these requirements only if the collective probability of impacting any ship would be less than or equal to 1×10
−5
. If a launch operator demonstrates, using statistical ship density data, that the collective ship-hit probability in the flight hazard area around the launch point or for the planned impact of a stage or component is less than or equal to 1×10
−5
, a launch operator would not need to survey the hazard area on the day of flight. Due to the uncertainty associated with statistical ship density data, the FAA is proposing that any ship density data obtained from a statistical source must be multiplied by a safety factor of 10 when used for any collective ship-hit probability analysis. This is because statistical density information is generally an average figure, does not reflect variances in time and is typically subject to limitations or other biases associated with deriving the density. If the launch operator fails to demonstrate that the collective ship-hit probability for the flight hazard area or an impacting stage or component is less than 1×10
−5
, using statistical ship density data, the launch operator would be required either to compute the probability of hitting the actual ships surveyed on the day of flight or define ship-hit contours and ellipses, which the launch operator would be required to survey for ships on the day of flight.

The proposed requirements would permit a launch operator to launch only if the collective probability of hitting any ship was less than or equal to 1×10
−5
.
3

A launch operator would determine this probability in one of two fashions. Under the first approach, a launch operator would, on the day of the planned flight, survey the ships in the vicinity of the flight hazard area and any planned impacts within 30 minutes of flight, and compute the probability of hitting a ship based on the number of ships surveyed. The analysis would account for the changes in impact locations resulting from any wind weighting operations on the day of flight, the speed of each ship in the vicinity of the impact area, and the ships' predicted location at the time of liftoff. The analysis would have to demonstrate that the collective probability of hitting a ship during flight was less than or equal to 1×10
−5
in order for flight to occur.

3
The practices at the Eastern and Western ranges differ with respect to the application of individual and collective impact probabilities. Because of the higher amount of ship traffic around Cape Canaveral, the Eastern Range conducts an analysis to ensure that it avoids hitting any ship. At the Western Range, where ship traffic is less dense, the Western Range usually ensures that the probability of impact for any individual ship does not exceed 1×10
−5
. The Western Range has informed the FAA, however, that were it to experience an increase in ship density around Vandenberg Air Force Base, it, too, would have to employ a collective impact probability criteria. As things stand now, however, the Western Range need not and therefore does not currently employ that amount of analysis. Because of the differences in ship traffic densities, the actual level of safety is not significantly different between the two ranges.

If a launch operator preferred to conduct the analysis in advance of the day of flight, the launch operator could demonstrate that its launch would take place in accordance within the limit on the probability of impact by creating ship hit contours in the flight hazard area and ship-hit ellipses around each planned impact point. Ship-hit contours and ellipses would be required for one through ten ships in increasing increments of one ship. For a given number of ships, the associated ship-hit contour or ellipse would be required to encompass an area where if the ships were located on the boundary of the contour or ellipse, the probability of impacting one of the ships would be less than or equal to 1×10
−5
. The launch operator would then survey on the day of launch to ascertain that less than the corresponding number of ships were present within each contour and ellipse. The launch operator would also have to create flight commit criteria that accounted for the winds used in the analysis in order to ensure that flight did not take place unless the winds on the day of flight were within the winds used in the analysis.

Through this rulemaking, the FAA proposes a refinement to the notice and surveillance requirements, as they are implemented at the federal launch ranges. As under current practice, the FAA proposes to require satisfaction of the 1×10
−5
collective ship-hit criterion in order for flight to occur. What would change is the nature of the verification required. Today at the federal launch ranges, surveillance takes place for ships in the vicinity of the launch point. The ranges do not survey downrange planned impact points because they assume that ship density is significantly less in those downrange locations. Through this notice, the FAA would require a launch operator desirous of avoiding surveillance in the flight hazard area or downrange planned impact areas to obtain confirmation of the density of ship traffic and demonstrate that the probabilities of impact for each launch are below 1×10
−5
, and the FAA would permit the use of statistical ship density data. Due to the uncertainty associated with any statistical ship density data and to make up for the lack of real-time surveillance, the FAA is proposing that any ship density obtained from a statistical source would have to be multiplied by a safety factor of 10 when used for the required collective ship-hit probability analysis. The FAA anticipates that in most cases of downrange planned impact, the criteria will be satisfied and that surveillance will continue not to be necessary. However, this approach would have universal applicability and would address a launch scenario with a planned impact point in an area where shipping density is relatively high and surveillance might become necessary in addition to posting a notice to mariners. For someone launching from the ocean, such as Sea Launch, surveillance requirements may decrease. However, the FAA does request public comment on this particular proposal and any available data that might show whether the criteria is indeed adequate to dispense with surveillance in either the flight hazard area or downrange.

As a final observation, the FAA is aware that the National Academy of Sciences addressed ship hazard areas and the requirements governing them in its study Streamlining Safety.
Id.
at 45. The Academy recommended that the federal launch ranges consider changing their threshold for probability of impact to increase the risk to ships and advised that the ranges conduct additional

studies.
Id.
at 37, 45. In the interest of maintaining the same level of safety as achieved by the federal launch ranges, the FAA is reluctant to follow this recommendation absent some compelling countervailing reason.

The Academy bases its recommendation on an argument for consistency between the ranges. Streamlining Safety at 45. Although the Eastern Range may initiate a launch hold or scrub if the collective risk exceeds 1×10
−5
, the Academy thought that the inconsistency between this approach and the Western Range's use of individual risk and what it characterized as accepted guidelines for the evacuation of hazard areas called for the use of individual risk. The FAA is not persuaded that this apparent inconsistency provides sufficient grounds for change; more so, because, in actuality, the Western Range employs individual risk because it has less shipping traffic to address. Were ship densities higher, the Western Range would also employ collective risk to ensure that a launch did not place any ship at risk.

4. Flight Safety Analysis for Unguided Suborbital Rockets Flown With a Wind Weighting Safety System

A launch operator would perform flight safety analysis to determine the launch parameters and conditions under which an unguided suborbital rocket could be flown using a wind weighting safety system and without a flight safety system. The results of this analysis would demonstrate whether any adverse effects resulting from flight would be contained within controlled operational areas that are isolated from the public. The analysis would also have to show whether any flight hardware or payload impacts would occur within planned impact areas that are isolated from the public. If such containment and isolation cannot be achieved, the launch operator must conclusively show that any adverse effect resulting from flight will not exceed individual or collective public risk criteria. The launch operator would perform a trajectory analysis, a hazard area analysis, a debris risk analysis, analyses for toxic and distant focus overpressure hazards, and a conjunction on launch assessment similar to those required of a launch vehicle with a flight safety system. The launch operator would also perform a wind weighting analysis to determine launcher azimuth and elevation settings that correct for the windcocking and wind-drift effects on an unguided suborbital rocket due to wind forces.

A launch operator must identify the dispersion around its nominal drag impact location. The launch operator must identify that area by analyzing the performance error parameters associated with the rocket's design and operation. A performance error parameter acts as a source of deviation from nominal performance. It is a quantifiable perturbing force that contributes to the dispersion of the launch vehicle's drag impact point in the uprange, downrange and crossrange directions. Performance error parameters typically include thrust, thrust misalignment, specific impulse, weight, variation in firing times of the stages, fuel flow rates, contributions from the wind weighting safety system employed, and winds.

5. Protected Areas and Flight Control Lines.

For a launch vehicle that uses a flight safety system to ensure public safety, a launch operator would establish flight control lines that border populated and other areas requiring protection. By implementing flight safety limits and flight termination rules, a launch operator would keep debris created by a malfunctioning launch vehicle from impacting any populated or other protected area outside the flight control lines. As part of the analysis to determine flight control lines, a launch operator would identify the boundaries of the areas that must be protected. To account for the uncertainties in knowing exactly where a protected area is on the face of the Earth in relation to the position of a launch vehicle, a launch operator would add map and tracking errors to offset flight control lines from the protected areas. The flight safety limits would account for the errors and dispersions associated with the launch vehicle and flight safety system, which includes the flight termination sequence of events.

The FAA notes that the proposed flight control lines are not unlike the impact limit lines currently employed by the federal launch ranges. The FAA intends the flight control lines as general performance requirements and also notes that employing impact limit lines as implemented by the federal launch ranges would satisfy the FAA's proposed requirements. The FAA proposes to employ the different terminology to clarify what is to be protected. EWR 127-1 defines an impact limit line as a hazardous launch area and the boundary within which trajectory constraints and flight termination systems are used to contain an errant launch vehicle and vehicle debris. EWR 127-1 at 1-vii (Oct. 31, 1997). In practice, an impact limit line is not a “line in the sand.” A worst-case map and tracking error could result in an impact beyond an impact limit line without necessarily indicating a failure of the flight safety analysis or the flight safety system as long as there is no impact of a protected area. Thus, an impact limit line does not mark only what must be protected.

One of the proposed criteria for establishing flight control lines dictates that flight control lines must protect any land area not controlled by the launch operator. The FAA's protected areas would not only include towns, cities and other obviously populated areas, but all land areas outside the control of the launch operator because of the relatively high probability that people could be present on any land and the fact that any land may constitute property or contain the property of others. The safety of ships and aircraft would be addressed through the establishment of hazard areas and flight commit criteria as discussed earlier in this notice.

If the overflight of a land area not controlled by the launch operator is necessary as part of normal flight, it may be accomplished by first establishing the flight control lines and then establishing a “gate” in the flight control lines in accordance with the risk criteria for overflight of land. A launch vehicle would be allowed to pass through a gate only if the vehicle was performing within normal limits. The land areas within a gate are still considered protected. The flight control lines protect such land areas up until the launch vehicle enters the gate. If the launch vehicle began to malfunction before it reached the gate, the flight safety system would terminate the flight before the launch vehicle reached the flight control line or the gate. FAA requirements would permit the launch vehicle to enter the gate and overfly a land area only if the launch operator obtained positive in-flight verification that the launch vehicle had performed within normal limits up to that point and performance parameters indicated that the launch vehicle would continue to perform normally and the launch vehicle's dwell time was such that it satisfied the risk criteria.

In addition to using the flight safety system, flight control lines, and gates as positive deterministic means to protect people and property, the regulations would also allow application of risk assessment techniques to quantify the risk to people in a proposed land overflight for purposes of determining whether the risk remains within acceptable limits. In effect, a launch operator's debris risk analysis would serve to restrict land overflight on the basis of the size of the population in any

land overflown. For example, the FAA expects that no launch in the foreseeable future would be able to meet the E
C
criteria of 30×10
−6
if the planned trajectory involved placing a gate in a flight control line that would result in overflight of a city or other densely populated area.

Flight control lines present other issues as well. The FAA defines the public to include other launch operators located at the same launch site. See Launch Site NPRM, 64 FR at 34334. The FAA's proposed use of a flight safety system and flight control lines would not necessarily provide protection for the property of such launch operators.
4

This is in keeping with the current practice at the federal launch ranges. Currently, at the federal launch ranges, two launch pads may be situated such that if flight control lines were drawn to demarcate and protect the property of others, launch might not take place at all because the flight control lines might intersect the normal flight trajectory. The unintended consequence of such an intersection at a federal range would be the requirement to destroy a perfectly good launch vehicle.

4
The proposed regulations would provide for the safety of another launch operator's personnel through the establishment and evacuation of hazard areas for each launch.

The basis of the FAA's proposed approach to ensuring the safety of another launch operator's property at the launch site is that, unlike the general public outside the launch site, another launch operator is in a significantly better position to be informed of launch activities and to participate in decisions on the best way to protect its property. The safety of another launch operator's property would be addressed through efforts coordinated by the launch site operator. Launch Site NPRM, 64 FR at 34337, 34364 (proposed section 420.55 and accompanying discussion). In this case, the FAA would not mandate how the safety of property is achieved, but would require that the coordination take place. As part of coordination with a launch site operator, a licensed launch operator would be required to provide any information on its activities and its potential hazards necessary to determine how to best protect another launch operator's property. For example, through coordinated scheduling, another launch operator may simply elect to ensure that its launch vehicle is not present when another launch is scheduled.

The FAA's flight control line requirements are not intended to preclude private arrangements that would result in more narrowly drawn flight control lines. After all, a launch site operator would have responsibility for coordination of its customers. For launch sites located outside of a federal launch range, where a launch site operator has the opportunity to select optimum launch point locations, the site operator could site each launch point so that it would be protected by flight control lines. Such a site operator would also be free to designate contractually that certain areas or property at a launch site or downrange be protected by flight control lines. The federal launch ranges do this today, describing impact limit lines around downrange assets such as transmitters whose loss would disrupt not just one but many launches. By not requiring flight control lines to protect the property of others at a launch site the FAA does not mean to imply that a launch operator might not face liability for any damage it caused to the property of others. Accordingly, the FAA recognizes that a launch site operator, in fulfilling its obligations under proposed section 420.55, and a launch operator, in the interests of avoiding damage to the property of others, may wish to establish flight control lines more stringent than those required by the FAA's proposed regulations.

A launch site operator's ability to require a launch operator to establish flight control lines by contract may create some confusion as to what is mandatory under the regulations. Regardless of whether a flight control line imposed by a launch site operator is more stringent than FAA requirements or not, that flight control line would still be mandatory under FAA regulation. Although flight control lines drawn within a launch site are not themselves required by FAA regulations, they are mandatory once included within the launch operator's flight safety plan. Because a flight safety plan is approved as part of the licensing process, it is mandatory upon a licensee.
See
14 CFR 415.73(a).

6. Distant Focus Overpressure Blast Effects Risk Analysis

A launch operator would be required to conduct an analysis to demonstrate that the potential hazard resulting from impacting explosive debris, including impact of an intact launch vehicle, would not cause public exposure to distant focus overpressure blast effects, sufficient to break windows and cause injuries. Impacting explosive materials, both liquid and solid, have the potential to explode. Given the appropriate combination of atmospheric pressure and temperature gradients, the impact explosion can produce distant focus overpressure at significant distance from the original blast point. Overpressures ranging from as low as 0.1 psi and greater may cause windows to break; but, depending on the size and thickness of windows and number of panes in each window in the locality of the launch site, other forms of overpressure such as multiple pulses may prove hazardous as well. Also, different levels of overpressure can occur at different distances depending on atmospherics and the explosive yield. A launch operator would have to address whichever levels and forms of overpressure created a hazard for the windows in the locale.

The distant focus overpressure explosion hazard primarily arises out of the impact of un-ignited solid propellant motors or failures of segmented motors so that portions of the motor impact intact,
5

and, when the weather conditions for inversion and lapse layers are right, the overpressure can focus in distant locations. A weather condition, referred to as an inversion, where sonic velocity increases with altitude, reflects the shock wave back toward the surface, where it can produce an increased overpressure at distances far from the source of the blast. The largest overpressure increase is produced from a caustic condition where the sonic velocity first decreases from its surface value and then increases beyond its surface value with increasing altitude.

5
Liquid propellant impact explosions are rare because destruction of a launch vehicle through a flight termination action usually causes the liquid propellant to disperse prior to impact.

The federal launch ranges typically assess the hazards of potential distant focus overpressure on a programmatic basis to determine if any population may be at risk for a given combination of launch vehicle and launch point. Based on this analysis a federal range may or may not perform an analysis for each launch. The FAA considered the option of not requiring this analysis. The FAA is aware of only a few launches involving the largest launch vehicles being delayed due to concerns regarding distant focus overpressure. This raised the question of whether sufficient grounds for concern exist to export this requirement to non-federal launch sites. However, because breaking windows or glass may cause injury to the public and the purpose of this rulemaking is to address all potential expendable launch vehicles, from all launch sites, the FAA proposes to retain this requirement. A launch operator would employ either a deterministic or

probabilistic analysis approach. For the deterministic approach, the launch operator would use the methodologies contained in the American National Standard Institute's ANSI S2.20-1983, “Estimating Air Blast Characteristics for Single Point Explosions in Air with a Guide to Evaluation of Atmospheric Propagation and Effects” to identify any populations that may be at risk and to establish flight commit criteria and other hazard mitigation measures. When using a probabilistic approach the launch operator would demonstrate through a distant focus overpressure risk analysis that the launch will be conducted in accordance with the proposed public risk criteria. The FAA proposes to evaluate any distant focus overpressure risk analysis on a case-by-case basis.

7. Dependent Analyses

Many of the proposed analyses are inherently dependent on one another. A launch operator would be required to ensure that each analysis product or data output is compatible in form and content with the data input requirements of any dependent analysis. A chart is provided in order to assist launch operators in determining which analyses depend on other analyses. The left column of figure 1 lists each analysis that is a source of data to be used as input by another analysis. The remaining columns in figure 1 identify the analyses that are dependent on the data from each data source analysis. The dependencies identified in figure 1 may vary depending on the methods that a launch operator chooses to implement to meet the proposed requirements for each analysis. A launch operator would have to understand the dependencies that its analyses have on one another in order to ensure that the overall analysis results accurately reflect the proposed launch and provide for public safety. The following paragraphs provide some examples of these dependencies that are of particular interest.

BILLING CODE 4910-13-P

EP25OC00.000

BILLING CODE 4910-13-C
All of the analyses depend on some form of trajectory analysis. Before a launch operator can analyze malfunction turns, establish flight safety limits or hazard areas, or perform various risk analyses, the launch operator must have a clear understanding of what the launch vehicle's trajectory would be under normal conditions when the vehicle performed as intended. For example, a launch operator would employ a point along the nominal trajectory as a starting point for a malfunction turn. As another example, in order to establish flight control lines and any gates in a flight control line that define the region over which a launch vehicle would be allowed to fly, a launch operator would have to know the limits of normal launch vehicle flight. The other proposed analyses have a similar dependence on the results of the trajectory analysis. An error made when performing the trajectory analysis or in translating the output of the trajectory analysis into input for the other analyses, can have a ripple effect, resulting in invalid analysis results with a potential negative effect on public safety.

Before a launch operator can establish flight safety limits or hazard areas to protect people and property from flight hazards, the launch operator must have a clear understanding of those hazards, which is the primary purpose of the debris analysis. A launch operator would conduct a debris analysis to identify inert, explosive and other hazardous launch vehicle debris resulting from a launch vehicle malfunction and from any planned jettison of launch vehicle components. A debris analysis would list and categorize the debris that would result from planned events and the potential activation of a flight termination system or spontaneous breakup due to a launch vehicle failure. Each debris piece would be categorized according to its physical properties and other characteristics, such as whether it is inert or explosive and the effects of impact, such as explosive overpressure radius, skip, splatter, or bounce. A launch operator 's flight safety limits analysis and hazard area analyses would use the debris characteristics established by the debris analysis to determine the debris impact dispersion, which shows where the debris might travel as it falls through the atmosphere and as it is affected by conditions such as wind and changing air density. The products of the debris analysis would also be used to determine where planned stage impacts would occur and, in the event of a malfunction, to ensure activation of the flight safety system in sufficient time to keep the impacting debris from impacting outside the flight control lines. The hazard area analysis would use debris data to identify the land, sea, and air regions that would have to be publicized, monitored, controlled, or evacuated in order to protect the public from potential impacting debris and comply with the public risk criteria.

As a final example, the debris analysis products would be employed in a debris risk analysis to determine the expected average number of casualties (E
C
) to the collective members of the public exposed to inert and explosive debris hazards from any one launch. The calculation of E
C
is dependent on the effective casualty area of the debris. A debris risk analysis would determine the effective debris casualty area as a function of, among other factors, launch vehicle flight time, whether the debris is from a launch vehicle breakup or a planned spent stage or jettisoned component impact, and whether the debris is inert or explosive on impact or dissipates through burning during its fall. A launch operator's debris analysis would also determine the effective casualty area for debris resulting from both payload and vehicle systems and subsystems.

8. Casualty Due to Debris

A launch operator should be aware that a debris analysis raises issues that have been the subject of debate for some time with respect to the definition of casualty. By this notice, the FAA proposes to employ its definition of serious injury as part of its definition of casualty. The FAA defines serious injury to mean any injury which requires hospitalization for more than 48 hours, commencing within seven days from the date the injury was received; results in a fracture of any bone (except simple fractures of fingers, toes, or nose); causes severe hemorrhages, nerve, muscle, or tendon damage; involves any internal organ; or involves second- or third-degree burns, or any burns affecting more than five percent of the body surface.
See
14 CFR 401.5 (referencing “serious injury” within definition of “launch accident”).

The proposed debris analysis requirements would require a launch operator to identify each piece of debris. In determining the debris hazard area that constitutes part of a flight hazard area and in defining ship-hit contours, the proposed regulations would require a launch operator to account for debris pieces with a ballistic coefficient of three or greater. The FAA realizes that, depending on circumstances, the impact of a person by a debris piece with a ballistic coefficient of less than three might cause a casualty and conversely, a debris piece with a higher ballistic coefficient might not cause a casualty. However, based on a review of the approaches used at the federal launch ranges, the FAA believes that using a ballistic coefficient of three when determining hazard areas and performing debris risk analyses provides for an appropriate level of safety.

The Western Range has historically analyzed all debris, regardless of how small the debris may be. The Eastern Range uses a ballistic coefficient of three as the measure of concern. The FAA proposed a ballistic coefficient of three in its Launch Site NPRM. A ballistic coefficient of three correlates approximately to a hazardous debris piece possessing 58 foot-pounds of kinetic energy, the Air Force explosive safety standard for debris that would produce a casualty. “Casualty Areas from Impacting Inert Debris for People in the Open,” RTI/5180/60-31F Montgomery and Ward, 2.2 (Apr. 13, 1995). This report recognizes the difficulties in establishing a suitable threshold expressed in terms of kinetic energy.
Id.
(citing “Estimation of Casualty from Impacting Debris,” ACTA, Inc., Technical Rep. No. 39-217/15-01, prepared for the U.S. Department of the Air Force (Sept. 29, 1989)). Those difficulties may be illustrated through example. For instance, a tackled football player who experiences an energetic impact of 400 to 500 foot-pounds usually is not injured. On the other hand, someone who stops a 38-caliber bullet having a kinetic energy of only 120 foot-pounds may well be killed. Other difficulties in employing kinetic energy as an indicator of a hazard are apparent as well. A piece of launch vehicle debris with an area of one square foot and a tumbling ballistic coefficient of two can have a vertical velocity component at impact of about 21feet per second and a kinetic energy of about eight foot-pounds. Although a broad side impact from the debris piece might leave a person unharmed, a slashing end-on impact might result in a serious wound.

Accordingly, although the Air Force uses 58 foot-pounds as a safety standard for a hazardous debris fragment , the FAA does not consider 58 foot-pounds a sufficiently adequate measure of what might produce a casualty. ACTA points out that this impact energy could be obtained with a full 12-ounce beverage can dropped from seven stories up, and that it could kill someone at street level. “Estimation of Casualty” at 1-10. Nor does reliance on kinetic energy account

for the surface area over which the impact may occur, or the duration of the impact, both of which are significant.

As a result, as the FAA proposed in the Launch Site NPRM, the FAA proposes to rely on a ballistic coefficient of three. See Launch Site NPRM, 64 FR at 34347 (relying on ballistic coefficient of three “because it is the most wind sensitive debris piece with a potential for harm of reasonable significance.”).

9. Collective Risk

As in previous rulemakings, this rulemaking raised a number of issues regarding risk. The FAA has had to address whether or not to limit risk based on an aggregation of the risks associated with each common launch hazard, whether to set a risk limit for each hazard separately and questions regarding the contribution of a flight termination system failure to risk in the launch area. The FAA proposes to limit acceptable risk to an aggregation of all hazards. On the basis of practices at the federal launch ranges, the FAA proposes to require consideration of the possibility of a flight termination system failure as a contributor to the risk of debris.

a.
Aggregation of hazards to measure risk.
In 1999, the FAA adopted a risk standard for debris which permitted launch only if flight of the launch vehicle did not exceed an expected average number of 0.00003 casualties (E
C
) per launch (E
C
≤30×10
−6
). 14 CFR 415.35(a). In this notice the FAA proposes to set a collective risk standard that accounts for all hazards, not just for debris, including such common hazards as those associated with toxic releases and blast overpressure. As permitted by 127-1, different federal launch ranges have different practices. EWR 127-1 establishes launch risk guidance on “a collective risk level of not more than 30 casualties in 1 million (30×10
−6
) for the general public.” EWR 127-1, 1-12, 1.4d (Oct. 31, 1997). The Air Force has not made a final decision on what that measure reflects.
See id.
at 1-41, Appendix 1D, 1D.1b (“The overall risk levels
may or may not
be an additive value that includes risks resulting from debris, toxic and blast overpressure exposures.” (Emphasis added.)) In practice, this has resulted in differing approaches at the Eastern and Western Ranges.

Historically, the 30th Space Wing, which oversees safety at the Western Range at VAFB, has reviewed an aggregated E
C
for all hazards of each launch when the measures of risk for each hazard are available.
6

The Western Range has found that one hazard usually predominates as the source of risk. The conditions that are conducive to driving up the risk of one hazard usually render another hazard less significant. Also, as a general rule, most launch vehicles do not generate multiple risks. Accordingly, on the basis of available risk measures, at the Western Range, the risks created by the combination of debris, toxic releases and blast overpressure do not tend to exceed E
C
≤30×10
−6
.

6
As the FAA is proposing, the federal launch ranges assess risks to determine the acceptability of those risks when containment or exclusion measures do not otherwise provide an adequate approach. Exclusion has proved practical and therefore, often, preferable. Where the ranges employ exclusion, they often do not measure the risk because risk remains far below the threshold levels. For example, if there is no inversion layer on the day of launch, there is no need to perform a risk analysis.

The same may or may not be true at the Eastern Range. The 45th Space Wing, which conducts launch safety for the Eastern Range, came more recently to the use and quantification of risk. Weather conditions and launch azimuths did not require the refinements of risk analysis to determine when conditions were satisfactory for launch. The Eastern Range used deterministic methods predicated on worst case conditions, assuming for toxic hazards that the undesired event would occur. Unlike the Western Range, the Eastern Range does not aggregate the risk numbers associated with each hazard for each launch. Instead, it caps two hazards, debris and overpressure, at E
C
≤30×10
−6
, and possibly toxic hazards as well. Were the Eastern Range to limit an aggregate of the identified hazards, rather than each one, the Eastern Range believes that launch availability would be curtailed below present launch rates. Accordingly, for commercial and government launches, the Eastern Range uses an E
C
≤30×10
−6
, for debris, an E
C
≤30×10
−6
for blast overpressure and E
C
≤233×10
−6
for toxic releases, where the Eastern Ranges defines the public as non-mission essential personnel located at the Cape and the general public outside of the Cape. The E
C
for toxic releases reflects the fact that the Eastern Range operates within the Range Commander's discretionary zone for accepting risk. The FAA foresees the possibility that capping risk at an E
C
≤30×10
−6
, for all hazards, may have an impact on launch availability and scheduling and invites comment from the launch operators regarding any data they may have regarding the possible effects.

The accuracy of the Eastern Range's measure of expected casualty is the subject of debate in light of the mitigation response available. In accordance with guidance from Space Command's Surgeon General, the Eastern Range approached local Brevard County authorities, described its risk management policy to the county and recommended a hazard level and management approach. The county agreed to the approach. The Eastern Range informed the county of its nominal public safety criteria of 30×10
−6
for each hazard, but that the recommended concentrations and risk level represented a collective risk level of 233×10
−6
. The county agreed with the recommendation. The Eastern Range and the county reached agreement on what predicted concentration of parts per million for various substances would result in a launch delay. The Eastern Range has not developed any methodology by which the effectiveness of Brevard County's emergency response can be accounted for in its risk estimation model, LATRA.

The county and the Eastern Range improved their notification capability after a January 1997 Delta abort, which took place prior to county personnel being present on base for all launches. Notification to the Brevard County Emergency Management Coordinator about the actual abort hazards from the August 1998 Titan abort took only minutes, as opposed to hours for 1997 Delta abort. Additionally, since that time the county has activated its automated reverse 911 capability for calling thousands of residences per hour for emergency notifications. While this capability has not been exercised to date for hazards arising out of a launch, it certainly promises mitigation benefits. Also, arrangements between Brevard County emergency management personnel and National Weather Service (NWS) Melbourne weather personnel have been made to transmit emergency management announcements of toxic cloud information. The announcements are made over the NOAA Weather Alert Radio System, which is constantly monitored on thousands of radios throughout the county, particularly at all schools and other county facilities. These emergency response capabilities and their effectiveness in reducing overall risk of exposure have not been evaluated.

Maintaining all risks below an acceptable level provides the best course. The FAA seeks to avoid a person being injured by any cause. This constitutes current practice for the 30th Space Wing and may well prove to constitute current practice for the 45th

Space Wing. The 45th may continue to abide by its understanding with Brevard County and alert the county at the concentration levels agreed to for government launches. The FAA anticipates that part of achieving a common approach to aggregations would require a launch operator to input identical failure response modes and associated probabilities for each hazard. If, for a commercial launch, risk exceeds 30×10
−6
when calculated under a standardized approach, launch may not take place. The FAA seeks public comment on the potential impacts of this proposal.

b.
Contribution to collective risk due to the possibility of flight termination system failure.
The FAA proposes to require a launch operator to address the possibility of a flight termination system failure in the course of the launch operator conducting its risk analysis. Although it may appear that flight termination system contribution is not addressed for most operational systems launching from federal ranges today, the ranges do, in fact, review whether flight termination system failure may constitute a significant contribution to risk. The ranges make this assessment early in the process of assessing a new launch vehicle system, and the Eastern Range, for each launch, assesses failure modes where a potential flight termination system failure could result in significant contribution to collective risk. Because of the robust flight termination system test program, redundancy and the degree of oversight the ranges' flight safety system analysts exercise, those responsible for assessing risk count on the reliability of the flight termination system employed for each launch. Although in many instances initial analysis may demonstrate that the contribution of flight termination system failure to expected casualty is insignificant, a credible scenario may exist where the contribution would be significant. Accordingly, based on the ranges' experience and the reasons addressed in the following discussion, the FAA proposes to ensure through this rulemaking that all commercial launch operators employing a flight termination system account for the contribution to risk of possible flight termination system failure.

As a general rule, where a flight termination system plays a role in mitigating a hazard, the likelihood of a failure of a flight termination system may contribute to the final outcome of an E
C
analysis and the ranges assess that contribution to determine its significance. Where a flight termination system does not serve to mitigate the potential risk, its contribution is not assessed. With the exceptions of failure scenarios addressing toxic and distant focus overpressure hazards, this typically means that for failure scenarios in which the launch vehicle's instantaneous impact point remains within the range destruct lines, possible flight termination system failure does not contribute in a significant way to risk totals. This is because under those circumstances the consequences of such a failure remain extremely low. A flight termination system may fail while the launch vehicle performs successfully, or the launch vehicle and the flight termination system could both fail, but if the launch vehicle's instantaneous impact point stays within the destruct lines, the consequences are typically negligible.

For potential launch vehicle break up that occurs when the vehicle's instantaneous impact point has moved outside the range destruct line, the ranges consider flight termination system reliability a factor in debris, toxic and distant focus overpressure E
C
calculations because a flight termination system can prevent a launch vehicle from crossing destruct lines. The Western Range generally does not calculate the E
C
for vehicle instantaneous impact point outside the destruct lines for each launch. At the Eastern Range, the 45th Space Wing does account for the possibility of a launch vehicle's instantaneous impact point crossing destruct lines, in what it characterizes as a “mode 5” failure analysis, due to the presence of populations in the vicinity including launch viewing areas open to the public.

There are also scenarios where the vehicle's instantaneous impact point remains within the destruct lines and where potential flight termination system failure would contribute to collective risk. For example, an on course failure endangering the continued operation of the flight termination system itself, by, for example, tumbling, could contribute to risk, although the ranges do not consider it significant because of the flight termination system design and test requirements that ensure a flight termination system will survive launch vehicle failure environments to the point that the launch vehicle will break up. As another example, if a flight termination system failed to disperse toxic materials at altitude or prevent intact impact of propellant and resulting explosions, the flight termination system probability of failure might contribute to risk.

Toxic release and distant focus overpressure risks are both functions of the probability of vehicle breakup at a location near the launch site and their hazardous effects upon the public are not necessarily dependent on destruct line violation. Therefore, destruct line violation is not considered as a factor in calculating toxic release and distant focus overpressure risks.
7

7
At the Eastern Range, only debris is considered for possible E
C
contribution outside of a destruct line. Failure of a flight termination system could allow an intact vehicle to impact off site with enough remaining toxic or perhaps explosive material to cause a toxic release or explosion at the distant site. To employ the ranges' computer models for a risk analysis under this situation would require establishing a source location at the distant impact site and assessing the local population, number of windows, local wind field, etc. This is not practical given a large number of possible, random distant impact sites. Because a flight termination system failure with ensuing uncontrolled flight and impact would be hazardous enough in itself, the Eastern Range treats attempting to calculate additional secondary effects of toxics and overpressure as superfluous.

F. Flight Safety System

1. Introduction

This proposed rulemaking contains requirements governing a flight safety system. The FAA proposes to define a flight safety system as a system that provides a means of preventing a launch vehicle and its hazards, including any payload hazards, from reaching any populated or other protected area in the event of a launch vehicle failure. A flight safety system, unless otherwise approved in the course of the licensing process, consists of an onboard vehicle flight termination system, a command control system, and support systems on the ground, including tracking, telemetry, display, and communications, and includes all associated hardware and software. A flight safety system also includes the functions of any personnel who operate flight safety system hardware and software.

This proposed rulemaking reflects much that is current practice at the federal launch ranges today. As with the other proposed requirements, the FAA in this proposed rulemaking intends to regulate flight safety systems as necessary to protect the public health and safety and the safety of property against significant risks and to achieve a high level of safety. A flight safety system protects against the significant risks created by launch of a launch vehicle. The requirements of the federal launch ranges, including their design, testing and installation requirements, are all part of an approach that has resulted in members of the public experiencing no physical harm. The FAA seeks to maintain the same high level of safety that the federal ranges have achieved. At the same time, the

FAA recognizes that more than one method exists by which to protect the public and to achieve the requisite levels of safety.

The proposed rulemaking proposes performance requirements for any flight safety system a licensed launch operator will employ, whether that flight safety system is the more familiar command destruct system, or an autonomous system, including Sea Launch's Russian and Ukrainian thrust termination system. As one of the more general performance goals, a flight safety system must keep the hazards associated with a launch vehicle and its payload from reaching populated and other protected areas. A launch operator seeking a license must demonstrate convincingly its ability to satisfy this requirement. If a launch operator plans to employ the flight termination system upon which most licensees rely today, this proposed rulemaking provides the performance, design, test and installation requirements with which that licensee must comply. If a launch operator proposes an atypical flight safety system, the launch operator must provide a clear and convincing demonstration that it will achieve an equivalent level of safety to that obtained through adherence to the requirements.

Although this proposed rulemaking would codify much of what the federal launch ranges require, some changes will be evident. Some of these changes arise out of the differences between regulatory requirements and the fact that the federal launch ranges may speak in terms of goals and the FAA must determine whether to require that goal or not. Other differences will evolve out of the existence of waivers issued by the federal launch ranges. A review of some of the background behind various flight safety systems is useful at the outset.

2. History and Background

Launch vehicles launching from the United States typically use a flight safety system, referred to at the federal launch ranges as a flight termination system or FTS, that is used to destroy the launch vehicle whenever the launch vehicle strays outside of a predefined flight envelope. Federal launch ranges typically require an FTS on guided launch vehicles that have the capability to violate established safety criteria under powered flight, in order to protect the public and range personnel. The reliability of the flight safety system plays more of a role than the reliability of the launch vehicle in achieving safety.

U.S. design standards normally require a redundant command flight termination system on every powered stage capable of reaching the public unless a particular stage possesses an autonomous destruct system such as an inadvertent separation destruct system (ISDS). The commonly employed inadvertent separation destruct system is usually implemented for solid rocket motors. Some rocket stages, primarily solid rocket boosters, may be capable of continued flight after becoming separated from the main launch vehicle if their propellant is not exhausted and continues to burn or even, as happens at times, begins to burn and produce thrust. An ISDS is required to ensure that a thrusting motor, freed by a vehicle breakup, will be destroyed. An ISDS uses lanyards, break wires, or other devices to detect the conditions in which it will initiate a destruct action. An ISDS is typically employed on stages that have the potential to become separated from the command flight termination system during the break up of a launch vehicle.

An autonomous system such as Sea Launch's Zenit-3SL's thrust termination system uses multiple computers to evaluate vehicle status as well as vehicle performance to determine if a flight termination command is required. The U.S. standards require a flight termination system to destroy a vehicle, not just terminate the motor thrust as is accomplished by a thrust termination system. An U.S. flight termination system is designed to terminate the thrust of the vehicle and to disperse the propellants with minimal explosive effect. Russian and Ukrainian space launch programs traditionally use an autonomous thrust termination system for liquid fueled vehicles. Such a system relies on the autonomous detection of trajectory or vehicle anomalies, the detection of which results in an autonomous shutdown of the liquid rocket engines. Termination of thrust allow

[Text truncated at 120,000 characters. The full text is on the page linked above.]

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A00-24472. Public record. Not legal advice.