Paul D. Wilde, Ph.D., P.E. - Federal Aviation Administration

70th International Astronautical Congress, Washington, DC.Copyright 2019 by Eleven International Publishing. All rights reserved. One or more authors of this work are employees of the government ofUnited States, which may preclude the work from being subject to copyright in USA, in which event no copyright is asserted in that country.reaching any populated or other protected area andensure that the launch satisfies the public risk criteria.”GPS SatellitesGPSReceiverTelemetryTransmitterDe s tCructIG, GPS Data,Vehicle HealthDataTelemetryData nitiatorsCommandReceiverPositionand mDisplayof Map,DestructLinesand cerFig. 2: Traditional Flight Safety System Elements.One fundamental tenet of risk management is thatacceptable risk levels are set with an understanding of theconsequences of a hazard and the likelihood of itsoccurrence. Of course, no serious public consequencesfrom launch or re-entry are truly acceptable, in that noresponsible authority would regard such an event asroutine or permissible. The FAA seeks to maintain alevel of public safety where adverse public consequencesremain rare events by enforcing well-defined regulatoryrisk tolerability criteria supported by multiple lines oflogic. 8,9 While the unmitigated consequences of CSThazards can be substantial (e.g. multiple casualties andmillions of dollars in damages would be the expectedoutcome if a large launch or re-entry vehicle crashed ona major city as explained in more detail below 10, 11), theacceptable risk levels contained in FAA/AST regulationsIAC-19-D6.1are only a small fraction of the “normal backgroundrisk accepted in the course of normal day-to-dayactivities.” 12 For example, AST’s risk limits equate toless than 1% of the annual risk accepted by USpedestrians on an individual and collective basis. The riskcriteria set by AST in the commercial space regulationsfor licensed operations are the same for each mission.These limits were set as a means to manage the risk forcurrent and expected future operations, consistent withthe goal that adverse public events remain rare. AST willperiodically re-evaluate the risk criteria to account for thefrequency of CST activities; the demonstrated safetyrecord and benefits provided; technological capabilitiesand maturity of the industry; risks tolerated in otherindustries, and common perceptions of CST risks. 13No US space launch has created a public casualty.FAA/AST seeks to maintain a level of public safetywhere adverse public consequences remain rare events.AST enforces public safety requirements that wereinitially developed and implemented by the US Air Forceand NASA. Building upon this experience and approach,the FAA has promulgated and implemented the currentset of public safety regulations that include specificoperating requirements, specific safety requirements forcritical systems, and the application of a public riskmanagement process that uses quantitative analyses. Aprimary purpose of the public risk management processapplied to launch and re-entry is to facilitate informeddecisions regarding the operating parameters and vehicledesign features that are necessary to limit the predictedpublic risks to pre-defined criteria. AST uses a riskinformed process to systematically identify, reduce,monitor, and ensure acceptable public risks. Compliancewith the applicable regulations constitutes what is“necessary” to protect the public during CST in general.III. IMPORTANT DEFINITIONS AND CONTEXTCurrentSeveral formal definitions help facilitate anunderstanding of the FAA’s public safety criteria,including those central to traditional risks and conditionalrisk criteria.Risk is a metric that accounts for both consequenceand probability of a hazard over a specified interval ofexposure. The total risk accounts for all possibleoutcomes and can be computed as the product of theprobability of each event and its consequence.Individual risk expresses the risk to a single person.A common individual risk is the annual risk of a personbeing killed by lightning worldwide, which can beestimated as the average number of people killed bylightning per year divided by the total population of theworld. United States Air Force Space Command Manual(AFSPCMAN) 91-710 14 provides a formal definition ofindividual risk): “Individual risk is the risk that any singlePage 3 of 12

70th International Astronautical Congress, Washington, DC.Copyright 2019 by Eleven International Publishing. All rights reserved. One or more authors of this work are employees of the government ofUnited States, which may preclude the work from being subject to copyright in USA, in which event no copyright is asserted in that country.person will suffer a consequence. Unless otherwisenoted, individual risk is expressed as the probability thatany individual will become a casualty from a givenhazard (PC) at a specific location and event.”A casualty is someone that suffers a serious injury orworse, including death. A launch or re-entry risk analysiscomputes the maximum individual risk as the highestprobability of casualty for any individual as a result ofthe launch or re-entry.Collective risk is the risk of an adverse outcomeamong a group of individuals, often expressed in termsof expected values: the average (i.e., mean) consequencespredicted to occur as a result of a launch or re-entry if thelaunch or re-entry were to be repeated many times. Forexample, the collective risk of fatality posed by lightningon an annual basis is the average number of people killedby lightning each year (i.e. Expected Fatalities, EF). Notethat a collective risk, such as the expected number ofcasualties, is not a probability (since it could exceed one)as described and defined below.ProposedIn the FAA’s proposed parlance, a “flight abort”means the process to limit or restrict the hazards to publichealth and safety and the safety of property presented bya launch vehicle or re-entry vehicle, including anypayload, while in flight by initiating and accomplishing acontrolled ending to vehicle flight. Under the NPRM, aflight abort would be required as a hazard control strategyfor a phase of flight that is shown by a consequenceanalysis to potentially have significant public safetyimpacts (as explained in some detail below) withoutflight abort or another safeguard. Otherwise, the NPRMwould allow an operator to bypass the traditional FSScentric hazard control strategy and instead use alternativestrategies: e.g. where a launch vehicle that does not havesufficient energy for any hazards associated with its flightto reach the public or critical assets (physicalcontainment); given wind-weighting for an unguidedsuborbital launch vehicle 15; or using a flight hazardanalysis. 16 Irrespective of the hazard control strategyused, the proposal would require an operator to conductflight safety analyses as necessary to demonstrate that alaunch or re-entry meets the quantitative public safetycriteria for debris, far-field overpressure, and toxichazards. (Other hazards such as those from nuclearpower sources would be addressed on a case-by-casebasis.) The NPRM would continue the public risktolerability criteria already in place under 14 CFR417.107(b), with a couple of exceptions as described inthe NPRM. The NPRM would add a quantitativecriterion to protect against the loss of functionality of anasset essential to the national interests of the UnitedStates. Critical assets would be defined and identified asdiscussed below.IAC-19-D6.1The proposal includes new or updated formaldefinitions for the following terms.“Critical asset” would mean an asset that is essentialto the national interests of the United States. Criticalassets include property, facilities, or infrastructurenecessary to maintain national defense, or assured accessto space for national priority missions. Critical assetswould also include certain military, intelligence, and civilpayloads, including essential infrastructure when directlysupporting the payload at the launch site. Under thisproposal, the FAA anticipates that it would work withrelevant authorities, including licensed launch or re-entrysite operators or Federal property owner, to identify each“critical asset” and its potential vulnerability to launchand re-entry hazards.“Expected Casualty” would be defined as the meannumber of casualties predicted to occur per flightoperation if the operation were repeated many times. Theproposal clarifies in § 450.101 that the operator mayinitiate the flight of a launch vehicle only if all risks tothe public satisfy the criteria. This means a debris riskanalysis must demonstrate compliance with public safetycriteria either (1) prior to the day of the operation,accounting for all foreseeable conditions within the flightcommit criteria; or (2) during the countdown using thebest available input data.In the past, the FAA defined “public safety,” but theNPRM included a proposed definition of public for thefirst time. “Public” would mean, for a particular licensedor permitted launch or re-entry, people and property thatare not involved in supporting the launch or re-entry andincludes those people and property that may be locatedwithin the launch or re-entry site, such as visitors,individuals providing goods or services not related tolaunch or re-entry processing or flight, and any otheroperator and its personnel.IV. CURRENT FLIGHT SAFETY SYSTEM NEEDAs alluded to in the previous section, and explainedfurther in this section, the main purposes of a FSS are to(1) prevent high consequence events as a result oflaunch/re-entry vehicle failures, and (2) ensure that eachCST operation satisfies the public risk criteria. However,the current regulations for ELVs and RLVs use starklydifferent approaches to establish the need for a FSS.Current Regulations for ELVsFor Expendable Launch Vehicles (ELVs), the currentFAA regulation in §417.107(a) requires a launch operatorto employ a FSS if either (1) any hazard from a launchvehicle, vehicle component, or payload can reach anyprotected area at any time during flight; or (2) a failure“would have a high consequence to the public” in thevicinity of the launch site, and (3) “if the absence of aflight safety system would significantly increase thePage 4 of 12

70th International Astronautical Congress, Washington, DC.Copyright 2019 by Eleven International Publishing. All rights reserved. One or more authors of this work are employees of the government ofUnited States, which may preclude the work from being subject to copyright in USA, in which event no copyright is asserted in that country.accumulated risk from debris impacts” in the downrangearea.As with any hazardous operation, full hazardcontainment is the preferred approach during a launch orre-entry. However, physical containment for acommercial space transportation vehicle is rarelypossible. Setting aside potential toxic and explosivehazards for a moment, just the amount of kinetic energyrequired to reach Earth orbit generally means that somehazard from an orbital launch vehicle (e.g. the potentialfor a debris impact) can reach a populated area at sometime during flight. Thus, a FSS is practically alwaysnecessary for an orbital ELV to comply with§417.107(a), at least in the launch area, because withouta FSS some hazardous debris impact could reach thepublic in the launch area. Hence, the high energy andcomplex nature of launch and re-entry, particularly fororbital operations, means that the protection of publicsafety generally involves “risk management.”Furthermore, a FSS is typically necessary to ensurethat an orbital launch satisfies the public risk criteriagiven (1) the relatively high probability of failure forELVs, particularly for new ELVs compared to certifiedaircraft, 17,18 and (2) the potential for a high consequenceevent given a failure, especially during the first stage offlight when large quantities of propellant are onboard.The demonstrated flight experience of even the mostreliable ELVs to date, such as the Delta II, reveal failureprobabilities on the order of 1%, and the demonstratedflight history shows that new vehicles developed byexperienced manufacturers have a POF near 0.3 forinitial launches. New ELVs from inexperienceddevelopers have demonstrated failure probabilities abouttwice high. In contrast, certified commercial transportaircraft have demonstrated accident rates on the order toone in ten-million per flight, roughly five orders ofmagnitude lower than the most reliable ELVs.Thus, public safety for large orbital launch vehicleshas traditionally been protected with the use of a highlyreliable FSS and quantitative risk analysis (QRA) toensure any “residual risks” are acceptable. The termresidual risk refers here to public risk from a launch orre-entry that is not mitigated by a FSS.Another example of a residual public risk from ELVlaunches involves downrange overflight of populatedareas. For example, launches to the International SpaceStation (ISS) from Cape Canaveral Air Force Station, orfrom the Guiana Space Center (near Kourou, FrenchGuiana) typically overfly portions of Europe while theupper-stage is thrusting prior to orbital insertion. 19 Afailure during downrange overflight, such as a thrusttermination or an on-trajectory explosion, would result indebris impacts over a large area and could produce debrisimpacts in populated areas. During downrange overflightor large landmasses, the activation of a FSS cannotIAC-19-D6.1completely prevent the possibility of debris impacts inpopulated areas. Thus, downrange overflight usuallyinvolves a significant residual risk to the public, and insome cases, activation of a FSS could increase the risks.There are several reasons that the public risks fromdownrange overflight are often below the acceptable riskcriteria, which AST applies equally to foreign anddomestic populations. First, the probability of a failurethat could produce debris impacts in populated areas isoften very low because downrange overflight usuallyinvolves a short dwell time of the Instantaneous ImpactPoint (IIP) over populated areas; usually there is only aperiod of a few seconds where a failure could producedebris impacts in a populated area during downrangeflight because the IIP moves very rapidly as the vehicleapproaches orbital insertion. Second, the lower stages ofthe vehicle are usually jettisoned into the ocean longbefore the IIP reaches any populated area duringdownrange overflight. A failure of an upper-stage as thevehicle approaches orbital insertion generally producesmuch smaller danger areas (more often called casualtyareas) compared to failures earlier in lower-stage flightbecause (1) the inert mass associated with an upper-stageis generally much lower than a lower-stage, (2)propellants often disperse naturally following such highspeed and high altitude break-ups, and (3) the inert debrismay be reduced by ablation following a failure where thevehicle speed exceeds Mach 10.The foregoing paragraph explains why activation of aFSS during downrange overflight may be unnecessary toprotect public safety, and why the FAA only requires andELV to be equipped with a FSS during downrangeoverflight “if the absence of a flight safety system wouldsignificantly increase the accumulated risk from debrisimpacts.” For example, this key regulation (in §417.107)generally means that a FSS, or an alternative mitigation,is necessary to prevent a vehicle or payload (e.g. acapsule) with full propellant tanks from surviving toimpact, and thus producing a relatively large danger areadue to the ensuing explosion. A specific example is thatSpaceX designed the thermal protection system of theDragon capsule so that a launch failure during downrangeoverflight would result in break-up and demise, and thusmitigate the risk from the potential for the capsule tosurvive intact to impact. 20Current Regulations for RLVsThe FAA’s current regulation, in § 431.43(a)(5),explicitly links the need for initiation of a FSS to thequantitative pubic risk criteria (i.e. limits on collectiveand individual risks): an applicant must submitprocedures “for initiation of a flight safety system thatsafely aborts the launch of an RLV if the vehicle is notoperating within approved mission parameters and thevehicle poses risk to public health and safety and thesafety of property in excess of acceptable flight risk asPage 5 of 12

70th International Astronautical Congress, Washington, DC.Copyright 2019 by Eleven International Publishing. All rights reserved. One or more authors of this work are employees of the government ofUnited States, which may preclude the work from being subject to copyright in USA, in which event no copyright is asserted in that country.defined in § 431.35.” The current RLV regulation alsocontains a limit on the conditional risk posed by an“unproven RLV;” 431.43(d) states that “any unprovenRLV may only be operated so that during any portion offlight the expected average number of casualties tomembers of the public does not exceed 1E-4 given aprobability of vehicle failure equal to 1.” The preamblefor Part 431 21 explained the intent of this section: “whenfailure consequences may be too great to be toleratedthen population overflight would be barred,” and“because unproven vehicles have an unknown oruncertain failure rate, the FAA considers it reasonable toensure that risk is most effectively mitigated bycontrolling the consequences of a failure.”Summary of Current Regulatory ApproachesAlthough both the current ELV and RLV regulationsrelevant to FSS needs determination include limits on therisks and consequences of reasonably foreseeablefailures, there are stark differences in the substance andstyle of these current regulations. In the case of ELVs,the consequence limit is qualitative and effectively mootdue to the overriding requirement for a highlyreliable/tested FSS (at least in the launch area) to preventhazards from reaching protected areas during the flight ofany guided vehicle. To date, public safety for all orbitalCST vehicles has been protected with the use of a highlyreliable/tested FSS and quantitative risk analyses (QRAs)to ensure that any “residual risks” are acceptable basedon compliance with numerous specific requirements inPart 417 on the nature of the FSS and the QRA. Incontrast to the much more explicit and relativelyprescriptive regulations for ELV launch safety, theFAA’s current RLV regulations are process based anddevoid of any specific requirements on the nature of theFSS and the QRA. However, the current RLV regulationsincludes an explicit quantitative limit on conditionalrisks, but only for an “unproven” RLV, which was notformally defined. Although the process-based approachin Part 431 has protected public safety for severalsuborbital RLVs and RV reentries, no CST launch hasreached orbit to date under the current RLV regulations.difference between risk and consequence (akaconditional risk).As explained above, public risks reflect theprobability of dangerous events that could producenegative public consequences, such as casualties or lossof critical asset functionality. Whereas the risk from alaunch or re-entry accident is quantified as the product ofprobability of the accident and the average (i.e. mean)consequence of the accident, a conditional risk analysisexamines the outcome of an event independent of theprobability of that event. Thus, consequence analysis iscentral to and embedded in risk analysis. Mathematically,the on

IAC-19-D6.1 Page 1 of 12 . IAC19-- D6.1.6 FAA PROPOSED CONSEQUENCE PROTECTION CRITERIA FOR FLIGHT SAFETY SYSTEMS AND FLIGHT ABORT FOR COMMERCIAL SPACE TRANSPORTATION . Paul D. Wilde, Ph.D., P.E. Federal Aviation Administration, USA, paul.wilde@faa.gov