[Federal Register Volume 85, Number 238 (Thursday, December 10, 2020)]
[Rules and Regulations]
[Pages 79566-79740]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2020-22042]
[[Page 79565]]
Vol. 85
Thursday,
No. 238
December 10, 2020
Part II
Department of Transportation
-----------------------------------------------------------------------
Federal Aviation Administration
-----------------------------------------------------------------------
14 CFR Parts 401, 404, 413, et al.
Streamlined Launch and Reentry License Requirements; Final Rule
Federal Register / Vol. 85 , No. 238 / Thursday, December 10, 2020 /
Rules and Regulations
[[Page 79566]]
-----------------------------------------------------------------------
DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration
14 CFR Parts 401, 404, 413, 414, 415, 417, 420, 431, 433, 435, 437,
440, 450, and 460
[Docket No.: FAA-2019-0229; Amdt. No(s). 401-9; 404-7, 413-12, 414-4,
415-7, 417-6, 420-9, 431-7, 433-3, 435-5, 437-3, 440-5, 450-2, and 460-
3]
RIN 2120-AL17
Streamlined Launch and Reentry License Requirements
AGENCY: FAA Aviation Administration (FAA), Department of Transportation
(DOT).
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: This rule streamlines and increases flexibility in the FAA's
commercial space launch and reentry regulations, and removes obsolete
requirements. It consolidates and revises multiple regulatory parts and
applies a single set of licensing and safety regulations across several
types of operations and vehicles. The rule describes the requirements
to obtain a vehicle operator license, the safety requirements, and the
terms and conditions of a vehicle operator license.
DATES:
Effective date: This rule is effective March 10, 2021, except for
amendatory instructions 3, 11, 17, 20, 27, 44 and 54, concerning
Sec. Sec. 401.5, 413.1, and 413.23, the removal of parts 415, 417,
431, and 435, and instructions 68 and 73 amending Sec. Sec. 440.3 and
460.45, respectively, which are effective March 10, 2026.
Compliance: Affected parties, however, are not required to comply
with the information collection requirements in part 450 until the
Office of Management and Budget (OMB) approves the collection and
assigns a control number under the Paperwork Reduction Act of 1995. The
FAA will publish in the Federal Register a notice of the control number
assigned by the Office of Management and Budget (OMB) for these
information collection requirements.
ADDRESSES: For information on where to obtain copies of rulemaking
documents and other information related to this final rule, see ``How
To Obtain Additional Information'' in the SUPPLEMENTARY INFORMATION
section of this document.
FOR FURTHER INFORMATION CONTACT: For technical questions concerning
this action, contact Randy Repcheck, Office of Commercial Space
Transportation, Federal Aviation Administration, 800 Independence
Avenue SW, Washington, DC 20591; telephone (202) 267-8760; email
[email protected].
SUPPLEMENTARY INFORMATION:
Authority for This Rulemaking
The Commercial Space Launch Act of 1984, as amended and codified at
51 U.S.C. 50901-50923 (the Act), authorizes the Secretary of
Transportation to oversee, license, and regulate commercial launch and
reentry activities, and the operation of launch and reentry sites
within the United States or as carried out by U.S. citizens. Section
50905 directs the Secretary to exercise this responsibility consistent
with public health and safety, safety of property, and the national
security and foreign policy interests of the United States. In
addition, Sec. 50903 requires the Secretary to encourage, facilitate,
and promote commercial space launches and reentries by the private
sector. As codified at 49 CFR 1.83(b), the Secretary has delegated
authority to carry out these functions to the FAA Administrator.
This rulemaking amends the FAA's launch and reentry requirements,
consolidating and revising multiple regulatory parts to set forth a
single set of licensing and safety regulations across several types of
operations and vehicles. It also streamlines the commercial space
regulations by, among other things, replacing many prescriptive
regulations with performance-based rules, and giving industry greater
flexibility to develop means of compliance that maximize their
objectives while maintaining public safety.
List of Abbreviations and Acronyms Frequently Used in This Document
AC--Advisory Circular
CEC--Conditional expected casualty
EC--Expected casualty
ELOS determination--Equivalent-level-of-safety determination
ELV--Expendable launch vehicle
FSA--Flight safety analysis
FSS--Flight safety system
RLV--Reusable launch vehicle
Table of Contents
I. Overview
II. Background
III. Discussion of the Rule
A. Safety Framework
B. Detailed Discussion of the Final Rule
1. Prescriptive vs Performance-Based Regulations, ELOS, Safety
Case
2. Part 450 Subpart A--General Discussion
a. Pre-Application Consultation
b. Application Process
c. Compliance Period for Legacy Licenses (Sec. 450.1(b))
d. Definition and Scope of Launch (Sec. 450.3)
e. Safety Element Approval (Part 414)
f. Vehicle Operator License--Issuance, Duration, Additional
License Terms and Conditions, Transfer, and Rights Not Conferred
(Sec. Sec. 450.5 Through 450.13)
3. Part 450 Subpart B--Requirements To Obtain a Vehicle Operator
License
a. Incremental Review and Determinations (Sec. 450.33)
b. Means of Compliance (Sec. 450.35)
c. Use of Safety Element Approval (Sec. 450.39)
d. Policy Review (Sec. 450.41)
e. Payload Reviews (Sec. 450.43)
f. Safety Review and Approval (Sec. 450.45)
g. Environmental Review (Sec. 450.47)
4. Part 450 Subpart C--Safety Requirements
a. Neighboring Operations Personnel (Sec. 450.101(a) and (b))
b. High Consequence Event Protection (Sec. 450.101(c))
c. Critical Asset and Critical Payload Protection
d. Other Safety Criteria (Sec. 450.101(d), (e), (f), and (g))
e. System Safety Program (Sec. 450.103)
f. Hazard Control Strategies (Sec. 450.107)
g. Hazard Control Strategy Determination (Sec. 450.107(b))
h. Flight Abort (Sec. 450.108)
i. Flight Hazard Analysis (Sec. 450.109)
j. Physical Containment (Sec. 450.110)
k. Wind Weighting (Sec. 450.111)
l. Flight Safety Analysis (Sec. Sec. 450.113 to 450.139)
m. Flight Safety Analysis Requirements--Scope (Sec. 450.113)
n. Flight Safety Analysis Methods (Sec. 450.115)
o. Trajectory Analysis for Normal Flight (Sec. 450.117)
p. Trajectory Analysis for Malfunction Flight (Sec. 450.119)
q. Debris Analysis (Sec. 450.121)
r. Population Exposure Analysis (Sec. 450.123)
s. Probability of Failure Analysis (Sec. 450.131)
t. Flight Hazard Area Analysis (Sec. 450.133)
u. Debris Risk Analysis (Sec. 450.135)
v. Far-Field Overpressure Blast Effect Analysis, or Distant
Focus Overpressure (DFO) (Sec. 450.137)
w. Toxic Hazards (Sec. Sec. 450.139 and 450.187)
x. Computing Systems (Sec. 450.141)
y. Safety-Critical Systems Design, Test, and Documentation
(Sec. 450.143)
z. Flight Safety Systems (Sec. Sec. 450.143 and 450.145)
aa. Hybrid Vehicles
bb. Agreements and Airspace (Sec. 450.147)
cc. Safety-Critical Personnel Qualifications (Sec. 450.149)
dd. Work Shift and Rest Requirements (Sec. 450.151)
ee. Radio Frequency (Sec. 450.153)
ff. Readiness and Rehearsals (Sec. 450.155)
gg. Communications (Sec. 450.157)
hh. Pre-Flight Procedures (Sec. 450.159)
ii. Control of Hazard Areas (Sec. 450.161)
jj. Lightning Hazard Mitigation (Sec. 450.163)
kk. Flight Commit Criteria (Sec. 450.165)
ll. Tracking (Sec. 450.167)
mm. Launch and Reentry Collision Avoidance Analysis Requirements
(Sec. 450.169)
[[Page 79567]]
nn. Safety at End of Launch (Sec. 450.171)
oo. Mishap (Definition, Sec. Sec. 450.173 and 450.175)
pp. Unique Safety Policies, Requirements and Practices (Sec.
450.177)
qq. Ground Safety (Sec. 450.179 to Sec. 450.189)
5. Part 450 Subpart D--Terms and Conditions of a Vehicle
Operator License
a. Public Safety Responsibility, Compliance With License,
Financial Responsibility, Human Spaceflight Requirements (Sec. Sec.
450.201 to 450.207)
b. Compliance Monitoring (Sec. 450.209)
c. Continuing Accuracy of License Application; Application for
Modification of License (Sec. 450.211)
d. Pre-Flight Reporting (Sec. 450.213)
e. Post-Flight Reporting (Sec. 450.215)
f. Registration of Space Objects (Sec. 450.217)
6. Changes to Parts 401, 413, 414, 420, 433, 437, and 440
7. Miscellaneous Comments
8. Responses to Regulatory Impact Analysis Comments
IV. Regulatory Notices and Analyses
A. Regulatory Evaluation
B. Regulatory Flexibility Act
C. International Trade Impact Assessment
D. Unfunded Mandates Assessment
E. Paperwork Reduction Act
F. International Compatibility
G. Environmental Analysis
V. Executive Order Determinations
A. Executive Order 13771, Reducing Regulation and Controlling
Regulatory Costs
B. Executive Order 13132, Federalism
C. Executive Order 13211, Regulations That Significantly Affect
Energy Supply, Distribution, or Use
VI. How To Obtain Additional Information
Rulemaking Documents
Comments Submitted to the Docket
Small Business Regulatory Enforcement Fairness Act
I. Overview
Overview of Final Rule
This rule amends 14 CFR parts 415, 417, 431, and 435 by
consolidating, updating, and streamlining all launch and reentry
regulations into a single part 450. After March 10, 2026, parts 415,
417, 431, and 435 will be removed. This rule also revises multiple
regulatory parts to apply a single set of licensing and safety
regulations across several types of operations and vehicles. In
addition, this rule replaces many prescriptive regulations with
performance-based rules, giving industry greater flexibility to develop
means of compliance that meet their objectives while maintaining public
safety. Where possible, the FAA has adopted performance standards, and
considered the prescriptive requirements for placement in advisory
circulars (AC) that will identify possible means of compliance, but not
the only means of compliance, with this rule. The goal of this approach
is to afford the industry and the FAA the added flexibility of using
new methods to better enable future innovative concepts and operations.
While some of the provisions in this rule may increase the risk to
public safety compared to the current regulations, such as the
provisions that apply to neighboring operations personnel, the FAA has
ensured that the increased risk is minimal and there is a corresponding
public interest benefit.
Part 450 accommodates all vehicle operators, including hybrid
vehicle operators. The revisions include more performance-based
requirements, alternatives to flight abort and flight safety analysis
(FSA) requirements based on demonstrated reliability, use of equivalent
level of safety (ELOS) for the measurement of a high consequence event,
and allowing application process alternatives as agreed to by the FAA.
Part 450 is divided into subparts A through D. Part 450 is
organized by sections that have both safety requirements for what an
operator must do to be safe and application requirements for what must
be submitted in an application. By ``applicant,'' the FAA intends to
reference an applicant for either a vehicle operator license, an
incremental approval, a payload determination, a policy approval, or an
environmental determination. By ``operator,'' the FAA intends to
reference the holder of a license, which is consistent with the
definition of ``operator'' in Sec. 401.7.
This preamble will discuss in detail the safety framework
encapsulated in part 450, part 450 requirements in sequential order,
followed by corresponding and related changes to other parts, and cost
implications for this rule.
i. Subpart A
Subpart A includes a general discussion on the application process,
licensing scope and duration, and compliance dates. Pre-application
consultation, which may include discussion of any applicable
flexibilities in the application process, scope of license, and means
of compliance, is required by part 413.
Figure 1 illustrates the licensing process. The licensing process
begins with pre-application consultation, which sets the stage for an
applicant to submit a license application. The application evaluation
consists of five major components: (1) A policy review, (2) a payload
review, (3) a safety review, (4) a determination of maximum probable
loss (MPL) for establishing financial responsibility requirements, and
(5) an environmental review. The license specifies the range of
activities the licensee may undertake along with any limitations.
Requirements after a license is issued encompass the licensee's
responsibility for public safety and compliance with its license,
representations in the license application, and FAA regulations. An
important component of this compliance is the FAA's authority to
perform safety inspections.
[[Page 79568]]
[GRAPHIC] [TIFF OMITTED] TR10DE20.000
In the final rule, the FAA does not make any changes to the
existing pre-application consultation provision, except to update the
term ``safety approval'' to the newly adopted ``safety element
approval.'' The FAA makes this change to delineate between the safety
approval portion of a license application and a safety element approval
that the FAA grants under Part 414. This distinction between terms will
not affect industry.
During the pre-application consultation stage, an applicant will
work with the FAA to develop an application and licensing process that
best fits its proposed operation. This stage will focus on compliance
planning and positioning the applicant to prepare an acceptable
application, which will increase the efficiency of the licensing
process. The length of pre-application consultation will vary based on
the proposed operation. For example, pre-application consultations may
be lengthy when involving new launch vehicles that are under
development or with operators inexperienced with the FAA's regulations.
Alternatively, pre-application consultation with experienced operators
using proven vehicles from established sites may be considerably
shorter.
During this stage, the FAA expects to discuss the following topics
with an applicant: Entrance and exit criteria for pre-application
consultation, the intended means of compliance to meet the regulatory
requirements in part 450, the scope of the license, safety element
approvals, incremental review, review period for license evaluation,
compliance expectations, and time frames an operator is required to
meet to satisfy part 450. Some of the topics allow for flexibility that
can result in a more efficient licensing process for both the applicant
and the FAA.
The rule allows an applicant and the FAA flexibility to establish
the scope of the license. Determining the point at which launch begins
will be discussed during pre-application consultation. The applicant
will describe to the FAA its launch site and its intended concept of
operations leading up to a launch, including any operations that are
hazardous to the public. Once the FAA and the applicant have a mutual
understanding of the applicant's intended concept of operations, the
FAA will determine what constitutes hazardous pre-flight operations and
thus the beginning of launch. The applicant will then scope its
application materials based on this starting point.
In the Notice of Proposed Rulemaking (NPRM), the FAA proposed to
set the scope of activity authorized by a vehicle operator license by
identifying the beginning and end of launch and reentry. The final rule
provides flexibility to scale the beginning of launch to the operation.
Specifically, the FAA will identify the beginning and end of launch on
a case-by-case basis and in consultation with an applicant. The final
rule does not adopt the proposed default that hazardous ground pre-
flight operations commence when a launch vehicle or its major
components arrive at a U.S. launch site. Instead, the final rule
identifies certain activities that qualify as hazardous pre-flight
operations, including, but not limited to, pressurizing or loading of
propellants into the vehicle or launch system, operations involving a
fueled launch vehicle, the transfer of energy necessary to initiate
flight, or any hazardous activity preparing the vehicle for flight.
This rule also clarifies that hazardous pre-flight operations do not
include the period between the end of the previous launch and launch
vehicle reuse when the vehicle is in a safe and dormant state.
For the end of launch and reentry, the FAA replaces each use of
``vehicle stage'' in the proposed rule with ``vehicle component'' in
the final rule. The FAA adopts this change in recognition that
components other than vehicle stages may return to Earth. Also, the FAA
now includes ``impact or landing'' in the end of launch and reentry
sections in the scope of license requirements to accommodate increasing
efforts to reuse components.
ii. Subpart B
Subpart B contains the requirements to obtain a vehicle operator
license. The topics include incremental review and determinations,
means of compliance,
[[Page 79569]]
policy review, payload review, safety review and approval, and
environmental review. This rule retains the key components of a license
application review: The policy review, payload review, safety review,
MPL determination, and environmental review. This rule continues to
allow operators to submit the payload, policy, environmental, and
financial responsibility portions of its application independently of
each other.
The final rule will also allow an applicant to submit an
application for a safety review in modules using an incremental
approach approved by the FAA. The safety review is typically the most
complex part of the license application and usually involves submission
of numerous documents. In this rule, the FAA has concluded that a
structured approach agreed to during pre-application consultation will
reduce regulatory uncertainty by allowing the FAA to affirm at an early
stage of development that the proposed safety measure or methodology
meets the FAA's requirements. An applicant must have its incremental
review approach approved by the FAA prior to submitting its application
so that the FAA can ensure that the modules can be reviewed
independently and in a workable order under an agreed time frame.
The rule makes it easier for an applicant to seek a safety element
approval in conjunction with its license application. A safety element
approval is an FAA document containing the FAA determination a safety
element, when used or employed within a defined envelope, parameter, or
situation, will not jeopardize public health and safety or safety of
property. A safety element includes a launch vehicle, reentry vehicle,
safety system, process, service, or any identified component thereof;
and qualified and trained personnel, performing a process or function
related to licensed activities or vehicles. An applicant may also
leverage existing safety element approvals by citing a safety element
approval in another license application, thus streamlining the
subsequent licensing process.
After the final rule becomes effective on March 10, 2021, operators
holding an active launch or reentry license, or who have an accepted
launch or reentry license application within 90 days after the
effective date, may choose to operate under parts 415 and 417 for
expendable launch vehicles (ELVs), part 431 for reusable launch
vehicles (RLVs), or part 435 for reentry vehicles, until five years
after the effective date of this rule.\1\ All operators, including
those exercising this provision, must come into compliance with this
regulation's requirements for critical asset protection and collision
avoidance (COLA) analysis beginning from the effective date of this
rule. Any operator may also choose to operate under part 450 on the
effective date of this rule. Operators conducting operations under
parts 415, 417, 431 or 435 may submit requests for license renewals
such that their license remains valid for up to five years after the
effective date of this rule. A license renewal issued after the
effective date of this rule will be valid for no longer than five years
after the effective date of this rule.\2\ All operators will need to
comply with all parts of this rule five years after its effective date.
Any operator may also choose to operate under part 450 on the effective
date of this rule.
---------------------------------------------------------------------------
\1\ The FAA refers to these licenses as ``legacy licenses''
throughout this preamble. After that time, all operators must come
into compliance with the new regulations.
\2\ Operators holding a part 431 mission operator license have a
2-year renewable period, operators holding a part 435 reentry
operator license have a 2-year renewable period, and operators
holding a part 415 launch operator license have a 5-year renewable
period.
---------------------------------------------------------------------------
For an application for a license modification submitted after this
rule becomes effective and within five years of the effective date, the
FAA will determine the applicability of part 450 on a case-by-case
basis. In determining whether to apply part 450 in evaluating a license
modification under this scenario in consultation with the applicant,
the FAA will consider the extent and complexity of the modification,
whether the applicant proposes to modify multiple parts of the
application, and if the application requires significant reevaluation.
The final rule allows most time frames to be determined during pre-
application consultation, or during the application review process. An
operator may propose alternative time frames for any of the
requirements listed in the newly created Appendix A to part 404.
Compliance with the performance requirements in this rule may be
demonstrated by using a means of compliance that is accepted by the
FAA. Means of compliance may be government standards, industry
consensus standards, or unique means of compliance developed by an
individual applicant. During pre-application consultation, the FAA will
work with applicants on compliance planning. The FAA will review the
submitted means of compliance to determine whether they satisfy the
regulatory safety standard.
For five requirements, an applicant must use a means of compliance
the FAA has accepted in advance of submitting an application. Those
requirements for which an applicant must use an accepted means of
compliance in advance are identified in Sec. 450.35 and include FSA
methods, airborne toxic concentration and duration thresholds for any
toxic hazards for flight, highly reliable flight safety systems (FSS),
lightning commit criteria, and airborne toxic concentration and
duration thresholds toxic hazard mitigation for ground operations. For
all other requirements, an applicant may include an accepted means of
compliance or a means of compliance the FAA has not yet accepted as
part of its application for the FAA to review during application
evaluation. The FAA will publish any publicly available means of
compliance that it accepts. In addition, an operator may request that
the FAA publish the operator's unique means of compliance, once
reviewed and accepted.
The FAA evaluates five major components in an application for a
vehicle operator license. The FAA adopts the proposed requirements for
the policy review without modification. For the FAA to conduct a policy
review, an applicant must identify the launch or reentry vehicle and
its proposed flight profile, and describe the vehicle by
characteristics that include individual stages and their dimensions,
the type and amounts of all propellants, and maximum thrust. The final
rule clarifies that a payload review is not required when the proposed
launch or reentry vehicle will not carry a payload or when the payload
is owned or operated by the U.S. Government. The FAA will continue to
conduct safety reviews to determine whether an applicant is capable of
conducting a launch or reentry without jeopardizing public health and
safety and safety of property as specified in Sec. Sec. 415.103,
431.31(a), and 435.31. Finally, the FAA adopts with revisions the
proposed requirements for environmental review. The revisions include
clarification on the FAA requirements for an Environmental Assessment
(EA) and the FAA's responsibility to determine whether a Categorical
Exemption (CATEX) applies, in accordance with current regulations. The
MPL calculation and financial responsibility requirements are discussed
under Subpart D.
iii. Subpart C
Subpart C addresses safety requirements. In the final rule, the FAA
revises numerous sections under
[[Page 79570]]
subpart C in response to public comments on the proposed rule, so that
the rule is more performance-based. Subpart C includes regulations for
key areas of concern to Federal launch or reentry sites that had not
been covered in previous FAA regulations (e.g., the treatment of
neighboring operations personnel and critical assets, including
critical payloads). Throughout this document, the terms ``Federal
launch or reentry sites'' and ``Federal sites'' replace the NPRM's use
of ``Federal launch range.''
The FAA structured the rule to facilitate elimination of
duplication of the requirements of Federal launch or reentry sites by
incorporating critical asset protections, to avoid the need for Federal
sites to impose this requirement. The rule also creates a path for the
FAA to determine that a Federal launch or reentry site's ground safety
processes, requirements, and oversight are not inconsistent with the
Secretary's statutory authority over commercial space activities.
The safety criteria in Sec. 450.101 (Safety Criteria) set the
public and property safety criteria that must be met before an operator
may initiate the flight of a launch or reentry vehicle.\3\ The
quantitative safety criteria continue to be the linchpin requirement
for flight safety, which is fundamental for all operators. There are
quantitative risk criteria for collective risk, individual risk, and
aircraft risk. The final rule applies collective and individual risk
criteria to people on waterborne vessels, enabling risk management
techniques that previously required a waiver. The rule carves out
neighboring operations personnel on a launch or reentry site as a
separate category of the public subject to different risk criteria.
This rule also adds risk criteria for the protection of critical assets
essential to the national interests of the United States, including a
more stringent requirement for the protection of critical payloads. The
final rule uses conditional risk management to ensure (1) mitigations,
such as flight abort, will be implemented to protect against high
consequence events, and (2) implementation of mitigations will produce
reasonable conditional risks.
---------------------------------------------------------------------------
\3\ The FAA changes the title of Sec. 450.101 from ``public
safety criteria'' in the NPRM to ``safety criteria'' in the final
rule. This is because the FAA changed the definition of ``public''
in new Sec. 401.7 of the final rule. In the NPRM, ``public'' was
defined to include ``people and property that are not involved in
supporting the launch or reentry and includes those people and
property that may be located within the launch or reentry site, such
as visitors, individuals providing goods or services not related to
launch or reentry processing or flight, and any other operator and
its personnel.'' In the final rule, the FAA removed references to
property, limiting the scope of the term ``public'' to people. This
was done to provide better clarity throughout part 450 regarding the
protection of people, property, or both. Because Sec. 450.101
includes criteria for both people and property, the FAA removes
``public'' from the title.
---------------------------------------------------------------------------
The rule allows for neighboring operations personnel to be
protected as members of the public, but to a less stringent risk
threshold as compared to other members of the public. In the final
rule, the FAA adopts the proposed requirements on neighboring
operations personnel in Sec. Sec. 401.7, 440.3, 450.101(a) and (b),
and 450.137 (Far-field Overpressure Blast Effect Analysis) paragraph
(c)(6), but removes the phase ``as determined by the Federal or
licensed launch or reentry site operator'' from the definition of
``neighboring operations personnel'' in Sec. 401.7. Instead, the
Federal or licensed site operator will determine those persons who are
eligible for neighboring operations personnel status in coordination
with the operators at the site and in accordance with definition in
Sec. 401.7. A site operator at a non-Federal site will have the option
to designate certain personnel as neighboring operations personnel.
In the final rule, critical assets include property, facilities, or
infrastructure necessary to maintain national security, or assured
access to space for national priority missions. In the final rule, the
FAA does not adopt the proposed requirement for operators to calculate
the risks to critical assets in preparing a flight hazard analysis,
debris analysis, and debris risk analysis. The FAA anticipates that it
will perform all critical asset and critical payload risk assessments
for commercial space transportation operations involving non-Federal
sites.
Under Sec. 450.101(c) of the NPRM, the FAA proposed to require an
operator to use flight abort as a hazard control strategy if the
consequence of any reasonably foreseeable vehicle response mode, in any
one-second period of flight, is greater than 1 x 10-\3\
CEC for uncontrolled areas. The FAA amends the title of
Sec. 450.101(c) from ``Flight Abort'' in the NPRM to ``High
Consequence Event Protection'' in the final rule, because the final
rule allows an operator to use a method other than flight abort in
certain situations in which the operator can show sufficient protection
against high consequence events. The FAA retains the CEC
requirement as a quantitative criterion that an applicant must use to
measure high consequence events, but revises the final rule to allow
ELOS for the CEC requirement. The final rule also allows
options for how an applicant may protect against a low likelihood, high
consequence event in uncontrolled areas for each phase of flight, such
as using flight abort in accordance with Sec. 450.108 (Flight Abort)
or demonstrating that CEC is below a certain threshold
without using flight abort.
The FAA adopts with revisions the proposal that an operator must
implement and document a system safety program throughout the
operational lifecycle of a launch or reentry system in Sec. 450.103
(System Safety Program). The system safety program includes a safety
organization, hazard management, configuration management and control,
and post-flight data review. In the final rule, the FAA removes the
proposed term ``operational'' to clarify that the regulation applies to
hazards throughout the lifecycle of a launch or reentry system--not
just to operational hazards. The FAA also does not adopt the proposed
requirement in Sec. 450.105 to conduct a preliminary safety
assessment, because that requirement has been replaced with a
requirement to conduct a functional hazard analysis under the Hazard
Control Strategies section in the final rule.
In the NPRM, the FAA proposed under the Hazard Control Strategies
section (Sec. Sec. 450.107 to 450.111) that, for each phase of a
vehicle's flight, an operator would not need to conduct a flight hazard
analysis for that phase of flight if the public safety and safety of
property hazards identified in the preliminary safety assessment could
be mitigated adequately to meet the requirements of proposed Sec.
450.101 using physical containment, wind weighting, or flight abort. In
the final rule, the FAA concludes that an operator must use one or more
of the hazard control strategies defined in Sec. Sec. 450.108 through
450.111 to meet the safety criteria. The FAA also adds a new paragraph
to this section to address how an operator determines its hazard
control strategy or strategies for any phase of flight during a launch
or reentry.
The FAA adopts proposed Sec. 450.108, which is a consolidation and
revision of several proposed sections associated with flight abort
requirements in the NPRM. As a result of this consolidation, the FAA
removes the flight abort related requirements in Sec. Sec. 450.123,
450.125, 450.127, and 450.129. The requirements in these sections have
been revised to be performance-based standards included in Sec.
450.108(c), which addresses flight safety limits objectives, and Sec.
450.108(d), which addresses flight safety limits constraints.
[[Page 79571]]
Section 450.109 (Flight Hazard Analysis) details requirements for
an operator using a flight hazard analysis as its hazard control
strategy for one or more phases of flight. A flight hazard analysis
must identify, describe, and analyze all reasonably foreseeable hazards
to public safety and safety of property resulting from the flight of a
launch or reentry vehicle, mitigate hazards as appropriate, and
validate and verify the hazard mitigations. The FAA revises the final
rule to reflect that performing a flight hazard analysis is included as
a hazard control strategy to derive hazard controls for the flight, or
phase of flight, of a launch or reentry vehicle.
Regardless of the hazard control strategy chosen or mandated an
operator must conduct an FSA to demonstrate quantitatively that a
launch or reentry meets the safety criteria for debris, far-field
overpressure, and toxic hazards. An operator may be required to conduct
additional analyses to use flight abort or wind weighting hazard
control strategies. The FAA anticipates that an operator will be
required to conduct some FSA for at least some phases of flight,
regardless of the hazard control strategy chosen or mandated. For
example, an FSA must determine flight hazard areas for any vehicle with
planned debris impacts capable of causing a casualty.
The FAA revises the FSA requirements in Sec. 450.113 (Flight
Safety Analysis Requirements--Scope), which establish the portions of
flight for which an operator would be required to perform and document
an FSA. An operator must perform and document an FSA for all phases of
flight, unless otherwise agreed to by the FAA. The FAA may agree there
is no need for an FSA for certain phases of flight based on
demonstrated reliability for any launch or reentry vehicle, instead of
just for hybrid vehicles as proposed in the NPRM. The FAA expands this
exception because, conceivably, an operation involving a vehicle other
than a hybrid could have an extensive and safe enough flight history to
demonstrate compliance with the risk criteria in Sec. 450.101 based on
empirical data in lieu of the traditional risk analysis.
An FSA generally consists of a set of quantitative analyses used to
determine flight commit criteria, flight abort rules, flight hazard
areas, and other mitigation measures, and to demonstrate compliance
with the safety criteria in Sec. 450.101. In the NPRM, the FAA
proposed 15 sections associated with FSA requirements in Sec. Sec.
450.113 to 450.141. The final rule moves requirements associated with
flight safety limits to Sec. 450.108 and condenses the remaining FSA
requirements into 11 performance-based sections that cover the scope of
the analyses, general methodology requirements, and specific sections
on normal trajectories, malfunction trajectories, hazardous debris
characterization, population exposure, probability of failure, flight
hazard areas, debris risks, and far-field overpressure blast effects.
The FAA moved some of the proposed FSA requirements such that an
operator could generally perform the analyses in the order that they
appear in the final rule, if they choose.
The FAA revises the FSA sections to be more performance-based than
what was proposed in the NPRM. Specifically, the FAA revises the FSA
requirements to identify their fundamental purpose, the essential
constraints, and the objectives in each section. The FSA requirements
in the final rule are consistent with current practice, but the rule
articulates important, often misunderstood, aspects of flight analysis
such as the creation of hazard areas and other operating constraints
necessary to protect public health and safety and safety of property.
Sections 450.139 (Toxic Hazards for Flight) and 450.187 (Toxic
Hazards Mitigation for Ground Operations) contain the requirements for
toxic release analysis. In the final rule, the FAA adopts Sec. Sec.
450.139 and 450.187 with some revisions. The FAA clarifies that
operators are not required to perform a toxic release hazard analysis
for kerosene-based fuels unless directed by the FAA. Also, the FAA
revises the requirements for performing toxic containment.
In the NPRM, Sec. 450.111 contained computing systems and software
requirements. In the final rule, the FAA revises and relocates the
requirements for computing systems and software to Sec. 450.141
(Computing Systems and Software). In response to comments, the FAA
revises the requirements of Sec. 450.141 to be more performance-based,
and levies requirements for computing system safety items in proportion
to their criticality instead of the item's level of autonomy. The final
rule also requires independent verification and validation for
computing system safety items that meet the definition of ``safety-
critical'' in Sec. 401.7.
The requirements of Sec. 450.143 (Safety-Critical System Design,
Test, and Documentation) apply to all safety-critical systems except
highly reliable FSS and safety-critical software items, which are
regulated by the requirements in Sec. Sec. 450.145 and 450.141
respectively. In the final rule, the FAA revises the reference to FSS
requirements in Sec. 450.143(a); amends Sec. 450.143(b) to include
other means of compliance and broader safe design concepts; and removes
the term ``vehicle'' in Sec. 450.143(c) because safety-critical
systems can be located off-vehicle. In addition, the FAA amends the
application requirements in Sec. 450.143(f) to require that applicants
describe the method used to validate predicted operating environments
and any standards used for each safety-critical system.
Section 450.145 (Highly Reliable Flight Safety System) contains the
requirements for certain FSS. The FAA revises Sec. 450.145 to apply to
a highly reliable FSS, which consists of any onboard portion and if
used, any ground-based, space-based, or otherwise not onboard portion
of the system. Conventional FSS with airborne flight termination
receivers and ground-based command transmitter systems will have both
airborne and ground-based subsystems. The final rule provides
additional flexibility for operations where the CEC is
between 1 x 10-\2\ and 1 x 10-\3\ and exempts the
FSS for such operations from the requirements of Sec. 450.145;
however, the FSS for such operations must still meet the requirements
of Sec. 450.143. The FAA makes these changes to scope the FSS design,
testing, and analysis more closely to potential consequence and risk.
These changes will reduce burden on operators that have a lower
potential for causing high consequence events. The FAA also removes the
reliability threshold required of an FSS for operations where
CEC is between 1 x 10-\2\ and 1 x
10-\3\. The final rule provides that an FSS required for
operations for which the CEC is between 1 x
10-\2\ and 1 x 10-\3\ must meet the requirements
of Sec. 450.143.
Section 450.147 (Agreements) requires a vehicle operator to have a
written agreement with any entity that provides a service or use of
property to meet a requirement in part 450. In the final rule, the FAA
requires an operator to enter into multiple agreements if the operator
works with multiple entities. Also, operators will continue to be
required to enter into agreements with the appropriate entities for
launches and reentries that cross airspace or impact water not under
U.S. jurisdiction.
Section 450.153 contains the requirements for radio frequency. In
the NPRM, the FAA proposed that an operator would be required to
identify each frequency, all allowable frequency tolerances, and each
frequency's intended use, operating power, and
[[Page 79572]]
source; and provide for the monitoring of frequency usage and
enforcement of frequency allocations. In the final rule, the FAA adopts
the proposed requirements with modifications to the performance-based
objectives central to radio frequency management. Operators will be
required to ensure that radio frequency does not adversely affect the
performance of FSS or safety-critical systems, and to coordinate radio
frequency with local and Federal authorities.
Section 450.157 contains the requirements for communications. In
the NRPM, the FAA proposed that personnel that have authority to issue
``hold/resume,'' ``go/no go,'' and abort commands must monitor each
common intercom channel during countdown and flight. The FAA does not
adopt the proposal because it was overly prescriptive.
Section 450.161 (Control of Hazard Areas) contains the control of
hazard areas. In the final rule, the FAA does not remove the
requirement for an operator to verify that warnings have been issued
when the operator relies on another party to publicize those warnings.
Instead, the FAA clarifies that the requirement may be met by
demonstrating due diligence pursuant to agreements that the operator
has with that party and notifying the FAA of any deviations from the
agreements by any party. The FAA also adds an application requirement
for the applicant to give a description of how the applicant will
provide for any publication of flight hazard areas.
In the final rule, the FAA does not adopt the four mishap
categories proposed in the NPRM. The FAA agrees with commenters that
the regulatory requirements for the proposed mishap classes, from most
severe (Class 1) to least severe (Class 4), were largely the same, and
concludes that the mishap classes are not needed to achieve the
objective of consolidating mishap-related terms and streamlining the
requirements to report, respond to, and investigate mishaps. Instead,
the FAA combines the substantive criteria of Mishap Classes 1-4 under
the definition of ``mishap.'' The revised definition in the final rule
describes events that constitute a mishap. The requirements to report,
respond to, and investigate mishaps are incumbent upon an operator
regardless of a mishap's severity.
Section 450.173 (Mishap Plan--Reporting, Response, and
Investigation Requirements) contains the requirements for the mishap
plan. In the final rule, the FAA does not adopt the proposed
requirement for a licensee to cooperate with FAA and NTSB
investigations contained in the NPRM. The FAA finds this requirement
duplicative of Sec. 450.13, which states that a vehicle operator
license does not relieve a licensee of its obligations to comply with
all applicable requirements of law or regulation that may apply to its
activities. Also, the final rule standardizes criteria for mishap plans
across all of 14 CFR Chapter III by making Sec. 450.173 applicable to
launch and reentry licensees, experimental permittees, and site
operators.
The FAA proposed to give license applicants and licensees the
option to pre-coordinate testing activities with the FAA. In the final
rule, the FAA clarifies that Sec. 450.175 (Test-induced Damage) will
only apply to licensees or license applicants who choose to apply for
the exception. The final rule also allows an operator to coordinate the
possibility of test-induced damage prior to an operation and exclude
damage meeting certain requirements from constituting a mishap, thereby
reducing unnecessary reporting.
v. Subpart D
Subpart D addresses the terms and conditions of a vehicle operator
license. This includes compliance monitoring (Sec. 450.209), material
changes and continuing accuracy (Sec. 450.211), pre-flight reporting
(Sec. 450.213), post-flight reporting (Sec. 450.215), and
registration of space objects (Sec. 450.217). In the final rule, the
FAA adopts these sections as proposed with the exception of revisions
to Sec. 450.213 (Pre-flight Reporting) as described below.
The final rule makes few changes to the post-licensing
requirements, for which the final rule standardizes requirements for
all launches and reentries from Federal sites and commercial spaceports
or exclusive use launch sites. In line with the previous requirements,
operators will provide information and comply with reported collision
avoidance closures. A Federal agency will continue to provide operators
the appropriate launch or reentry closures, but the rule allows the
possibility of some other entity's providing this service in the
future. The final rule offers operators flexibility, in coordination
with the FAA, to use different timelines for the submission of pre-
flight and post-flight reports. The FAA revises Sec. 450.213(d) to
allow an operator the flexibility to identify an appropriate time frame
in coordination with the FAA. The FAA also revises Sec. 450.217(c) so
that licensees will only need to notify the FAA that they removed an
object from orbit if removal occurs during or immediately after
licensed activities.
II. Background
This rulemaking arose from work by the National Space Council that
led to President Donald J. Trump's Space Policy Directive-2 (SPD-2) in
May 2018, directing the U.S. Department of Transportation to streamline
the regulations governing commercial space launch and reentry
licensing. The goals of this streamlining include creating a single
licensing regime for all types of commercial space flight launch and
reentry operations, and replacing prescriptive requirements with
performance-based criteria. The final rule is consistent with DOT's
regulations under 49 CFR 5.5(e), which instruct that regulations should
be technologically neutral, and, to the extent feasible, should specify
performance objectives, rather than prescribing specific conduct that
regulated entities must adopt.
On March 8, 2018, the FAA chartered the Streamlined Launch and
Reentry Licensing Requirements Aviation Rulemaking Committee (ARC) to
provide a forum for a broad range of stakeholders from the aviation and
space communities to discuss regulations to set forth procedures and
requirements for commercial space transportation launch and reentry
licensing. The FAA tasked the ARC with developing recommendations for a
performance-based regulatory approach in which the regulations set
forth the safety objectives to be achieved while providing the
applicant flexibility to produce tailored and innovative means of
compliance.
On April 30, 2018, the ARC submitted its final recommendation
report to the FAA.\4\ The FAA addressed the recommendations in more
detail throughout the NPRM. This final rule incorporates
recommendations provided by the ARC.
---------------------------------------------------------------------------
\4\ Streamlined Launch and Reentry Licensing Requirements ARC,
Recommendations Final Report (April 30, 2008). The ARC Report is
available for reference in the docket (Docket FAA-2019-0229).
---------------------------------------------------------------------------
On March 26, 2019, the FAA posted on its website an NPRM titled
``Launch and Reentry Licensing Requirements'' that would revise parts
401, 404, 413, 414, 415, 417, 420, 431, 433, 435, 437, and 440, and
create a new part 450. In the NPRM, the FAA proposed to streamline and
increase flexibility in the FAA's commercial space launch and reentry
regulations, remove obsolete requirements, consolidate and revise
multiple regulatory parts, and apply a single set of licensing and
safety
[[Page 79573]]
regulations across several types of operations and vehicles.
On April 15, 2019, the FAA published this NPRM in the Federal
Register (85 FR 15296). The initial comment period was 60-days from the
date of publication, ending on June 14, 2019.
In the ensuing month, commenters submitted fifty-six requests for
an extension of the comment period to a total of 120 days, or until
August 13, 2019.
In response, on May 31, 2019, the FAA published an extension of the
comment period on the NPRM (84 FR 25207), for an additional 45-days to
July 30, 2019, to allow commenters more time to analyze the proposed
rule.
On June 14, 2019, the FAA posted to the docket a response \5\ to
MLA Space, LLC, which had requested that the FAA reconvene the ARC to
engage in dialogue regarding the NPRM. In the response, the FAA stated
its belief that engagement with industry in the form of an ARC, a
public meeting, or through a special session of Commercial Space
Transportation Advisory Committee (COMSTAC) would not be beneficial at
that point in the rulemaking process. The FAA encouraged members of
industry to submit any questions requesting clarification regarding the
NPRM to the docket.
---------------------------------------------------------------------------
\5\ See FAA-2019-0229-0088.
---------------------------------------------------------------------------
On July 16, 2019, the FAA posted to the docket the first of its
responses \6\ to commenters' questions requesting clarification. Also
on July 16, 2019, the FAA posted a statement \7\ to the docket
encouraging commenters to post any further requests for clarification
in the docket as soon as possible. That statement reasserted the FAA's
judgment that further engagement with industry through a public meeting
to have clarifying dialogue regarding the NPRM would not be beneficial,
but also offered to entertain meetings in the month of July 2019 with
members of the public who wished to provide to the FAA their
information bearing on the proposed rule.
---------------------------------------------------------------------------
\6\ See FAA-2019-0229-0106.
\7\ See FAA-2019-0229-0107.
---------------------------------------------------------------------------
Subsequently, the FAA met with Blue Origin,\8\ the Coalition for
Deep Space Exploration,\9\ Space Exploration Technologies Corp.
(SpaceX),\10\ Virgin Galactic,\11\ and Virgin Orbit \12\ to receive
their clarifying questions and a preview of their comments on the
NPRM.\13\
---------------------------------------------------------------------------
\8\ See FAA-2019-0229-0127.
\9\ See FAA-2019-0229-0178.
\10\ See FAA-2019-0229-0129.
\11\ See FAA-2019-0229-0128.
\12\ See FAA-2019-0229-0126.
\13\ Since the information provided at these meetings is already
captured in these commenters' clarifying questions or comments
submitted to the docket, the FAA gave these commenters the option of
not posting to the docket a summary of the meeting, as required by
the FAA's Statement Regarding Requests for Public Meetings (see FAA-
2019-0229-0107), as this would be a duplicative effort.
---------------------------------------------------------------------------
On July 22, 2019, the FAA published a second extension of the
comment period to the NPRM (84 FR 35051). To provide commenters with
sufficient time to review the FAA's clarifications in response to the
commenter's questions, the FAA extended the comment period to August
19, 2019.\14\
---------------------------------------------------------------------------
\14\ See 84 FR 35051.
---------------------------------------------------------------------------
On August 16, 2019, the FAA posted its response to the docket \15\
to commenters' questions for clarification received by July 12, 2020,
and July 29, 2019.
---------------------------------------------------------------------------
\15\ See FAA-2019-0229-0134 and FAA-2019-0229-0135.
---------------------------------------------------------------------------
On August 19, 2019, the comment period closed, with a total of 155
submissions from 85 commenters, and two submissions containing
proprietary information. Of these comments, 62 requested an extension
of the comment period, 10 requested to reconvene the ARC, 29 requested
a public meeting, 18 requested a Supplemental Notice of Proposed
Rulemaking (SNPRM), 18 contained clarifying questions for parts of the
NPRM, and 53 comments contained substantive feedback regarding the
proposed rule. The FAA discusses the adjudication of these comments in
more detail later in the preamble.
III. Discussion of the Rule
A. Safety Framework
[[Page 79574]]
[GRAPHIC] [TIFF OMITTED] TR10DE20.001
General. The final rule relies on a safety framework that provides
the flexibility needed to accommodate current and future launch and
reentry operations. The safety framework encompasses both ground safety
and flight safety. Acceptable safety for ground operations is achieved
primarily through a process-based hazard analysis and certain
prescribed hazard controls. Acceptable safety for flight operations is
achieved through several elements discussed further in this preamble
section. The FAA identifies specific safety criteria and requirements
in Sec. 450.101 that must be met before a launch or reentry can take
place, including collective risk, individual risk, aircraft risk, risk
to critical assets, protection against high consequence events,
disposal of orbiting stages, risk to people and property on orbit, and
notification of planned impacts.
System Safety Program. All operators are required to have a system
safety program that establishes system safety management principles for
both ground safety and flight safety throughout the operational
lifecycle of a launch or reentry system. The system safety program
includes a safety organization, hazard management, configuration
management and control, and post-flight data review.
Hazard Control Strategies. To address the wide variety of
commercial launch and reentry systems and operations concepts, the
final rule includes four hazard control strategies. An operator can use
multiple hazard control strategies during flight because different
strategies may be appropriate for different phases of flight. Different
hazard control strategies may also be appropriate during any one phase
of flight to protect different sets of people and property. The hazard
control strategies are physical containment, wind weighting, flight
abort, and flight hazard analysis.
Physical containment would most likely be used for low
energy test flights, when a launch vehicle does not have sufficient
energy for any hazards associated with its flight to reach the public
or critical assets.
Wind weighting is traditionally used in the launch of
unguided suborbital launch vehicles, otherwise known as sounding
rockets, where the operator adjusts launcher azimuth and elevation
settings to correct for the effects of wind conditions at the time of
flight to provide impact locations for the launch vehicle or its
components that will ensure compliance with the safety criteria in
Sec. 450.101.
Flight abort is the traditional safety approach for
expendable launch vehicles, and is a process to limit or restrict the
hazards to public safety and the safety of property presented by a
launch vehicle or reentry vehicle, including any payload, while in
flight by initiating and accomplishing a controlled ending to vehicle
flight. With the exception of phases of flight with demonstrated
reliability, flight abort is mandated as a hazard control strategy if
the potential for a high consequence event is above a certain
threshold.
Flight hazard analysis is the traditional safety approach
for reusable launch vehicles, and is the most flexible hazard control
strategy because an operator derives specific hazard controls unique to
its launch or reentry vehicle system and operations concept. Flight
hazard analysis is mandated as a hazard control strategy if the other
three hazard control strategies cannot mitigate the safety hazards
sufficient to meet the safety criteria of Sec. 450.101.
An operator determines the appropriate hazard control strategy by
conducting a functional hazard analysis.
[[Page 79575]]
Flight Safety Analyses. Regardless of the hazard control strategy
chosen or mandated, an operator is required to conduct several FSA.
These include trajectory analyses for normal and malfunction flight, a
debris analysis, a population exposure analysis, and a probability of
failure analysis. These analyses provide input to a debris risk
analysis, a far-field overpressure blast effects analysis, and a toxic
hazard analysis that together demonstrate compliance with the safety
criteria of Sec. 450.101, and provide input to a flight hazard area
analysis.
Derived Hazard Controls. With respect to flight operations, an
operator would derive several hazard controls by conducting the FSA
and, if necessary, a flight hazard analysis. Because hazard controls
are derived from these analyses, they are not specifically addressed in
part 450.
Prescribed Hazard Controls for Computing Systems and Software and
Safety-Critical Hardware. Regardless of the hazard controls derived
from a flight hazard analysis and FSA, the FAA requires many other
hazard controls. The first set of hazard controls includes requirements
for computing systems and software, safety-critical systems, and highly
reliable FSS.
Other Prescribed Hazard Controls. The second set of hazard controls
have historically been necessary to achieve acceptable flight safety.
These include requirements for (1) written agreements, (2) safety-
critical personnel qualifications, (3) work shift and rest
requirements, (4) radio frequency management, (5) readiness, (6)
communications, (7) pre-flight procedures, (8) control of hazard areas,
(9) lightning hazard mitigation, (10) flight commit criteria, (11)
tracking, (12) collision avoidance, (13) safety at the end of launch,
and (14) mishap plans.
Ground Safety. With respect to the safety of ground operations, the
safety framework includes (1) coordination with a site operator, (2)
explosive siting, (3) a ground hazard analysis, (4) toxic hazard
mitigations, and (5) prescribed hazard controls addressing visitors,
countdown aborts, fire suppression, and emergency procedures. These
together provide an acceptable set of public safety considerations for
ground operations.
B. Detailed Discussion of the Final Rule
1. Prescriptive vs Performance-Based Regulations, ELOS, Safety Case
i. Prescriptive
The FAA sought in the NPRM to propose changes that would convert
many of its prescriptive requirements to more performance-based
requirements that would allow for different means of compliance. The
FAA received several comments stating generally that the proposed rule
was still too prescriptive. The Commercial Spaceflight Federation (CSF)
and SpaceX commented that some of the proposed requirements would
unnecessarily drive applicants to a burdensome equivalent level of
safety (ELOS) process as a default. Blue Origin recommended broadly
that the FAA remove all prescriptive portions of the proposed rule.\16\
---------------------------------------------------------------------------
\16\ Blue Origin submitted to the rulemaking docket a letter to
Admiral James Ellis, Jr, USN (ret.), Chairman, Users' Advisory
Group, National Space Council, in which Blue Origin expressed
concerns with the NPRM. The letter encouraged Adm. Ellis to
communicate the concerns to the Administration and the members of
the National Space Council and advise the Office of the Secretary of
Transportation and FAA to engage further with industry through a
public meeting to address concerns with the NPRM and then to issue a
supplemental NPRM that achieves the goals of SPD-2. The FAA is
construing the contents of the letter as comments on the proposals
in the NPRM.
---------------------------------------------------------------------------
The FAA agrees that some of the requirements in proposed part 450
were unnecessarily prescriptive, particularly those for software and
FSA. The FAA has modified those requirements to remove unnecessary
prescriptiveness and provide additional flexibility while still
preserving safety and providing regulatory clarity. For many of the
requirements amended for this purpose in the final rule, the
prescriptive parts of the proposal will be moved to a corresponding AC
as guidance on means of compliance. Specific changes to the
requirements are discussed later in this preamble.
Several commenters, including Blue Origin, CSF, and SpaceX, also
stated that the FAA should base its new requirements on parts 431 and
435 and add details on how to comply through guidance. CSF also stated
that the FAA ignored the draft regulatory text provided by the ARC,
which used parts 431 and 435 as a basis for updated rules.
The FAA disagrees that parts 431 and 435 should be used as the sole
basis for part 450. Part 431 depends on an operator to use the system
safety process to derive hazard controls, which as reflected in part
450, is appropriate for some launch and reentry vehicle systems and
operations. However, as also reflected in part 450, not all launch and
reentry vehicle systems and operations require an operator to derive
hazard controls through the system safety process. Specifically,
physical containment, wind weighting, and, most importantly, flight
abort are often sufficient. Part 450 incorporates the flexibility of
part 431, but acknowledges the acceptability of other hazard control
strategies. Part 450 also builds on the precedent set by part 431's
limits on the foreseeable consequences of a failure in terms of
conditional expected casualties and establishes a less stringent
threshold.\17\ Furthermore, the FAA stated in the NPRM that it would
not specifically address the ARC's proposed regulatory text because
that regulatory text did not receive broad consensus within the ARC.
---------------------------------------------------------------------------
\17\ Section 431.43(d) sets a limit for foreseeable public
consequences in terms of CEC, but only for an unproven
RLV. Section 431.43(d) provides an unproven RLV may only be operated
so that during any portion of flight, the expected number of
casualties does not exceed 1 x 10-\4\ given a vehicle
failure will occur at any time the instantaneous impact point is
over a populated area. This is in greater detail in the high
consequence event protection section of the preamble.
---------------------------------------------------------------------------
One individual commenter noted that streamlining was long overdue.
Another individual commenter noted that the proposed rule is longer and
more complicated than the rule it proposes to replace, and that past
FAA approaches led to codifying Federal launch and reentry site
requirements, which the Federal sites subsequently changed such that
they no longer matched the FAA requirements.
In response, the FAA notes that the proposed regulation combined
elements from parts 415, 417, 431, and 435. Part 450 is shorter than
parts 415 and 417 and more performance-based. Although it is longer
than parts 431 and 435, part 450 is more flexible and encompasses more
types of launch and reentry operations. This final rule allows
operators to use a means of compliance that will accommodate customized
operations, changing technologies, and innovation.
ii. Equivalent Level of Safety (Sec. 450.37)
In the NPRM, the FAA proposed in Sec. 450.37 (Equivalent Level of
Safety) that for all requirements in part 450, except Sec. 450.101, an
applicant may clearly and convincingly demonstrate that an alternative
approach provides an equivalent level of safety (ELOS) to the
requirement.
In the final rule, the FAA revises Sec. 450.37 so that only some
portions of Sec. 450.101--specifically Sec. 450.101(a), (b), (c)(1),
(c)(3), (d), (e)(1), and (g)--are excluded from eligibility for an ELOS
approach. This change allows an applicant to propose an equivalent
level of safety to the orbital debris requirement in Sec.
450.101(e)(2) and the notification of planned impacts requirement in
Sec. 450.101(f). Most significantly, this change also allows an
applicant to propose an equivalent level of safety to the use of a
CEC of 1 x 10-\3\
[[Page 79576]]
as the measure of a high consequence event in Sec. 450.101(c)(2).
Section 450.101(c) is discussed more fully later in this preamble.
Virgin Galactic commented that ELOS determinations should be part
of the license application process. The FAA agrees with the comment and
incorporates ELOS determinations into the license application process.
To exercise this option, an applicant must demonstrate, through
technical rationale, that the proposed alternative provides a level of
safety equivalent to the requirement it would replace. The FAA will
evaluate the proposal during the application evaluation.
CSF stated that, if the FAA adopted the parts 431 and 435
framework, ELOS would be unnecessary because the ELOS process does not
exist under those regulations.\18\ Blue Origin urged the FAA to
consider the need for an ELOS option in this rule.
---------------------------------------------------------------------------
\18\ The FAA added equivalent level of safety provisions to
parts 431 and 435 in a 2018 final rule. 83 FR 28528 (June 20, 2018).
---------------------------------------------------------------------------
In response to CSF's comments, the FAA acknowledges that, in
theory, a performance-based regulation like part 450 could function
without an ELOS provision, because, in concept, a performance-based
rule allows many different means of compliance with the required safety
standard. The FAA considered eliminating the ELOS provision from the
final rule, but decided that eliminating the ELOS provision would
remove a useful regulatory tool that provides flexibility. Unlike means
of compliance, which demonstrate compliance with the regulation, ELOS
allows an applicant to propose and demonstrate a method that ensures an
ELOS to the requirement, but not necessarily compliance with the
requirement itself. The FAA has chosen to retain the option of ELOS to
allow operators to propose unique processes and procedures that this
rule may not have contemplated.
Blue Origin stated that it supports the use of safety cases as a
means to establish an ELOS under proposed Sec. 450.37. A safety case
is a structured argument, supported by a body of evidence that provides
a compelling, comprehensive, and valid case that a system is safe, for
a given application in a particular setting. Regarding process, Blue
Origin recommended requiring only one layer of external-to-applicant
audit, and that the audit criteria be transparently developed with
industry input to ensure understanding of the scope of compliance with
the ELOS proposal process. Another individual commenter stated that the
FAA should add a provision that would allow use of an alternate process
for obtaining a license based on the use of a ``safety case''
methodology. This methodology would consist of voluntary audits of an
applicant's safety and risk management program, followed by development
of a safety case showing how the public would be protected during
licensed activities.
The FAA finds that the proposed regulation is flexible in allowing
an applicant to propose a means of compliance. It also affords the
possibility of meeting most requirements by demonstrating an ELOS.\19\
An applicant may wish to use a safety case to demonstrate that it is
has satisfied the ELOS standard; however, the FAA declines to add
prescriptive audit requirements for its use. An applicant could, but is
not required to, use a safety case to show that a certain method
satisfies an ELOS to a regulatory requirement, excluding the
requirements of Sec. 450.101(a), (b), (c)(1), (c)(3), (d), (e)(1), and
(g). A safety case is not required to demonstrate ELOS. It is one way
to provide rationale for ELOS. An applicant could use a safety case or
other justification for ELOS.
---------------------------------------------------------------------------
\19\ ELOS is not applicable to Sec. 450.101(a), (b), (c)(1),
(c)(3), (d), (e)(1), and (g).
---------------------------------------------------------------------------
Virgin Galactic recommended that safety cases be counted as an
alternative to CEC in Sec. 450.101(c). The Boeing Company
(Boeing), Lockheed Martin Corporation (Lockheed Martin), Northrop
Grumman Corporation (Northrop Grumman), and United Launch Alliance
(ULA) sought clarification as to why Sec. 450.37 would not apply to
Sec. 450.101. Similarly, Blue Origin, CSF, SpaceX, and Virgin Galactic
commented that ELOS should be allowed for Sec. 450.101(c).
The FAA agrees with allowing ELOS for Sec. 450.101(c)(2). This
allows an operator to make a safety case or provide some other
justification for an ELOS determination for an alternative method to
protect against a high consequence event, such as safeguards other than
flight abort, or an alternative to CEC as a measurement of
the potential for a high consequence event, such as a risk profile,
both of which are described more in the preamble section discussing
Sec. 450.101(c). Section 450.101(a), (b), (c)(1), (c)(3), (d), (e)(1),
and (g) contain the core safety requirements to protect people and
property on land, at sea, in the air, and in space. Any proposed non-
compliance with these risk requirements will require a waiver and are
not eligible for a demonstration of ELOS. By contrast, all other flight
safety requirements in part 450 subpart C, which can be demonstrated
through ELOS, support the achievement of these underlying risk
criteria. To use an ELOS, an operator may demonstrate that an
alternative approach provides an equivalent level of safety to a
requirement in accordance with Sec. 450.37. A petition for waiver must
be submitted at least 60 days in advance and address why granting the
request for relief is in the public interest and will not jeopardize
the public health and safety, safety of property, and national security
and foreign policy interests of the United States in accordance with
Sec. 404.5.
Boeing, Lockheed Martin, Northrop Grumman, and ULA commented that
the FAA should accept a Federal launch or reentry site's safety
processes as providing an ELOS to the FAA's own safety standards
without any additional safety requirements.
The FAA disagrees. FAA regulations apply to licensed launches and,
in accordance with Sec. 450.45(b) (Safety Review and Approval), the
FAA will accept any safety-related launch or reentry service provided
by a Federal launch or reentry site or other Federal entity by
contract, if the FAA determines that the launch or reentry service
satisfies part 450. Although it is possible for the FAA to find that a
service provided by a Federal launch or reentry site does not satisfy a
requirement in part 450 but does provide an ELOS, the FAA needs to make
that determination on a case-by-case basis.
iii. ``As agreed to by the Administrator''
Throughout the NPRM, the FAA used the clause ``as agreed to by the
Administrator.'' The term was used in all time frame requirements, as
well as in proposed Sec. Sec. 450.3(a) and (b)(1), 450.33, 450.101(c),
450.113(a)(5), 450.107(b)(2), 450.107(d), 450.147(c), 450.173(g),
450.213(a), and 450.215(b). As stated in the proposal, this clause is
used to mean that an operator may submit an alternative to the proposed
requirement to the FAA for review. The FAA must agree to the operator's
proposal for the operator to use the alternative.
CSF and SpaceX commented that it was unclear how the clause ``as
agreed to by the Administrator'' differed from an ELOS determination.
CSF and SpaceX requested that the FAA describe its expectations and
capture any process associated with this option in guidance. CSF and
SpaceX also recommended adding ``unless otherwise agreed to by the
Administrator'' to the beginning of proposed Sec. 450.101(c).
[[Page 79577]]
The clause ``as agreed to by the Administrator'' means that an
operator may submit an alternative to a regulatory requirement. The FAA
must agree to the operator's proposal for the operator to use this
alternative. Unlike an ELOS determination, an applicant need not
demonstrate that this alternative satisfies an ELOS to the requirement.
Each use of the term ``as agreed to by the Administrator'' includes
criteria or considerations by which the FAA will agree to a different
approach than the regulatory requirement. An applicant should look to
these criteria or considerations to determine what the FAA would expect
from an applicant when providing an alternative proposal.
For most of the requirements in part 450, an applicant may
demonstrate an equivalent level of safety if the applicant is unable to
meet a requirement. In addition, an operator may request a waiver to
any requirement. An ELOS may be submitted in a license application and
must clearly and convincingly demonstrate that an alternative approach
provides an equivalent level of safety to the requirement. A petition
for waiver must be submitted 60 days in advance and address why
granting the request for relief is in the public interest and will not
jeopardize the public health and safety, safety of property, and
national security and foreign policy interests of the United States.
For some requirements, the FAA anticipated the need for additional
regulatory flexibility without the burden of providing an equivalent
level of safety or applying for a separate waiver. For those
requirements, the FAA has incorporated the clause ``as agreed to by the
Administrator'' to mean that an operator may submit an alternative to
the proposed requirement to the FAA for review. For each requirement
where the FAA has provided additional flexibility by including the ``as
agreed to by the Administrator'' clause, the FAA has also provided
criteria that the Administrator will consider in determining whether to
approve the alternative approach, including safety considerations when
appropriate. For example, an alternative time frame will generally be
accepted if it provides sufficient time for the FAA to review the
submittal. These alternatives will typically be agreed to in pre-
application consultation.
The FAA addresses the recommendation from CSF and SpaceX by
including ELOS in Sec. 450.101(c)(2). The use of ELOS and ``agreed to
by the Administrator'' for Sec. 450.101(c) is discussed in more detail
in the preamble section addressing CEC.
iv. Time frames
In the NPRM, the FAA proposed to allow an operator to propose
different time frames for certain regulatory sections if ``agreed to by
the Administrator''. Blue Origin, CSF, and SpaceX disagreed with this
approach and requested that the FAA remove any requirement to submit
such a request in a specific time frame other than as soon as the
operator understands that a different time frame is necessary. Virgin
Galactic recommended that alternate time frames should be spelled out
within an operator's license application documents and suggested
alternative regulatory text.
The FAA disagrees with the approach to remove specific time frames
because the time frames are designed to ensure the FAA has sufficient
time to conduct its review and make the requisite public health and
safety, safety of property, and national security and foreign policy
findings. The FAA notes that the time frames proposed in the NPRM and
adopted in the final rule are default time frames. An applicant can
propose and the FAA can accept an alternative time frame. The FAA
expects alternative time frames to be proposed and accepted during pre-
application consultation or during the application process so that the
agreed to time frames are then reflected in the license once issued.
Time frames can be adjusted after a license is issued through the
license modification process, as opposed to the waiver process under
the current regulations. However, in most cases, the FAA expects
flexible time frames to be negotiated for all the launches or reentries
under the license prior to the first licensed activity.
v. Level of Rigor Based on Experience
An individual commenter stated startup launch operators should not
operate under the same regimen as experienced operators. This
individual stated that startup operators should be subject to strict
and precise regulations. Similarly, another individual expressed
concern that the proposed rule would apply performance-based
requirements to launch vehicles with no prior launch history.
SpinLaunch, Inc. (SpinLaunch) commented that the correct regulatory
framework should consist of an applicant's demonstrating the necessary
skills and knowledge to perform safe and accepted operations.
The FAA disagrees that startup launch operators should operate
under a different regulatory regime than experienced operators, and
that performance-based requirements should not apply to launch vehicles
with no prior launch history. Performance-based requirements provide
flexibility to all operators. Means of compliance located in ACs and
other standards that have been identified as accepted means of
compliance to part 450 provide detailed guidance to those new operators
that have not yet established safety processes and procedures. In
response to SpinLaunch's comment, the final rule is structured such
that an applicant must demonstrate to the FAA the necessary skills and
knowledge to perform safe operations in its launch or reentry license
application.
2. Part 450 Subpart A--General Discussion
a. Pre-Application Consultation
In the NPRM, the FAA proposed to retain the requirement for pre-
application consultation from Sec. 413.5 (Pre-Application
Consultation) because the various flexibilities proposed in this rule
would benefit from pre-application discussions. These include
incremental review, timelines, and the performance-based nature of the
regulatory requirements. In the final rule, the FAA adopts the proposal
with no changes to the existing pre-application consultation provision.
As proposed, this rule retains pre-application consultation for
vehicle operators seeking a license. The FAA will also publish a pre-
application consultation Advisory Circular, which will provide
additional guidance but will not establish new regulatory requirements.
Pre-application consultation will continue to focus on compliance
planning and ensuring the applicant can prepare an acceptable
application, which will increase the efficiency of the licensing
process. The length of pre-application consultation will vary based on
the proposed operation. For example, pre-application consultations may
be longer when involving new launch vehicles that are under development
or with operators inexperienced with FAA's regulations. Alternatively,
pre-application consultations with operators who demonstrate knowledge
of FAA regulations and/or use proven vehicles from established sites
should be considerably shorter. The FAA expects to discuss the
following topics with an applicant during pre-application consultation,
to the extent they are relevant to the applicant's proposed operation:
Entrance and exit criteria for pre-application consultation, the
intended means of compliance to meet the regulatory requirements in
part 450,
[[Page 79578]]
the scope of the license, safety element approvals, incremental review,
review period for license evaluation, compliance expectations, and time
frames an operator is required to meet to satisfy part 450. Some of the
topics allow for flexibility that can result in a more efficient
licensing process for both the applicant and the FAA.
The FAA will continue to consider the following factors to
determine if a prospective applicant is ready to begin pre-application
consultation: Whether the concept of operations is realistic and
whether the prospective applicant is able to provide a program schedule
that includes definition of significant milestones and a funding source
or sources. The regulatory requirements for a launch and reentry
license are the same for all applicants; however, FAA expects it will
take longer for less experienced operators to meet all of the
requirements. As currently required, to exit pre-application
consultation and begin the license evaluation period, an application
must be complete enough in accordance with Sec. 413.11 (Acceptance of
an application). A complete enough application must include enough
information for the FAA to start its review. The FAA will screen an
application in its entirety or in modules to determine whether it is
complete enough for the FAA to start its review. The components of a
vehicle operator license application are listed in Sec. 450.31
(General) and include a policy review, a payload review, a safety
review that complies with Subpart C, an environmental review, and
information necessary to satisfy the maximum probable loss analysis
required by part 440.
For the five sections listed in Sec. 450.35(a), an applicant must
use a means of compliance that has been accepted by the Administrator
prior to application acceptance. An applicant may propose another
standard or a unique means of compliance for these five sections before
submitting its application.\20\ Furthermore, many requirements
throughout the final rule allow an operator to use an alternative
method if that method has been agreed to by the Administrator. This
allowance maximizes flexibility and will reduce the need for the
applicant and the FAA to use process waivers. During pre-application
consultation, the FAA anticipates that applicants will discuss the
means of compliance they plan to use for the remaining sections of the
rule, and any alternative means they plan to use for those sections
that allow alternative means of compliance. While the FAA anticipates
that this pre-application consultation will expedite license review
times and aid both FAA and applicant, it is only required for the
sections listed in Sec. 450.35(a).
---------------------------------------------------------------------------
\20\ Further discussion on this topic is in the preamble section
for performance-based regulations and means of compliance.
---------------------------------------------------------------------------
The final rule has built-in flexibilities for determining the
beginning and end of launch such that the launch is scoped to an
individual operator's unique circumstances. It is important that the
applicant and the FAA come to a mutual understanding during pre-
application consultation about the beginning and end of launch for the
license. The beginning and end points of a launch operation define the
extent of a number of requirements, including, but not limited to,
indemnification and FAA oversight. Therefore, an applicant should
define the beginning and end of its operation during pre-application
consultation, and should coordinate with the FAA before finalizing and
submitting its application.\21\ In this way, the applicant can ensure
that the FAA will evaluate the complete scope of its proposed
operation.
---------------------------------------------------------------------------
\21\ A discussion on what constitutes beginning and end of
launch is in the preamble section discussing scope of launch.
---------------------------------------------------------------------------
If an applicant is planning to seek a safety element approval, the
applicant must continue to consult with the FAA before submitting its
application in accordance with Sec. 414.9 (Pre-Application
Consultation). Doing so will help ensure that the FAA and the applicant
have a thorough understanding of how the applicant will comply with the
regulatory requirements surrounding a safety element approval before
submitting an application. During pre-application consultation, the FAA
would expect an applicant to be able to discuss, at a minimum, the
following information as outlined in Sec. 414.15: (1) How the
applicant will meet the applicable requirements of part 450; (2) the
information required in Sec. 414.13(b)(3), (c)(2), and (c)(3); and (3)
the sections of the license application that support the application
for a safety element approval.
If an applicant is proposing an incremental review of its
application, the applicant must have its approach approved by the FAA
prior to submitting its application, in accordance with Sec. 450.33
(Incremental Review and Determinations). Incremental review is intended
primarily to give additional flexibility to the applicant, by allowing
the applicant to separate the safety review into sections so that those
sections can be approved independently. In many ways, the incremental
review process is similar to the independent payload review or a safety
element approval process because it allows the applicant to comply with
the safety approval portion of the regulation in modules or sections
rather than all at once. An applicant considering the use of the
incremental review process should indicate to the FAA during pre-
application consultation which portions of its application will be
evaluated under the incremental review process. See the Incremental
Review section of this preamble for further discussion.
Finally, part 450 allows an operator to propose alternative time
frames for certain requirements, which are listed in Appendix A to part
404. If an operator knows in advance of application submittal that it
will propose an alternative time frame, the applicant should raise this
proposal during pre-application consultation. The FAA would also be
able to discuss during pre-application consultation the FAA's expected
review period to make its determination on the proposed alternative
time frame. Flexible time frames are discussed at length later in this
preamble.
The FAA received several comments on the pre-application
consultation process. An individual commenter stated that pre-
application consultation may not provide substantial benefits for an
existing program and suggested allowing the FAA to request a pre-
application consultation process with a 30-day completion timeline for
any ``material changes'' to existing programs deemed as posing a
significant risk to the safety of the vehicle. The commenter also
suggested the FAA could request this process at least 60 days before
the integration of the launch vehicle. The commenter stated that past
performance of space flights and aircraft should be taken into
consideration for the level of rigor for the pre-application process.
The FAA will not attach a schedule to pre-application consultation
but agrees with the commenter that a material change can be discussed
as part of pre-application consultation. The FAA acknowledges that pre-
application consultation should be minimal for experienced operators
using proven vehicles from established sites. This type of abbreviated
consultation period for experienced operators would be consistent with
the pre-application process prior to issuance of this final rule. The
FAA disagrees with a 30-day completion timeline for pre-application
consultation for any material change to existing programs. The FAA also
disagrees with the suggestion that the
[[Page 79579]]
FAA request pre-application consultation at least 60 days before
integration of the launch vehicle or that pre-application consultation
be tied to the flight safety risk of the vehicle. These timelines and
criteria may be inadequate in some cases to prepare a complete
application properly; in others, they might result in unnecessary
delays in addressing and implementing critical safety changes. In
addition, the FAA will not tie pre-application consultation to risk to
the vehicle because the FAA does not oversee risk to the vehicle but
rather risk to the public.
Sierra Nevada noted that operators could work with the FAA to
develop a program schedule and define anticipated data submissions
during pre-application consultation. Sierra Nevada noted that this use
of the consultation process was not specifically codified in the
proposed regulations and recommended including it expressly in an AC.
The FAA agrees and will include guidance on application scheduling
and data submissions in the pre-application consultation AC. The FAA
considered including more robust requirements for pre-application
consultation in the final rule, however, the FAA concluded that the
current regulation both prepares the applicant to submit a complete
application and the FAA to accept it, while also providing flexibility
to the applicant to approach pre-application consultation in a manner
that best fits the proposed operation.
b. Application Process
In the NPRM, the FAA proposed to clarify in Sec. 413.1 (Scope of
this Part) that the term ``application'' means either an application in
its entirety or a portion of an application for incremental review. In
Sec. 413.21 (Denial of a License or Permit Application), the FAA
proposed to remove ``license'' from paragraph (c) so the regulation
applied to both license and permit applications. In part 414 (Safety
Element Approvals), the FAA proposed to change the term ``sufficiently
complete'' to ``complete enough,'' as used in Sec. 413.11 (Acceptance
of an Application), because the two terms both described the point at
which the FAA determined it had sufficient information to accept an
application and begin its evaluation. Finally, the FAA proposed to
amend Sec. 413.7 (Application Submission) paragraph (a)(3) to allow an
applicant the option to submit its application by email as a link to a
secure server and remove the requirement that an application be in a
format that cannot be altered. In the final rule, the FAA adopts these
changes as proposed.
A joint set of comments submitted by Boeing, Lockheed Martin,
Northrop Grumman, and ULA expressed support for the proposal to allow
the submission of an application using physical electronic storage.
In addition, the FAA received suggested changes to the generic
application process. The American Association of Airport Executives
(AAAE) and the Denver International Airport commented on the need for
further engagement with stakeholders during an operator's application
process. These commenters said the FAA should provide an opportunity
for affected stakeholders to provide input on an operator's application
regarding issues such as impacts to the National Airspace System (NAS).
Denver International Airport stated that stakeholders should be able to
submit comments on license applications.
The FAA does not agree that an application should be open to a
public input process. The FAA issues a license based on whether the
applicant's proposal will not jeopardize public health and safety, the
safety of property, and the national security and foreign policy
interests of the United States. The FAA coordinates with government or
private entities as necessary to make this determination. A broad
public input process outside the environmental review process is
unnecessary for the FAA to make its licensing determination. While
commenters may seek the opportunity to raise issues such as non-safety
impacts to the NAS or the economic impact to land adjacent to a launch,
the FAA cannot consider such issues in the licensing determination.
The NPRM specifically sought comments on how the FAA could
standardize and better implement the ``complete enough'' application
standard. Sierra Nevada inquired whether the FAA will still conduct a
complete enough review. Sierra Nevada concurred with the FAA's approach
in conducting complete enough reviews but commented that the FAA should
specify a timeline for these reviews. SpaceX commented that the FAA
should aim to conduct its complete enough review within ten days of
receipt of submission and apply that standard to submissions for
continuing accuracy, renewals, and modifications. Furthermore, Sierra
Nevada asserted that the review should be included in the FAA's
statutory 180-day review period or a new, defined timeline. CSF and
SpaceX recommended that the complete enough standard in current Sec.
413.11 be expanded to apply to any application submission, including
the initial license application, continuing accuracy submissions, and
modification submissions. CSF and SpaceX suggested regulatory text
changes to Sec. 413.11 to this end. Both commenters also requested the
FAA issue an AC that that explains how the agency makes the complete
enough determination, including a checklist comprising regulatory
sections that require submissions. Virgin Galactic recommended that
what constitutes ``complete enough'' be agreed upon by both the
applicant and the FAA during the pre-application consultation phase and
provided several changes to the regulatory text.
The FAA will continue to use the complete enough standard to
determine whether a license is sufficiently complete to begin review.
The FAA endeavors to make these determinations within 14 calendar days
of receiving an application. Limiting the FAA to ten days, as suggested
by SpaceX, may not provide adequate time for review. The FAA begins the
calculation of the 180-day statutory review period on the date that it
receives the information needed to make the application complete
enough, regardless of how long it takes to make that determination. The
FAA does not base this calculation on the date it determines that the
application is complete enough. The complete enough standard applies to
any submission, including those for license modifications for
consistency. The FAA has applied this standard to submissions for
license modifications and, when necessary, requested additional
information and clarifications to allow it to proceed with its
evaluation. Section 450.211(c) states that an application to modify a
license must be prepared and submitted in accordance with part 413.
Therefore, Sec. 413.11 is applicable to an initial license application
submission and license modification submissions and does not need to be
modified to apply to any application submission. The FAA will work
closely with applicants on a case-by-case basis to determine what
changes may be made without invalidating the license. In accordance
with Sec. 450.211(c), the licensee must apply to the FAA for
modification of the license once a license has been issued, except for
the allowable changes identified by the FAA. An operator may propose an
alternate method from part 413 to request a license modification. This
alternate method could include an agreed-upon submittal schedule and
FAA review period.
It should be noted that Sec. 450.211 (Continuing Accuracy of
License
[[Page 79580]]
Application; Application for Modification of License) also covers
license modification submissions related to continuing accuracy. The
FAA will provide an AC that includes application checklists that an
applicant can choose to use to help guide application submittal.
However, additional information may be needed depending on the type of
operation.
In response to Virgin Galactic's comments, the FAA agrees that
dialogue as to what constitutes ``complete enough'' can be part of the
pre-application consultation, but disagrees that any change in the
regulatory text is required. One of the primary purposes of pre-
application consultation is to provide the applicant guidance in
preparing its license application. Although the FAA determines when an
application is complete enough to begin its review, the FAA expects to
develop collaboratively agreed upon criteria with an applicant for
determining ``complete enough'' during pre-application consultation. By
allowing applicants and the FAA to negotiate criteria for ``complete-
enough'' during pre-application, the FAA anticipates applicants will be
able to more predictably track their progress toward completing the
application.
CSF and SpaceX also suggested that the FAA provide a substantive
response to submittals within 30 days of receiving the application. CSF
also suggested the FAA provide status updates to an applicant every two
weeks.
The FAA already typically provides written response to submittals
within 30 days, often much sooner. In some instances, however, the FAA
requires more than 30 days to draft a response, especially for highly
technical analyses. The FAA also provides a substantive response to an
applicant in writing whenever additional information is required and,
therefore, does not see a compelling rationale for a requirement to
provide status updates on a predetermined schedule. However, FAA
recognizes the concerns expressed by operators regarding extended
delays between communications in certain circumstances. While the FAA
does not believe establishing a specific time period for communication
to applicants is a necessary component of its regulatory framework, it
also recognizes the need for applicants to stay informed and
anticipates communicating with applicants throughout the application
process, including procedural changes to ensure applicants will be
provided a status update within 14 days of receipt of an application.
c. Compliance Period for Legacy Licenses (Sec. 450.1(b))
In the NPRM, under proposed Sec. 450.1(b) and subject to two
exceptions, the FAA would permit an operator to conduct a launch or
reentry pursuant to a license issued by the FAA under parts 415,\22\
431, and 435 before the effective date of the new part 450 or an
application accepted by the FAA before the effective date of part 450.
Even though the operator could continue to conduct operations under the
regulations in effect at the time of license or application as
referenced above, the proposed requirements under Sec. Sec. 450.169
for collision avoidance analysis (COLA) and 450.101(a)(4) and (b)(4)
for critical asset protection would apply to all operators subject to
the FAA's authority under 51 U.S.C. chapter 509 conducting launches
after the effective date of the new regulations. The FAA would
determine the applicability of part 450 to an application for a license
modification submitted after the effective date of the part on a case-
by-case basis based on the extent and complexity of the modification,
whether the applicant proposes to modify multiple parts of the
application, or if the application requires significant reevaluation.
---------------------------------------------------------------------------
\22\ The FAA notes that an operator operating under a license
issued under part 415 would also be subject to the requirements of
part 417.
---------------------------------------------------------------------------
The FAA adopts Sec. 450.1 (Applicability) with revisions. The FAA
does not adopt Sec. 450.1(b) as proposed in the NPRM. While the FAA
adopts the concept as proposed in Sec. 450.1(b) in parts 415, 417,
431, and 435, it also makes corresponding changes to Sec. Sec. 413.23
and 415.3 to limit the duration of all licenses issued or renewed to no
more than five years after the effective date of part 450. The FAA
refers to these licenses as ``legacy licenses'' throughout this
preamble. After that time, all operators must come into compliance with
the new regulations. In the final rule, the FAA makes numerous
revisions to certain regulations that apply to operators conducting
operations under parts 415, 417, 431, and 435. These revisions include
amending Sec. 401.5 title to read ``Definitions as Applied to Parts
415, 417, 431, 435,'' adding new Sec. 401.7 for definitions, updating
Sec. 413.1, and amending parts 415, 417, 431, 435, 440, and 460 to
reference compliance with part 450.
The FAA notes that certain definitions in Sec. 401.5 apply to
parts 415, 417, 431, and 435. Therefore, because the FAA will allow
operators that hold an approved license at the time this rule goes into
effect, or an accepted license application within 90 days after the
effective date of the final rule, to operate under parts 415, 417, 431,
and 435 for up to five years, this rule preserves Sec. 401.5 without
change. Section 401.5 will be removed five years after the effective
date of the final rule.
The FAA adds Sec. 401.7, which contains the definitions that apply
to Chapter III other than parts 415, 417, 431, and 435, and which
broadly captures those changes proposed in Sec. 401.5 in the NPRM. The
FAA notes that parts 415, 417, 431, and 435 and Sec. 401.5 will be
removed five years after the effective date of the final rule.
Part 413 explains how to apply for a license or experimental
permit. In the final rule, the FAA amends the table in Sec. 413.1(b)
to identify that the requirements in parts 415, 417, 431, and 435 apply
only to applicants whose launch or reentry license has been approved or
license application has been accepted by the FAA no later than 90 days
after the effective date of the final rule. As previously mentioned,
operators holding an approved launch or reentry license, or who have an
accepted launch or reentry license application may choose to continue
to operate under parts 415 and 417, part 431, and part 435, until five
years after the effective date of this rule. The FAA also adds ``Launch
and Reentry License Requirements'' as a subject in the table in Sec.
413.1(b). Finally, the FAA adopts the provision that the FAA may grant
a request to renew a license issued under parts 415, 417, 431 or with a
non-standard duration in proposed Sec. 450.1(b) and re-designates it
as Sec. 413.23(a)(2) in the final rule. Specifically, the FAA may
grant a request to renew a under parts 415, 431, and 435 with a non-
standard duration so as not to exceed five years after the effective
date of this rulemaking. The FAA adds an applicability section to parts
415, 431, and 435. These parts apply to such licenses issued before the
effective date of the final rule and licenses issued on or after the
effective date of the final rule if the FAA accepted the application
under Sec. 413.11 no later than 90 days after the effective date. All
operators must comply with the COLA and critical asset protection
requirements in part 450.
In the final rule, the FAA adds the phrase ``pursuant to a license
issued under part 415 of this chapter'' to the scope in Sec. 417.1(a).
The FAA also removes Sec. 417.1(e), which addresses grandfathering
that is no longer used from when part 417 was first established. For
the same reason, the FAA also removes the grandfathering
[[Page 79581]]
reference to paragraph (e) in Sec. 417.1(f). As a result of this
amendment, the FAA re-designates Sec. 417.1(f) and (g) as Sec.
417.1(e) and (f) in the final rule.
The FAA further revises Sec. Sec. 417.11 and 431.73 in the final
rule. The FAA adds a paragraph stating that the Administrator may
determine that a modification to a license issued under these parts
must comply with the requirements in part 450. The Administrator will
base the determination on the extent and complexity of the
modification, whether the applicant proposes to modify multiple parts
of the application, or if the application requires significant
evaluation.
The FAA revises Sec. 440.3, which addresses definitions. In the
final rule, Sec. 440.3 references the definitions contained in
Sec. Sec. 401.5 and 401.7. The reference to Sec. 401.5 will be
removed from Sec. 440.3 five years after the effective date of the
final rule.
Finally, the FAA revises Sec. 460.45 to identify which mishap
definitions an operator should apply in the description of the safety
record of the vehicle to each space flight participant. Specifically,
Sec. 460.45(d)(1) addresses licenses issued under part 450. For these
licenses, the operator's safety record must cover events that meet
paragraphs (1), (4), (5), and (8) of the definition of a ``mishap'' in
Sec. 401.7 that occurred during and after vehicle verification
performed in accordance with Sec. 460.17. Section 460.45(d)(2)
addresses licenses issued under parts 415, 431, or 435. For these
licenses, the operator's safety record must cover launch and reentry
accidents and human space flight incidents as defined by Sec. 401.5.
Section 460.45(d)(1) will be re-designated to Sec. Sec. 460.45(d) and
460.45(d)(2) will be removed from Sec. 460.45 five years after the
effective date of the final rule.
Several commenters asked for clarity on the FAA's approach in Sec.
450.1(b) to legacy licenses issued under the current regulations. CSF
objected to requiring renewals of licenses issued under the current
regulations to meet the requirements of proposed part 450, as this
would result in significant cost and regulatory burdens for the
operator and the FAA.
As previously noted, the FAA does not adopt Sec. 450.1(b) in the
final rule. However, the FAA implements the concept as proposed in
Sec. 450.1(b) in parts 415, 417, 431, and 435. In the final rule, the
FAA establishes a five-year period after the effective date of this
rule. Operators holding either an active license or an accepted license
application no later than 90 days after the effective date of this rule
may operate under the applicable regulatory provisions upon which the
licensing determination was made. In addition, these operators may
submit requests for license renewals within that five-year period and
will be required to comply with the regulations under which the license
determination was made.\23\ The FAA has revised Sec. Sec. 413.23 and
415.3 to reflect that no license issued under parts 415, 431 or 435
will be renewed with an expiration date that extends beyond the five-
year period. As such, applications for renewal submitted near the end
of the five-year period will be valid only for a short time. All
operators will need to comply with this rule in its entirety five years
after its effective date.
---------------------------------------------------------------------------
\23\ As noted, all operators are also required to comply with
the critical assets and COLA provisions of part 450 beginning from
the effective date of this rule.
---------------------------------------------------------------------------
CSF noted that operators under current parts 431 and 435 would need
to come into compliance with the proposed part 450. Similarly, Virgin
Galactic requested that FAA allow currently licensed operators to be
grandfathered into part 450 for vehicles that cannot meet certain part
450 requirements as long as the current public safety requirements are
met. Virgin Galactic stated that, unlike ELV operators, RLV operators
use their vehicles repeatedly, and the FAA has not shown why it is
necessary for current operators to undergo new analyses and possible
design changes. Virgin Galactic noted that the FAA's aviation
regulations allow for ``true'' grandfathering. Virgin Galactic
commented that if the FAA chooses not to allow for ``true''
grandfathering, it should work with each licensee during pre-
application consultation to determine applicability of the new rule to
modifications to current licenses.
The FAA notes that as the final rule is more performance-based than
the rule as proposed in the NPRM, many of the current requirements
would serve as a means of compliance to meet the new regulations. The
FAA anticipates that there would be few, if any, additional
requirements that will not be fulfilled by previously submitted
information. The FAA will not allow operating under parts 415, 417,
431, and 435 indefinitely because the current rule is more streamlined,
performance-based, and up-to-date than the previous regulations.
Therefore, the FAA will require all operators to come into compliance
with the new rule five years after the effective date. The FAA will
consult with existing licensees shortly after the final rule is
published to assist operators with the transition to part 450 so they
may take advantage of the significant number of new flexibilities.
CSF objected to the lack of clarity on grandfathering and
recommended that the FAA make clear that a licensee approved under the
current licensing regime may continue to renew its approvals, with no
significant changes, without having to apply under part 450. License
renewals without significant changes may continue to be renewed, but
not to exceed the five-year compliance period.
Operators currently holding an active, valid license will have five
years after the effective date of this rule to come into compliance
with the entirety of part 450. If a license expires before the end of
this period, an applicant may seek a renewal under the previous
provisions in parts 415, 417, 431, and 435, but the renewal will only
be valid for however much time remains between the time of issuance of
the renewal and the end of the five-year period.
Virgin Galactic recommended the FAA hold a pre-application phase
for all current license holders to ensure that licensees and the FAA
are in agreement as to whether the FAA would require part 450
requirements or parts 415, 417, 431, and 435 requirements when an
operator requests to modify a legacy license once part 450 becomes
effective.
During the five-year compliance period, an operator may need to
modify its legacy license. The provisions that relate to modification
are contained in Sec. Sec. 417.11 and 431.73. Whether or not new
license modifications need to comply with part 450 is subject to
Administrator approval on a case-by-case basis, which can be determined
during consultation with the FAA before the applicant requests the
modification. In making the determination as to whether a license
modification is necessary to comply with the new requirements, the
Administrator will consider the extent and complexity of the
modification, whether the licensee would need to modify multiple parts
of the application, or if the license requires significant
reevaluation. The FAA encourages licensees to consult with the FAA on
transitioning to part 450 in advance of the compliance period deadline.
d. Definition and Scope of Launch (Sec. 450.3)
In the NPRM, the FAA proposed to set the scope of activity
authorized by a vehicle operator license by identifying the beginning
and end of launch in
[[Page 79582]]
Sec. 450.3 (Scope of Vehicle Operator License).\24\
---------------------------------------------------------------------------
\24\ The FAA proposed to move the beginning and end of launch
and reentry language from the definition of ``launch'' in Sec.
401.5 to proposed Sec. 450.3.
---------------------------------------------------------------------------
i. Beginning of Launch
In Sec. 450.3(b)(1) and (b)(2), the FAA proposed that launch
begins under a license with the start of hazardous activities that pose
a threat to the public at a U.S. launch site. The proposed rule further
stated that, unless agreed to by the Administrator, those hazardous
pre-flight ground operations would commence when a launch vehicle or
its major components arrive at a U.S. launch site. For a non-U.S.
launch site, the FAA proposed that launch begins at ignition or first
movement that initiates flight.
In the final rule, the FAA adopts proposed Sec. 450.3(b)(1) and
(b)(2) with revisions. First, the FAA does not adopt the proposed
default that hazardous ground pre-flight operations commence when a
launch vehicle or its major components arrive at a U.S. launch site.
The final rule identifies certain activities that qualify as hazardous
pre-flight operations, including but not limited to, pressurizing or
loading of propellants into the vehicle or launch system, operations
involving a fueled launch vehicle, the transfer of energy necessary to
initiate flight, or any hazardous activity preparing the vehicle for
flight. Second, this rule also clarifies that hazardous pre-flight
operations do not include the period between the end of the previous
launch and launch vehicle reuse when the vehicle is in a safe and
dormant state. Finally, this rule adds language in Sec. 450.3(a) that
allows the Administrator to agree to a scope of license different from
that laid out in Sec. 450.3(b), as discussed later in this document.
An applicant wishing to deviate from the scope of license parameters
laid out in Sec. 450.3(b) would discuss the deviation during pre-
application consultation. The FAA would only allow a deviation for
unique operations where the scope of license continued to cover those
hazardous launch activities identified by statute.
CSF, SpaceX, and Virgin Galactic suggested proposed Sec.
450.3(b)(1) be revised to remove reference to the arrival of major
components at a U.S. launch site as beginning of launch. Virgin
Galactic noted that the beginning of hazardous pre-flight ground
operations should be determined only on a case-by-case basis and
commented that the arrival of components at a launch site was an
inappropriate prescriptive default limit chosen for administrative
convenience. CSF, SpaceX, and Virgin Galactic also requested that the
FAA limit the beginning of hazardous pre-flight operations only to
include potential threats to the public over which no other Federal
regulatory agency has jurisdiction.
The FAA agrees that the beginning of pre-flight ground operations
should be determined on a case-by-case basis because each operation is
unique. The FAA recognizes that with this flexibility comes some
ambiguity as to when launch will begin for each unique operation. The
designation of when launch begins is important for both operators and
the FAA. Among other things, the financial responsibility protections
apply from beginning to end of launch. Therefore, a clear understanding
of when launch begins is essential for an operator to understand fully
its responsibilities under chapter III and for the FAA to satisfy its
obligations, including the calculation of maximum probable loss (MPL).
Because the proposed default beginning of launch, phrased as
``arrival of major components at a U.S. launch site,'' is removed from
Sec. 450.3(b)(1) in the final rule, an application requirement is
added to Sec. 450.3(d) to require an operator to identify the scope of
the license being sought in the application, specifically pre- and
post-flight ground operations. The final rule requires an applicant
intending to launch from a U.S. launch site to identify pre- and post-
flight ground operations such that the FAA is able to determine when
the launch operation would begin and end. This requirement applies only
to launches from a U.S. launch site, as launches from a non-U.S launch
site begin at ignition or first movement that initiates flight. The FAA
anticipates that an applicant would identify hazardous pre- and post-
flight operations that are reasonably expected to pose a risk to the
public. During pre-application consultation, the applicant is expected
to describe to the FAA its launch site and its intended concept of
operations leading up to a launch, including any operations that are
potentially hazardous to the public. Once the FAA and the applicant
have a clear, mutual understanding of the applicant's concept of
operations, the FAA and the applicant will agree on a starting point
for hazardous pre-flight operations, and thus, the beginning of launch.
The applicant will provide that information in its application and
scope its application materials based on this starting point. The scope
of the license lends itself to the first module of an incremental
review.
The FAA also agrees that the arrival of components at the launch
site is an unnecessarily prescriptive baseline that may not constitute
the threshold for hazardous pre-flight operations for all launches.
Therefore, the FAA revises Sec. 450.3(b)(1) to remove the reference to
arrival of components at a launch site. Because the beginning of launch
is an important designation upon which many licensee responsibilities
rely, the FAA has added to the regulatory text certain activities that
constitute hazardous pre-flight operations. The list of hazardous pre-
flight operations added to the final regulatory text is derived from
the preamble text in the NPRM explaining the proposal.\25\ Hazardous
pre-flight operations include, but are not limited to, pressurizing or
loading of propellants into the vehicle or launch system, operations
involving a fueled launch vehicle, the transfer of energy necessary to
initiate flight, or any hazardous activity preparing the vehicle for
flight. This list is not exhaustive, and during pre-application
consultation the FAA or an applicant may identify an activity not
included in this list that poses a hazard to the public and may
constitute the beginning of launch. The FAA retains the ability to
determine that licensed oversight is unnecessary for certain activities
if the Administrator determines that they do not jeopardize public
health and safety, safety of property, and the national security and
foreign policy interests of the United States.
---------------------------------------------------------------------------
\25\ See 84 FR at 15361.
---------------------------------------------------------------------------
The FAA further amends Sec. 450.3(b)(1) to indicate clearly that
activities occurring between launches of reusable vehicles will not be
considered hazardous pre-flight activities if the vehicle is in a safe
and dormant state. Generally, a launch system is in a safe and dormant
state when it is not undergoing the pressurizing or loading of
propellants, a transfer of energy necessary to initiate flight,
operations involving a fueled launch vehicle, or any other hazardous
activity preparing the vehicle for flight. The NPRM preamble discussed
the exemption of RLVs if a vehicle is in a safe and dormant state.\26\
---------------------------------------------------------------------------
\26\ See 84 FR at 15359.
---------------------------------------------------------------------------
One commenter suggested the definition of beginning of flight for
hybrid vehicles be changed to include the first forward motion of the
vehicle with the intent for takeoff.
The FAA agrees that the beginning of flight for a hybrid vehicle is
the first forward motion of the vehicle with the
[[Page 79583]]
intent to takeoff. However, the FAA will continue to use ``first
movement that initiates flight'' to define beginning of the flight
phase of launch because it better accommodates all vehicle types.
Regarding the FAA's jurisdiction over launch activities at a non-
U.S. launch site, CSF stated that proposed Sec. 450.3(b)(2) could be
problematic for captive carry technologies for which an operator must
comply with the oversight of foreign aviation authorities. CSF
suggested removing reference to ``the first movement that initiates
flight.''
The FAA does not adopt CSF's recommendation because the current
regulation is flexible enough to accommodate all launch vehicle
technologies at non-U.S. sites, as well as comprehensive enough to
protect public safety. Starting launch at ignition will not capture the
full flight of the captive carry hybrid vehicle system. The FAA
regulates all of the components of a hybrid vehicle system, including
any captive carry operations under a license; however, as discussed
earlier, the flexibility in Sec. 450.3(a) for the Administrator to
adjust the scope of license applies to Sec. 450.3(b)(2) as well. In
the case of a unique operation for which hazardous activities begin
later than first movement or ignition, the Administrator may agree to a
different beginning of launch for that operation.
Virgin Galactic recommended that the FAA continue to avoid
duplicating oversight and memorialize that commitment in its
description of the beginning of launch as starting when hazardous pre-
flight ground operations commence at a U.S. launch site that pose a
threat to the public and over which no other Federal regulatory agency
has jurisdiction.
The FAA has amended the regulation to address duplicative oversight
at Federal launch or reentry sites in the final rule. These changes are
discussed in the preamble section addressing launch and rentries from a
Federal launch or reentry site. The FAA does not agree with the comment
that launch under this chapter may only begin at a site over which no
other Federal agency has jurisdiction. In fact, many sites, such as
Federal sites or launch sites co-located at airports, may be subject to
the jurisdiction of multiple Federal agencies depending on the types of
activities that are conducted.
ii. End of Launch
In the NPRM, the FAA proposed to amend the definition of end of
launch to remove reference to RLVs and ELVs. Although it did not
receive comment on this proposal specifically, the FAA makes the
following additional changes to the end of launch language: The
addition of ``vehicle component'' and ``impact or landing'' throughout
to ensure the definition captures a broader variety of operations; and
the addition of ``deployment'' in Sec. 450.3(b)(3) to include
operations for which a payload remains on the vehicle. Under Sec.
450.3(b)(3) and (c), the FAA replaces each use of ``vehicle stage'' in
the proposed rule in recognition of the fact that components other than
vehicle stages may return to Earth. Examples include a discarded engine
or payload fairing. In addition, throughout Sec. 450.3(b)(3) and (c),
the FAA includes ``impact or landing'' in the end of launch and reentry
sections in the scope of license requirements where the proposal only
referred to one or the other or failed to reference either. With the
increasing efforts to reuse components, including both impact and
landing throughout Sec. 450.3(b)(3) and (c) encompasses a broader
range of activities because landing includes a soft vertical landing or
runway landing of a vehicle or component, whereas impact is more
accurate to describe a hard landing of a stage or component. Under
Sec. 450.3(b)(3)(ii), the FAA adds that, for an orbital launch of a
vehicle with a reentry of the vehicle, launch may also end ``after
vehicle component impact or landing on Earth, after activities
necessary to return the vehicle or component to a safe condition on the
ground after impact or landing.'' This additional language accommodates
a carrier vehicle landing after the completion of the orbital part of
the launch.
CSF, SpaceX, and Virgin Galactic expressed confusion regarding
proposed Sec. 450.3(b)(3), and requested clarity regarding proposed
Sec. 450.3(b)(3)(iv), including when reentry applies to suborbital
vehicles and end of launch. The FAA introduced suborbital reentry in
its experimental permit final rulemaking in 2007. In that rulemaking,
the FAA stated that:
A suborbital rocket may engage in reentry. For most suborbital
launches, whether the flight entails a reentry will not matter from
a regulatory perspective. The FAA will authorize the flight under a
single license or permit, implementing safety requirements suitable
to the safety issues involved. Recognizing suborbital reentry
matters for two reasons. First, if a suborbital rocket is flown from
a foreign country by a foreign entity into the United States, that
entity may require a reentry license or permit from the FAA,
depending on whether the planned trajectory of the rocket includes
flight in outer space. Second, a permanent site that supports the
landing of suborbital rockets may now be considered a reentry site
depending, once again, on whether the planned trajectory reaches
outer space.\27\
---------------------------------------------------------------------------
\27\ See 72 FR 17001, 17002.
The NPRM did not propose any change to this framework, and no
change is made in the final rule.
Virgin Galactic commented that the FAA should include specific
parameters for suborbital reentry. Virgin Galactic also recommended
additional regulatory language specifying that, for a suborbital
reentry, reentry ends when each vehicle has returned to Earth and has
been returned to a safe condition as defined in the operator's
application documents. As noted earlier, a suborbital reentry requires
flight into outer space.
This distinction does not change when launch ends for a suborbital
vehicle because, whether a vehicle or vehicle component impacts or
lands on Earth due to a launch or reentry, the launch or reentry would
end at the same point in time; namely, after activities necessary to
return the vehicle or vehicle component to a safe condition on the
ground after landing. (See Sec. 450.3(b)(3)(iv) and (c)).
CSF and SpaceX suggested that orbital launch without a reentry in
proposed Sec. 450.3(b)(3)(i) did not need to be separately defined by
the regulation, stating that, regardless of the type of launch,
something always returns: Boosters land or are disposed, upper stages
are disposed. CSF and SpaceX further requested that the FAA not
distinguish between orbital and suborbital vehicles for end of launch.
The FAA does not agree because the distinctions in Sec.
450.3(b)(3)(i) and (ii) are necessary due to the FAA's limited
authority on orbit. For a launch vehicle that will eventually return to
Earth as a reentry vehicle, its on-orbit activities after deployment of
its payload or payloads, or completion of the vehicle's first steady-
state orbit if there is no payload, are not licensed by the FAA. In
addition, the disposal of an upper stage is not a reentry under 51
U.S.C. Chapter 509, because the upper stage does not return to Earth
substantially intact.
The FAA proposed in Sec. 450.3(b)(3)(ii) that for an orbital
launch of a vehicle with a reentry of the vehicle, launch ends after
deployment of all payloads, upon completion of the vehicle's first
steady-state orbit if there is no payload, after vehicle component
impact or landing on Earth, after activities necessary to return the
vehicle or component to a safe condition on the ground after impact or
landing, or after activities necessary to return the site to a safe
condition, whichever occurs later. The final rule changes ``if there is
no payload'' to ``if there is no payload
[[Page 79584]]
deployment'' to clarify the FAA's intent on how to determine the end of
launch for a vehicle carrying no payload or payloads that stay onboard
a vehicle.
Both CSF and SpaceX proposed ``end of launch'' should be defined on
a case-by-case basis in pre-application consultation and specified in
the license. The FAA disagrees, in part. The FAA only regulates on a
case-by-case basis if the nature of an activity makes it impossible for
the FAA to promulgate rules of general applicability. This need has not
arisen, as evidenced by decades of FAA oversight of end-of-launch
activities. That said, because the commercial space transportation
industry continues to innovate, Sec. 450.3(a) gives the FAA the
flexibility to adjust the scope of license, including end of launch,
based on unique circumstances as agreed to by the Administrator. Unique
circumstances may include, but are not limited to, unconventional
technologies like railguns that may use innovative launch and reentry
procedures requiring adjustments to a scope of license.
Finally, CSF pointed out that in the proposed rule, for hybrid
vehicles, end of launch did not mention the recovery of carrier
aircraft.
Section 450.3(b)(3) distinguishes orbital vehicles with and without
a reentry, and suborbital vehicles with and without a reentry. A
separate section for end of launch for hybrid vehicles is unnecessary
because the same parameters apply to hybrids as apply to non-hybrid
vehicles regarding end of launch. The FAA also acknowledges that the
end-of-launch parameters do not mention the recovery of a carrier
aircraft. Again, it is unnecessary to include this distinction because,
during launch, a carrier aircraft is considered part of the launch
vehicle.\28\ Therefore, to the extent that Sec. 450.3(b)(3) refers to
activities necessary to return the vehicle or component to a safe
condition on the ground after impact or landing, this reference will
include returning the carrier aircraft to a safe condition after impact
or landing.\29\
---------------------------------------------------------------------------
\28\ See Legal Interpretation to Pamela Meredith from Mark W.
Bury, Assistant Chief Counsel for International Law, Legislation and
Regulations (Sept. 26, 2013); available at https://www.faa.gov/about/office_org/headquarters_offices/agc/practice_areas/regulations/interpretations/Data/interps/2013/Meredith-ZuckertScoutt&Rasenberger%20-%20(2013)%20Legal%20Interpretation.pdf.
\29\ See Legal Interpretation to Laura Montgomery from Lorelei
Peter, Assistant Chief Counsel for Regulations (Dec. 10, 2019);
available at https://www.faa.gov/about/office_org/headquarters_offices/agc/practice_areas/regulations/interpretations/Data/interps/2019/Montgomery-Ground%20Based%20Space%20Matters%20-%202019%20Legal%20Interpretation.pdf.
---------------------------------------------------------------------------
Blue Origin asked how the FAA plans to prevent disparate impacts of
the proposed rule on those operators at multiuse facilities and at U.S.
facilities. While the meaning of disparate impacts is unclear, the FAA
construes the commenter as asking how the FAA will distinguish between
launch and non-launch (e.g., manufacturing or refurbishment of pre-
flown stages) activities at a launch site. Because launch begins with
the start of hazardous pre-flight ground operations that prepare a
vehicle for flight, an operator may manufacture or refurbish launch
vehicle components or perform certain other activities on a launch site
without requiring an FAA authorization during the time after the end of
the launch and before hazardous operations begin for the next launch.
This treatment is consistent with existing practice prior to this rule:
a vehicle operator could theoretically perform non-launch related
activities on a launch site without needing a license as long as those
activities are not in the scope of the license and do not pose a risk
to public safety.
The Airline Pilots Association (ALPA) suggested the FAA define
``family of vehicles.''
The FAA does not define ``family of vehicles'' in this final rule
because the industry continues to innovate and it would be premature to
attempt to classify all types of vehicle families for the emerging and
still-evolving commercial space industry. As discussed in the NPRM,
launch operators often define ``family of vehicles'' themselves.
Usually, the vehicles have similar base operational characteristics,
but each member of the family may be capable of different performance
characteristics.
AAAE and Denver International Airport believed that operating at a
specific site should necessitate a separate and thorough review from
the FAA, and that operators should not be able to receive one license
covering multiple sites.
The FAA will perform a thorough and complete review of all sites
where a vehicle is authorized to operate. An applicant will not be able
to add another location to its license ``with a lesser review
standard'' as described by the commenter. A licensee will have to meet
all applicable regulations for all sites authorized in a license.
Denver International Airport cited 49 U.S.C 50904(d) to argue the FAA
lacked statutory authority to grant a vehicle operator permission to
operate from multiple launch and/or reentry sites on a single license.
The FAA believes Denver International Airport meant to cite 51 U.S.C.
50904(d), which states that the Secretary of Transportation (the
``Secretary'') shall ensure that only 1 license or permit is required
from the DOT to conduct activities, including launch and reentry. The
law does not prohibit the FAA from issuing a license that allows an
operator to conduct an approved operation from various sites. Rather,
section 50904(d) merely prevents the FAA from requiring multiple
licenses for the same type of activity for which a license or permit is
required under title 51 chapter 509.
e. Safety Element Approval (Part 414)
In the NPRM, the FAA proposed to change the part 414 term from
``safety approval'' to ``safety element approval'' to distinguish it
from ``safety approval'' as used in parts 415, 431, 435, and 450. Also,
the NPRM proposed to modify part 414 to streamline the process by
enabling applicants to request a safety element approval in conjunction
with a license application. The final rule adopts the changes as
proposed.
Several commenters expressed general support for the FAA's proposed
regulations regarding safety element approvals in part 414. Blue Origin
concurred with the FAA's proposal and anticipated many benefits to an
applicant's ability to submit a separate safety element approval. One
individual commented that more extensive use of these approvals could
increase operator flexibility and significantly simplify the licensing
process for future launches.
Virgin Galactic recommended an operator that already holds a
license be able to use previously submitted data to apply for a safety
element approval. Virgin Galactic also noted that the language in the
first sentence of proposed Sec. 414.23 should be changed from ``safety
approval'' to ``safety element approval'' to reflect the updated
terminology.
The FAA agrees that an operator that already holds a license may
use previously submitted data to apply for a safety element approval.
Just as is the case with a license application or modification, an
applicant can reference previously submitted data in its safety element
approval application. The applicant will need to specify clearly what
it is referencing and indicate the referenced material is still valid.
In addition, the FAA has corrected ``safety approval'' to ``safety
element approval'' in Sec. Sec. 414.23 and 414.3.
An individual commenter suggested a new definition for safety
element approvals for hybrid vehicles. The commenter suggested the
definition include a reference to hybrid vehicle components that are
critical to avoiding
[[Page 79585]]
or mitigating hazards to the public, including vehicle characteristics.
The FAA does not agree that it should add a separate definition of
``safety element approvals'' specifically for hybrid vehicles. The
definition of ``safety element approval'' is broad enough to encompass
approvals for hybrid and non-hybrid vehicle systems. The definition
already includes the phrase ``any identified component thereof,'' which
includes a carrier vehicle. The FAA agrees that it is possible to craft
a safety element approval for the types of hazard control strategies
employed by hybrid vehicles. The FAA notes that the definition of a
``safety element'' includes launch vehicle, reentry vehicle, safety
system, process, service, or any identified component thereof; or
qualified and trained personnel performing a process or function
related to licensed activities or vehicles. This definition would allow
a hybrid operator to apply for a wide range of safety element
approvals.
Regarding process, a joint set of comments submitted by Boeing,
Lockheed Martin, Northrop Grumman, and ULA stated an operator should
not be required to apply to the FAA to transfer a safety element
approval under proposed Sec. 414.33 when the transfer is due to a
corporate transaction, reorganization, or restructure that does not
affect the material content of the original application.
The FAA will apply the same standard for application, transfer, and
issuance of a safety element approval as it does for a license. Name
changes and internal corporate restructuring do not typically require a
license transfer and therefore will not require a safety element
approval transfer.
Microcosm, Inc. (Microcosm), inquired as to how the FAA will issue
a safety element approval. The FAA will issue a safety element approval
applied for concurrently with a part 450 license in accordance with
part 414.
f. Vehicle Operator License--Issuance, Duration, Additional License
Terms and Conditions, Transfer, and Rights Not Conferred (Sec. Sec.
450.5 Through 450.13)
In the NPRM, the FAA proposed requirements addressing the issuance,
duration, and transfer of a vehicle operator license in proposed
Sec. Sec. 450.5 (Issuance of a Vehicle Operator License), 450.7
(Duration of a Vehicle Operator License), and 450.11 (Transfer of a
Vehicle Operator License), respectively. The FAA also proposed
requirements addressing the addition and modification of licensing
terms in proposed Sec. 450.9 (Additional License Terms of Conditions).
Finally, the FAA proposed requirements describing those rights that
would not be conferred by a vehicle operator license in proposed Sec.
450.13 (Rights Not Conferred by a Vehicle Operator License). The FAA
proposed these rules to consolidate the requirements for different
types of launch and reentry licenses in parts 415, 431, and 435 into a
single vehicle operator license.
AIA and Sierra Nevada commented that the FAA should not be allowed
to make modifications to the terms and conditions of a license except
within a limited time frame and subject to specified procedures to
ensure reasonable notice and due process to the vehicle operator. The
FAA will not adopt this recommendation and retains the provision in
Sec. 450.9 that allows the FAA to modify a vehicle operator license at
any time by modifying or adding license terms and conditions to ensure
compliance with the Act and its implementing regulations. This
provision was introduced in 1999 in 14 CFR 415.11 because the FAA
recognized that a particular licensee's launch (or reentry) may present
unique circumstances that were not covered by the license terms and
conditions in place. Because such a modification would be based on
unique circumstances, the FAA is unable to specify a timeline as
requested by the commenter.
In the final rule, the FAA adopts these requirements as proposed
and adds specificity to Sec. 450.11 to indicate that either the holder
of a vehicle operator license or the prospective transferee may request
a vehicle operator license transfer, both the holder and prospective
transferee must agree to the transfer, and the FAA will provide written
notice of its determination to the person requesting the vehicle
operator license transfer. These additions mirror the language used for
the transfer of a safety element approval and reflect current practice.
The FAA did not receive any comments on these proposed
requirements.
3. Part 450 Subpart B--Requirements To Obtain a Vehicle Operator
License
a. Incremental Review and Determinations (Sec. 450.33)
In the NPRM, the FAA proposed to amend part 413 and to include
provisions in part 450 to allow an applicant the option for an
incremental review of all portions of its application. This proposal
was in response to the ARC recommendations. Specifically, the FAA
proposed to amend Sec. 413.15 (Review Period) to provide that the time
frame for any incremental review and determinations would be
established with an applicant on a case-by-case basis during pre-
application consultation. As stated in the NPRM, the FAA did not
propose to reduce by regulation the statutory review period of 180
days.
In the final rule, the FAA provides clarification on the basis the
Administrator would consider when approving an incremental approach.
In the NPRM, the FAA sought comment on how a formal incremental
review process would account for the statutory 180-day review period
when application increments or modules are likely to be submitted and
reviewed at different times, other useful guidelines for applicants
crafting incremental approaches, and any safety approval sections that
would be appropriate for incremental review. The FAA did not receive
any comments with feasible solutions on any of these topics.
Several commenters expressed support for the FAA's proposed
incremental review process, stating that it would increase flexibility.
Virgin Galactic supported the FAA's proposed approach to incremental
review and commented that it aligned with many other approval processes
in other divisions of the FAA.
Many commenters, including Leo Aerospace, Microcosm, Sierra Nevada,
SpaceX, and Virgin Orbit asked about the duration of incremental review
periods. Noting the FAA's statutory mandate to issue a license
determination not later than 180 days after accepting an application,
commenters inquired whether each module would be subject to this 180-
day review period. Several commenters, including CSF and Sierra Nevada,
stated they interpret the 180-day statutory requirement to mean that
the sum total of all module reviews must not exceed 180 days.
Commenters noted that if every module was subject to a 180-day review,
the process would be very time-intensive.
Until the FAA has more experience with the incremental review
process, the FAA will review each module in accordance with a schedule
discussed with the prospective applicant during pre-application
consultation. In developing the incremental review schedule, the FAA
will consider the interdependence of parts of the evaluation and the
sequence of their submissions. The FAA makes these criteria explicit in
this rule in Sec. 450.33 (Incremental Review and
[[Page 79586]]
Determinations) paragraphs (b)(1) and (b)(2).\30\
---------------------------------------------------------------------------
\30\ These criteria derived from the discussion in the preamble
to the NPRM on what an applicant should consider when proposing an
incremental approach. In relevant part, the NPRM stated: ``1.
Application increments submitted at different times should be not be
dependent on other increments to the extent practicable. 2.
Application increments should be submitted in a workable
chronological order. In other words, an applicant should not submit
an application increment before a separate application increment on
which it is dependent. For example, the FAA would not expect to
agree to review a risk analysis before reviewing a debris analysis
or probability of failure analysis because the risk analysis is
directly dependent on the other two analyses.'' 84 FR at 15366.
---------------------------------------------------------------------------
Review of any modules prior to submittal of an application in its
entirety will not initiate or be bound by the statutory 180-day review
period. Rather, an agreed upon review period will begin once the FAA
has a complete enough application in its entirety. During pre-
application consultation, an applicant seeking an incremental review
may negotiate a time frame shorter than the statutory 180-day review
period. As the FAA gains more experience with the incremental review
process, it may develop guidance concerning expected timelines for
various sequences of modular submissions.
Sierra Nevada commented that, if a module is denied, proposed Sec.
413.21 (Denial of a License or Permit Application) should allow the FAA
to extend the review period by up to 60 days to consider a revised
application. The commenter noted it supports the FAA's practice of
tolling the review period in the case of a deficient application as
long as the applicant understands the deficiency and what must be
submitted for the FAA to continue its review. Leo Aerospace inquired
whether an application would be considered accepted after the
incremental process is defined, or after the last step of the
incremental process is completed, and asked how an operator would be
notified if its safety review was accepted.
Sierra Nevada's interpretation of incremental review is incorrect
because a module cannot be denied under Sec. 413.21. If the FAA
determines a module does not contain sufficient information, the FAA
and the applicant will discuss amending the agreed upon incremental
review schedule to allow time for the applicant to submit a revised
module. An applicant will be notified in writing when its complete
application has been accepted.
Sierra Nevada noted the primary concern with module time frames was
the transparency of the FAA's license application process and the
ability for operators to reduce operational risk associated with the
various time frames. To that end, a number of commenters, including
Sierra Nevada, Leo Aerospace, and SpaceX, requested the FAA provide an
outline of acceptance and review timelines and example timelines for
incremental applications. CSF and Sierra Nevada agreed with the FAA's
proposal to establish the timeline for incremental submissions in the
pre-application phase but suggested the FAA include in an AC its goal
for maximum review time frames for particular modules. CSF and Sierra
Nevada recommended the AC include the following time frames: 60 days
for policy approval; 30 days for payload review; 60 days for safety
approval; 5 days for environmental assessment; and 15 days for
financial responsibility assessment. CSF and Sierra Nevada noted that
the FAA's review of the environmental assessment should only take 5
days because the FAA has had insight into the contractor used to
conduct the environmental assessment, and the FAA's review should
therefore simply be a verification that the applicant has submitted the
final product. CSF and Sierra Nevada acknowledged that the financial
responsibility assessment could take longer than 15 days for methods
other than obtaining insurance, but stated that this possibility could
be mitigated by the FAA's providing guidance that addresses the type of
information that a licensee would need to submit to satisfy FAA review
under Sec. 440.9(f).
Commenters suggested that time frames for incremental review should
be based on the complexity of the review and that they should be
shorter than the statutory limit for the review of a complete
application. Specifically, Virgin Galactic commented time frames should
be based on the complexity of the item being reviewed. Sierra Nevada
recommended modules be subject to a shorter review time frame than full
application reviews and to define that time frame in Sec. 413.15.
Sierra Nevada stated the FAA should consider a shorter timeline of 90
days for review of a license application in order to meet the direction
in Space Policy Directive-2 to streamline the review process.
The FAA declines to incorporate the suggested time frame changes
because they will not provide adequate time for the FAA to assess
application materials for completeness in all situations and for all
potential applications. The FAA agrees that modules will likely be
reviewed faster than an entire application, and that review times will
depend largely on complexity; however, at this point it is premature to
define those time frames until FAA has more experience with incremental
reviews. The FAA will not at this time adopt maximum time frames,
because each evaluation is a unique review that must be adjusted to
each operation. The FAA's evaluation of the safety implications of an
application typically requires the most effort and time, usually far
more than the 60 days suggested by the commenters. The MPL is derived
from the safety analysis and cannot be completed independently of it.
An environmental review must be completed before a license can be
issued. Particularly for new operations, the environmental process can
be lengthy, and the FAA advises applicants to begin it early, even
before a license application is submitted. For example, an applicant
must submit a completed environmental impact statement (EIS) prepared
by the FAA (or an FAA-selected and managed consultant contractor), FAA-
approved environmental assessment (EA), categorical exclusion
determination, or written re-evaluation as part of its application
materials. The 180-day statutory application review period is not
intended to encompass the time needed for the applicant to develop the
necessary application materials, including environmental documentation.
Five days may not be enough time to evaluate an environmental document,
such as a complex EA.
For conventional operations that do not pose substantial policy-
related challenges, policy and payload reviews can be conducted in less
time than the safety review. However, these reviews are often performed
concurrently with the safety review so their completion typically does
not reduce the overall time required to reach a license determination.
As the FAA gains more experience with the incremental review process,
it may elect to update guidance to reflect timelines that have
consistently proven effective.
Submitting an application incrementally affords an applicant the
approval of various systems and processes earlier than the current non-
incremental review process. The FAA expects that the central value of
an incremental approach is regulatory certainty for components of the
application and flexibility for applicants rather than a reduction in
overall review time. However, the FAA anticipates that a determination
of an accepted application that utilizes safety element approvals or
approved modules will be completed faster than a similar application
that does not use safety element approvals or incremental review.
[[Page 79587]]
Sierra Nevada recommended that an AC should also address the type
of information a licensee would need to submit for the FAA's financial
responsibility review. The financial responsibility requirements
contained in part 440 are beyond the scope of this rulemaking. However,
the financial responsibility requirements are adequately addressed in
Appendix A to Part 440--Information Requirements for Obtaining a
Maximum Probable Loss Determination for Licensed or Permitted
Activities. Virgin Galactic recommended the FAA take into account FAA
AVS \31\ Project Specific Certification Plans to inform the incremental
review process in proposed part 414. The FAA will discuss project-
specific information, including AVS documents, during pre-application
consultation.
---------------------------------------------------------------------------
\31\ AVS is the FAA's Office of Aviation Safety.
---------------------------------------------------------------------------
Virgin Galactic also inquired how the operator would be notified
when the operator's safety review has been accepted or rejected. The
FAA will inform an applicant in writing as to whether each module is
accepted or rejected.
b. Means of Compliance (Sec. 450.35)
In the NPRM, the FAA proposed that an applicant would be required
to use an accepted means of compliance for the following requirements:
Highly reliable FSS, FSA methods, lightning flight commit criteria, and
airborne toxic concentration and duration thresholds for both flight
and ground hazards. For these requirements, the means of compliance
would need to be accepted by the FAA prior to the submission of an
application. For all other performance-based requirements, an applicant
would be able to use a means of compliance proposed in an application.
While the final rule maintains that an applicant must use an
accepted means of compliance in an application for specified
requirements, the FAA has made amendments to the structure of the
regulatory text to identify more clearly that the use of accepted means
of compliance is an application requirement. This requirement is now
specified in Sec. 450.35(a) of the final rule.
As stated above, for those five sections now identified in Sec.
450.35, an applicant must use a means of compliance in its application
that has been reviewed and accepted by the Administrator. The FAA will
not accept an application that uses a means of compliance that has not
already been accepted by the Administrator for any of the five
requirements listed in Sec. 450.35. The five requirements listed in
Sec. 450.35 are essential to public safety and involve well-
established and complex methodologies, thresholds, or practices.
Because of the complex nature and public safety impact of these
requirements, the FAA would be unable to review unique means of
compliance for these five requirements during its application
evaluation within its review time frame. Rather, an applicant could
choose to use an accepted means of compliance in its evaluation, or
could submit a unique means of compliance for review and acceptance
prior to submitting its application. Unique means of compliance for the
requirements identified in Sec. 450.35 may require evaluation before
they are accepted as demonstrating fidelity and safety, however this
rule allows unique means of compliance for these sections to be
submitted in advance of a license application in order to provide
flexibility and enable innovative concepts. For all other sections of
part 450, an applicant may propose in its application a means of
compliance that has not been previously accepted by the Administrator,
and the FAA will review the means of compliance as part of its
application review process. It is worth noting that an applicant who
uses means of compliance that have already been accepted by the FAA in
its license application will likely experience a more expeditious
license review and determination.
A means of compliance is one means, but not the only means, by
which a requirement can be met and may be used to demonstrate
compliance with any of the performance-based requirements. For all
performance-based requirements other than those listed in Sec. 450.35,
an applicant may include a unique means of compliance in an application
for the FAA to review during the application evaluation. In the NPRM
docket,\32\ the FAA included a table listing all publicly available
means of compliance for each proposed performance-based requirement
(the ``Means of Compliance Table'') in subpart C that the FAA has
accepted to date. An applicant need not include the entirety of an
accepted means of compliance standard in an application, but may
instead reference the accepted means of compliance using identifying
features such as title and date or version.
---------------------------------------------------------------------------
\32\ See FAA-2019-0229-0018.
---------------------------------------------------------------------------
Several commenters interpreted the NPRM as only allowing the means
of compliance listed in the Means of Compliance Table. Conversely, the
CSF commented that applying means of compliance flexibility only to the
regulations cited in the Means of Compliance Table would be too
limited, and should be expanded. The CSF also requested that the FAA
remove or correct the preamble text to reflect that any applicant can
seek to add an accepted means of compliance to the Means of Compliance
table. The CSF specifically mentioned that the FAA should allow
flexible means of compliance to meet the conditional expected casualty
calculation in proposed Sec. 450.101(c). SpaceX also commented that
the FAA should expand the scope of flexible means of compliance and
specifically identified proposed Sec. 450.101(c).
The FAA emphasizes that any requirement in part 450 can have one or
more means of compliance. The Means of Compliance Table provides one
way, but not the only way, to meet the requirements in part 450. The
conditional expected casualty thresholds in proposed Sec. 450.101(c)
were intended as safety criteria to measure and protect against
potential high consequence events. In the final rule, the FAA has
clarified Sec. 450.101(c) to allow alternative demonstrations of high
consequence event mitigation. This change is discussed in detail later
in the preamble. The FAA will review the submitted means of compliance
to determine whether they satisfy the regulatory safety standard. These
means of compliance may be government standards, industry consensus
standards, or unique means of compliance developed by an individual
applicant. For government standards or means of compliance developed by
a consensus standards body, the FAA will provide public notice of those
accepted means of compliance that it determines satisfy the
corresponding regulatory requirement. The FAA will also review unique
means of compliance developed by an individual applicant to determine
whether they satisfy the regulatory requirement.
Once a means of compliance is accepted by the FAA, it may be used
to demonstrate compliance with the corresponding regulatory
requirement. An updated Means of Compliance Table will be placed on the
docket once the final rule publishes. This updated table identifies the
means of compliance accepted by the FAA at this time for the
corresponding regulation. This table will be made available on the FAA
website and updated as additional means of compliance are accepted by
the FAA. Unique individual operator-developed means of compliance will
not be included in the Means of Compliance Table to protect proprietary
information,
[[Page 79588]]
unless the operator that developed the means of compliance requests
that its means of compliance be included.
CSF requested that the FAA clarify that it would not require
compliance with an untailored RCC 319 \33\ in order to demonstrate
reliability. Blue Origin commented that the preamble does not address
accepted means of compliance as a standalone flexibility measure. CSF
and SpaceX commented that the proposed rule risks being quickly
outdated and could discourage innovation because it does not allow
tailoring of the requirements.
---------------------------------------------------------------------------
\33\ The Range Commanders Council (RCC) addresses the common
concerns and needs of operational ranges within the United States.
It works with other government departments and agencies to establish
various technical standards to assist range users. RCC 319 provides
for the safety of people and missions during launch and flight
operations.
---------------------------------------------------------------------------
This rule does not require compliance with an untailored RCC 319 in
order to demonstrate reliability; however, at this time, RCC 319 is the
only accepted means of compliance for flight abort with a highly
reliable FSS under Sec. 450.145. An applicant may propose a tailored
version of any accepted means of compliance, including RCC 319. If an
applicant wishes to tailor RCC 319, the applicant must propose its
tailored means of compliance as a unique means of compliance in advance
of its license application. An applicant may include any unique means
of compliance as part of its license application, other than those
sections identified in Sec. 450.35(a) that require a means of
compliance to be accepted prior to application submittal. An applicant
may also propose a unique means of compliance to meet these
requirements in advance of its license application.
An individual commenter recommended that the FAA allow tailoring
and include a clause to attend United States Air Force (USAF) tailoring
meetings as part of meeting parts 415 and 417 requirements. As noted
earlier, the FAA does allow tailoring. Part 450 will not change the
FAA's current practice of attending tailoring meetings.
Virgin Galactic also recommended that the current part 417
appendices and range analyses continue to satisfy the requirements in
part 450, and that the FAA complete its Launch Site Safety Assessments
(LSSAs) in order for operators to know which Federal launch or reentry
site's analyses and processes the FAA would find acceptable as means of
compliance. ULA commented that the rule should more clearly allow work
performed by another Federal agency to meet FAA requirements.
The part 417 appendices that can be used as an accepted means of
compliance to part 450 requirements are listed in the Means of
Compliance Table in the docket. The FAA agrees that it needs to
determine and communicate to the industry which Federal launch or
reentry site analyses and processes satisfy part 450. As noted earlier,
the FAA will accept any safety-related launch or reentry service
provided by a Federal launch or reentry site or other Federal entity by
contract, as long as the FAA determines that the launch or reentry
service satisfies part 450.
The New Zealand Space Agency (NZSA) and Virgin Galactic asked what
process and standards the Administrator would employ for accepting
means of compliance. Virgin Galactic asked what accepted means of
compliance would be and whether the Administrator would use means of
compliance that have not been published. Virgin Galactic also stated
that means of compliance would need to be published prior to any work
being performed that would require the means of compliance. Northrup
Grumman supported the publication of newly accepted means of
compliance.
The FAA will provide public notice of each publicly available means
of compliance that the Administrator has accepted by posting the
acceptance on its website. This notification will communicate to the
public and the industry that the FAA has accepted a means of compliance
or any revision to an existing means of compliance. The FAA will not
post unique means of compliance documents with proprietary information
submitted by applicants, unless specifically authorized by the
applicant. The applicant may wish to consider offering its unique means
of compliance to a consensus standards body for inclusion as part of an
industry-developed consensus standard. The final rule does not adopt
proposed Sec. 450.35(b), which stated that the FAA would provide
public notice of each means of compliance that the Administrator has
accepted. The FAA removes this requirement because it is not a
licensing requirement.
Proposed Sec. 450.35(c) is amended and renumbered as Sec.
450.35(b). The provision is renumbered because the final rule removes
the proposed Sec. 450.35(b), as discussed previously. In the final
rule, Sec. 450.35(b) allows a person to submit a means of compliance
to the FAA for review outside the licensing process. The means of
compliance must be submitted in a form and manner acceptable to the
Administrator. The proposed rule limited this provision to applicants,
whereas the final rule would allow any person to request acceptance of
a proposed means of compliance. This is because the FAA anticipates
other people or entities other than applicants may wish to submit a
proposed means of compliance, such as operators that plan to be
applicants in the future, and voluntary consensus standards bodies. The
FAA wants to enable this. Section 450.35(b) is limited to requests for
acceptance of a proposed means of compliance outside a license
application, because the license application process is already defined
in parts 413 and 450. Lastly, the FAA changes the modifier in front of
``means of compliance'' from ``alternative'' to ``proposed.'' The term
``proposed'' is better suited to the types of means of compliance the
FAA would expect from this provision.
The process the FAA employs to accept a means of compliance will be
set forth in guidance. \34\ When submitting a unique means of
compliance, an applicant's proposal should identify the regulation that
the proposed means of compliance will address and provide the rationale
as to why it demonstrates compliance with the applicable regulation.
When reviewing a unique means of compliance, the FAA will consider past
engineering practices, the technical quality of the proposal to
demonstrate compliance with the part 450 regulations, the safety risk
of the proposal, best practice history, and consultations with
technical specialists for additional guidance.
---------------------------------------------------------------------------
\34\ See AC 450.35-1, Means of Compliance.
---------------------------------------------------------------------------
NZSA and Virgin Galactic asked how the FAA would protect an
operator's proprietary information when publishing means of compliance.
NZSA recommended that the FAA retain the ability to share, with consent
of the applicant, information about the means of compliance used to
issue a license that may include proprietary information.
As a general matter, the FAA does not share proprietary data with
the public. The FAA will treat any proprietary data linked to a unique
means of compliance in the same manner as it protects proprietary data
that an applicant uses to support a license application.
An individual commenter suggested the development of a Space Safety
Institute to develop industry consensus standards. A consensus
standards body, any individual, or any organization would be able to
submit means of compliance documentation to the FAA for consideration
and potential acceptance. The FAA recommends that in developing
standards, a voluntary
[[Page 79589]]
consensus standards body consider the processes outlined in OMB
Circular A-119.
c. Use of Safety Element Approval (Sec. 450.39)
In the NPRM, the FAA proposed Sec. 450.39 (Use of Safety Element
Approval) to allow an applicant to use any vehicle, safety system,
process, service, or personnel for which the FAA has issued a safety
element approval under part 414 without the FAA's reevaluation of that
safety element during a license application evaluation to the extent
its use is within its approved envelope. The proposed rule would also
change the part 414 term from ``safety approval'' to ``safety element
approval'' to distinguish it from ``safety approval'' as used in parts
415, 431, and 435, and proposed part 450, because these terms have
different meanings.
In the final rule, the FAA replaces the word ``envelope'' with the
word ``scope.'' ``Scope'' more accurately captures ``envelope,
parameter, or situation'' as used in the definition of ``safety element
approval.'' For consistency, the same change is made in Sec. 437.21.
d. Policy Review (Sec. 450.41)
In the NPRM, the FAA proposed to remove the requirement that
applications include, for the purpose of conducting a policy review,
information related to the structural, pneumatic, propulsion,
electrical, thermal, guidance, and avionics systems used in the launch
vehicle and all propellants. Instead, in order for the FAA to conduct
its policy review, the FAA proposed that an applicant identify the
launch or reentry vehicle and its proposed flight profile and describe
the vehicle by characteristics that include individual stages, its
dimensions, type and amounts of all propellants, and maximum thrust. In
the final rule, the FAA adopts Sec. 450.41 (Policy Review and
Approval) as proposed.
Boeing, Lockheed Martin, Northrop Grumman, Sierra Nevada, and ULA
suggested the FAA change the word ``normal'' in proposed Sec.
450.41(e)(4)(iv) to ``nominal'' to be consistent with industry
vernacular.
The FAA disagrees with this suggestion because the FAA seeks a
range of possible impact areas in this section, not a particular impact
point inferred by the use of ``nominal.''
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended the
FAA add to Sec. 450.41(b)(3) the phrase ``but not limited to'' in
order to allow the FAA to consult Federal agencies other than the
National Aeronautics and Space Administration (NASA).
The FAA disagrees that the additional language is needed to clarify
that the FAA may consult Federal agencies other than NASA pursuant to
Sec. 450.41(b)(3). The term ``include'' implies the phrase ``but not
limited to.''
The FAA notes, consistent with current practice, that if a launch
or reentry proposal would potentially jeopardize U.S. national security
or foreign policy interests, or international obligations of the United
States, the FAA may seek additional information from an applicant in
support of interagency consultation to protect U.S. Government
interests.
An individual commenter recommended the FAA require licensees to
comply with the Committee on Space Research's planetary protection
policy (COSPAR PPP) as a means of ensuring that commercial launches
comply with the Outer Space Treaty and of resolving existing gaps in
the statutory prohibition on obtrusive advertising in outer space.
The FAA acknowledges the commenter's concerns, but the scope of
this rulemaking does not encompass COSPAR's PPP or the statutory
prohibition on obtrusive advertising.
e. Payload Reviews (Sec. 450.43)
In the NPRM, the FAA proposed to consolidate payload review
requirements, remove the requirement to identify the method of securing
the payload on an RLV, add application requirements to assist the
interagency review, such as the identification of approximate transit
time to final orbit and any encryption, clarify the FAA's relationship
with other Federal agencies for payload reviews, and modify the 60-day
notification requirements currently found in Sec. Sec. 415.55 and
431.53.
The FAA stated in the NPRM preamble that, while it would review all
payloads to determine their effect on the safety of launch, the FAA
will not make a determination on those aspects of payloads that are
subject to regulation by the Federal Communications Commission (FCC) or
the Department of Commerce or on payloads owned or operated by the U.S.
Government. In addition, the proposed rule added informational
requirements that would include the composition of the payload and any
hosted payloads, anticipated life span of the payload in space, any
planned disposal, and any encryption associated with data storage on
the payload and transmissions to or from the payload. Finally, the NPRM
proposed to preserve the ability of payload operators to request a
payload review independent of a launch license application. The FAA
sought comments on the approach of including more requirements for a
payload review in the regulation in order to expedite payload review
application processing, but received none.
In the final rule, the FAA adopts Sec. 450.43 (Payload Review and
Determination) with revisions. The FAA adds the term, ``if
applicable,'' to Sec. Sec. 450.31(a)(3) and 450.43(a) to clarify that
a payload review is not always required. The FAA notes that all
payloads include any hosted or secondary payloads.
The Commercial Smallsat Spectrum Management Association (CSSMA)
suggested that the FAA adopt a sixty (60) day timeline for independent
payload review. CSSMA found little incentive for a payload owner or
operator to use the independent payload review process, absent a fixed
timeline for such payload reviews. CSSMA also recommended language that
would render Sec. 413.21(a) (Denial of a License or Permit) applicable
to independent payload reviews.
The FAA declines to revise Sec. 413.21(a) as suggested because the
payload review is a requirement to obtain a launch or reentry license
under part 450. The FAA notes that a favorable payload determination
does not itself constitute a license. As such, the procedures set forth
in Sec. 413.21(a) do not apply to payload reviews, whether conducted
independently of or in conjunction with a license application.
The FAA also declines to incorporate CSSMA's suggested timeline for
review. The FAA has not specified a timeline to complete payload
reviews independent of a license application because, historically,
payload owners or operators have requested such reviews for unique
missions that have raised novel concerns regarding public health and
safety, safety of property, or national security or foreign policy
interests of the United States. Because independent payload reviews
often raise complex issues and often require extensive interagency
consultation, the FAA cannot anticipate a standard timeline for payload
reviews conducted independently from a license application.
Accordingly, FAA will not establish a standard timeline for such
reviews in its regulations. Applicants are encouraged to discuss
timelines to review their particular proposals during pre-application
consultation.
NZSA requested the FAA include in the final rule all legislative or
regulatory standards by which the FAA will assess payloads at the
application stage. NZSA stated that doing so would give owners
[[Page 79590]]
of novel payloads and non-U.S. operators regulatory certainty on the
standards they must meet to be launched on a vehicle licensed by the
FAA. As one example of a rule that would affect payload review but did
not appear in proposed Sec. 450.41, NZSA cited the prohibition on
launching payloads for ``Obtrusive Space Advertising.''
The FAA declines to expand the bases for issuing an unfavorable
payload determination beyond those set forth in Sec. 450.43(a). It
would not be practical to list every law, regulation, and policy that
may possibly affect a proposed payload under Sec. 450.43. Rather,
applicants are required to complete a pre-application consultation
during which the FAA can learn about the proposed action and advise the
applicant on a path forward, including any U.S. regulations, laws, or
policies that may impact its proposal. Payload owners and operators may
also use the independent payload review process set forth in Sec.
450.43(d), which provides greater regulatory certainty for novel
payloads.
Virgin Galactic suggested the FAA treat payloads that stay within a
vehicle as additional equipment on the launch vehicle, subject only to
the safety analysis required of any other piece of equipment on board a
launch vehicle. Virgin Galactic commented that requiring a payload
review for items not ejected from a launch vehicle places an
unnecessary burden on operators and the FAA. Virgin Galactic also
requested clarification on seemingly contradictory language in the NPRM
preamble regarding a payload placed in outer space versus a payload
that remained on or within the vehicle.
The FAA disagrees with Virgin Galactic's suggestion. Payloads that
(1) stay within a vehicle, (2) do not contain hazardous materials, or
(3) have previously been approved may require less scrutiny but are
still being placed in outer space and therefore meet the 14 CFR 401.5
definition of ``payload'' and require a payload review. Under 51 U.S.C.
50904(c), the FAA must verify that all licenses, authorizations, and
permits required for a payload have been obtained; and that the
proposed launch or reentry will not jeopardize public health and
safety, safety of property, U.S. national security or foreign policy
interests, or international obligations of the United States. The FAA
therefore declines to exclude from the requirement to obtain a payload
review any payload that remains on the vehicle.
Virgin Galactic recommended the FAA amend proposed Sec.
450.31(a)(3), which seemed to require favorable payload determinations
for any launch or reentry, noting that not all vehicles carry payloads.
Absent this amendment, Virgin Galactic commented it would need to seek
a waiver for each non-payload flight, creating an unnecessary burden.
The FAA agrees that an applicant does not need to seek a payload
determination if the proposed launch or reentry will not involve a
payload. Therefore, the FAA revises Sec. 450.31(a)(3) by adding the
phrase, ``if applicable.''
Space Logistics, LLC (Space Logistics) urged the FAA to coordinate
with other Federal agencies before expanding its payload review process
in order to avoid duplicating activities. Space Logistics noted that
the requirements to describe encryption associated with a payload's
data storage and transmissions and to provide any information deemed
necessary by the FAA under proposed Sec. 450.43(i) were open-ended and
may duplicate requirements of the FCC, NASA, the National Oceanic and
Atmospheric Administration (NOAA), or Office of Space Commerce (OSC).
The FAA agrees with Space Logistics's comment that Federal agencies
must continue to streamline requirements applicable to commercial space
activities and work closely to eliminate duplicative requirements and
minimize review times for policy and payload issues. The FAA has
engaged its Federal partners in this rulemaking process in order to
minimize duplication. For instance, the FAA proposed to require that
applicants provide encryption data (in Sec. 450.43(i)(1)(x)) in part
to support the Department of Defense (DOD) review of payloads for
impacts to national security. Encryption information allows the DOD to
assess impacts on national security due to potential cyber intrusion or
loss of vehicle control. Through its interagency coordination, the FAA
endeavors not to request information already provided to other Federal
agencies.
Boeing, Lockheed Martin, Northrop Grumman, and ULA suggested adding
to proposed Sec. 450.43(a) a requirement for FAA coordination with the
applicable Federal agency to ensure that the payload will not interfere
with or impede launch, on[hyphen]orbit operations, or reentry of other
approved missions. The commenters stated this addition would avoid
adverse impacts to other federally-approved missions or operating
systems.
Although the FAA agrees that coordination with applicable Federal
agencies is important to ensure a payload or payload class will not
interfere with agency operations, the FAA disagrees that the
recommended addition to Sec. 450.43(a) is necessary. The interagency
coordination required for both payload and license application review,
coupled with the criteria set forth in Sec. 450.43(a)(1) and (a)(2),
adequately addresses the commenters' concerns. Those provisions direct
that the FAA will issue a favorable payload determination if (1) the
applicant, payload owner, or payload operator has obtained all required
licenses, authorizations, and permits; and (2) the launch or reentry of
the payload would not jeopardize public health and safety, safety of
property, U.S. national security or foreign policy interests, or
international obligations of the United States. The FAA notes,
consistent with current practice, that if a payload or payload class
presents a potential risk to an agency's asset or other mission, the
FAA may seek additional information from an applicant on behalf of the
agency to protect U.S. Government interests and assets consistent with
these two objectives. However, in light of commenters' concerns, the
FAA is working with the appropriate agencies to increase transparency
and support the development of agency guidance on the interagency
consultation process during a payload review. The FAA also plans to
publish its own guidance on payload review, in the form of an Advisory
Circular, which will reference NASA, DOD, or other agency guidance.
Insight into the interagency process will help operators anticipate
what questions and concerns may arise during interagency consultation,
which may vary depending on the operation, and will allow operators to
be better prepared to address any potential issues during payload
review. To the extent the commenters intended to address space traffic
management or access-to-space issues, such matters exceed the scope of
this rulemaking.
Boeing suggested the FAA refrain, in proposed Sec. 450.43(b)(2),
from issuing a determination on payload components owned, sponsored, or
operated by the U.S. Government. Similarly, Boeing, Lockheed Martin,
Northrop Grumman, and ULA recommended the FAA exclude from the review
requirement in proposed Sec. 450.31(a)(3) any payloads that have
undergone safety review or received approval by another Federal agency.
The FAA declines to exclude from review under Sec. 450.43(b)
payloads that are sponsored by the U.S. Government. Section
450.43(b)(2) excludes payloads owned or operated by the U.S.
[[Page 79591]]
Government. Payloads that are not owned or operated by the U.S.
Government may not have undergone the same scrutiny, and hence the FAA
review is warranted. The FAA also disagrees with the recommended change
to Sec. 450.31(a)(3). Although the FAA does not make a determination
on those aspects of payloads that are subject to regulation by other
Federal agencies, the FAA does review all payloads to determine their
effect on the safety of launch, which may differ from the purpose of
another agency's payload review. As such, no change from the proposal
is made.
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended
adding to the agencies listed in proposed Sec. 450.43(e)(3) the FCC,
NOAA, and the National Telecommunications and Information
Administration. The commenters also proposed adding to the interagency
consultation process set forth in proposed Sec. 450.43(e) a
requirement that the FAA consult with Federal launch or reentry sites
to coordinate facility information for MPL determination, and to
coordinate collision avoidance analysis with the cognizant Federal
agency, when the launch or reentry activity is not on a Federal launch
or reentry site. The commenters stated that operators should not have
to obtain and provide Federal site facility information, which is often
sensitive and not available to commercial operators.
The FAA disagrees that the recommended addition to Sec.
450.43(e)(3) is necessary. The list of agencies that the FAA consults
with under Sec. 450.43(e) is not exhaustive and does not preclude
consultation with any other Federal entity in order to ensure that a
payload meets the criteria set forth in Sec. 450.43. With respect to
the recommendation for the FAA to add the interagency consultation
process to its MPL determination, current regulations address
coordination. In addition, changes to part 440 are outside the scope of
the rulemaking. In accordance with 14 CFR 440.7(b), the FAA consults
with Federal agencies that are involved in, or whose personnel or
property are exposed to risk of damage or loss as a result of, a
licensed activity and obtains any information needed to determine
financial responsibility requirements. Similarly, collision avoidance
analysis is conducted wholly outside of the payload review. Part 450
provides for coordination of collision avoidance analyses with the
cognizant Federal agency, though this coordination is primarily
conducted on a launch-by-launch basis, and well after the payload
review process, which often occurs during the application review
process.
f. Safety Review and Approval (Sec. 450.45)
i. Launch and Reentries From a Federal Launch or Reentry Site (Sec.
450.45(b))
In the NPRM, to address concerns regarding duplicative government
requirements at Federal launch or reentry sites, the FAA proposed
largely performance-based requirements for both ground and flight
safety that an operator could meet using Air Force and NASA practices
as means of compliance. The FAA pointed out that it issues a safety
approval to a license applicant proposing to launch from a Federal
launch or reentry site if the applicant satisfies the requirements of
part 415, Subpart C (Safety Review and Approval for Launch from a
Federal Launch Range), and has contracted with the Federal site for the
provision of safety-related launch services and property, as long as an
FAA LSSA shows that the site's launch services and launch property
satisfy part 417. The FAA did not refer to the LSSA process in the
regulatory text in proposed part 450. The FAA did propose, in Sec.
450.45 (Safety Review and Approval) paragraph (b), that the FAA would
accept any safety-related launch or reentry service or property
provided by a Federal launch or reentry site or other Federal entity by
contract, as long as the FAA determined that the launch or reentry
services or property provided satisfy part 450.
The FAA adopts Sec. 450.45(b) as proposed, with one revision. The
FAA changes the reference to ``Federal range'' to ``Federal launch or
reentry site'' throughout part 450, to include NASA and DOD launch and
reentry sites.
As discussed in the NPRM preamble, the FAA assesses each Federal
launch or reentry site and determines if the Federal site meets FAA
safety requirements. If the FAA assessed a Federal launch or reentry
site and found that an applicable safety-related launch service or
property satisfies FAA requirements, then the FAA treats the Federal
site's launch service or property as that of a launch operator's, and
there is no need for further demonstration of compliance to the FAA.
The FAA reassesses a site's practices only when the site changes its
practice. The final rule maintains the position discussed in the NPRM,
namely that these performance-based regulations allow an operator to
use DOD and NASA practices as a means of compliance. In addition, this
rule introduces a provision that allows operators operating from
certain Federal sites to opt out of demonstrating compliance with the
FAA's ground safety requirements.
CSF and Space Florida submitted comments indicating their
dissatisfaction with the NPRM's approach to reducing duplication
regarding launch from a Federal launch or reentry site. ULA encouraged
the FAA to reduce duplication between the FAA and Federal sites.
Northrop Grumman commented that the FAA should accept the Federal
launch or reentry site safety processes as satisfying FAA requirements
because it was reasonable to presume changes to launch range
regulations would continue to provide for safe pre-flight and flight
operations on Federal launch or reentry sites. Similarly, SpaceX stated
that part 450 or its supporting documents should reference agreements
between the FAA and other Federal entities, including the USAF, which
allow each agency to accept the analyses and technical determinations
of the other. Blue Origin commented that it looks forward to
understanding the contents of any agreements between the ranges and the
FAA.
Another individual commenter raised similar concerns that the FAA's
proposed licensing regulations do not resolve long-standing issues with
duplicative and overlapping rules burdening commercial launch operators
at the KSC and CCAFS. CSF stated that duplicative or conflicting rules
among overlapping Federal jurisdictions create a barrier to entry for
small startups and unnecessarily increase the cost of space access to
all users by forcing all providers either to pass those costs on to
their customers (including the U.S. Government) or to be denied the
availability of new capabilities due to lack of bandwidth and
resources. CSF argued that this burden will drive internationally-
competed business to other countries to avoid the cost or schedule
impacts arising from duplicative, conflicting, and overlapping sets of
rule. CSF also argued the FAA did not address the overlapping
jurisdiction of the FAA and other Federal and State agencies (the
Occupational Safety and Health Administration (OSHA), the Environmental
Protection Agency (EPA), the Bureau of Alcohol, Tobacco, Firearms and
Explosives (ATF), and their State and local equivalents) for hazardous
ground operations.
The FAA does not agree with the comment that the FAA is duplicating
oversight with other agencies such as OSHA, EPA, and ATF. Commercial
space activities may be subject to the
[[Page 79592]]
jurisdiction of multiple Federal agencies depending on the types of
activities that are being conducted. OSHA, EPA, and ATF may regulate or
provide oversight for different aspects of an operation without
duplicating FAA oversight. The authority for protecting public health
and safety, safety of property, and national security and foreign
policy interests of the United States during commercial space launches
and reentries remains solely with the FAA.
In the interest of removing duplicative authorities, CSF suggested
the FAA should acknowledge when other agencies have jurisdiction over
activities and not duplicate that oversight. SpaceX recommended that
instead of the FAA's determining that the launch or reentry services or
property provided by a Federal launch or reentry site or other Federal
entity satisfy part 450, the FAA should just determine that the site
operations are in good standing.
In the final rule, an operator may meet part 450's performance-
based requirements using DOD and NASA practices that have been accepted
by the FAA as a means of compliance. An applicant would reference in
its application those DOD or NASA requirements or procedures accepted
as means of compliance. The 2015 Commercial Space Launch
Competitiveness Act directed the Secretary of Transportation to consult
with the Secretary of Defense, Administrator of NASA, and other
agencies, as appropriate, to identify and evaluate requirements imposed
on commercial space launch and reentry operators to protect the public
health and safety, safety of property, national security interests, and
foreign policy interests of the United States. It also directed the
Secretary of Transportation to resolve any inconsistencies and remove
any outmoded or duplicative Federal requirements or approvals
applicable to any commercial launch of a launch vehicle or commercial
reentry of a reentry vehicle.\35\ The FAA has worked closely with DOD
and NASA in developing part 450 to minimize any need for a DOD or a
NASA facility to impose additional requirements.\36\ The FAA will
continue to work with DOD and NASA in reviewing means of compliance
that involve these Federal entities' practices to ensure those
practices continue to satisfy the FAA's part 450 requirements. The FAA
expects that there will be few, if any, instances in which DOD or NASA
practices do not satisfy part 450's performance-based requirements. In
addition, part 450 should provide enough flexibility to accommodate
changes in DOD and NASA practices in the future.
---------------------------------------------------------------------------
\35\ Public Law 114-90--Nov. 25, 2015 U.S. Commercial Space
Launch Competitiveness Act.
\36\ Note that the John S. McCain National Defense Authorization
Act for Fiscal Year 2019 (NDAA) includes a provision stating that
the Secretary of Defense may not impose any requirement on a
licensee or transferee that is duplicative of, or overlaps in intent
with, any requirement imposed by the Secretary under 51 U.S.C.
chapter 509, unless imposing such a requirement is necessary to
avoid negative consequences for the national security space program.
---------------------------------------------------------------------------
In addition to issuing performance-based requirements that an
operator could meet using DOD and NASA practices as means of
compliance, the FAA has addressed concerns regarding duplicative
government requirements by modifying its approach to ground safety at
certain Federal sites. For ground safety, the Administrator may
determine that the Federal launch or reentry site's ground safety
processes, requirements, and oversight are not inconsistent with the
Secretary's statutory authority over commercial space activities.
Therefore, under Sec. 450.179 (Ground Safety--General) paragraph (b),
an operator is not required to comply with the ground safety
requirements of part 450 if:
(1) The launch or reentry is being conducted from a Federal launch
or reentry site;
(2) The operator has contracted with the Federal launch or reentry
site for ground safety services or oversight; and
(3) The Administrator has determined that the Federal launch or
reentry site's ground safety processes, requirements and oversight are
not inconsistent with the Secretary's statutory authority over
commercial space activities.
In making the determination to accept the Federal site's processes
without specific compliance with ground safety regulations, under Sec.
450.179(c), the Administrator will consider the nature and frequency of
launch and reentry activities conducted from the Federal launch or
reentry site, coordination between the FAA and the Federal launch or
reentry site safety personnel, and the Administrator's knowledge of the
Federal site's requirements. The FAA will consider the nature and
frequency of the activity in order to evaluate a site's level of
experience with different types of launch and reentry operations. An
example of the ``nature'' of the launch and reentry activities would be
that a site's experience with non-toxic or non-explosive propellant
might not qualify the site for an exemption from FAA ground safety
requirements involving toxic or explosive materials. The FAA makes this
change to respond to the direction of SPD-2, the National Space
Council, and the recommendation of the ARC to address duplicative
requirements across Federal agencies for commercial space licensing.
In the final rule, an operator need not comply with the ground
safety requirements contained in Sec. Sec. 450.181 (Coordination with
a Site Operator) through 450.189 (Ground Safety Prescribed Hazard
Controls) if the conditions in Sec. 450.179(b) are met. In making this
change, the FAA preserves its statutory jurisdiction over those ground
safety activities that are part of launch and reentry, but recognizes
certain Federal processes and procedures as sufficient to meet the
FAA's mandate.
For Sec. 450.179(b) to apply, an operator must conduct launch or
reentry activities from a Federal launch or reentry site. The FAA
limits the applicability of this provision to certain Federal sites,
such as Kennedy Space Center and Cape Canaveral Air Force Station,
because they have a long history of conducting launches and reentries
in a manner consistent with FAA regulations. In addition, an operator
must contract with the Federal launch or reentry site for ground safety
services or oversight. The FAA would require that the operator have a
written agreement with the Federal site to use its ground safety
services or oversight and comply with its ground safety processes and
requirements. Finally, the Administrator must have determined,
consistent with the considerations in Sec. 450.179(c), that the
Federal launch or reentry site's ground safety processes, requirements,
and oversight are not inconsistent with the Secretary's statutory
authority over commercial space activities. In considering the site's
ground safety record, the Administrator will consider the extent and
sophistication of both its ground safety procedures and the frequency
with which the site uses them during FAA-licensed activities.
In making the determination to accept a Federal site's ground
safety procedures, the Administrator generally will accept only those
sites that have a regular cadence of both commercial and government
launches and highly developed, well-understood processes and
procedures. In considering the coordination between the FAA and the
Federal site safety personnel, the Administrator generally will approve
only those sites with which the FAA has a long-term working
relationship through the Common Standards Working Group (CSWG).
Familiarity with a Federal site's ground safety practices and
procedures is the only means by which the FAA can ensure it has met its
statutory obligation to ensure public health and safety, safety of
[[Page 79593]]
property, and national security and foreign policy interests of the
United States. When the Administrator finds that a site meets the
conditions in Sec. 450.179(b), the FAA will develop a Memorandum of
Agreement (MOA) with the approved site and publish the MOA on the FAA's
website. If these conditions are met, then the operator can seek FAA
permission during pre-application consultation to comply only with the
ground safety regulations imposed by the Federal site. The FAA will
publish, maintain, and update the Federal launch and reentry site
ground safety MOAs on its website.
For Federal launch or reentry sites or other Federal entities that
do not satisfy the conditions in Sec. 450.179(b), the final rule
retains the LSSA-like process in accordance with Sec. 450.45(b). As
noted earlier, the FAA believes that because of the performance-based
nature of part 450, Federal launch or reentry sites will typically
satisfy most or all FAA requirements.
ii. Radionuclides (Sec. 450.45(e)(6))
In the NPRM, the FAA proposed in Sec. 450.45(e)(6) that the FAA
would evaluate the launch or reentry of any radionuclide on a case-by-
case basis, and issue an approval if the FAA finds that the launch or
reentry is consistent with public health and safety, safety of
property, and national security and foreign policy interests of the
United States. For any radionuclide on a launch or reentry vehicle, an
applicant would need to identify the type and quantity, include a
reference list of all documentation addressing the safety of its
intended use, and describe all approvals by the Nuclear Regulatory
Commission for pre-flight ground operations.
SpaceX requested that the FAA clarify the intent of this
regulation, as this topic is heavily regulated by other Federal
entities. In addition, SpaceX recommended that the FAA defer to and
accept results from other Federal entities when applicable, and stated
that processes for acceptance and deferral should be provided in an AC.
As discussed in the NPRM preamble, Sec. 450.45(e)(6) will address
the potential launch or reentry of radionuclides, similar to current
Sec. 415.115(b), but with the addition of reentries. It is the current
practice of the FAA to address novel public safety issues on a case-by-
case basis because such proposals are so rarely encountered in
commercial space transportation. When applicable, FAA will work closely
with other Federal entities to avoid duplicative requirements. Moving
forward however, the Presidential Memorandum on Launch of Spacecraft
Containing Space Nuclear Systems \37\ directs the Secretary to issue
public guidance for applicants seeking a license for launch or reentry
of a space nuclear system. The FAA is currently developing this
guidance.
---------------------------------------------------------------------------
\37\ https://www.whitehouse.gov/presidential-actions/presidential-memorandum-launch-spacecraft-containing-space-nuclear-systems/ (August, 2019).
---------------------------------------------------------------------------
g. Environmental Review (Sec. 450.47)
In the NPRM, the FAA proposed to consolidate and clarify
environmental review requirements for launch and reentry operators in a
single section, Sec. 450.47 (Environmental Review). In addition, the
FAA proposed to revise Sec. Sec. 420.15, 433.7, 433.9, and 437.21 to
conform to the changes in proposed Sec. 450.47. These revisions codify
the environmental review process as currently conducted, in accordance
with FAA Order 1051.F, in which applicants for a launch or reentry
license provide the FAA with the information needed to comply with the
National Environmental Policy Act (NEPA) and other applicable
environmental laws, regulations, and Executive Orders.
In the final rule, the FAA adopts Sec. 450.47 as proposed with
revisions. The FAA revises Sec. 450.47(b) to affirmatively state that
an applicant must prepare an Environmental Assessment (EA), assume
financial responsibility for preparation of an Environmental Impact
Statement (EIS), or provide information to support a written re-
evaluation of a previously submitted EA or EIS, when directed by the
FAA. The FAA revised this section to clarify that the FAA, not the
applicant, determines which environmental documentation is required by
NEPA. If the FAA determines that under NEPA an EIS is required, the FAA
will select a contractor to prepare the EIS for the license applicant
who will pay the contractor. The FAA also revised Sec. Sec. 420.15(b),
433.7(c), 437.21(b)(1)(iii), and 450.47(c) to clarify that it is the
FAA's responsibility to determine whether a Categorical Exemption
(CATEX) applies under NEPA.
An applicant may provide data and analysis to assist the FAA in
determining whether a CATEX could apply (including whether an
extraordinary circumstance exists) to a license action. Examples
include modifications that are administrative in nature or involve
minor facility siting, construction, or maintenance actions. In the
final rule, the FAA revises Sec. Sec. 420.15(b), 433.7(c),
437.21(b)(1)(iii), and 450.47(c) to state affirmatively that it is the
FAA's responsibility to determine whether a CATEX applies rather than
an applicant's responsibility to request a CATEX.
If a CATEX does not apply to the proposed action, but it is not
anticipated to have significant environmental effects, then NEPA
requires the preparation of an EA. When directed by the FAA, an
applicant must prepare an EA with FAA oversight. When NEPA requires an
EIS for commercial space actions, the FAA uses third-party contracting
to prepare the document. That is, the FAA selects a contractor to
prepare the EIS, and the license applicant pays the contractor.
Finally, if an EA or EIS was previously developed, the FAA may require
an applicant to submit information to support a written re-evaluation
of the environmental document by an FAA-selected contractor to ensure
the document's continued adequacy, accuracy, and validity.\38\
---------------------------------------------------------------------------
\38\ FAA Order 1050.1, Environmental Impacts: Policies and
Procedures, provides a more detailed description of the FAA's
policies and procedures for NEPA and CEQ compliance.
---------------------------------------------------------------------------
This rule will not alter the current environmental review
requirements. However, as explained in the NPRM preamble, the
consolidation of the launch and reentry regulations necessitates a
consolidation of the environmental review requirements.
CSF asked the FAA to explain why it added the requirement that
applicants prepare EAs with FAA oversight, assume financial
responsibility for preparation of an EIS, or submit a written re-
evaluation of a previously submitted EA or EIS. CSF requested
clarification on the phrase ``under FAA oversight'' in proposed Sec.
450.47, versus the current language in FAA Order 1050.1 that requires
FAA approval of an applicant-prepared EA. CSF requested further that
the FAA clarify when and for what purpose the FAA might require an
applicant to prepare a written re-evaluation of a previously-submitted
EA or EIS, noting that the costs and schedule impacts of this
requirement are unclear.
As noted in the NPRM, the changes to the regulatory text on
environmental review do not represent a substantive change to past
regulations or to current practice. Section 450.47 reflects the
existing environmental review process that Sec. Sec. 415.201 and
415.203 broadly described, in which applicants must provide sufficient
information to enable the FAA to comply with NEPA. Section 450.47
replaces this general requirement by identifying the specific documents
that the FAA may require applicants to
[[Page 79594]]
provide and the process to prepare those documents. The language added
to Sec. 450.47 reflects current practice and is consistent with NEPA
and FAA policy. According to FAA Order 1050.1, unless the FAA
determines that a categorical exclusion applies, the FAA may prepare an
EA, EIS, or written re-evaluation, or direct an applicant to provide
the information as described in Sec. Sec. 450.47(b)(1), (2), and
(3).\39\ In response to CSF's comment, the FAA revises Sec. 450.47(b),
as well as Sec. Sec. 420.15(b), 433.7(b), and 437.21(b)(1)(ii), from
the language proposed in the NPRM to state expressly that an applicant
must provide the documents set forth in paragraph (b) ``when directed
by the FAA.'' The modified text clarifies the applicant's
responsibilities in accordance with FAA Order 1050.1 (Paragraph 2-2-2).
These responsibilities are consistent with current practice and will
not increase the cost, impact schedules, or alter the burden under the
previous regulations.
---------------------------------------------------------------------------
\39\ Currently, the FAA has not established categorical
exclusions for this program. However, the FAA may propose new
categorical exclusions applicable to the program after the FAA's
performance of NEPA reviews of proposed actions finds that the
actions, when implemented, do not result in significant individual
or cumulative environmental effects.
---------------------------------------------------------------------------
With respect to Sec. 450.47(b)(1), ``with FAA oversight'' means
the FAA will guide the work of an applicant or an applicant's
contractor. In order to use an applicant or contractor-prepared
document for compliance with NEPA or other environmental requirements,
the FAA must evaluate and take responsibility for the document. The
FAA's oversight ensures that: (1) The applicant's potential conflict of
interest does not impair the objectivity of the document; and (2) the
EA meets the requirements of FAA Order 1050.1. The FAA may require an
applicant to submit information to support a written re-evaluation of a
previously prepared environmental document (i.e., a draft or final EA
or EIS) to determine whether the document remains valid or a new or
supplemental environmental document is required. Applicants should work
closely with the FAA to determine the documentation requirements of
NEPA and other applicable environmental requirements.\40\ In response
to CSF's comment, the FAA revises Sec. 450.47(b)(3), as well as
Sec. Sec. 420.15(b), 433.7(b), and 437.21(b)(1)(ii), to clarify that
an applicant would submit ``information to support'' a written re-
evaluation of a previously submitted EA or EIS, rather than the re-
evaluation document itself, as proposed. The contractor selected by the
FAA will use the information provided by the applicant to prepare the
re-evaluation document.
---------------------------------------------------------------------------
\40\ See FAA Order 1050.1, Section 9-2.
---------------------------------------------------------------------------
CSF commented that the FAA should adopt, to the greatest extent
possible, NEPA documentation from other Federal agencies or licensed
site operators.
The FAA notes that it may adopt, in whole or in part, another
Federal agency's draft or final EA, the EA portion of another agency's
EA/FONSI, \41\ or EIS in accordance with applicable regulations and
authorities implementing NEPA.\42\ Whenever possible, the FAA will
adopt the other Federal agency's NEPA documents to support the issuance
of launch and reentry licenses. Further, the FAA encourages early
coordination with the FAA to benefit applicants that are seeking
approvals from other Federal agencies related to the FAA-issued license
(e.g., an applicant seeking approval from a Federal agency to make
modifications on a Federal launch or reentry site in anticipation of
receiving a launch license from the FAA). This coordination will
increase the likelihood of a more efficient environmental review
process as the applicant seeks different but related approvals from
multiple Federal agencies. The applicant should consult with the FAA
early in the project's development phase, prior to the development of
the NEPA document, to determine environmental review responsibilities,
and the appropriate level of review, and to foster efficient procedures
to develop documentation to meet the agencies' legal requirements.
---------------------------------------------------------------------------
\41\ Finding of No Significant Impact.
\42\ 40 CFR 1506.3 of the Council on Environmental Quality (CEQ)
Regulations and FAA Order 1050.1, as of the publication date of this
rule.
---------------------------------------------------------------------------
CSF also encouraged the FAA to request appropriations to fund
regional or area EAs. This recommendation is beyond the scope of this
rulemaking.
The Aircraft Owners and Pilots Association (AOPA) stated its
concern that, under the proposed regulations, existing Special Use
Airspace approvals (SUAs) would be activated for purposes that may not
align with the original environmental determinations that led to
approval of the SUAs. AOPA noted that the environmental process for
establishing SUAs includes detailed studies of the intended activity,
its frequency, and its effect on the public. Many of the SUAs activated
in support of commercial space activity originally underwent
environmental review and approval on the assumption that they were
supporting military or governmental activity, not commercial civil
space operators.
This rule will not affect the environmental determination process
for establishing or altering SUAs. Environmental review concerns
associated with the designation or activation of SUAs are not the
subject of this rulemaking. The FAA notes that all environmental
impacts associated with a proposed launch or reentry will be addressed
in the NEPA document prepared for that activity.
AOPA urged the FAA to ensure that the documentation for commercial
space operations is complete and transparent so that the public can
understand and identify potential impacts.
This rule will not alter the current environmental review process,
which requires documentation of environmental impacts. The FAA remains
responsible for complying with NEPA and other applicable environmental
laws, regulations, and Executive Orders prior to issuing a launch or
reentry license. The FAA ensures transparency of the potential
environmental impacts by publishing all draft and final EAs and EISs,
and associated Findings of No Significant Impact and Records of
Decisions.
CSF and Denver International Airport requested clarification on how
the environmental reviews required under NEPA would apply to multiple
sites. In accordance with applicable regulations and authorities
implementing NEPA, the FAA's decision-making process must consider and
disclose the potential impacts of a proposed action and its
alternatives on the quality of the human environment. This process
includes considering the impacts of launches from multiple sites, which
may be covered in a single NEPA document when appropriate. In some
instances, one single NEPA document may not be possible and individual
site-specific NEPA documents could be developed. The FAA is examining
the use of programmatic NEPA documents to analyze the impacts of
launches from multiple sites. Under such an approach, applicants could
tier their individual, site-specific NEPA analyses from the
programmatic document.\43\ The FAA will conduct programmatic EA
analyses consistent with FAA Order 1050.1 and CEQ regulations.
---------------------------------------------------------------------------
\43\ See Order 1050.1, Section 3-2.
---------------------------------------------------------------------------
SpinLaunch stated the environmental review process is lengthy,
sometimes taking as long as 2 years or more. To facilitate the process,
it recommended (1) including the environmental review within the
statutory period, thereby
[[Page 79595]]
forcing an expedited process; and (2) establishing limited
environmental approval for proposed activities (e.g., non-rocket launch
systems) that do not have the adverse environmental impacts of a
traditional rocket.
The FAA does not consider the 180-day statutory review period to
include NEPA document preparation. Specifically, the applicant must
submit a completed EIS prepared by the FAA (or an FAA-selected and
managed consultant contractor) or an FAA-approved EA, categorical
exclusion determination from the FAA, or written re-evaluation as part
of its application materials. The statutory application review period
is not intended to encompass the time needed for the applicant to
develop the necessary application materials, including environmental
documentation. Regarding the commenter's second recommendation, the FAA
is bound by CEQ's NEPA regulations. There are three levels of NEPA
review: CATEX, EA, and EIS. Each of the three levels of review is
described in FAA Order 1050.1. The required level of review depends on
the nature of the commercial space action. Applicants should coordinate
with the FAA early in the application process to determine the
appropriate level of NEPA review based on the potential for significant
impact.
Boeing, Lockheed Martin, Northrop Grumman, and ULA jointly
recommended adding to proposed Sec. 450.47(a) a statement requiring
the FAA to coordinate with other government entities to assist the
applicant in completing EAs, in order to alleviate the cost impact on
operators who currently have to negotiate multiple sets of requirements
by Federal, State, and local governments. The joint commenters also
recommended amending Sec. Sec. 420.15(b)(ii), 433.7(b)(2), and
450.47(b)(2) to allow EISs to be prepared by an FAA-approved consultant
contractor, in addition to one selected and managed by the FAA. The
commenters suggested these changes would provide flexibility and allow
an operator to use qualified EIS contractors at the State- or local-
level as long as the contractor meets the qualifications for completing
an EIS in accordance with the law.
The FAA declines the suggested regulatory text changes.
Section 1506.5(c) of the CEQ Regulations for Implementing the
Provisions of NEPA and Appendix C of FAA Order 1050.1 state that EISs
must be prepared by a contractor selected by the lead agency to avoid a
conflict of interest.
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended the
FAA craft an additional section to proposed Sec. 450.47 to address
space environmental impacts such as debris, collision risk, and
interference.
The FAA does not agree with this recommendation. The applicability
of NEPA to space debris is outside the scope of this rulemaking.
One individual commenter expressed concern that the proposed part
450 may cause companies to forgo environmental considerations or
somehow bypass compliance requirements. The proposal does not alter
NEPA and will continue to require potential licensees to comply with
all policies and procedures implementing NEPA, as well as other
applicable environmental laws, regulations, and Executive Orders
intended to protect the environment.
4. Part 450 Subpart C--Safety Requirements
a. Neighboring Operations Personnel (Sec. 450.101(a) and (b))
In the NPRM, the FAA proposed to carve out separate individual and
collective risk criteria for neighboring operations personnel. The
proposal was intended to reduce the need to clear or evacuate other
launch operator personnel during a commercial launch or reentry
operation. Under the current regulations, an operator may be required
to clear anywhere from a handful of employees to over a thousand
employees from a neighboring site for a significant portion of a day.
To address this issue, the NPRM proposed to define ``public'' and
``neighboring operations personnel'' in Sec. 401.5. Under the
proposal, neighboring operations personnel would still be members of
the public, but would be subject to different individual and collective
risk criteria. These proposed regulations were intended to enable
neighboring operations personnel to remain within safety clear zones
and hazardous launch areas during flight as long as their risk did not
exceed the newly designated thresholds.
In the final rule, the FAA adopts the proposal for neighboring
operations personnel in Sec. Sec. 401.7, 440.3, 450.101(a) and (b),
and 450.137(c)(6). The FAA revises the Sec. 401.7 definition of
``neighboring operations'' by removing the phrase ``as determined by
the Federal or licensed launch or reentry site operator'' because the
phrase is not relevant to the definition of neighboring operations
personnel. The FAA also revises Sec. 450.133 (Flight Hazard Area
Analysis) paragraph (e)(2) to require that an applicant provide the
hypothetical location of any member of the public that could be exposed
to a probability of casualty of 1 x 10-\5\ or greater for
neighboring operations personnel, in response to a comment to clarify
representative probability contours.
The FAA sought comment on the proposed approach, as well as on
proposals (1) not to require that neighboring operations personnel be
specially trained, (2) not to designate ground operations hazard
criteria for neighboring operations personnel, and (3) for the purpose
of determining MPL, to align the individual risk threshold for
neighboring operations personnel with the threshold for losses to
government property and involved government personnel. Many commenters
agreed with the FAA's proposal to change the risk threshold for
neighboring operations personnel, stating that a higher risk threshold
is necessary to allow for co-processing of multiple operations at a
single facility. Despite this general agreement, some commenters
disagreed with the specifics of the proposal. Several commenters
pointed out that the FAA's approach to neighboring operations personnel
differs from the ARC recommendation to exclude permanently badged
personnel and neighboring launch operations from the definition of
``public'' but still to employ mitigation measures for uninvolved
neighboring operations personnel when a hazardous operation or launch
is scheduled.
Several commenters, including Blue Origin, Boeing, CSF, Lockheed
Martin, Northrop Grumman, Space Florida, SpaceX, ULA, and Virgin Orbit,
commented that neighboring operations personnel should not be included
as members of the public. CSF stated that neighboring operations
personnel should not be considered members of the public because they
have essential, on-going requirements to conduct neighboring space
transportation activities. CSF further stated that the FAA has the
flexibility to exclude neighboring operations personnel from its
definition of ``public.'' Blue Origin similarly stated that neighboring
operations personnel are more familiar with the hazardous operations
present at a launch site and may have a relationship or engagement with
their neighboring operators and, therefore, should be treated
differently from the public who are completely uninvolved and are not
knowledgeable about launch and reentry operations. Space Florida also
commented that employees of the licensee who may be working on a test
program or a different launch or reentry program are not members of the
public and raised the question whether the
[[Page 79596]]
FAA should have statutory authority over launch essential personnel of
a neighboring operator for other launch, reentry, or associated
operations. Virgin Orbit commented that it would be better to include
neighboring operations personnel under launch personnel, rather than
requiring a new and possibly burdensome expected casualty analysis.
The FAA agrees that neighboring operations personnel are a unique
category of people because of their essential, ongoing tasks. The FAA
disagrees, however, with commenters' assertions that neighboring
operations personnel should be excluded from the definition of
``public'' because of their involvement in launch operations or the
tasks they are expected to perform. The FAA has a statutory obligation
to protect the health and safety of members of the public. Prior to
this rulemaking, the FAA defined public safety, for a particular
licensed launch, as the safety of people and property that are not
involved in supporting the launch, including those people and property
that may be located within the boundary of a launch site, such as
visitors, individuals providing goods or services not related to launch
processing or flight, and any other launch operator and its personnel.
The FAA's definition of ``public'' is derived from the definition of
``public safety'' in Sec. 401.5 and the definition of ``public'' in
Sec. 420.5.\44\
---------------------------------------------------------------------------
\44\ Both of these definitions are being replaced by the new,
consolidated definition of ``public'' in Sec. 401.7.
---------------------------------------------------------------------------
The FAA's definition of ``public'' encompasses neighboring
operations personnel because they are not involved in supporting the
specific launch or reentry they are neighboring. The FAA agrees that
neighboring operations personnel are more familiar with the hazardous
operations present at a launch site and may have a relationship or
engagement with their neighboring operators, but the FAA does not find
that to be sufficient to exclude them from the definition of
``public.'' It was a factor, however, in the FAA's decision to apply a
risk requirement to neighboring operations personnel different from the
requirement applied to other members of the public. Although this rule
includes neighboring operations personnel in the definition of
``public,'' the FAA recognizes that neighboring operations personnel
are aware of the inherent risks associated with launch and reentry
activities and are likely trained and prepared to respond to hazards
present at these sites. Because of these differences, as well as their
unique role in performing safety, security, and critical tasks, the FAA
considers neighboring operations personnel a separate category of
public, whose collective exposure to risk may not exceed 2 x
10-\4\ and for whom the risk to any individual may not
exceed 1 x 10-\5\.
The FAA disagrees with Virgin Orbit's comment that neighboring
operations personnel should be included as launch personnel so as to be
exempted from risk calculations and eliminate the burden of the
additional risk calculation. Neighboring operations personnel are not
supporting the licensed activity and are members of the public;
therefore, they must be protected under the FAA's statutory mandate.
The FAA acknowledges that this conclusion requires risk analysis for
the neighboring operations personnel; however, the FAA expects that
this analysis will involve little additional effort because the
operator already has to perform a similar analysis for the other
members of the public and will only need to account for the population
of neighboring operations personnel, if any. For these reasons, the FAA
adopts the proposal without amendment.
In addition to comments recommending that neighboring operations
personnel be excluded from the definition of ``public,'' several
commenters had other recommendations for the proposed definition of
``public.'' CSF commented that the proposal does not specify how
involved in a licensed operation a person needs to be to fall outside
public risk protections. CSF also proposed that the definition of
``public'' should allow for a risk threshold for those who have been
briefed on the risks and hazards and chosen to participate to the same
level as neighboring operations personnel, and that historic NASA
operations have followed this model. CSF further stated that the
definition of ``public'' should not include persons who have a passive
involvement in the licensed activity, such as invited guests of the
operator, customers, families of astronauts, and other stakeholders
with a legitimate enough interest in the launch or reentry activity to
be on-site. SpaceX echoed CSF's comments on this issue, and further
suggested that the definition of ``public'' should generally include
only those people who reside and work outside the controlled areas of a
launch or reentry site. Blue Origin, CSF, and SpaceX recommended
excluding invited guests of the launch or reentry operator from the
definition of ``public.''
As discussed earlier, the FAA's definition of ``public'' was
derived from the definition of ``public safety'' in Sec. 401.5 and the
definition of ``public'' in Sec. 420.5. Historically, the FAA has
considered ``public'' to include all people and property that are not
involved in supporting a licensed or permitted launch and in the final
rule extends the same definition to reentry. While neighboring
operations personnel or invited guests \45\ may accept a higher level
of background risk, they are not involved in supporting the particular
licensed operation and this rule continues the FAA's longstanding
practice of protecting them as members of the ``public.'' While the FAA
expects that certain members of the public may be briefed and aware of
hazards, the FAA does not agree with CSF's rationale that being
informed is a sufficient condition for such persons to be treated under
the higher risk threshold for neighboring operations personnel. In
addition to being informed of potential hazards, neighboring operations
personnel are required to perform safety, security, or critical tasks
at the neighboring site. The FAA finds that the necessity of these
tasks justifies the minimal increase in risk to which neighboring
operations personnel are exposed. Informed members of the public do not
meet this criterion and, therefore, will continue to be protected at
the public threshold rather than the higher threshold for neighboring
operations personnel.
---------------------------------------------------------------------------
\45\ The FAA is not proposing a higher risk threshold for
invited guests or other consenting members of the public at this
time.
---------------------------------------------------------------------------
The FAA considered potential regulatory mechanisms for allowing
public stakeholders with a legitimate enough interest in the launch or
reentry activity to be on-site as requested by commenters. However, the
FAA identified certain statutory and regulatory challenges with making
these changes as a part of this final rule. Given the inherent risks
associated with commercial space activity, Congress established a
framework for liability insurance and financial responsibility that
distinguishes individuals involved in launch or reentry activities from
third parties. Section 50902 defines third party as persons other than
launch or reentry participants.\46\ Section 50914
[[Page 79597]]
states that a licensee must obtain liability insurance to protect
launch or reentry participants from third party claims, based on
maximum probable loss calculations.\47\ Additionally, section 50914(b)
establishes a reciprocal waiver of claims regime for applicable parties
whereby each party to the waiver agrees to be responsible for personal
injury to, death of, or property damage or loss sustained by it or its
own employees resulting from an activity carried out under the
applicable license. This regime includes certain parties waiving claims
against the U.S. Government.\48\ The FAA has codified these
requirements in the part 440 regulations.
---------------------------------------------------------------------------
\46\ Specifically, in accordance with Sec. 50902(26), ``third
party'' means a person except--
(A) the United States Government or the Government's contractors
or subcontractors involved in launch services or reentry services;
(B) a licensee or transferee under this chapter;
(C) a licensee's or transferee's contractors, subcontractors, or
customers involved in launch services or reentry services;
(D) the customer's contractors or subcontractors involved in
launch services or reentry services; or
(E) crew, government astronauts, or space flight participants.
\47\ Specifically, in accordance with Sec. 50914(a)(4), the
insurance must protect the following, to the extent of their
potential liability for involvement in launch services or reentry
services, at no cost to the Government:
(A) the Government.
(B) executive agencies and personnel, contractors, and
subcontractors of the Government.
(C) contractors, subcontractors, and customers of the licensee
or transferee.
(D) contractors and subcontractors of the customer.
(E) space flight participants.
\48\ 51 U.S.C. 50914(b)(2).
---------------------------------------------------------------------------
While the FAA may waive certain risk requirements in order to allow
members of the public to be present in hazard areas during launch or
reentry activities, these individuals are third parties under title 51
and will therefore be included in maximum probable loss calculations.
This would likely increase insurance costs, which would be borne by the
licensee. Additionally, these individuals are not currently included in
title 51's cross-waiver framework nor has the FAA gone beyond the scope
of title 51 in part 440 to expand the cross-waiver framework to include
them. As such, their presence in hazard areas during launch or reentry
activities may increase the liability of the United States (and others
involved in the launch who have executed cross-waivers with the
operator) because of the increased potential for third party claims.
Finally, any regulatory changes would need to be effectuated in part
440 where the FAA's financial responsibility requirements for
commercial space transportation are located; however, the FAA did not
contemplate substantial changes to part 440 in this rulemaking. Because
of these challenges, the FAA elects to proceed with a waiver regime
rather than a regulatory change at this time.The FAA notes that
operators may request waivers to allow members of the public to be
present in areas where risk requirements under part 450 would not
otherwise allow them to be during launch and reentry activities.\49\
Such requests can serve a purpose of encouraging, facilitating, or
promoting commercial space launches and reentries by the private
sector, facilitating private sector involvement in commercial space
transportation activity, and promoting public-private partnerships.
However, the FAA expects operators to articulate more specifically the
reasons why allowing particular individuals to be in areas they
otherwise would be prohibited from entering is in the public interest.
In considering such waiver requests, the FAA would be mindful of its
role in protecting the public and accounting for any additional
liability such a waiver would impose on the U.S. Government. Some
factors that would affect the FAA's decision may include the number of
people an operator seeks to have present and the strength of
association between those people and the launch or reentry activity.
Individuals that have an employment or contractual arrangement with the
licensee, or are otherwise part of the cross-waiver framework of the
license, may pose minimal, if any, liability for the U.S. Government.
This could include high-level company officials and U.S. Government
officials. Members of the public for whom a waiver is requested should
have a strong connection to the launch, reentry, or licensee; for
example, future customers, major investors, or invited press might
qualify.
---------------------------------------------------------------------------
\49\ Should the FAA grant such a waiver, any individuals to whom
the waiver applied would still constitute third parties under title
51 U.S.C. 50902, and operators would continue to be required to
obtain liability insurance or demonstrate financial responsibility
to cover third party claims as required by 51 U.S.C. 50914 and 14
CFR part 440.
---------------------------------------------------------------------------
The operator bears the burden of providing adequate justification
for this relief through the waiver process. The operator should include
in its waiver application an assessment of the risks to the individuals
covered by the requested waiver,\50\ information on how the operator
will assume liability and hold the U.S. Government harmless, and the
individuals' association to the launch, reentry, or licensee. The FAA
anticipates using its experience in considering waivers to accommodate
the presence of additional members of the public during commercial
space launch and reentry activities to inform potential future
rulemaking in this area.
---------------------------------------------------------------------------
\50\ An operator may perform a risk analysis using its own
methods or the risk analyses identified in part 450 in order to
demonstrate the individual and collective risks imposed on the
individuals identified in the waiver request.
---------------------------------------------------------------------------
The FAA also received several comments on the proposed definition
of ``neighboring operations personnel.'' Blue Origin requested that the
FAA further define the term ``critical tasks'' referenced in the new
definition to include ``tasks that are critical to normal business
operations.''
The FAA does not agree that adding Blue Origin's definition of
``critical tasks'' is necessary. In the absence of a regulatory
definition, the plain language definition applies and is sufficient
here. In addition, the FAA gave context in the preamble to the NPRM for
the types of activity that may qualify as ``safety, security, or
critical tasks.'' The plain language definition maintains flexibility
to include various tasks as industry practices evolve over time. These
tasks include maintaining the security of a site or facility or
performing critical launch processing tasks such as monitoring pressure
vessels or testing safety-critical systems of a launch vehicle for an
upcoming mission. These tasks also include business operations that
cannot be reasonably conducted off site, such as onsite hardware work
as well as data processing that must be conducted in a secure facility.
Neighboring operations personnel do not include individuals conducting
normal business operations that need not be conducted in hazardous
areas, individuals in training for any job, or individuals performing
routine activities such as administrative, office building maintenance,
human resource functions, or janitorial work. This flexibility
accommodates practices like those USAF and NASA follow at their launch
sites and is intended to allow critical operations to proceed at
neighboring locations without jeopardizing those operations. As
explained in the NPRM, neighboring operations personnel are members of
the public. The FAA allows a slightly increased risk to these personnel
over that permissible to other members of the public. The FAA does not
believe that an increase in risk is justified for reasons other than to
facilitate performing safety, security, or critical tasks at the site.
The FAA estimates that the collective risk criteria in the final rule
for neighboring operations personnel will enable, on average,
approximately forty additional personnel to operatate in this capacity,
which the FAA believes will ensure that neighboring operators can
maintain operations with minimum disruption.
Virgin Galactic commented that the definition of ``neighboring
operations personnel'' should include all personnel who have been
properly trained to respond to hazards present at a launch or reentry
site and who are notified of hazardous operations occurring by other
licensed operators at that site. Virgin
[[Page 79598]]
Galactic objected to including in the definition a requirement that
neighboring operations personnel be notified of the operation, stating
that a lack of notification should not exclude individuals from
qualifying as neighboring operations personnel. Similarly, ULA
commented that the requirement appeared to be mostly in the definition,
which ``removes the definition's objectivity.''
FAA disagrees with Virgin Galactic that training and notification
are sufficient to justify the inclusion of personnel in the neighboring
operations personnel category. Training alone does not justify placing
personnel at a raised level of risk. Only those personnel performing
safety, security, or critical tasks qualify as neighboring operations
personnel who may be subjected to a higher risk threshold because of
the nature of those tasks, as discussed previously and in the NPRM.
Furthermore, as explained in the NPRM, requiring a licensee to ensure
neighboring operations personnel are trained would be burdensome and is
not necessary to justify the increase in risk allowed for workers
performing safety, security, or critical tasks.
The FAA does not agree with Virgin Galactic and ULA that the
definition of ``neighboring operations personnel'' imposes a regulatory
requirement. Rather, it enables neighboring operations to continue by
describing which individuals qualify as neighboring operations
personnel. Notification of an operation is a precondition to qualify as
neighboring operations personnel. Personnel cannot be designated as
neighboring operations personnel and be subject to the higher risk
thresholds, if they have not been notified of the operation. For these
reasons, the FAA declines to accept these particular changes to the
proposed definition.
A number of commenters focused on which authority designates
personnel as neighboring operations personnel. Many commenters,
including CSF, Space Florida, and SpaceX, noted their agreement that
the designation of neighboring operations personnel should be
coordinated and determined by the site operator, but urged the FAA to
remove its proposed neighboring operations personnel risk thresholds
and instead allow site operators to designate what mitigations would be
necessary to protect neighboring operations personnel. CSF urged the
FAA generally to defer to Federal, State, local, or private site owners
and operators as the sole decision-makers responsible for determining
which personnel would be considered essential to ongoing operations and
what hazard mitigation measures should be observed.
Other commenters, including ULA and Virgin Galactic, commented that
the FAA should designate neighboring operations personnel. These
commenters argued that a site operator should not determine who
qualifies as neighboring operations personnel, because it would be
tantamount to the FAA's reassigning its decision-making authority on
the matter. Sierra Nevada recommended that the FAA collect the
neighboring operations personnel information and calculate the risk on
behalf of the applicant so that the proprietary nature of workforce
numbers can be maintained between competitive companies. The Aerospace
Industry Association (AIA), Blue Origin, Virgin Galactic, and other
commenters also raised concerns about how proprietary data would be
shared after neighboring operations are designated. Virgin Galactic
commented that those best suited to know which employees are required
for safety, security, or critical tasks are the other launch operators,
not the site operator.
As previously described, the FAA maintains that the separate risk
thresholds are the appropriate protections for neighboring operations
personnel, and the FAA does not agree with removing its proposed
neighboring operations personnel risk thresholds and instead allowing
site operators to designate what mitigations would be necessary to
protect neighboring operations personnel. The FAA does not agree with
ULA and Virgin Galactic that the FAA or the launch operator should
determine what individuals are appropriately classified as neighboring
operations personnel. Site operators are in the best position to know
what operations occur on their sites and which individuals are
appropriately designated as neighboring operations personnel. The FAA
expects that the site operator (i.e., an operator of a Federal site or
FAA-licensed launch or reentry site) would work with operators of
neighboring sites to identify these personnel because the site operator
is in the best position to identify which personnel are required to
perform safety, security, or critical tasks at the launch site. The
site operator has a formal relationship with all operators on its site
and has an interest in enabling continued and unimpeded operations
amongst its tenants. At Federal sites, the site operator already
fulfills this function, and thus enabling neighboring operations
personnel does not impose any additional costs on the site operator.
The designation of neighboring operations personnel is optional for
FAA-licensed or exclusive use site operators. The FAA will monitor a
launch site operator's designation and vehicle operator's
implementation of neighboring operations personnel to ensure the
appropriateness of these designations, thereby retaining its authority
to determine which individuals are properly characterized as
neighboring operations personnel.
Further, site operators are best positioned to adjudicate between
tenants, to coordinate acceptable numbers of neighboring operations
personnel during licensed operations, and to protect their tenants'
proprietary information and furnish the necessary information to the
licensed operator. The FAA expects that the coordination of the
necessary data transfer will be collaborative between the licensed
operator, the site operator, and the neighboring operators. Neighboring
operators have the option of removing their personnel during the flight
of a neighboring flight or reentry. As discussed above, neighboring
operators have the option of discussing with the site operator which
personnel they believe need to remain present in order to maintain
safety, security, or other critical tasks. The accommodation of
neighboring operations personnel through the risk thresholds benefits
the launch or reentry operator by reducing the possibility that their
presence without evacuation could result in a violation of the public
risk criteria. It also benefits the neighboring operators to allow
safety, security, or critical tasks to continue in cases where the site
operator might otherwise require evacuation of personnel. Hence, the
FAA believes that generally, as is current practice at Federal sites,
neighboring operations personnel can be accommodated with little direct
intervention by the FAA.
Blue Origin, CSF, and SpaceX all commented that the neighboring
operations personnel provisions should apply to exclusive-use or
private sites. Blue Origin asked whether the FAA intended to exclude
such sites from its proposal because, although these are sites that the
FAA does not license, launch and reentry activities at these sites can
cause disruptions to non-licensed neighboring activities, such as
developmental or test programs.
The FAA does not license exclusive-use sites, but it does license
launch and reentry activities that occur at exclusive-use sites. The
FAA does not anticipate that many exclusive-use sites would have
personnel within a launch or reentry site, or an adjacent launch or
reentry site, that qualify as neighboring
[[Page 79599]]
operations personnel. Nevertheless, the FAA may accept the designation
of neighboring operations personnel at an exclusive-use site if they
are designated by the licensed vehicle operator that operates the site.
Such designations will only apply to members of the public located
within the site or an adjacent launch or reentry site who are not
associated with the specific hazardous licensed or permitted operation
being conducted, but who are required to perform safety, security, or
critical tasks at the site and are notified of the operation. This
approach is accommodated by the proposed regulations without change.
The FAA recognizes that there are activities that currently take
place at launch sites that are not explicitly associated with launch or
reentry operations. For example, payload processing typically occurs at
launch sites. The Reagan Test Site at Kwajalein also has facilities
that are essential for tracking objects in space. The U.S. Navy has a
presence at Cape Canaveral Air Force Station (CCAFS). These activities
may sometimes require critical personnel to remain on site during
neighboring launch activities to ensure the continuation of operations.
While the FAA envisioned primarily facilitating launch operations by
proposing a carve out for neighboring operations personnel, it will
allow other personnel conducting non-licensed activities on a launch or
reentry site or an adjacent launch or reentry site to qualify as
neighboring operations personnel as long as they meet the criteria
enumerated in the definition.
ALPA and Space Florida questioned whether the neighboring
operations personnel provisions would apply at joint spaceport/airport
facilities to allow airport staff to stay in the hazard area or clear
zone based on risk assessments during licensed space operations. In the
NPRM, the FAA took into account that neighboring operations personnel
are more likely than the rest of the public to be specially trained and
prepared to respond to hazards present at a launch or reentry site. The
USAF and NASA definitions specify that these personnel are either
trained in mitigation techniques or accompanied by a properly trained
escort. However, the FAA did not require that neighboring operations
personnel be trained or accompanied by a trained escort because such a
requirement would be burdensome, and training is not necessary to
justify the slight increase in risk allowed for workers performing
safety, security, or critical tasks. Although in developing the NPRM,
the FAA did not contemplate airport personnel at co-located sites as
neighboring operations personnel, the proposed definition did not
preclude the possibility. In response to commenters, the FAA finalizes
the definition of ``neighboring operations personnel'' as proposed, and
agrees that the definition may include airport personnel working at a
launch site.
Many commenters expressed concerns about the impact of designating
neighboring operations personnel on the MPL calculation and the
associated financial responsibility requirements. Northrup Grumman,
Sierra Nevada, SpaceX, and ULA all commented that the inclusion of
neighboring operations personnel would likely raise MPL, even at the
proposed lower threshold in the NPRM. CSF, Space Florida, and SpaceX
requested that neighboring operations personnel should be excluded from
MPL calculations via waivers of liability.
Section 50914(c) of title 51 of the U.S. Code states that the
Secretary of Transportation shall determine the maximum probable losses
for which a licensee must obtain liability insurance or demonstrate
financial responsibility. This amount must include the maximum probable
loss from claims by, in relevant part, third parties. 51 U.S.C.
50914(a)(1)(A). Neighboring operations personnel are third parties
under chapter 509 of title 51.\51\ Therefore, the FAA must include
neighboring operations personnel in its MPL calculations.
---------------------------------------------------------------------------
\51\ ``Third party'' means a person except--(A) the United
States Government or the Government's contractors or subcontractors
involved in launch services or reentry services; (B) a licensee or
transferee under this chapter; (C) a licensee's or transferee's
contractors, subcontractors, or customers involved in launch
services or reentry services; (D) the customer's contractors or
subcontractors involved in launch services or reentry services; or
(E) crew, government astronauts, or space flight participants. 51
U.S.C. 50902(26).
---------------------------------------------------------------------------
The FAA agrees with the comments that MPL calculations could be
affected by the designation of neighboring operations personnel because
the proposed rule allowed more people to stay inside the 1 x
10-\5\ probability of casualty hazard area. While the FAA
must include neighboring operations personnel in the MPL calculation,
it does not expect the inclusion to affect materially the MPL amount.
This expectation is based on the adoption in the proposed rule, for the
purpose of determining MPL, of setting the threshold for neighboring
operations personnel at the same threshold for losses to government
property and involved government personnel. The MPL will determine
losses to property and personnel of neighboring operators that have a
probability of occurrence of no less than one in one hundred thousand
(1 x 10-\5\), instead of the more stringent requirement of
one in ten million (1 x 10-\7\) used for other third party
losses. This threshold is appropriate for neighboring operations
personnel because, unlike other third parties, except for involved
government personnel, the presence of neighboring operations personnel
at a launch or reentry site is necessary either for security reasons or
to avoid the disruption of co-located activities at neighboring sites.
The MPL methodology captures catastrophic events that, while extremely
unlikely, still fall within the probability threshold.
The FAA's examination of past MPL determinations gives it
confidence that these other events will generally drive MPL amounts
more than the limited presence of neighboring operations personnel.\52\
While additional insurance costs are expected to be minimal, these
minimal cost burdens are more appropriately placed on the launch or
reentry operator creating the hazards, rather than the neighboring
operator who otherwise must halt its operation. The FAA notes, however,
that these regulations do not prevent a launch operator from entering
into an agreement with a neighboring operator to recover costs as a
result of any increase in the required amount of third party liability
insurance due to the presence of neighboring operations personnel.
Should a launch operator choose to enter into such an agreement, the
launch operator would still be required to purchase insurance to cover
all third parties, to include any neighboring operations personnel, and
could seek reimbursement as a secondary measure. Therefore, the FAA
adopts the proposal without amendment.
---------------------------------------------------------------------------
\52\ For example, the third party MPL for an Atlas 541 launch
from CCAFS is currently $164M, which accounts for an event involving
30 third party casualties based on the risk profile method. An
unlicensed government launch of the same vehicle occurred with 12
people deemed neighboring operations personnel that were located
within the 1 x 10-\6\ PC contour. If the
conditions present during that unlicensed launch were to occur under
part 450, then those 12 neighboring operations personnel would be
accounted for in the third party MPL calculation at the 1 x
10-\5\ probability threshold (instead of the current
standard 1 x 10-\7\ threshold for third parties as
explained in the previous paragraph). The presence of the 12
neighboring operations personnel does not exceed the event involving
30 third party casualties. Therefore, it is unlikely that those 12
neighboring operations personnel would lead to an increase in the
MPL for the Atlas 541 under part 450.
---------------------------------------------------------------------------
[[Page 79600]]
b. High Consequence Event Protection (Sec. 450.101(c))
In the NPRM, the FAA proposed to expand the FAA's use of
consequence criteria to protect the public from an unlikely but
catastrophic event. Specifically, the FAA proposed to use conditional
expected casualties (CEC) as the quantitative metric for:
(1) Determining the need for flight abort \53\ as a hazard control
strategy in proposed Sec. 450.101(c); (2) setting reliability
standards for an FSS required by Sec. 450.101(c) in proposed Sec.
450.145(a); and (3) determining when to initiate a flight abort in
proposed Sec. 450.125(c)(1) and (c)(2). The proposed use of
CEC represented the most significant change in the NPRM
because it introduced a new safety criteria pertaining to low
probability, high consequence events and provided a means by which an
operator could demonstrate that expensive, highly reliable FSS design
and testing may be unnecessary to protect public safety. As explained
in the NPRM, consequence can be measured in terms of CEC
without regard to the probability of failure.
---------------------------------------------------------------------------
\53\ In the final rule, flight abort is defined as the process
to limit or restrict the hazards to public health and safety, and
the safety of property, presented by a launch vehicle or reentry
vehicle, including any payload, while in flight by initiating and
accomplishing a controlled ending to vehicle flight. Flight abort is
discussed more fully in the discussion of Sec. 450.108.
---------------------------------------------------------------------------
The FAA received extensive comments on this proposal and, as a
result, has made significant changes in the final rule to allow for
additional flexibility in measuring and mitigating high consequence
events. The following subsections provide an overview of the finalized
CEC requirements in Sec. 450.101(c), the FAA's rationale
for making the change, and specific responses to comments. The FAA
notes that this section of the preamble focuses on CEC as a
means to measure the potential for high consequence events under Sec.
450.101(c). CEC will be discussed further in the preamble
sections addressing Sec. Sec. 450.108 (Flight Abort) and 450.145
(Highly Reliable Flight Safety System).
i. Sec. 450.101(c)
In the NPRM, proposed Sec. 450.101(c) would require an operator to
use flight abort as a hazard control strategy if the consequence of any
reasonably foreseeable vehicle response mode, in any one-second period
of flight, is greater than 1 x 10-\3\ CEC for
uncontrolled areas. The FAA further proposed that the requirement would
apply to all phases of flight, unless otherwise agreed to by the
Administrator based on the demonstrated reliability of the launch or
reentry vehicle during that phase of flight. Although not specifically
spelled out in the regulatory text, the FAA explained in the preamble
that Sec. 450.101(c) was designed to ensure the public was
sufficiently protected against low probability, high consequence events
using CEC as a measure of the potential for high consequence
events.
In the final rule, the FAA retains the use of CEC as a
quantitative criteria that an applicant may use to measure the
potential for high consequence events. However, as explained in the
preamble section addressing Sec. 450.101(c)(2), the FAA revises Sec.
450.37(b) (Equivalent Level of Safety) to allow an applicant to propose
an alternative way to measure high consequence events other than by
CEC. The final rule also allows multiple ways an applicant
may protect against a low probability, high consequence event in
uncontrolled areas for each phase of flight in Sec. 450.101(c)(1)
through (3). As discussed in more detail later in this section, an
operator sufficiently protects against a high consequence event by (1)
using flight abort in accordance with Sec. 450.108; (2) demonstrating
that CEC is below a certain threshold without any FSS; or
(3) demonstrating sufficient vehicle reliability and in consideration
of CEC.\54\ The FAA changes the heading of Sec. 450.101(c)
from ``Flight Abort'' in the NPRM to ``High Consequence Event
Protection'' in the final rule because this section allows an operator
in certain circumstances to use a method other than flight abort to
protect against high consequence events.
---------------------------------------------------------------------------
\54\ A CEC value is calculated as the mean number of
casualties predicted to occur given a specified failure mode in a
given time interval with a probability of 1.
---------------------------------------------------------------------------
Multiple commenters, including CSF, Sierra Nevada, and SpaceX,
stated that the NPRM requirements in Sec. 450.101(c) were too
prescriptive and objected to the lack of an explicit provision allowing
an applicant to propose another approach to address a high consequence
event, absent a waiver. The FAA agrees that the final rule should
provide additional flexibility and discusses those changes in more
detail later in this section.
Multiple commenters, including CSF and Virgin Galactic, indicated
that the EC collective risk criteria alone should be enough
to establish the need for an FSS, the reliability of the FSS, and when
an FSS would be required to be activated to ensure public safety.\55\
The FAA finds that the use of collective risk through analyses of
EC and individual risk through analysis of Probability of
Casualty (PC) is inherently inadequate to establish
sufficient protection against low probability, high consequence events
during launch and reentry operations. Whereas PC limits the
maximum risk to an individual and EC limits the average
outcome in terms of casualties in a group of people, both PC
and EC are indifferent to the risk of events that involve
multiple casualties. This indifference means that, if the risk of a
potential event that could result in a high number of casualties is low
enough, the PC and EC criteria would not act to
prevent that event. As explained in the NPRM, the purpose of
CEC is to protect the public from certain high consequence
events, regardless of the probability of those events. Thus, the final
rule includes specific provisions, such as in Sec. Sec. 450.101,
450.108, and 450.145, to ensure adequate protection against low
probability but high consequence events during launch and reentry.
---------------------------------------------------------------------------
\55\ As proposed, Sec. 450.101(c) simply used CEC to
determine whether flight abort would be required as a hazard control
strategy. Other proposed regulations relied on CEC to
establish FSS reliability and activation of FSS. These regulations
and the response to commenters' concern with using CEC for those
purposes are discussed later in the preamble.
---------------------------------------------------------------------------
In addition, a conditional risk assessment ensures adequate
mitigation measures are in place to protect against a low probability,
high consequence event in circumstances in which EC and Pc
may not dictate the need for mitigation. As explained in the NPRM,
unlike collective risk that determines the expected casualties
factoring in the probability that a dangerous event will occur,
conditional risk determines the expected casualties assuming the
dangerous event will occur.\56\ This assumption means that using
EC alone may result in a lack of mitigations, such as flight
abort capability and preparedness, for certain high consequence events
because the low probability of occurrence would translate into an
EC below the 1 x 10-\4\ limit. Conversely, using
a conditional risk assessment ensures that, if a high consequence event
is reasonably foreseeable, such as an incorrect azimuth at lift-off,
then an operator will have a mitigation in place to prevent that event
from producing catastrophic results. This result is assured because the
decision to activate an FSS is always made in response to a system
failure in the operational environment, as no operator plans to
implement a flight abort unless the mission objectives include an
intentional test of the FSS.
---------------------------------------------------------------------------
\56\ See 84 FR at 15298.
---------------------------------------------------------------------------
[[Page 79601]]
Calculating CEC ensures an operator correctly recognizes
certain system failures that may have catastrophic consequences and
builds mitigations into the system to account for those failures. As
such, an FSS is generally activated in the following context: (1) The
vehicle is no longer performing nominally; (2) the vehicle is outside
the limits of a useful mission; \57\ and (3) continued flight would
increase public risks in uncontrolled areas. Hence, the risk to the
public associated with the decision to activate an FSS is inherently
conditioned on the fact that a system failure has occurred. An operator
would only identify a system failure for low probability, high
consequence events if the operator used a CEC-based
analysis, rather than an EC calculation, because a
CEC analysis assumes that the event will occur. Therefore,
relying on the collective risk criteria alone would not adequately
protect against low probability, high consequence events that could
result in multiple public casualties.
---------------------------------------------------------------------------
\57\ Limits of a useful mission are defined in the final rule as
the trajectory data or other parameters that bound the performance
of a useful mission, including flight azimuth limits. This concept
is discussed in greater detail in Sec. 450.119.
---------------------------------------------------------------------------
The FAA received several comments regarding the potential for
various launch operations to comply with the proposed CEC
thresholds in the NPRM. Rocket Lab USA, Inc. (``Rocket Lab'') commented
that it would be ``nearly impossible'' for any orbital launch vehicle
to meet the CEC thresholds defined in the proposal and
recommended the use of cumulative risk and individual risk metrics as
additional or alternative means of determining the reliability required
for the flight abort system. Blue Origin also stated that most, if not
all operators, including those operating smaller suborbital launch
vehicles in remote locations, would be forced to implement an FSS that
complies with an unmodified set of USAF requirements. SpaceX
recommended that the FAA gather more detail on CEC for
different launch vehicles and trajectory profiles to evaluate
appropriate lower tiers of reliability.
The FAA sponsored a series of tasks, performed by ACTA, LLC (ACTA),
to investigate the potential conditional risks associated with a wide
array of past and foreseeable future launch operations using the best
available information and tools. The study \58\ provided an independent
evaluation of the potential for the CEC-related requirements
in the NPRM to necessitate changes to current practice for more than a
dozen missions involving large, medium, and small launch vehicles from
a wide variety of sites. The results of this study demonstrate that the
required reliability of an FSS for relatively small rockets depends
greatly on the launch site. Specifically, the ACTA study found that a
small ELV launched from Cape Canaveral or Wallops Island would need a
highly reliable FSS compliant with proposed Sec. 450.145 to meet the
NPRM requirements, but that a less reliable FSS, such as an FSS
compliant with proposed Sec. 450.143, would suffice for the same
vehicle launched from more remote locations, such as the Mahia
Peninsula and Kodiak Island. To the extent that commenters suggested
proposed Sec. 450.101(c) would require currently licensed operators to
use an FSS, the ACTA study results indicate that no changes would be
required under the final rule regarding the need for an FSS for any
currently licensed launch vehicle launched from a Federal launch or
reentry site.\59\ The ACTA study also indicates that, for operators who
currently employ an FSS to meet the FAA's public risk criteria, their
current practices regarding FSS reliability and activation criteria
would be sufficient to demonstrate compliance with the requirements in
Sec. 450.108.
---------------------------------------------------------------------------
\58\ The report can be found in docket number FAA-2019-0229.
\59\ The ACTA study made four notable conclusions:
1. For two current launch vehicles launched from outside the
continential US, the 1 x 10-\3\ CEC threshold
is not exceeded. Thus, part 450 will not require an FSS for either
of these two launches, yet both are designed to employ an FSS (as
required by part 417).
2. For ten launch vehicles launched from within the continential
US9, the part 450 CEC requirements are consistent with
current practice, where part 417 requires the highly reliable FSS.
3. For two piloted launch vehicles, one would require no
changes, and the other would require no FSS although a flight abort
capability is currently employed under part 431.
4. One current reentry poses CEC well above the 1 x
10-\2\ threshold. Thus, under part 450 this reentry
operation would either need to be modified to reduce the consequence
of failure modes that would result in an intact impact, or be
granted a waiver.
---------------------------------------------------------------------------
A number of commenters asserted that the proposed CEC
requirements would increase cost for operators, particularly for
current RLV operators.
CEC analysis is not mandatory. If an operator chooses to
use a Sec. 450.145 compliant FSS, it does not need to do the
CEC analysis to establish if a Sec. 450.145 compliant FSS
is necessary or if a Sec. 450.143 compliant FSS would suffice. A
CEC analysis to establish compliant Flight Safety Limits is
unnecessary if the operator chooses to demonstrate compliance with
Sec. 450.108(c)(6).
The FAA does not agree that the cost of a CEC analysis
is prohibitively expensive. The FAA provides estimates in the final
Regulatory Impact Assessment of the costs of the CEC
analyses as well as estimates of cost savings on those launches that
will not need an FSS.
The ACTA study calculated CEC for a sample of licensed
RLVs and the results indicate that the final rule will not require any
changes regarding the FSS robustness and FSS activation criteria
currently used for the operations at the Mojave Air and Space Port. The
ACTA study results suggest that launches from Spaceport America would
not need to use flight abort as a hazard control strategy to meet the
CEC requirements in the final rule. Thus, the ACTA study
suggests the final rule could facilitate a reduction in costs for RLV
launches from non-Federal launch sites for current part 431 licenses
that include flight abort as a hazard control strategy. Ultimately, the
ACTA study indicates that CEC will not drive a requirement
for flight abort for currently licensed RLVs operating from non-Federal
sites and is therefore not expected to drive costs for RLV operators.
In the final Regulatory Impact Analysis, the FAA discusses in detail
estimated voluntary costs to perform CEC analyses as well as
cost savings that result when an FSS is not required.
Several commenters, including CSF, Rocket Lab, Sierra Nevada,
SpaceX, and an individual commenter, expressed a need for clarification
of acceptable methodologies to compute CEC. CSF and Sierra
Nevada commented that there are no publicly available methodologies or
background for conducting CEC analysis. CSF noted that the
CEC analysis is computationally intensive and approved risk
analysis tools and input data were not readily available. SpaceX stated
it needed guidance on several specific technical issues on the
computation of CEC. Rocket Lab stated that, without
standardized methods and input data, results would vary widely.
The FAA notes that CEC is inherent in the calculation of
EC for launch or reentry operations. There are extensive
guidance documents available currently that explain methodologies that
can be used to compute EC and, as a byproduct,
CEC as well.\60\ The FAA is aware of at least one operator
that has used these guidelines to develop and implement its own safety
analysis tools to demonstrate
[[Page 79602]]
compliance with the current public risk criteria under part 417. Some
tools have already been modified to compute CEC with only a
few hours of effort. Even so, the FAA remains dedicated to improving
the guidance materials available to applicants and plans to provide
additional advisory materials to explain acceptable safety analysis
methods, including those that address any unique aspects of
CEC computations.
---------------------------------------------------------------------------
\60\ See e.g., the FAA Flight Safety Analysis Handbook v 1.0,
2009 and the Range Commanders Council Risk Committee of the Range
Safety Group, Common Risk Criteria for National Test Ranges--
Supplement, RCC 321-20, White Sands Missile Range, New Mexico, 2020.
---------------------------------------------------------------------------
Sierra Nevada commented that CEC analysis was not a
widely accepted practice, nor had it been subject to rigorous testing,
and it was not ready to be implemented. In response, the FAA notes that
RCC 321 Standard and Supplement has included conditional risk standards
and guidelines since 2010. Moreover, CEC analysis has been
used to help inform important decisions regarding the safety of
commercial space transportation operations since 2016, when the FAA
first cited CEC as part of a formal waiver evaluation.\61\
As noted in the NPRM preamble, in granting these waivers, the FAA has
adopted the conditional risk management approach, noting that the
predicted consequence was below a threshold of 1 x 10-\2\
CEC.\62\ The FAA further stated in the preamble that
measuring the consequence from reasonably foreseeable, albeit unlikely,
failures is an appropriate metric to assess prudent mitigations of
risks to public health and safety and the safety of property. In recent
years, the USAF has also used CEC analyses to establish
appropriate FSS activation criteria for launch operations from both
CCAFS and VAFB. Most recently, the FAA considered the results of
CEC analyses in granting waivers to the debris containment
requirements in Sec. 417.213(a) and (d) that enabled the SAOCOM-1B
mission to be conducted safely.
---------------------------------------------------------------------------
\61\ See Waiver of Debris Containment Requirements for Launch.
81 FR 1470, 1470-1472 (January 12, 2016).
\62\ 84 FR 15312.
---------------------------------------------------------------------------
Several commenters, including CSF, Sierra Nevada, and SpaceX,
recommended that the proposed CEC-related requirements be
moved to a guidance document as an accepted means of compliance to a
more performance-based regulation to preserve flexibility. CSF stated
that, at a minimum, the quantitative criteria should be moved to a
guidance document.
The FAA considered replacing the proposed quantitative
CEC criteria with a qualitative standard and moving the
quantitative criteria to a guidance document as one acceptable means of
compliance. However, the FAA finds that a qualitative approach to
determine the three key CEC-related issues (i.e., the need
for flight abort with a reliable FSS as a hazard control strategy, the
reliability standards for any required FSS, and the criteria for
activation of an FSS) would lack regulatory clarity necessary to ensure
a consistent level of public protection, given the wide variety of
launch and reentry operations. As noted by Rocket Lab and other
commenters, even the results of quantitative high consequence event
assessments can vary significantly from operator to operator without
standardized methods and input data.
Although quantitative CEC is retained in the final rule,
the FAA adds flexibility in both the manner in which a high consequence
may be measured and the manner in which an operator can sufficiently
protect against a high consequence event. First, in the NPRM, ELOS
would not have been allowed for the requirements in Sec. 450.101. As
noted in the discussion of ELOS earlier in the preamble, the FAA has
revised Sec. 450.37 in the final rule to allow operators to use ELOS
to measure a high consequence event under Sec. 450.101(c)(2). Second,
Sec. 450.101(c)(2) permits an operator whose CEC is greater
than 1 x 10-\3\ to propose safeguards other than flight
abort to reduce the CEC below 1 x 10-\3\. These
revisions are discussed in greater detail later in this section.
Virgin Galactic recommended the FAA provide a definition of
CEC. In addition, Virgin Galactic commented that, in the
NPRM preamble, CEC was described using the phrase, ``without
regard to the probability of failure,'' which appeared to Virgin
Galactic to translate to ``assume 100% failure probability.'' Virgin
Galactic recommended the FAA use the terminology ``assuming the failure
will occur'' and clearly state the probability of failure would be 1,
if that was what was intended.
The FAA does not agree that CEC should be defined in the
final rule. Rather, the preamble and associated AC (on High Consequence
Event Protection) discuss in detail what the requirement entails and
how to calculate CEC. A CEC value is calculated
as the mean number of casualties predicted to occur given a specified
failure mode in a given time interval with a probability of 1. As
previously mentioned, there are extensive guidance documents currently
available that explain methodologies that can be used to compute
EC and, as a byproduct, CEC as well.\63\ The term
``high consequence'' appears in Sec. 417.107(a)(1)(ii), but the FAA
chose not to define this term formally at this time to allow for
operational flexibility. High consequence events include incidents that
could involve multiple casualties, massive toxic exposures, extensive
property or environmental damage, or events that jeopardize the
national security or foreign policy interests of the United States.
---------------------------------------------------------------------------
\63\ The FAA notes that CEC is inherent in the
calculation of EC because the total EC for the
operation is the sum of all EC contributions from each
failure mode and failure time, and each EC contribution
for a failure mode and failure time is the probability of failure
multiplied by CEC. Therefore, CEC for a given
failure mode and failure time can be found by dividing the
EC contribution by the probability of failure for that
failure mode and failure time.
---------------------------------------------------------------------------
Boeing, Lockheed Martin, Northrop Grumman, and ULA provided
regulatory text recommendations for Sec. 450.101(c) including removal
of ``flight abort,'' stating that a distinction needed to be made from
flight abort that was not initiated based on threat to public health
and safety because not all abort systems are considered FSS.
The FAA understands that the term ``flight abort'' has been used in
other U.S. Government contexts to mean something different, but the FAA
finds that ``flight abort'' accurately describes the required hazard
mitigations while remaining flexible as to implementation. For these
reasons, the FAA will not amend the rule to remove the term ``flight
abort.'' The final rule adopts the proposed definition of flight abort
in Sec. 401.7, which means the process to limit or restrict the
hazards to public health and safety, and the safety of property,
presented by a launch vehicle or reentry vehicle, including any
payload, while in flight by initiating and accomplishing a controlled
ending to vehicle flight. The final rule also adopts in Sec. 401.7 the
proposed definition of ``flight safety system,'' which means a system
used to implement flight abort, for which a human can be a part of an
FSS.
The FAA finds that the definition of ``flight abort'' is consistent
with current practice for licensed launches and reentries. Most RLVs
use some method to achieve flight abort reliably, either in the form of
a pilot that can safely abort flight using system controls or an
automated system to terminate thrust. Traditional FSS for ELVs are
comprised of an onboard flight termination system, a ground-based
command and control system, and tracking and telemetry systems.
Historically, the flight safety crew monitoring the course of a vehicle
would send a command to self-destruct,
[[Page 79603]]
thus aborting the flight, if the vehicle crossed flight safety limits
and in doing so threatened a protected area. Redundant transceivers in
the launch vehicle would receive the destruct command from the ground,
set off charges in the vehicle to destroy the vehicle and disperse the
propellants so that an errant vehicle's hazards would not impact
populated areas. While this method of flight abort through ordnance is
conventional, the existing definition in Sec. 417.3 and the definition
in the final rule do not require an FSS to be destructive.
In response to commenters' concerns, the FAA finds that the
definitions of ``flight abort'' and ``flight safety system'' adopted in
the final rule remove any perceived confusion over the use of these
terms for the purpose of FAA licensing under part 450.
ii. Sec. 450.101(c)(1)
Section 450.101(c)(1) states that an operator must protect against
a high consequence event in uncontrolled areas for each phase of flight
by using flight abort as a hazard control strategy in accordance with
the requirements of Sec. 450.108. The FAA has not included the
reference to the CEC threshold of 1 x 10-\3\ in
Sec. 450.101(c)(1) because an operator who uses flight abort in
accordance with Sec. 450.108 has demonstrated compliance with Sec.
450.101(c)'s requirement to protect against a high consequence event
without further inquiry into CEC beyond the requirements in
Sec. 450.108(c). This change is consistent with the concept proposed
in Sec. 450.101(c) of the NPRM that required an operator to use flight
abort with a reliable FSS \64\ if CEC was greater than 1 x
10-\3\ for any phase of flight. Under the proposal, if an
operator elected to use flight abort with an FSS that met the
reliability requirements in Sec. 450.145, the FAA would not have
required the operator to calculate CEC for the purposes of
determining compliance with proposed Sec. 450.101(c) because the
operator opted into flight abort as a hazard control strategy
irrespective of CEC.
---------------------------------------------------------------------------
\64\ Proposed Sec. 450.101(c) required an operator to use fight
abort with an FSS that met the reliability requirements set forth in
Sec. 450.145. The reference to reliability requirements for FSS has
been moved to Sec. 450.108(b) and will be discussed in that section
of the preamble.
---------------------------------------------------------------------------
As such, in the final rule, there is no need to reference a
CEC threshold in Sec. 450.101(c)(1) because an operator who
elects to use flight abort as its hazard control strategy and complies
with Sec. 450.108 does not need to calculate CEC (beyond
the requirements in Sec. 450.108(c) discussed later in the preamble)
to determine that it has sufficiently protected against a high
consequence event. Rather, use of flight abort consistent with the
requirements in Sec. 450.108 by itself demonstrates compliance with
Sec. 450.101(c).
As explained in the next two sections, operators who do not elect
to use flight abort consistent with the requirements of Sec. 450.108
must demonstrate they can protect against a high consequence event by
means other than flight abort. If an operator cannot demonstrate
compliance with Sec. 450.101(c)(2)--including through ELOS--or (c)(3),
the operator would be required to rely on Sec. 450.101(c)(1) as the
only remaining means to protect against a high consequence event.
iii. Sec. 450.101(c)(2)
In the final rule, Sec. 450.101(c)(2) states that an operator must
protect against a high consequence event in uncontrolled areas for each
phase of flight by ensuring the consequence of any reasonably
foreseeable failure mode, in any significant period of flight, is not
greater than 1 x 10-\3\ CEC. As noted, proposed
Sec. 450.101(c) would have required an operator with a CEC
greater than 1 x 10-\3\ to use flight abort with an FSS that
meets the reliability requirements of proposed Sec. 450.145 except for
a single exception explained in greater detail in the discussion of
Sec. 450.101(c)(3).
The FAA recognizes that flight abort is not the only method to
protect against low probability, high consequence events. Therefore, in
the final rule, Sec. 450.101(c)(2) allows an operator with
CEC greater than 1 x 10-\3\ in any significant
period of flight to demonstrate protection against a low probability,
high consequence event through means other than flight abort. This
added flexibility in the final rule allows operators to implement other
safeguards that sufficiently protect against a high consequence event.
For example, one company included a design feature in a system so that
a launch failure during downrange overflight would result in break-up
and demise and thus mitigate the risk from the potential for the
capsule to survive intact to impact.
In addition, although this provision retains the quantitative
CEC threshold proposed in Sec. 450.101(c), the FAA provides
additional flexibility by modifying Sec. 450.37 to allow applicants to
propose alternative approaches that provide an equivalent level of
safety, which can be approved by the FAA without a waiver. The FAA
added this flexibility because it is aware of methods other than using
CEC to measure high consequence events, such as conditional
risk profile. If an operator chooses to propose an alternative means of
measuring a high consequence event, the FAA would expect the
alternative means to account for the potential for any event that would
be expected to produce multiple casualties,\65\ using a method that
demonstrates equivalent level of safety to a CEC analysis.
The operator must ensure that the alternative means accurately assesses
that the operation would not exceed an acceptable threshold for high
consequence events. In order to determine whether an alternative
threshold for high consequence events is acceptable, the FAA will
compare the alternative measurement to the CEC threshold.
Alternatively, the applicant would be expected to demonstrate that
either the consequence of any failure during any significant period of
flight is at least an order of magnitude less than the average results
from a fixed-wing general aviation aircraft fatal accident.\66\
---------------------------------------------------------------------------
\65\ High consequence events include incidents that could
involve multiple casualties, massive toxic exposures, extensive
property or environmental damage, or events that jeopardize the
national security or foreign policy interests of the United States.
\66\ The FAA computed this risk profile using NTSB accident data
between 1982 and 2019 for fixed-wing aircraft operated under FAR
parts 91, 135, and 137, excluding aircraft type certificated under
part 25.
---------------------------------------------------------------------------
For example, the Range Commanders Council Document 321-17, ``Common
Risk Criteria Standards for National Test Ranges'' (RCC 321) includes
catastrophic risk protection provisions that use a ``risk profile.''
\67\ In fact, the FAA currently uses a modified risk profile method to
establish the insurance requirements for certain launch or reentry
operations.\68\ The
[[Page 79604]]
FAA understands that risk profiles are currently in use in other
industries \69\ and could be a useful means to quantify the probability
of high consequence events associated with a wide variety of hazardous
operations. However, the computation of a risk profile generally
entails significantly more effort than the CEC evaluation
because a risk profile involves more sophisticated computations and
additional input data. Specifically, the development of a risk profile
for a launch or reentry operation would consist of an evaluation of the
absolute probability of each foreseeable failure mode and the relative
probability of each outcome of each failure mode in terms of the number
of public casualties that could result in uncontrolled areas. The RCC
321 Supplement describes a more simplified and conservative method to
screen for excessive catastrophic risk, which the FAA finds as another
acceptable method to measure high consequence events.\70\ In contrast,
a CEC analysis is independent of the probability of each
failure mode and requires an assessment of only the average outcome of
each failure mode. In addition, the FAA is publishing an AC that
describes how an applicant can demonstrate compliance with Sec.
450.101(c)(2) by showing that the conditional risk profile for its
proposed launch or reentry mission is comparable with the conditional
risk profile empirically derived from evidence from a set of past
fixed-wing general aviation fatal accidents. Finally, the FAA
recognizes that industry may develop new innovative and less burdensome
methods, and therefore the final rule allows applicants to propose
methods other than CEC to measure high consequence events.
---------------------------------------------------------------------------
\67\ RCC 321-17 defines a risk profile as ``a plot that shows
the probability of N or more casualties (vertical axis) as a
function of the number of casualties, N (horizontal axis),'' such
that the area under a risk profile is equal to the EC. Unlike the
single valued EC, risk profiles illustrate whether the collective
risk is from a relatively low probability, high consequence event or
from more frequent, smaller consequence outcomes.
\68\ See, e.g., the 2016 Report to Congress ``FAA's Development
of an Updated Maximum Probable Loss Method'' in response to Public
Law 114-90, Section 102. An MPL analysis must model each accident
scenario as a discrete event with discrete results, e.g., no
casualties, exactly one casualty, two casualties, etc. Each accident
scenario also has a quantitative probability of occurrence. The MPL
analysis process involves simulation of many thousands of discrete
accident scenarios that cover the parameter space of the problem
(i.e., all foreseeable accident scenarios for each and every failure
time and vehicle failure mode). The predicted results of all
foreseeable accident scenarios are accumulated into a histogram and
the risk profile is computed as the complementary cumulative
distribution. For details, see Collins, Brinkman, and Carbon paper
``Determination of Maximum Probable Loss'' presented at 2nd IAASS
conference in Chicago, May 2007.
\69\ For example, Santa Barbara County, California (where
Vandenberg AFB is located) uses risk profiles as part of their
management of public casualty risks from activities that involve
significant quantities of hazardous materials as explained in the
County of Santa Barbara, Planning and Development, Environmental
Thresholds and Guidelines Manual, October 2008. Several European
countries, including the UK and Netherlands, use risk profiles as
part of their governance of a wide array of industries that pose
public risks.
\70\ For example, the catastrophic risk averse pseudo-
EC contribution from people in ships may be computed
using a standard EC computation but replacing the number
of casualties contributed by type of ship, N, with N raised to an
exponent of 1.5.
---------------------------------------------------------------------------
In Sec. 450.101(c)(2), the FAA replaces the term ``one-second
period of flight'' in proposed Sec. 450.101(c) with ``significant
period of flight.'' A period of flight would be significant if it is
long enough for a mitigation, such as flight abort, to decrease the
public risks or consequences materially from any reasonably foreseeable
failure mode. The FAA makes this change because it recognizes that for
some launch and reentry concepts, such as relatively slow-moving
vehicles like balloons, a ``significant'' period of flight could exceed
one second. In addition, the FAA foresees circumstances in which an
elevated CEC in a single second of flight would not warrant
additional mitigation, such as when no additional mitigation would
improve public safety meaningfully in terms of the public risks and
consequences. The preamble discussion of Sec. 450.108 contains further
explanation of what constitutes a material decrease.
Finally, the final rule replaces the phrase ``any reasonably
foreseeable vehicle response mode'' proposed in Sec. 450.101(c) with
``any reasonably foreseeable failure mode'' in Sec. 450.101(c)(2) of
the final rule. The NPRM defined ``vehicle response mode'' as a
mutually exclusive scenario that characterizes foreseeable combinations
of vehicle trajectory and debris generation. Thus, the NPRM would have
required an evaluation of CEC for each foreseeable
combination of vehicle trajectory and debris generation. By replacing
the term ``vehicle response mode'' (VRM) with ``failure mode,'' the
final rule is both less prescriptive and consistent with the current
requirements.\71\
---------------------------------------------------------------------------
\71\ As part of the demonstration required under Sec.
431.35(c), a part 431 applicant is required in Sec. 431.35(d)(4) to
identify and describe all safety-critical failure modes and their
consequences.
---------------------------------------------------------------------------
In the NPRM, the FAA defined a VRM as a mutually exclusive scenario
that characterizes foreseeable combinations of vehicle trajectory and
debris generation. As stated in the NPRM, proposed Sec. 450.101(c)
would have required, at a minimum, that an operator compute the
effective casualty area and identify the population density that would
be impacted for each reasonably foreseeable vehicle response mode in
any one-second period of flight in terms of CEC. The NPRM
further explained that the casualty area, population density, and
predicted consequence for each vehicle response mode are intermediate
quantities that are necessary to demonstrate compliance with the
individual and collective risk criteria currently; thus, these new
requirements would not necessarily impart significant additional burden
on operators.
The draft AC 450.115-1 on High Fidelity Flight Safety Analysis
published for comment in conjunction with the NPRM further explained
that ``VRMs are a combination of debris list and failure modes'' and
provided a description of typical failure modes for launch and reentry
systems, including loss of thrust, engine explosion, attitude control
failure, structural failure, separation failure, guidance or navigation
failure, etc. Because the final rule replaces the term ``vehicle
response mode'' with ``failure mode,'' an operator is no longer
required to evaluate CEC for each foreseeable combination of
failure mode and debris generation. Instead, an operator is required to
evaluate CEC for each reasonably foreseeable failure mode in
any significant period of flight.\72\
---------------------------------------------------------------------------
\72\ As an example of the distinction between ``vehicle response
mode'' in the NPRM and ``reasonably foreseeable failure mode,'' in
the final rule consider, a loss of thrust (LoT) failure mode. Under
the NPRM, LoT failure mode would need to be accounted for by three
VRMs: A LoT resulting in an intact impact, a LoT resulting in
aerodynamic break-up, and a LoT resulting in explosion due to FSS
activation. Under the NPRM's proposal, the operator would have been
required to compute CEC for three VRMs associated with
LoT, but under the same circumstances the final rule will require
only one CEC for the LoT. The final rule CEC
for LoT will equal the average CEC for the three VRMs
that the NPRM would have required.
---------------------------------------------------------------------------
Boeing suggested changing the term ``reasonably foreseeable'' to
``credible'' vehicle response modes. The FAA does not agree that the
term ``reasonably foreseeable'' should be replaced by the term
``credible'' in this section. As previously noted, the term
``reasonably foreseeable'' is used in Sec. 431.35 and commonly used in
system safety. In the absence of a compelling reason to change, the FAA
prefers to continue to use language consistent with previous
regulations instead of introducing a new term at this time.
Furthermore, the FAA finds that the term ``credible'' is prone to
errors in judgment whereas the term ``reasonably foreseeable'' is more
readily discerned by analysis (e.g., fault trees).
iv. Sec. 450.101(c)(3)
In the NPRM, in instances in which CEC was greater than
1 x 10-\3\, proposed Sec. 450.101(c) provided relief from
the use of flight abort if the Administrator agreed that flight abort
was not necessary based on the demonstrated reliability of the launch
or reentry vehicle during a phase of flight. The NPRM preamble cited
the flight of a certificated aircraft carrying a rocket to a drop point
as an example of a phase of flight when the use of an FSS would likely
not be necessary, even though the CEC could be above the threshold
because the aircraft would have demonstrated reliability.
While the final rule retains the ``demonstrated reliability
concept'' proposed in the Sec. 450.101(c) of the
[[Page 79605]]
NPRM, it has been revised and relocated to Sec. 450.101(c)(3). Section
450.101(c)(3) of the final rule states that an operator must protect
against a high consequence event in uncontrolled areas for each phase
of flight by establishing the launch or reentry vehicle has sufficient
demonstrated reliability based on the CEC during that phase
of flight.
Because demonstrated reliability provides an alternative to flight
abort when CEC is greater than 1 x 10-\3\, it is
appropriate to assess it consistent with the approach to flight abort
and FSS reliability, which depends on CEC with a 1 x
10-\2\ threshold.\73\ Notably, the ARC recommended that the
need for an FSS should be determined by taking into account population
density, the realm of reasonably foreseeable failures, trajectory,
size, and explosive capabilities of the vehicle. CEC
accounts for all those factors. As such, the CEC computed
for a proposed operation is inherent in determining whether the vehicle
has sufficient demonstrated reliability to protect against a high
consequence event. This revision informs operators on the approach the
FAA will take in determining whether the launch or reentry vehicle has
sufficient demonstrated reliability to protect against a high
consequence event.
---------------------------------------------------------------------------
\73\ In the proposal and the final rule, the FAA uses
CEC not only as a basis to determine whether flight abort
is required but also as a basis to determine the appropriate FSS
requirements. As noted, FSS requirements are discussed later in the
preamble.
---------------------------------------------------------------------------
More specifically, the FAA will use the demonstrated reliability
and average ground consequence results from fatal accidents involving
U.S. civil aviation aircraft with standard airworthiness certificates
to establish what constitutes sufficient demonstrated reliability to
protect against a high consequence event based on CEC. For
example, a carrier vehicle with a CEC near 1 x
10-\2\ in a given phase of flight would need to have
demonstrated reliability during that phase of flight on par with the
subset of fixed-wing general aviation aircraft that empirically produce
CEF \74\ near 1 x 10-\2\. However, the same
carrier vehicle operated in a more densely populated area could have a
CEC near 1 in a given phase of flight and thus would need to
have demonstrated reliability during that phase of flight on par with
commercial transport aircraft that empirically produce CEF
near 1.\75\ This approach is consistent with the longstanding and often
cited principle that launch and reentry should be no more hazardous to
the public than over-flight of conventional aircraft, as explained in
the NPRM preamble.
---------------------------------------------------------------------------
\74\ CEF represents conditional expected fatalities
and is used to measure the mean number of fatalities predicted to
occur given an event with a probability of 1. As noted in the NPRM,
the FAA found that about one ground fatality resulted on average
from one-hundred fatal accidents involving US aircraft operated
under part 91 between 1984 and 2013 based on NTSB data. A comparison
of CEC to CEF is appropriate here because the
CEF values cited here are empirical results from aviation
accidents, whereas the CEC values used here are the
results of physics-based computer simulations for launch and reentry
operations. In addition, the differences between aviation and space
operations justify some margin in the tolerability of the
conditional risks predicted for space transportation operations.
\75\ As noted in the NPRM, the FAA found that about one ground
fatality resulted on average from a fatal accident involving US
aircraft operated under part 121 between 1984 and 2013 based on NTSB
data.
---------------------------------------------------------------------------
The FAA received multiple comments seeking clarification of the
provision to use demonstrated reliability as a means to ensure a low
probability, high consequence event is sufficiently mitigated. In the
NPRM, the FAA noted that ``demonstrated reliability'' in this context
refers to statistically valid probability of failure estimates based on
the outcomes of all previous flights of the vehicle or stage. For
example, a probability of failure analysis that complies with Sec.
450.131 will provide a valid basis to establish the demonstrated
reliability of a launch or reentry vehicle in a given phase of flight.
That concept is also applicable to Sec. 450.101(c)(3) of the final
rule. Furthermore, the FAA will consider the magnitude of the high
consequence event in determining what level of reliability will be
sufficient to ensure that the high consequence event is mitigated. One
way to show that a vehicle has demonstrated reliability during a phase
of flight is to show that it has demonstrated reliability during that
phase of flight equivalent to a specific aircraft type or an average
aircraft of similar size and performance characteristics with a
standard airworthiness certificate.\76\ The FAA notes an average
aircraft of similar size would have less uncertainty than a specific
type aircraft because there would be more data collected for an average
aircraft, and thus the demonstrated reliability of an average aircraft
could be more readily characterized with a reasonable level of
confidence. Furthermore, both a specific aircraft type and an average
aircraft with a standard airworthiness certificate generally will not
need additional flight abort capability unless the addition of the
rocket substantially increased the risk from a high consequence event.
However, aside from some carrier aircraft used as a component of a
launch vehicle, no launch vehicle, including U.S. government owned and
operated vehicles, to date has a significant amount of historical
flights to ensure sufficient protection against a high consequence
event based on demonstrated reliability in accordance with Sec.
450.101(c)(3).
---------------------------------------------------------------------------
\76\ As discussed in the preamble section on Hybrid Vehicles,
the FAA agreed with a comment that the FAA should not similarly find
that an aircraft with only an experimental airworthiness certificate
(EAC) would satisfy the demonstrated reliability standard. An
aircraft with an EAC may demonstrate sufficient reliability through
the use of a rigorous flight test program or numerous flights
without a failure as defined in Sec. 450.131.
---------------------------------------------------------------------------
c. Critical Asset and Critical Payload Protection
Commercial space transportation operations occur increasingly in
close proximity to critical assets. In order to maintain the continuing
functionality of critical assets, the FAA proposed to define ``critical
assets'' in Sec. 401.5 (Sec. 401.7 in the final rule) and add a
quantitative risk criterion (1 x 10-\3\) for the protection
of critical assets during launch or reentry activity under Sec.
450.101 in the NPRM.
In the final rule, the FAA adopts the ``critical asset'' definition
in Sec. 401.7 with modification, as discussed below. The FAA adopts
the risk criterion as proposed but removes the requirement for
operators to assess the risks to critical assets in preparing a flight
hazard analysis (proposed Sec. 450.109(a)(3)(ii)), debris analysis
(proposed Sec. 450.121(c)(1) and (c)(2)), debris risk analysis (Sec.
450.135), and ground hazard analysis (Sec. 450.185(c)). Instead, in
accordance with Sec. 450.101(a)(4)(iii) and (b)(4)(iii), either the
FAA or a Federal launch or reentry site operator will determine whether
the proposed activity would expose critical assets to a risk of loss of
functionality that exceeds the risk criterion in Sec. 450.101(a)(4) or
(b)(4) and convey any necessary constraints to the operator. The
operator must receive confirmation from the FAA or Federal launch or
reentry site operator that the risk to critical assets satisfies the
risk criterion in Sec. 450.101(a)(4) or (b)(4) prior to launch or
reentry. The FAA anticipates that most critical assets for a given
launch site will be known when an applicant begins pre-application
consultation. Current practice demonstrates that the critical asset
evaluation can often be completed using preliminary flight safety data
(during pre-application or during the license evaluation), sufficient
to show critical assets risks are acceptable. Where the prevailing
weather conditions are important to the critical asset risks, an
assessment is performed either close to or on the day-of-launch.
[[Page 79606]]
In the final rule, the FAA also clarified in Sec.
450.101(a)(4)(ii) and (b)(4)(ii) the Federal procedure by which
critical assets will be identified. To identify critical assets, the
FAA will consult with relevant Federal agencies, and each agency will
identify, for purposes of part 450, any critical assets that the agency
owns or otherwise depends on. The FAA will accept any identification by
the Secretary of Defense that an asset is critical to national
security. For critical assets identified by other relevant Federal
agencies, such as NASA, the FAA will work with the agency to ensure its
identification of critical assets aligns with the requirements of part
450.
The FAA also adds in Sec. 450.165(a)(5) (Flight Commit Criteria) a
requirement that operators' flight commit criteria include confirmation
from the FAA that the risk to critical assets satisfies the
requirements of Sec. 450.101(a)(4) or (b)(4). Lastly, the FAA sought
comments in the NPRM on its proposal to add to the final rule a
definition for ``critical payload'' and a requirement that the
probability of loss of functionality not exceed 1 x 10-\4\
for each critical payload. The FAA adopts the proposed definition and
requirement in the final rule.
In the final rule, the FAA adopts the risk criterion proposed for
critical assets in the NPRM. The property protection criteria in Sec.
450.101(a)(4) and (b)(4) are consistent with current practice at
Federal sites. Launch operations from NASA-operated ranges are
currently subject to requirements that limit the probability of debris
impact to less than or equal to 1 x 10-\3\ for designated
assets. The USAF requirement in AFI 91-202 and the Guidance Memorandum
to AFSPCI 13-610 match those proposed by the FAA. The FAA also adopts
its proposal to extend the protection of critical assets to non-Federal
launch or reentry sites because the protection of critical assets is
necessary irrespective of the location of the launch.
As proposed in the NPRM, a critical asset is an asset that is
essential to the national interests of the United States. The proposed
definition noted that critical assets include property, facilities, or
infrastructure necessary to maintain national defense, or assured
access to space for national priority missions.\77\ In the final rule,
the FAA replaces ``necessary to maintain national defense'' with
``necessary for national security'' to be more consistent with the rest
of 14 CFR Chapter III. The FAA also adds that critical assets may
include those necessary for high priority civil space purposes, for
clarity. An example of this would be infrastructure necessary to
support launch and reentry services to deliver cargo to and from the
International Space Station.
---------------------------------------------------------------------------
\77\ ``Property'' includes launch vehicles, reentry vehicles,
and payloads.
---------------------------------------------------------------------------
CSF and SpaceX noted that critical assets are frequently located on
or near Federal launch or reentry sites, and that the current practice
at Federal launch or reentry sites is to allow a site operator or
neighboring operator to waive the critical asset requirement for its
own facilities. The commenters requested the regulation provide a
similar allowance to reduce the frequency with which operators would
need to apply for waivers. SpaceX recommended revising the regulation
to allow for the waiver of an operator's own designated critical
assets, as well as assets that may be shared or used as common
infrastructure at a range.
The FAA acknowledges that critical assets located on a launch site,
including the launch facility itself, may be exposed to a risk of loss
of functionality that exceeds 1 x 10 -\3\ during launch
activity. The FAA finds that it would be burdensome to require a waiver
of the critical asset protection requirement when a launch site
operated by the U.S. Government or licensed by the FAA allows an
operator to use its facility for launch. Therefore, the FAA revises
Sec. 450.101(b)(4) to not apply the critical asset risk criteria to
property, facilities, or infrastructure supporting the launch that are
within the public area distance, as defined in part 420 Appendix E,
Tables E1 and E2 or associated formulae, of the vehicle's launch
point.\78\ Assets that fall within this exception, located at Sec.
450.101(b)(4)(v), are exempt from the critical asset protection
requirements in Sec. 450.101(a)(4)(i) and (b)(4)(ii) for a licensed
launch.
---------------------------------------------------------------------------
\78\ Part 420 defines public area distance as ``the minimum
distance permitted between a public area and an explosive hazard
facility.''
---------------------------------------------------------------------------
Assets excepted from risk criteria are determined by the required
distance to a public area specified in Table E-1 or E-2 or associated
formulae in Appendix E to part 420, using the quantities of propellants
or other explosives on the vehicle, including any payloads. These
distances are equivalent to Inhabited Building Distances commonly
observed on Federal launch or reentry sites to protect critical assets.
The exception limits consideration to quantities of propellants on the
vehicle, including any payloads. Any critical assets within this area
that are not supporting the activity would be subject to the risk
criteria. This exclusion would be applicable from ignition or at the
first movement that initiates flight, whichever occurs earlier, and end
when the launch ends.
The FAA received many comments on the definition of ``critical
asset.'' ULA expressed support for the proposed definition. A number of
commenters, including CSF and Sierra Nevada, asked who will determine
whether an asset is ``critical'' and how the determination would be
communicated to an applicant. Virgin Galactic commented that the
proposed definition is vague and did not provide enough information to
the operator to ensure protection of critical assets because the
definition could potentially apply to all property at a Federal site.
Virgin Orbit commented that the lack of clarity could result in Federal
agencies incorrectly concluding their assets were protected. CSF and
SpaceX commented that there was no limit on the number or location of
assets for which an operator would need to perform a risk analysis. CSF
and SpaceX recommended the definition of ``critical asset'' be limited
to U.S. Government assets located on Federal property that the
Secretary of Defense or Administrator of NASA determines to be
essential to the national interests of the United States. Boeing,
Lockheed Martin, Northrop Grumman, and ULA recommended critical assets
be defined as assets for which incapacitation or destruction would have
a very serious, debilitating effect on national defense, or assured
access to space for national priority missions. The commenters noted
this change would be consistent with the definition in DCMA-MAN 3401-
02, Defense Industrial Base Critical Asset Identification and
Prioritization. Furthermore, the commenters stated that classification
as a critical asset should be determined by minimum criteria (not
specified in the comment) and an assessment by the asset owner.
The FAA disagrees that the definition of ``critical asset'' is
vague or overbroad. The proposed definition, along with the examples
provided in the NPRM preamble, bound the scope of critical assets
appropriately and provide sufficient clarity for operators. Only those
facilities, property, or infrastructure that are necessary for national
security purposes, high priority civil space purposes, or assured
access to space for national priority missions will be deemed critical
assets under Sec. 401.7. Critical assets will also include certain
military, intelligence, and civil payloads, including essential
infrastructure when directly supporting the payload at the launch site.
The FAA provided several examples of critical
[[Page 79607]]
assets in the NPRM. Critical assets include assets that, if
incapacitated or destroyed, would have a serious, debilitating effect
on national security or assured access to space for national security
missions, but the FAA disagrees that the additional words proposed by
the commenters add clarity beyond the proposed definition.
Virgin Orbit's concern that Federal agency may assume incorrectly
that a critical asset was protected is alleviated by the fact that
critical assets will be identified by Federal agencies that own or
otherwise depend on assets that are essential to the national interests
of the United States. The FAA will work with operators to identify any
measures that operators may need to undertake in order to protect
critical assets to the level required by Sec. 450.101(a)(4) or (b)(4).
With respect to the concern that Federal agencies might be inclined
to overestimate their assets as critical, the FAA does not find that
experience at Federal launch or reentry sites warrants such a concern.
In fact, discussions with safety officials at CCAFS indicate that the
risk to critical assets or critical payloads has rarely exceeded the
risk thresholds adopted by the FAA. Federal launch or reentry sites
have not excessively designated assets as critical, nor have they
imposed significant restrictions on launch activity. When approving the
use of their sites for launch activity, Federal sites consider the
potential of launch activities endangering other facilities. Similarly,
other users of the site do not knowingly put their assets at risk. The
FAA maintains that similar considerations would hold at non-Federal
sites. Non-Federal launch or reentry site operators will consider the
siting and scheduling of activities to avoid one user's activity
threatening the assets of another user. Occasionally, delays in one
site user's activity may necessitate rescheduling another user's
activity. Otherwise, a new activity that was not anticipated when
siting decisions were made, such as fly-back of a stage, is most likely
to expose a critical asset to risk exceeding the criterion.
Only property, facilities, or infrastructure located close to the
launch point might typically be expected to exceed the criteria, and
those assets are generally associated with the subject launch
operation. As discussed in this section, the FAA revised Sec.
450.101(a)(4) to eliminate the need to seek waivers for assets located
within the immediate vicinity of a launch point during the launch.
Although many of these assets may be critical, meeting the critical
asset criteria would be impractical during a launch from the particular
launch point. Hence, assets located within the public area distance
required by part 420 during a licensed launch are exempt from the
critical asset protection requirements in Sec. 450.101(a)(4)(i) and
(b)(4)(i). As such, the FAA anticipates that operations exceeding the
risk criteria for critical assets will continue to be few, resulting in
minimal restrictions on launch activity.
The FAA maintains that establishing explicit risk criteria for
protecting critical assets in this final rule provides a level of
certainty. Launch and reentry site operators will have a metric to
determine what activities are appropriate for various locations on
their sites. Either the FAA or Federal site will perform any necessary
analysis, and will provide written confirmation to the operator that
the criteria in Sec. 450.101(a)(4) or (b)(4) have been met. If the
risk to critical assets posed by the proposed activity exceeds the
criteria in Sec. 450.101(a)(4) or (b)(4), then the FAA will work with
asset owners and operators to reach solutions that allow operations
without sacrificing safety to the critical assets or mission
objectives.
The FAA does not adopt the suggestion by CSF and SpaceX to limit
critical assets to U.S. Government assets located on Federal property
that the Secretary of Defense or the Administrator of NASA determines
to be essential to the national interests of the United States. Federal
entities other than the DOD and NASA might own or otherwise depend on
critical assets, such as NOAA. Thus, it would be inappropriate to
assign the determination of critical assets to only these agencies.
However, as noted earlier, critical assets will be identified by
Federal agencies, such as DOD and NASA, which own or otherwise depend
on assets that are essential to the national interests of the United
States, and the FAA will accept any identification by the Secretary of
Defense that an asset is critical to national security. Note also that
the FAA does not limit the definition of ``critical assets'' to assets
that are owned or located on property owned by the U.S. Government. As
stated in the NPRM, the FAA extended the protection of critical assets
to non-Federal launch or reentry sites, which previously had no
regulatory assurance of protection from loss of functionality of
critical assets. The FAA maintains the same safety standards for
critical assets for launches that take place on a Federal launch or
reentry site as those that take place on a non-Federal launch or
reentry site, some of which are dual use, supporting both commercial
and military operations. Similarly, as explained in the NPRM the FAA
will deem any commercial property that meets the definition set forth
in Sec. 401.7 a critical asset.
Blue Origin asked the FAA to provide examples of critical
infrastructure. The FAA notes that in the past, the launch complexes at
CCAFS that support Atlas V and Delta IV launches have been designated
as critical assets because they support missions essential to the
interests of the United States.
An individual commenter recommended the FAA define categories of
national security interests, including cybersecurity, security
controls, and classification level. Although these are important
national interests, they are not by themselves critical assets, and the
FAA does not find it necessary to add categories of national security
interests.
Airlines for America (A4A) recommended the FAA extend the safety
protections of critical assets to include critical aviation
infrastructure, including airports. The FAA notes that the definition
of ``critical asset'' does not preclude aviation infrastructure from
being a critical asset. More generally, the definition of ``critical
asset'' can include non-space associated assets, including those not
located at or adjacent to a launch or reentry site. However, the
criterion for loss of functionality likely limits aviation
infrastructure assets from being subject to protection.
Commenters were divided on the need for critical asset protection.
ULA acknowledged the need for protection of critical assets. Virgin
Galactic questioned whether the FAA's proposed critical asset
requirements were within the FAA's statutory authority, as title 51 did
not reference ``national interests'' or ``national priority missions.''
Blue Origin acknowledged the FAA's statutory authority to protect
property and asked the FAA to explain how it will interpret and
implement this authority. An individual commenter stated only assets
directly related to national security should be given heightened
protection. CSF, Spaceport Strategies, LLC (Spaceport Strategies), and
SpaceX commented that critical assets were already protected by current
requirements at Federal launch and reentry sites, rendering the FAA's
regulations duplicative. SpaceX added that NASA or DOD may not agree
with the FAA's proposed critical asset requirements, which may lead to
further duplication of requirements at Federal sites.
[[Page 79608]]
The FAA has the authority to protect critical assets. The
Commercial Space Launch Act authorizes the DOT, and the FAA by
delegation, to protect public health and safety, safety of property,
and national security and foreign policy interests of the United
States. In carrying out its responsibility to protect property, the FAA
has established a quantitative requirement to protect assets that are
essential to the national interests of the United States. As noted in
the NPRM, national interests go beyond national security and include
infrastructure such as that used to support high priority NASA
missions. As noted earlier, an example of this would be infrastructure
necessary to support launch and reentry services to deliver cargo to
and from the International Space Station.
As CSF, Spaceport Strategies, and SpaceX noted, the FAA's critical
asset requirements codify current practice at Federal launch or reentry
sites, but also extend the same regulatory protection for launch or
reentry activity at non-Federal launch or reentry sites. Although
critical assets are primarily located on Federal launch or reentry
sites at this time, the FAA foresees increased commercial space
activity at non-Federal sites that may result in the presence of
critical assets at those sites. In licensing commercial launch or
reentry activities, the FAA safeguards critical assets--which by
definition are essential to the national interests of the United
States--irrespective of their location.
The FAA does not find the critical asset requirements to be
unnecessarily duplicative of requirements at Federal launch or reentry
sites. As discussed in the NPRM, the FAA proposed these requirements to
further the goal of common standards for launches from any U.S. launch
or reentry site, Federal or non-Federal. Inclusion of critical asset
protection in FAA regulations aligns FAA licensing with Federal launch
or reentry site requirements and removes duplication of effort. The FAA
closely coordinated the critical asset requirements with the CSWG and
its interagency partners, including NASA and DOD. As a result of this
coordination, the FAA anticipates that the methodologies used by the
Federal launch or reentry sites will satisfy the FAA's requirements for
critical asset protection.
Many commenters, including AIA, Blue Origin, Boeing, CSF, Lockheed
Martin, Northrop Grumman, Sierra Nevada, SpaceX, Virgin Galactic, and
ULA raised concerns about how an applicant would obtain the information
necessary to perform the proposed critical asset analysis, including
proprietary or confidential information. CSF and SpaceX noted the same
data should be provided to all operators to ensure the fair and
unbiased application of this regulation. Sierra Nevada recommended the
FAA provide a method of acceptable means of compliance that does not
require a commercial company to contract with DOD to complete this
analysis. Alternatively, Sierra Nevada recommended the FAA provide the
analysis instead of the applicant. CSF and SpaceX also recommended the
FAA publish an AC that would provide an acceptable means for analyzing
critical assets, describe how the FAA would obtain a definitive list of
critical assets, and how the FAA would provide operators the data
necessary to conduct the analysis. Blue Origin stated that, by
requiring information that includes data from other entities, the FAA
would become responsible for facilitating acquisition of this data or
would risk implementing a requirement that would not be possible to
comply with or a requirement that would establish a sole source
provider of a service.
The FAA acknowledges the practical problems an applicant would
likely encounter in collecting the input data necessary to identify and
perform a risk assessment for critical assets, especially critical
payloads. The FAA agrees with Sierra Nevada that it would be better for
the U.S. Government to perform all critical asset and critical payload
risk assessments necessary to ensure operators comply with the risk
criteria in part 450. The FAA therefore removes the requirement for
operators to assess the risks to critical assets in preparing a flight
hazard analysis, debris analysis, and debris risk analysis. The FAA
also removes from Sec. 450.185 (Ground Hazard Analysis) the
requirement that the ground hazard analysis ensure that the likelihood
of any hazardous condition that may cause damage to critical assets is
remote. The FAA notes that the input data and analysis tools necessary
to perform a risk assessment for critical assets are often a subset of
those the FAA uses to establish the MPL values. The FAA will perform
all critical asset and critical payload risk assessments for commercial
space transportation operations involving non-Federal sites. Hence,
operators should not bear additional cost for the analyses associated
with critical assets.
Blue Origin asked how the FAA will address overflight of critical
assets. The FAA notes that overflight of a critical asset is possible
if the safety criteria set forth in Sec. 450.101 are satisfied. Past
experience demonstrates that the critical asset criteria in Sec.
450.101 are satisfied except in occasional cases involving critical
assets located within the same launch site. Historically, the risk to
critical assets from overflight outside the launch site is negligible.
Virgin Galactic asked how an operator would have input on or
dispute the determination of a critical asset. The FAA will discuss
with operators any concerns they may have about ensuring protection of
critical assets during their licensed activities, but the FAA is not
proposing a formal dispute mechanism to adjudicate its determination
that an asset is critical or threatened within the risk criterion.
Often, it might not be possible to share such information due to
national security issues and proprietary interests. The FAA notes,
however, that if the FAA denies an application for a license based on
its determination that the proposed activity exceeds the risk threshold
for critical assets, an applicant may request reconsideration under
Sec. 413.21 or a hearing in accordance with part 406 of this chapter.
CSF asked how the FAA will manage proprietary and national security
concerns among operators and asset-owners. The FAA does not foresee a
need to share proprietary data with non-Federal entities because the
Federal Government will conduct the assessment of critical asset risk
on behalf of the licensee. Based on discussions with relevant Federal
agencies, it is also possible to perform an assessment of critical
assets without disclosing the precise location or nature of each asset,
thereby eliminating the need to share proprietary and national security
information. For example, the USAF 45th Space Wing/Wing Safety
identifies what facilities are threatened within the thresholds and
shares that information with the appropriate tenants. The tenant can
then inform the USAF, or another entity performing the analysis, that
an asset is threatened without divulging sensitive information to any
entity outside the U.S. Government. The FAA will work with the entities
responsible for critical assets to ensure any necessary coordination,
taking into account the need to protect proprietary and confidential
data.
Several commenters, including CSF, SpaceX, and Virgin Galactic
requested clarification as to the meaning of ``loss of functionality''
and how the FAA or other entity would determine what could result in
the ``loss of functionality'' of a critical asset. CSF sought
clarification on whether infrastructure was ``critical'' if it was
needed to support full functionality of a critical asset and on the
standard for
[[Page 79609]]
determining whether an asset's function had been lost. It inquired
whether it would matter if the function could be restored in a timely
manner or met with an alternative asset.
CSF and SpaceX also recommended that ``loss of functionality'' be
defined in Sec. 401.7 as an asset designated critical by the Secretary
of Defense or Administrator of NASA that (a) has been rendered unable
to support a specific mission or program deemed critical to the
national interest; (b) for which the loss of function will preclude the
assurance of a time-critical mission or program unless promptly
restored; or (c) for which the asset's function cannot be restored by
an accelerated recovery strategy or replaced by an alternate means of
mission/program execution. SpaceX and Virgin Galactic requested the FAA
include this new definition in an SNPRM, along with a clear rationale
for the FAA's proposed requirements for protecting critical assets.
Under the final rule, the party responsible for the critical asset
would determine what constitutes loss of functionality. The FAA
recognizes that the threshold conditions that cause loss of
functionality will be different depending on the type of asset and its
robustness. For example, infrastructure is typically more robust than a
payload that may be more fragile. For this reason, the FAA does not
elect to incorporate a specific standard for what may constitute loss
of functionality into the final rule. Likewise, the FAA does not find
that it is useful to create a more detailed definition of ``loss of
functionality'' but agrees that considerations such as those suggested
by CSF and SpaceX (e.g., ability to support missions critical to
national interests, or ability to repair or restore function through
alternative means in a timely manner) would be relevant and appropriate
to determining loss of functionality.
An individual commenter stated that critical asset protection
should not compromise protection of the public and neighboring
operation personnel. The commenter stated that an operator's required
insurance should already cover losses to critical assets.
The FAA notes that the critical asset protection requirements will
not compromise the protection of the public or neighboring operation
personnel. The FAA retains stringent requirements for protecting the
public, including neighboring operations personnel, which are
independent of the requirements protecting critical assets. The FAA
also disagrees with the commenter that an operator's financial
responsibility requirements are adequate to protect critical assets.
The FAA is limited by statute to imposing no more than $100 million in
financial responsibility to compensate for losses to U.S. Government
property. The value of many critical assets easily exceeds that limit,
with some critical payloads reportedly costing over a billion dollars.
More importantly, financial compensation for a loss may not address the
delay before repairs or replacement, during which time national
security might be jeopardized or the opportunity to accomplish
important national interests missed.
The FAA sought comments on its proposal to require a more stringent
criterion for critical assets of utmost importance to the U.S., to be
defined as ``critical payloads'' in Sec. 401.7. The FAA proposed to
require that the probability of loss of functionality for critical
payloads, including essential infrastructure when directly supporting
the payload, not exceed 1 x 10-\4\. In the past, Federal
launch or reentry sites have, on occasion, applied a more stringent
requirement, limiting the probability of debris impact caused by launch
or reentry hazards to less than or equal to 1 x 10-\4\ for
national security payloads, including essential infrastructure when
directly supporting the payload at the launch site. The FAA asked
commenters to identify (1) the impacts a 1 x 10-\4\ risk
criterion would have on their operations if applied to critical
payloads; (2) whether a more stringent risk criterion should be imposed
on any commercial payload; and (3) potential additional costs and
benefits associated with applying a 1 x 10-\4\ risk
criterion to critical payloads.
In the final rule, the FAA adopts the risk criterion and definition
as discussed in the NPRM preamble, with minor clarifications.
ULA supported the 1 x 10-\4\ risk criterion for critical
payloads, stating that given the time and expense associated with
replacing these assets, it was essential they receive the greatest
protection possible. It further commented that this risk criterion
should also apply to infrastructure and booster hardware in direct
support of critical payloads, beginning when booster hardware for that
particular critical payload was received and began processing at the
launch site. Under ULA's suggestion, at the completion of the launch
campaign, the risk criterion should revert to 1 x 10-\4\.
Virgin Galactic, however, commented that it was not necessary to adopt
a heightened risk criteria for critical payloads. It saw no benefit to
the discussed 1 x 10-\4\ requirement over the 1 x
10-\4\ requirement. It also inquired whether the criterion
would apply to payloads on the vehicle of the operator that might be
subject to this new risk threshold. If so, Virgin Galactic stated this
would constitute managing mission success. Virgin Galactic also
inquired whether this risk criterion would apply to payloads at
neighboring launch sites. If so, Virgin Galactic believes the FAA must
demonstrate need and a nexus to statutorily obligated concerns. It
further stated that a more stringent criterion for commercial payloads
would place undue burden on operators, potentially requiring additional
analyses or redesign. Virgin Galactic noted that it did not intend to
carry critical payloads, so impacts to its operations from this
requirement would be negligible.
In the final rule, the FAA defines a critical payload as a payload
and essential infrastructure directly supporting such a payload that is
a critical asset (1) that is so costly or unique that it cannot be
readily replaced, or (2) for which the time frame for its replacement
would adversely affect the national interests of the United States. As
noted in the NPRM, a commercial payload that meets this definition will
be treated as a critical payload. The critical payload protection
requirement does not apply to payloads on the vehicle of the operator
regulated under part 450 but will apply to payloads on neighboring
launch sites. The FAA agrees with ULA that the 1 x 10-\3\
risk criterion should apply to essential infrastructure directly
supporting the critical payload, and notes that it will likely apply to
booster hardware in direct support of the launch of a critical payload.
After a launch of a critical payload, the infrastructure supporting the
launch will be critical only if it is essential to the national
interests of the United States. The risk criterion determines the
protection required for critical assets and payloads. It is not
necessary to specify in the regulation that this requirement does not
apply during activities that do not exceed the risk threshold.
The FAA disagrees with Virgin Galactic that there is no benefit in
applying a 1 x 10-\4\ risk criterion to critical payloads.
As explained in the NPRM, during the interagency review process, DOD
requested that the FAA consider specifying a more stringent criterion
for certain critical assets of utmost importance. The FAA considers a
critical payload a type of critical asset. The FAA finds it necessary
to protect payloads such as vital national security payloads and high-
priority NASA and NOAA payloads. The NPRM noted that a payload such as
NASA's Curiosity rover would likely be afforded this
[[Page 79610]]
protection. In the final rule, the FAA adopts this higher protection
criterion to safeguard those payloads of utmost importance to the U.S.
meriting a greater degree of protection than other critical assets.
While the FAA is providing for heightened protection for critical
payloads, it expects the protection to have minimal effects on
commercial launch and reentry operations. Currently there are few
commercial payloads that would rise to the level of being considered
critical payloads, although the FAA recognizes that might change in the
future, if for instance, DOD were to rely on a commercial service for
critical communication support.
Virgin Galactic requested the FAA adopt neither 1 x
10-\3\ nor a more stringent criterion. It argued the
proposed requirement contradicted the requirement in 51 U.S.C. Sec.
50901(a)(7) that the FAA regulate only to the extent necessary. Virgin
Galactic stated the FAA did not show why these requirements were
necessary, given that Federal launch or reentry sites already protect
their own property. Furthermore, Virgin Galactic commented that the FAA
would be enforcing a more stringent, but undisclosed criterion and
argued the proposed regulation was non-transparent and would deprive
the public of the opportunity to comment on this criterion as required
by the Administrative Procedure Act. The commenter asserted this
undisclosed criterion could prevent operators from planning ahead and
would create two standards that might conflict.
As articulated in the NPRM, the FAA finds it necessary to codify
current practice at Federal launch or reentry sites to protect critical
assets that are of utmost importance to the U.S. and to extend the same
protections for launch or reentry activity conducted at non-Federal
sites. For launches from Federal sites, this rule does not change
current practice; rather it incorporates that practice in a regulation.
This regulation consolidates the FAA's requirements for protection of
critical assets and critical payloads in all commercial launch or
reentry operations, in accordance with the FAA's statutory authority.
This rule reduces the need for a Federal or non-Federal site operator
to impose critical asset protection requirements on operators as a
contractual condition for the use of its facility. The FAA expects that
the instances in which a more stringent criterion will be necessary
will be rare. Preserving the flexibility to protect particularly vital
assets at a more stringent criterion in a license, as proposed in the
NPRM, is consistent with current practice at Federal launch and reentry
sites and will reduce the need for a Federal or non-Federal launch site
operator to impose a more stringent criterion on operators through
contract.
CSF and SpaceX commented that the FAA did not assess the cost
burden on industry for compliance with the critical asset requirements.
Virgin Orbit commented that critical asset calculations would require
additional analysis and resources.
In the final rule, the FAA's removal of the requirements for
operators to assess impacts to critical assets in flight hazard, ground
hazard, debris or debris risk analyses assuages the commenters'
concerns for costs associated with performing those analyses. As
compared to the proposal, there will be much reduced administrative
burden on the operator. The FAA will coordinate as necessary with
critical assets owners, and either the FAA or the Federal site operator
will provide written confirmation to the operator that the criteria in
Sec. 450.101(a)(4) or (b)(4) have been met. If the FAA or Federal site
operator determines that the criteria have not been met, either the FAA
or Federal site operator will work with the operator to identify any
measures that operators may need to undertake in order to protect
critical assets to the level required by Sec. 450.101(a)(4) or (b)(4).
An individual commenter stated that the proposed regulation would
require companies to perform trade studies to determine if additional
controls would be needed to reduce the likelihood of critical asset
loss of functionality. The commenter requested the FAA require a cost-
benefit analysis to ensure that upfront investment of controls to
protect critical assets would be less than the cost of replacing that
asset.
When determining whether an asset is a critical asset, the cost of
an asset is a factor. However, ultimately an asset is critical if it is
essential to the national interests of the United States. If it cannot
be replaced in a time frame that satisfies those interests, the cost of
the asset is irrelevant. Furthermore, the FAA does not find that most
mitigations will impose significant cost.
Virgin Galactic indicated the need for FAA assistance in planning
hazard control strategies pursuant to proposed Sec. 450.107(e)(2)(ii)
\79\ due to the secrecy of some critical assets. If an operator is
using physical containment as a hazard control strategy, the FAA or
Federal launch or reentry site operator will work with the operator to
ensure no critical assets are within the flight hazard area. The most
likely mitigation is shifting the launch point or, if the critical
asset is mobile, changing in the launch schedule.
---------------------------------------------------------------------------
\79\ As proposed, an applicant using physical containment as a
hazard control strategy would have been required to describe the
methods used to ensure that flight hazard areas are cleared of the
public and critical assets. This requirement has been relocated to
Sec. 459.110(c)(2) in the final rule.
---------------------------------------------------------------------------
Sierra Nevada requested the FAA conduct a publicly-available
assessment to determine if the proposed critical asset protection
requirements would impact an operator's MPL calculation. CSF requested
the FAA engage industry on the topic of critical assets.
The FAA does not find that the protection of critical assets will
increase MPL. The designation of an asset as critical is unrelated to
financial responsibility. In performing its MPL calculation for U.S.
Government property, the FAA ascertains the financial responsibility
required so that the likelihood of exceeding losses to government
property involved in a licensed activity (taken to mean such property
on a Federal launch or reentry site) that are reasonably expected to
result from that activity does not exceed 1 x 10-\5\; or, in
the rarer situation in which a critical asset might not be U.S.
Government property on a Federal launch or reentry site, 1 x
10-\7\. Critical assets are protected to a less stringent 1
x 10-\3\, or in the case of certain critical payloads, 1 x
10-\4\, and financial responsibility and protection are not
directly related. If anything, the requirement to protect critical
assets has the potential to lower MPL for U.S. Government property
because the mitigation employed may well remove the possibility that
the asset can be damaged even within the more stringent MPL threshold.
This would be the case if, to avoid placing the critical asset at risk
a launch was rescheduled, its trajectory adjusted, or the critical
asset was moved or physically protected. The FAA finds that it is
unlikely that a mitigation employed to protect critical assets will
change the MPL for third-party liability.
d. Other Safety Criteria (Sec. 450.101(d), (e), (f), and (g))
The FAA adopts the criteria in Sec. 450.101(d), (e), (f), and (g)
with no changes. Section 450.101(d) addresses disposal safety criteria,
Sec. 450.101(e) is the requirement for the protection of people and
property on orbit, Sec. 450.101(f) requires the notification of
planned impacts, and Sec. 450.101(g) addresses the validity of
analyses.
The FAA received public comments from Virgin Galactic on the
notification of planned impacts. Specifically, Virgin
[[Page 79611]]
Galactic advised that a carrier aircraft operating under an
airworthiness certificate should be exempt from proposed Sec.
450.101(f). This comment is discussed in further detail in the preamble
section on hybrid vehicles. The FAA will not exempt all hybrid vehicle
operators from the requirement in Sec. 450.101(f). If an operation has
no planned impacts from debris capable of causing a casualty, then no
notification will be necessary to comply with Sec. 450.101(f). The
regulation is adopted as proposed.
e. System Safety Program (Sec. 450.103)
In the NPRM, the FAA proposed in Sec. 450.103 that an operator
must implement and document a system safety program throughout the
operational lifecycle of a launch or reentry system. The system safety
program was proposed to include a safety organization (Sec.
450.103(a)), procedures to evaluate the operational lifecycle of the
launch or reentry system (Sec. 450.103(b)), configuration management
and control (Sec. 450.103(c)), and post-flight data review (Sec.
450.103(d)).
In the final rule, the FAA adopts proposed Sec. 450.103 with
revisions. The FAA replaced the term ``operational lifecycle'' in the
introductory paragraph of Sec. 450.103 with simply ``lifecycle'' to
clarify that the regulation applies to hazards throughout the lifecycle
of a launch or reentry system, not just operational changes to the
system. This change is consistent with the statements in the NPRM
indicating that, due to the complexity and variety of vehicle concepts
and operations, a system safety program would be necessary to ensure
that an operator considers and addresses all risks to public safety,
which include both design and operational changes to a system.
i. Safety Organization
In the NPRM, the FAA proposed that the system safety program would
require an operator to maintain and document a safety organization that
has clearly defined lines of communication and approval authority for
all public safety decisions, and that includes a mission director and
safety official. In the final rule, the FAA adopts the proposed rule
with a revision. The FAA removes ``and document'' from the proposed
requirement because the first sentence in Sec. 450.103 already
requires a system safety program to be documented.
Proposed Sec. 450.103(a)(1) stated that for each launch or
reentry, an operator would be required to designate a position
responsible for the safe conduct of all licensed activities and
authorized to provide final approval to proceed with licensed
activities. This position is referred to as the mission director. In
the final rule, the FAA adopts Sec. 450.103(a)(1) as proposed. The FAA
did not receive comments on this section.
Proposed Sec. 450.103(a)(2) stated that, for each launch or
reentry, an operator would be required to designate a position with
direct access to the mission director who would be responsible for
communicating potential safety and noncompliance issues to the mission
director and would be authorized to examine all aspects of the
operator's ground and flight safety operations, and to independently
monitor compliance with the operator's safety policies, safety
procedures, and licensing requirements. This position would be referred
to as a safety official. The FAA noted in the NPRM preamble that the
absence of a safety official could result in a lack of independent
safety oversight and a potential for a breakdown in communications of
important safety-related information. The FAA also noted that a safety
organization that included a safety official was essential to public
safety; however, identifying that individual by name was not necessary.
In the final rule, the FAA adopts Sec. 450.103(a)(2) as proposed.
Thus, a safety official will need to be in place prior to and
throughout any licensed activity.
Rocket Lab supported the proposed safety organization documentation
requirements in proposed Sec. 450.103(a), noting the requirements
would provide improved flexibility for the industry and support growth
in operations, while maintaining clear lines of communication and
independence in safety decision making. Virgin Galactic noted that it
agreed with the FAA's approach not to require a specific person be
listed as the safety official. Microcosm inquired if a specific named
safety official would be required for each launch site for operators
with licensed activity at multiple sites, and how far in advance that
information would need to be provided to the FAA.
The FAA notes that a safety official must be named and in place
prior to the initiation of any licensed activity, and an operator may
use the same safety official for multiple launch or reentry sites. It
may be difficult for a single individual to serve as a safety official
for multiple sites if launch or reentry activities were to occur close
in time to each other. In those instances, an operator may choose to
have multiple safety officials. An operator needs to provide the name
of the safety official to the FAA only when requested. The FAA may
request the name of the individual who will act as a safety official as
part of a compliance monitoring action. As is current practice, the FAA
will coordinate in advance with the operator prior to a compliance
monitoring action.
ALPA concurred with the requirement for operators to develop a
general system safety program. It also recommended that that embedding
FAA representatives within commercial space companies would assist the
commercial space community in growing robust system safety procedures.
The FAA notes that embedding FAA representatives within commercial
space companies is outside the scope of this rulemaking.
Proposed Sec. 450.103(a)(3) requires the mission director to
ensure that all of the safety official's concerns are addressed. In the
final rule, the FAA adopts Sec. 450.103(a)(3) as proposed. The FAA did
not receive any comments on this section.
ii. Hazard Management
Proposed Sec. 450.103(b) would have required an operator to
establish procedures to evaluate the operational lifecycle of the
launch or reentry system, including methods to review and assess the
validity of the proposed preliminary safety assessment and any flight
hazard analysis throughout the operational lifecycle of the launch or
reentry system, methods for updating the preliminary safety assessment
and flight hazard analysis, and methods for communicating and
implementing the updates throughout the organization. For operators
that would need to conduct a flight hazard analysis, the proposed rule
would also require an operator's system safety program to include a
process for tracking hazards, risks, mitigation and hazard control
measures, and verification activities.
In the final rule, the FAA adopts proposed Sec. 450.103(b) with
revisions. The FAA renames this section ``Hazard management'' to be
more descriptive than the proposed name of ``Procedures.'' The FAA also
does not adopt the proposed requirement in Sec. 450.103(b)(1) to
conduct a preliminary safety assessment because that requirement has
been replaced with the requirement to conduct a hazard control strategy
determination in Sec. 450.107(b) in the final rule, as will be
discussed later.
As noted, proposed Sec. 450.103(b)(1) would have required the
system safety program to include: (i) Methods to review and assess the
validity of the preliminary safety assessment throughout the
operational lifecycle of
[[Page 79612]]
the launch or reentry system; (ii) methods for updating the preliminary
safety assessment; and (iii) methods for communicating and implementing
the updates throughout the organization. For those operators required
to conduct a flight hazard analysis, proposed Sec. 450.103(b)(2) would
have required the system safety program to include the same methods for
the flight hazard analysis and a process for tracking hazards, risks,
mitigation and hazard control measures, and verification activities.
In the final rule, the FAA consolidates the requirements in
proposed Sec. 450.103(b)(1) and (b)(2) into Sec. 450.103(b)(1) of the
final rule. Section 450.103(b)(1) requires a system safety program to
include methods to assess the system to ensure the validity of the
hazard control strategy determination and any flight hazard or FSA
throughout the lifecycle of the launch or reentry system.\80\ The FAA
added FSA to this requirement because, as proposed in Sec. 450.101(g)
and adopted in the final rule, any analysis used to demonstrate
compliance with Sec. 450.101 must use accurate data. This is
consistent with the proposal because proposed Sec. 450.103(b)(1)(i)
would have required methods to review and assess the validity of the
preliminary safety assessment, which would have included components of
FSA such as vehicle response modes, public safety hazards associated
with vehicle response modes, population exposed to hazards, and
CEC. As previously noted, the final rule in Sec.
450.103(b)(1) uses the term ``lifecycle'' by itself to clarify that the
regulation applies to hazards throughout the lifecycle of a launch or
reentry system, not just operations hazards.
---------------------------------------------------------------------------
\80\ Proposed Sec. 450.103(b)(1)(ii) and (b)(2)(ii) would have
required the system safety program to include methods for updating
the preliminary safety assessment and flight hazard analysis. In the
final rule, the FAA simplifies the regulatory text of Sec.
450.103(b) in the final rule, which requires an operator to
implement methods to assess the system to ensure the validity of the
hazard control strategy determination and any flight hazard or
flight safety analysis throughout the lifecycle of the launch or
reentry system. Updating the safety analyses is a component of
ensuring their validity.
---------------------------------------------------------------------------
Proposed Sec. 450.103(b)(1)(iii) and (b)(2)(iii) would have
required the system safety program to include methods for communicating
and implementing the updates throughout the organization. In the final
rule, the FAA consolidates the requirements in proposed Sec.
450.103(b)(1)(iii) and (b)(2)(iii) into Sec. 450.103(b)(2) of the
final rule with a revision. The FAA changes the term ``the updates'' to
``any updates'' to clarify the intent for comprehensiveness.
Proposed Sec. 450.103(b)(2)(iv) would have required the system
safety program, for operators that must conduct a flight hazard
analysis, to include a process for tracking hazards, risks, mitigation
and hazard control measures, and verification activities. The FAA
adopts the language proposed in Sec. 450.103(b)(2)(iv) of the NPRM in
Sec. 450.103(b)(3) of the final rule with a revision. The FAA deletes
the terms ``hazard control,'' because it is duplicative with the
existing term ``mitigation measures.''
iii. Configuration Management and Control
Proposed Sec. 450.103(c) would have required an operator to (1)
employ a process that tracks configurations of all safety-critical
systems and documentation related to the operation; (2) ensure the use
of correct and appropriate versions of systems and documentation
tracked under the subsection; and (3) maintain records of launch or
reentry system configurations and document versions used for each
licensed activity, as required by the requirement for records in
proposed Sec. 450.219.
In the final rule, the FAA adopts Sec. 450.103(c)(1) and (c)(2) as
proposed and revises Sec. 450.103(c)(3) as discussed later.
Blue Origin commented that tracking and maintaining records of
individual configurations and associated operations documentation for
completed operations does not, by itself, enhance public safety. Blue
Origin believes that changes should be evaluated for safety impact
according to a configuration management plan, which is a deliverable
under the current regulations. Blue Origin stated that an approved
configuration management plan, coupled with continued accuracy of the
application, should suffice without additional requirements for
increased documentation and storage of records.
The FAA agrees that tracking and maintaining records for completed
operations in isolation does not directly enhance public safety, but
tracking and maintaining records for completed operations is an
important component of configuration management, which, as a whole,
does enhance public safety. The FAA agrees with Blue Origin that an
approved configuration management plan coupled with continued accuracy
of the application should suffice, but does not agree that current
requirements are sufficient. Part 431 does not have any requirements
for configuration management, and Sec. 417.111(e) is more general in
its requirement to define the launch operator's process for managing
and controlling any change to a safety-critical system to ensure its
reliability. Section 450.103(c) adds necessary detail.
Blue Origin also stated that proposed Sec. 450.103(c) is
repetitive of the recordkeeping requirements in proposed Sec. 450.219,
making it unnecessary. Blue Origin added that if the FAA were to
maintain the requirement, it should be written in the context of
safety-critical systems, which would tie directly to FAA's
responsibility to protect public safety.
While the FAA considers Sec. 450.103(c) necessary, proposed Sec.
450.103(c)(3) could be perceived as repetitive. Proposed Sec.
450.103(c)(3) would have required an operator to maintain records of
launch or reentry system configurations and document versions used for
each licensed activity, as required by Sec. 450.219 (Records). Section
450.219 requires a licensee to maintain for 3 years all records, data,
and other material necessary to verify that a launch or reentry is
conducted in accordance with representations contained in the
licensee's application, the requirements of part 450 subparts C and D,
and the terms and conditions contained in the license. The FAA removes
the reference to maintaining records in Sec. 450.103(c)(3) and revises
the provision to require an operator to document the configurations and
versions identified in paragraph (c)(2) for each licensed activity.
This is a more focused requirement than Sec. 450.219 and limits the
documentation requirement specifically to safety-critical systems,
consistent with Blue Origin's recommendation.
iv. Post-Flight Data Review
Proposed Sec. 450.103(d) would have required an operator to employ
a process for evaluating post-flight data to (1) ensure consistency
between the assumptions used for the preliminary safety assessment, any
hazard or flight safety analysis, and associated mitigation and hazard
control measures; (2) resolve any identified inconsistencies prior to
the next flight of the vehicle; (3) identify any anomaly that may
impact any flight hazard analysis, FSA, or safety-critical system, or
would otherwise be material to public health and safety and the safety
of property; and (4) address any anomaly identified in (3) prior to the
next flight, including updates to any flight hazard analysis, FSA, or
safety-critical system. The FAA explained in the NPRM that this
requirement was consistent with industry practice to review post-flight
data to address
[[Page 79613]]
vehicle reliability and mission success and that this requirement
imposes no additional burden. The FAA sought comment on whether
proposed Sec. 450.103(d) would change an operator's approach to
reviewing post-flight data.
In the final rule, the FAA adopts proposed Sec. 450.103(d)(1),
(d)(2), and (d)(4) with revisions, and adopts Sec. 450.103(d)(3) as
proposed. Section 450.103(d)(1) was modified to replace ``preliminary
safety assessment'' with ``hazard control strategy determination'' as
discussed earlier. The FAA also added the word ``flight'' in front
``hazard or flight safety analysis'' to make clear that the requirement
addresses any flight hazard analysis or FSA.
CSF, Rocket Lab, and Sierra Nevada commented that proposed Sec.
450.103(d) should be deleted because it was overly burdensome and
inconsistent with the directive to streamline the regulations. The
commenters stated that the requirement would extend the industry
practice beyond the typical analysis for reliability and mission
success. Sierra Nevada suggested that the section could be re-written
to address only post-flight data of safety-critical systems.
As discussed in the NPRM, operator review of post-flight data
provides valuable safety information on future operations. The
inconsistencies that need to be resolved in this subsection are only
those that affect safety analyses and associated mitigation and hazard
control measures, such as greater population in the launch area than
modeled. The anomalies that need to be addressed are only those that
may impact any flight hazard analysis, FSA, or safety-critical system,
or are otherwise material to public health and safety and the safety of
property, such as the momentary drop-out of an FSS. Therefore, while
the FAA revises Sec. 450.103(d)(2) to narrow its applicability, as
discussed below, it declines to remove proposed Sec. 450.103(d)(2).
Blue Origin proposed a revision of Sec. 450.103(d)(2) to specify
``public safety.'' Virgin Galactic recommended removing the word
``any'' in front of ``identified inconsistencies,'' and recommended
limiting applicable inconsistencies to those that have an effect on the
safety criteria of Sec. 450.101.
The FAA agrees that proposed Sec. 450.103(d)(2) could be read to
reach more broadly than public safety, so the FAA has revised the
section to require that an operator resolve any inconsistencies
``identified in paragraph (d)(1) of this section'' prior to the next
flight of the vehicle. This language would explicitly limit the
applicability of the provision to the hazard control strategy
determination, and any hazard or flight safety analyses and associated
mitigation and hazard control measures, as opposed to mission success.
The FAA does not agree with Virgin Galactic's suggestion to limit
applicable inconsistencies to those that have an effect on the safety
criteria of Sec. 450.101. That change would imply that a quantitative
analysis is all that is required. As discussed earlier in the hazard
management section, the hazard control strategy determination and the
hazard and flight safety analyses must be kept up to date throughout
the lifecycle of the launch and reentry system, so inconsistencies need
to be addressed. The FAA also does not agree with Virgin Galactic to
remove the word ``any'' in front of ``inconsistencies'' because it
would not change the scope of the requirement, because Sec.
450.103(d)(2) explicitly refers to the analyses in Sec. 450.103(d)(1).
Virgin Galactic recommended that proposed Sec. 450.103(d)(4)--
which would have required an operator to address any anomaly identified
in paragraph (d)(3) prior to the next flight, including updates to any
flight hazard analysis, FSA, or safety-critical system--be revised to
state the FAA should review and provide a determination on an
operator's post-flight data to approve the operator's ability to launch
according to schedule, rather than delaying until all anomalies are
resolved.
The FAA notes that proposed Sec. 450.103(d)(4) would not have
required FAA approval of the methodology an operator uses to address
anomalies in general or a specific anomaly in particular. In order to
avoid Virgin Galactic's interpretation that all anomalies must be
resolved prior to the next flight, the FAA revised the final rule to
require an operator to address any anomaly identified in paragraph
(d)(3) prior to the next flight as necessary to ensure public safety.
As proposed, this would include updates to any flight hazard analysis,
FSA, or safety-critical system. To ensure public safety, the FAA would
expect an operator to reassess its safety analyses to determine any
potentially new public safety hazards or increased risks to known
public safety hazards due to the anomaly and, if necessary, determine
the need for any additional mitigation strategies or updates to its
safety analyses.
v. Application Requirements
An applicant under proposed Sec. 450.103(e) would have to submit
(1) a description of the applicant's safety organization, identifying
the applicant's lines of communication and approval authority, both
internally and externally, for all public safety decisions and the
provision of public safety services; and (2) a summary of the processes
and products identified in the system safety program requirements.
In the final rule, the FAA adopts Sec. 450.103(e) as proposed. The
FAA did not receive any comments on this section.
f. Hazard Control Strategies (Sec. 450.107)
In the NPRM, the FAA proposed in Sec. 450.107 that, for each phase
of a vehicle's flight, an operator does not need to conduct a flight
hazard analysis for that phase of flight if the public safety hazards
identified in the preliminary safety assessment (PSA) can be mitigated
adequately to meet the requirements of proposed Sec. 450.101 using
physical containment, wind weighting, or flight abort, in accordance
with Sec. 450.107(b), (c), and (d). If the public safety hazards
identified in the PSA could not be adequately mitigated using these
methods, an operator would be required to conduct a flight hazard
analysis in accordance with proposed Sec. 450.109 to derive hazard
controls for that phase of flight.
The FAA has restructured Sec. 450.107 in the final rule to require
an operator to use a functional hazard analysis to make a hazard
control strategy determination. This requirement is based on the
requirements for the PSA that was proposed, but not adopted, in Sec.
450.105. In addition, the FAA has removed from Sec. 450.107 specific
details for each hazard control strategy available to operators and
instead directs operators to Sec. Sec. 450.108, 450.109, 450.110, and
450.111, which provide requirements for flight abort,\81\ flight hazard
analysis, physical containment,\82\ and wind weighting, respectively.
---------------------------------------------------------------------------
\81\ In the NPRM, the requirements for flight abort had been
scattered throughout proposed Sec. Sec. 450.107, 450.123, 450.125,
450.127, 450.129, and 450.165. Section 450.108 is discussed more
fully later in the preamble section titled Flight Abort.
\82\ The NPRM did not include a separate section for physical
containment. In the final rule, as will be discussed later, the
requirements from proposed Sec. 450.107(b) are relocated to a new
Sec. 450.110 (Physical Containment).
---------------------------------------------------------------------------
Section 450.107 also characterizes flight hazard analysis as a
hazard control strategy. Although a flight hazard analysis is different
from the other hazard control strategies in that it does not lay out
specific hazard controls, it does lay out a process by which hazard
controls can be derived. The hazard controls that are derived from the
flight hazard analysis, like those defined in the other three hazard
[[Page 79614]]
control strategies, are then used as part of the input to the FSA that
is used to show compliance with Sec. 450.101(a), (b), and (c).
Therefore, because a flight hazard analysis is a means by which an
operator derives the appropriate hazard controls, the FAA has
characterized it as a hazard control strategy in this final rule. As
such, throughout the final rule, a flight hazard analysis is listed
with physical containment, wind-weighting, and flight abort as a hazard
control strategy.\83\ Further, Sec. 450.107(c) retains the proposed
requirement that an operator must conduct a flight hazard analysis if
the public safety hazards for that phase of flight cannot be mitigated
adequately to meet the requirements of Sec. 450.101 through physical
containment, wind weighting, or flight abort.\84\
---------------------------------------------------------------------------
\83\ The FAA notes that, throughout the preamble, it uses the
phrase ``as a hazard control strategy'' to modify physical
containment, wind-weighting, flight abort, and flight hazard
analysis. For example, in the preamble, the FAA refers to operators
who use ``flight abort as a hazard control strategy.'' In such
instances, the FAA means that flight abort is being used as a hazard
control strategy consistent with the requirements in Sec. 450.108.
Likewise, when an operator uses flight hazard analysis as a hazard
control strategy, the operator is conducting a flight hazard
analysis consistent with the requirements set forth in Sec.
450.109.
\84\ Although proposed Sec. 450.107 was written in the
negative, stating that an operator was not required to conduct a
flight hazard analysis if the public safety hazards identified in
the preliminary safety assessment for that phase of flight could be
mitigated adequately to meet the requirements of Sec. 450.101
through physical containment, wind weighting, or flight abort, the
final rule has revised this language to be more easily understood.
---------------------------------------------------------------------------
Lastly, the final rule fixes an error in proposed Sec. 450.107,
which referenced Sec. 450.101 in its entirety as being relevant to the
hazard control strategies, even though certain requirements in Sec.
450.101 regarding the disposal of upper stages, protection of people
and property on orbit, and notification of planned impacts, are not
relevant to the hazard control strategies defined in Sec. 450.107.
Section 450.107 refers instead to Sec. 450.101(a), (b), or (c).
The FAA adds paragraph (b) to Sec. 450.107 to address how an
operator determines its hazard control strategy or strategies for any
phase of flight during a launch or reentry. This paragraph is based on
and replaces a portion of the preliminary safety assessment in proposed
Sec. 450.105 of the NPRM. Because an operator determines a hazard
control strategy or strategies based on an assessment of potential
hazards, the requirements for such an assessment are better suited for
this section. The next preamble section discusses the revision to Sec.
450.107(b) more fully.
Proposed Sec. 450.107(e) would have required an applicant in its
application to describe its hazard control strategy for each phase of
flight. The application requirements in the final rule, in Sec.
450.107(d), similarly require an applicant to provide a description of
its hazard control strategy or strategies for each phase of flight. The
FAA added the phrase ``or strategies'' to reflect the fact that an
operator may use one or more hazard control strategies for any given
phase of flight. In addition, because the requirements for physical
containment have been relocated to Sec. 450.110, the FAA has likewise
relocated the application requirements for physical containment
proposed in Sec. 450.107(e) to Sec. 450.110(c).\85\ These
requirements have been adopted as proposed.
---------------------------------------------------------------------------
\85\ The proposed rule also required an applicant using physical
containment as a hazard control strategy to demonstrate that the
launch vehicle does not have sufficient energy for any hazards
associated with its flight to reach outside the flight hazard area
developed in accordance with Sec. 450.133, and to describe the
methods used to ensure that flight hazard areas are cleared of the
public and critical assets.
---------------------------------------------------------------------------
Lastly, Sec. 450.107(d) in the final rule requires an applicant to
submit in its application the results of its hazard control strategy
determination, including all functional failures identified under Sec.
450.107(b)(1), the identification systems, and a timeline of all
safety-critical events. These relate to the hazard control strategy
determination, which is discussed in the next section of this preamble.
The FAA received a few comments for proposed Sec. 450.107. One
individual commenter supported the additional flexibility inherent in
allowing an operator to select its hazard control strategy and noted
that this flexibility would help to reduce overall design costs for the
private enterprise. Virgin Galactic requested that the FAA define
``traditional hazard controls'' and provide opportunity for public
comment through the issuance of an SNPRM. Blue Origin proposed that the
FAA amend proposed Sec. 450.107(e)(2)(ii) to require that an applicant
describe the methods used to ensure that risk to the public and
critical assets in flight hazard areas meet allowable criteria. This
latter comment is discussed later in the preamble section titled
Physical Containment.
To the extent that Virgin Galactic commented that the term
``traditional hazard controls'' should be defined and comment allowed
through publication of an SNPRM, the FAA notes that the NPRM stated
that traditional hazard controls included physical containment, wind
weighting, and flight abort.\86\
---------------------------------------------------------------------------
\86\ See 84 FR 15316 (footnote 62).
---------------------------------------------------------------------------
g. Hazard Control Strategy Determination (Sec. 450.107(b))
In the NPRM, the FAA proposed in Sec. 450.105 to require that
every operator conduct and document a PSA for the flight of a launch or
reentry vehicle to identify potential public safety impacts early in
the design process. The FAA intended the PSA to be a top-level
assessment of the potential public safety impacts identifiable early in
the design process and broad enough that minor changes in vehicle
design or operations would not have a significant impact on, or
invalidate the products produced by, the PSA. As proposed, the PSA
would have required the operator to identify a number of items,
including: A preliminary hazard list that documents all hardware,
operational, and design causes of vehicle response modes that,
excluding mitigation, have the capability to create a hazard to the
public; safety-critical systems; and a timeline of all safety-critical
events.\87\ An applicant would have been required to submit the PSA
result, including the items identified above, in its application for a
license.
---------------------------------------------------------------------------
\87\ The operator would also have needed to identify (1) vehicle
response modes; (2) public safety hazards associated with vehicle
response modes, including impacting inert and explosive debris,
toxic release, and far field blast overpressure; (3) geographical
areas where vehicle response modes could jeopardize public safety;
(4) any population exposed to public safety hazards in or near the
identified geographical areas; and (5) the CEC, unless otherwise
agreed to by the Administrator based on the demonstrated reliability
of the launch or reentry vehicle during any phase of flight.
---------------------------------------------------------------------------
The final rule removes proposed Sec. 450.105 in its entirety but
relocates certain items from the PSA section into Sec. 450.107(b) as
part of the hazard control strategy determination. The final rule
replaces the requirement for a PSA with a functional hazard analysis
and replaces the term ``vehicle response mode'' with ``reasonably
foreseeable hazardous events.'' The FAA finds these changes are less
prescriptive and burdensome on an operator, while preserving the
intended benefits and level of safety of the proposed requirements.
Blue Origin and Microcosm commented that requiring operators to
develop a preliminary hazard list that identifies all causes of hazards
and vehicle response modes for a PSA, prior to analysis or testing of
their vehicle systems, was unreasonable. Blue Origin stated it would be
infeasible to document in a preliminary hazard list all hardware,
operational, and design causes of vehicle response modes capable of
causing a hazard to the public at the preliminary design phase.
[[Page 79615]]
The commenters noted that operators identify potential hazards, but not
all causes of vehicle response modes, prior to the detailed design
phase. Blue Origin added that identification of causes was a continuous
process that evolves as hardware and operations design matures, and
recommended the PSA be limited to analyzing and identifying all
functional failures that could have the capability to create a hazard
to the public, rather than analyzing the detailed design, which may
still be maturing. Blue Origin also noted that early engagement with
the FAA through the pre-application process, before a design is mature,
was beneficial to both parties.
The FAA concurs that the detailed design may not be mature enough
at a preliminary stage such that an operator could define all hardware,
operational, and design causes of vehicle response modes with minimal
changes downstream in the development process in a preliminary hazard
list. Although the preliminary hazard list would not have been provided
to the FAA until an applicant submitted an application, the FAA agrees
with the commenters that the proposed rule would have required a launch
or reentry operator to complete the preliminary hazard list early in
the design process, to enable the operator to then carry out its hazard
control strategy or strategies. This, as noted by Blue Origin, would
not have been practicable as proposed. Accordingly, the FAA does not
adopt the proposed requirement for an operator to identify a
preliminary hazard list. Instead, the FAA requires an operator, in
Sec. 450.107(b), to determine its hazard control strategy or
strategies for any phase of flight during a launch or reentry, based on
a functional hazard analysis accounting for all functional failures
associated with reasonably foreseeable hazardous events, safety-
critical systems, and safety-critical events. Even with this change,
the FAA also agrees with Blue Origin that this approach will encourage
operators to engage early with the FAA, prior to the design becoming
mature.
In the final rule, the FAA eliminates proposed Sec. 450.105, but
moves, with some revision, the requirements in proposed Sec. Sec.
450.105(a)(6) through (a)(8) into Sec. 450.107(b). Section 450.107(b),
titled ``Hazard Control Strategy Determination,'' requires that for any
phase of flight during a launch or reentry, an operator must use a
functional hazard analysis to determine a hazard control strategy or
strategies accounting for (1) all functional failures associated with
reasonably foreseeable hazardous events that, excluding mitigation,
have the capability to create a hazard to the public, (2) safety-
critical systems, and (3) a timeline of all safety-critical events.
In the NPRM, proposed Sec. 450.105(a)(6) would have required a
preliminary hazard list documenting all hardware, operational, and
design causes of vehicle response modes that, excluding mitigation,
have the capability to create a hazard to the public. The final rule
requires an operator to use a functional hazard analysis that accounts
for, among other things, all functional failures associated with
reasonably foreseeable hazardous events that, excluding mitigation,
have the capability to create a hazard to the public. A functional
failure is a condition of a system, subsystem, or component function
derived by assessing each function against multiple potential failure
modes during each phase of the system's mission. This addresses Blue
Origin's concerns about the preliminary hazard list because identifying
functional failures does not require detailed design information that
may not be finalized at the stage of design when a hazard control
strategy is being considered.
A functional hazard analysis is a common system safety tool that,
as articulated in DOD's MIL-STD-882E, is used to identify and classify
the system functions and the safety consequences of functional failure
or malfunction.\88\ A functional hazard analysis is a foundational tool
useful throughout the lifecycle of the launch or reentry system that
helps drive the design and development process at a preliminary stage
by identifying safety-critical functions of which launch and reentry
vehicle developers should be cognizant throughout the process to ensure
public safety. The requirement to perform a functional hazard analysis
instead of a preliminary hazard list, as proposed in Sec. 450.105,
should reduce the burden on operators, for the reasons cited by Blue
Origin.
---------------------------------------------------------------------------
\88\ Department of Defense, Standard Practice for System Safety,
MIL-STD-882E, May 11, 2012.
---------------------------------------------------------------------------
The FAA finds that a functional hazard analysis will preserve the
benefits of the preliminary safety assessment proposed in the NPRM, but
reduce the burden on applicants by not requiring detailed design
information that may not be finalized at the stage of design when a
hazard control strategy is being considered. Like the PSA, a functional
hazard analysis should help an operator identify specific information
relevant to public safety, scope the analyses that must be conducted to
ensure that the launch or reentry operation satisfies safety criteria,
identify the effect of design and operational decisions on public
safety, and provide the operator with an appropriate hazard control
strategy for its proposed operation.
Section 450.107(b)(1) in the final rule requires an operator to use
a functional hazard analysis to determine a hazard control strategy
accounting for all functional failures associated with reasonably
foreseeable hazardous events that, excluding mitigation, have the
capability to create a hazard to the public. As noted earlier, a
functional failure is a condition of a system, subsystem, or component
function derived by assessing each function against multiple potential
failure modes during each phase of the system's mission. The failure
end-effect is the resulting system behavior from each functional
failure. Failure end-effects that result in impacts to public safety
should in turn identify the safety-critical systems and can be grouped
to identify the system hazards to the public. Thus, the inability of a
safety-critical system, subsystem, or component to function as
designed, or to function erroneously, may potentially result in a
hazard to the public. It is important to note that public exposure to a
hazard should only be accounted for after determining the potential
hazards to the public. That is, limits to public exposure can be a
mitigation when considering hazards at the overall system or mission
level, and thus not considered when determining what constitutes a
hazard to the public (i.e., functional sources of the hazard) for the
purposes of Sec. 450.107(b)(1).
The FAA does not retain in Sec. 450.107(b) the items in proposed
Sec. 450.105(a)(1) through (a)(5) for an operator to identify (1)
vehicle response modes, (2) public safety hazards associated with
vehicle response modes, (3) geographical areas where vehicle response
modes could jeopardize public safety, (4) any population exposed to
public safety hazards in or near the identified geographical areas, and
(5) the CEC. These are addressed in the four hazard control
strategies and in FSA.
Finally, the FAA replaces the term ``vehicle response mode'' in the
NPRM with ``reasonably foreseeable hazardous events'' in Sec.
450.107(b)(1) in the final rule. As explained in the preamble section
discussing Sec. 450.101(c), the NPRM defined ``vehicle response mode''
as a mutually-exclusive scenario that characterizes foreseeable
combinations of vehicle trajectory and debris generation. The final
rule is less prescriptive by requiring that an operator account for
reasonably foreseeable hazardous events, instead of
[[Page 79616]]
each foreseeable combination of vehicle trajectory and debris
generation. Accounting for reasonably foreseeable hazardous events in a
functional hazard analysis is consistent with common industry
standards. This change also means the FAA does not adopt the proposed
definition of ``vehicle response mode'' in Sec. 401.7.
Blue Origin also requested clarification from the FAA on its
interpretation of the requirement proposed in Sec. 450.105(a)(8) to
provide ``a timeline of all safety-critical events.'' Blue Origin noted
that it interprets ``safety'' to mean meeting the collective and
individual risk requirements for launch and reentry and, in essence,
suggested that the PSA should be limited in scope based on the
collective risk criteria resulting from the FSA.
The FAA does not agree with Blue Origin's interpretation nor with
its suggestion that this requirement, now in Sec. 450.107(b)(3) in the
final rule, be limited by the results of FSA. The FAA will consider any
event that occurs during a phase of flight of a launch or reentry
vehicle that meets the definition of ``safety critical'' in Sec. 401.7
to be a ``safety-critical event.''
As noted earlier, proposed Sec. 450.105 would have required that
every operator conduct and document a PSA for the flight of a launch or
reentry vehicle and submit its results. Virgin Galactic inquired as to
when the PSA would be due to the FAA, as well as the timeline for the
review. The final rule replaces the requirement to conduct a PSA with
the requirement to conduct a functional hazard analysis in Sec.
450.107(b). The application requirements for Sec. 450.107(b) are in
Sec. 450.107(d) and are due with the application, even though a launch
or reentry operator will conduct the functional hazard analysis early
in the design phase, well before it applies for a license. This
approach is consistent with Blue Origin's recommendation that the
analysis be limited to analyzing and identifying all functional
failures that could have the capability to create a hazard to the
public, rather than analyzing the detailed design, which may still be
maturing. As such, in the final rule an applicant is required to
provide the results of the functional hazard analysis, including all
functional failures, the identification of all safety-critical systems,
and a timeline of all safety-critical events.
h. Flight Abort (Sec. 450.108)
As discussed, if an operator cannot ensure by means other than
flight abort \89\ that it has sufficiently protected against a high
consequence event (as measured by CEC), the only remaining
way to satisfy Sec. 450.101(c) is to use flight abort consistent with
the requirements in Sec. 450.108.
---------------------------------------------------------------------------
\89\ As discussed, Sec. 450.101(c)(2) and (c)(3) allow an
operator to demonstrate it can sufficiently protect against a high
consequence event through other means that reduce CEC
below 1 x 10-\3\ or through demonstrated reliability.
---------------------------------------------------------------------------
In the NPRM, the FAA proposed to address flight abort in several
sections. As proposed, to implement flight abort as a hazard control
strategy, an operator would have been required to:
(1) Establish flight safety limits and gates in accordance with
proposed Sec. Sec. 450.123 (Flight Safety Limits Analysis) and
450.125 (Gate Analysis);
(2) establish when an operator must abort a flight following the
loss of vehicle tracking information with proposed Sec. 450.127
(Data Loss Flight Time and Planned Safe Flight State Analyses);
(3) establish the mean elapsed time between the violation of a
flight abort rule and the time when the FSS is capable of aborting
flight for use in establishing flight safety limits in accordance
with proposed Sec. 450.129 (Time Delay Analysis);
(4) establish flight abort rules in accordance with Sec.
450.165(c) (Flight Abort Rules); and
(5) employ an FSS in accordance with Sec. 450.145 and software
in accordance with Sec. 450.111.
Many of these requirements were derived from existing requirements in
part 417 and retained a more prescriptive approach to flight abort than
the final rule adopts.
Blue Origin, CSF, and SpaceX commented that the FSA requirements in
proposed Sec. Sec. 450.117 through 450.141 were too prescriptive and
should be replaced with a performance standard. The commenters cited a
lack of flexibility and the use of an approach directed at large
orbital launches from Federal launch or reentry sites.
In the final rule, the FAA consolidates the requirements for flight
abort in Sec. 450.108 and revises the more prescriptive requirements
from the proposal into a single performance-based regulation. As a
result of this consolidation, proposed Sec. Sec. 450.123, 450.125,
450.127, and 450.129 are not included in the final rule. The
requirements in these sections have been revised to reflect the
performance-based standards in Sec. 450.108(c), which establishes
flight safety limits objectives, and Sec. 450.108(d), which
establishes flight safety limits constraints. The FAA adds Sec.
450.108(e) in the final rule to relieve the operator from the
requirement to use flight abort in certain situations in which high
consequence events are possible but would not be effectively mitigated
by an FSS. In addition, the flight abort rule requirements proposed in
Sec. 450.165(c) have been revised and relocated to Sec. 450.108(f) to
reflect the revisions to the flight safety limits requirements. The FAA
also moves the reference to FSS reliability from proposed Sec.
450.101(c) to Sec. 450.108(b).
The FAA will provide guidance to illustrate how operators may
demonstrate compliance with these requirements. The guidance will
encompass many of the traditional means of developing flight safety
limits, but operators can develop other means of demonstrating
compliance with the performance-based objectives and constraints. As
discussed in more detail throughout this section of the preamble, the
revisions in the final rule allow for greater flexibility for operators
while maintaining the same level of safety as proposed in the NPRM.
i. FSS Thresholds Using CEC
In the NPRM, an operator required to use flight abort under
proposed Sec. 450.101(c) was referred to proposed Sec. 450.145 to
determine the required reliability of its FSS based on CEC.
Section 450.145(a)(1) proposed to require an operator to employ an FSS
with design reliability of 0.999 at 95 percent confidence and
commensurate design, analysis, and testing if the consequence of any
vehicle response mode is 1 x 10-\2\ CEC or
greater. This is the reliability standard for a highly reliable FSS
under part 417. Section 450.145(a)(2) proposed to require that, if the
consequence of any vehicle response mode is between 1 x
10-\2\ and 1 x 10-\3\ CEC for
uncontrolled areas, an operator must employ an FSS with a design
reliability of 0.975 at 95 percent confidence and commensurate design,
analysis, and testing. The FAA explained that, for operations for which
the consequence of a flight failure is less, an FSS--while still being
reliable--may not need to be as highly reliable as an FSS for a vehicle
operating in an area where the consequence of a flight failure is
higher.\90\
---------------------------------------------------------------------------
\90\ The FAA anticipated that this proposed relaxation of the
FSS reliability requirements would be applicable to operations
launching or reentering in remote locations or for stages that do
not overfly population centers. 84 FR 15328.
---------------------------------------------------------------------------
In the final rule, the CEC thresholds for establishing
the reliability or other requirements for an FSS proposed in Sec.
450.145(a) have been moved to Sec. 450.108(b). The requirements for a
highly reliable FSS proposed in
[[Page 79617]]
Sec. 450.145(a)(1) remain in Sec. 450.145.\91\ However, the
requirements for an FSS proposed in Sec. 450.145(a)(2) have been
revised and relocated to Sec. 450.143.\92\
---------------------------------------------------------------------------
\91\ The reliability requirements for a highly reliable FSS will
be discussed later in the preamble in the section pertaining to
Sec. 450.145.
\92\ The reliability requirements for an FSS that is not
required to meet the standard for highly reliable FSS will be
discussed later in the preamble in the section pertaining to Sec.
450.143.
---------------------------------------------------------------------------
Rocket Lab agreed with the concept of quantifying consequence as a
key metric in determining the reliability of a flight abort system.
Other commenters were critical of the proposed use of CEC
thresholds to set reliability standards for any required FSS,
particularly in situations in which a lower reliability FSS may be
sufficient to protect the public. For example, SpaceX commented that
the requirement in RCC 319 for an FSS with 0.999 at 95 percent
confidence reliability was overly prescriptive for low-risk mission
profiles. CSF noted that, by ``binning'' the CEC of a
vehicle and then prescribing a fixed reliability requirement for the
FSS, risk of an unmitigated (by FSS) CEC event was not
consistent. CSF commented that such an approach requires the same FSS
even though the risk varies by an order of magnitude between the
extreme values. Several other commenters, including CSF and Sierra
Nevada commented that the FAA should not preclude applicants from
making a ``safety case'' to justify a certain level of rigor for their
FSS.
As noted in the discussion of Sec. 450.101(c), the FAA has
retained CEC as the appropriate regulatory standard for
measuring high consequence events. Likewise, for the reasons set forth
in that section of the preamble, the FAA has retained the use of
CEC in Sec. 450.108(b) to determine the level of
reliability required for an FSS. However, in response to comments, the
FAA has added flexibility for FSS that do not need to meet the standard
for highly reliable FSS in proposed Sec. 450.145(a)(1) based on the
CEC. The FAA notes that an operator does not need to
calculate CEC for the purposes of determining reliability
under Sec. 450.108(b) if it elects to use a highly reliable FSS that
meets the requirements of Sec. 450.145.
In the final rule, the FAA removes the prescribed reliability
threshold proposed in Sec. 450.145(a)(2) of the NPRM for operations
with a maximum CEC value between 1 x 10-\2\ and 1
x 10-\3\. Accordingly, an operator does not need to employ
an FSS with a design reliability of 0.975 at 95 percent confidence and
commensurate design, analysis, and testing. Rather, under Sec.
450.108(b)(2), an operator must use an FSS that meets the requirements
of Sec. 450.143 if the consequence of any reasonably foreseeable
failure mode in any significant period of flight is between 1 x
10-\2\ and 1 x 10-\3\ CEC for
uncontrolled areas.
The requirements for the two types of FSS, as well as the removal
of the proposed requirements, are discussed in more detail later in
this preamble in the discussion of Sec. Sec. 450.143 and 450.145.
ii. Flight Safety Limits Objectives
Proposed Sec. 450.123(a) stated an FSA must identify the location
of uncontrolled areas and establish flight safety limits that define
when an operator must initiate flight abort to: (1) Ensure compliance
with the safety criteria of Sec. 450.101; and (2) prevent debris
capable of causing a casualty from impacting in uncontrolled areas if
the vehicle is outside the limits of a useful mission.
The introductory language of Sec. 450.108(c) is a revision of
proposed Sec. 450.123(a).\93\ In the final rule, Sec. 450.108(c),
titled ``Flight Safety Limits Objectives,'' requires an operator to
determine and use flight safety limits that define when an operator
must initiate flight abort if the conditions enumerated in Sec.
450.108(c)(1) through (c)(5) are met. Alternatively, an operator could
meet Sec. 450.108(c)(6) to satisfy the requirements of Sec.
450.108(c)(2) and (c)(4).
---------------------------------------------------------------------------
\93\ The FAA has not included in the final rule the language in
Sec. 450.123(a) that would have required the operator to identify
the location of uncontrolled areas. The FAA finds it is unnecessary
to specify this language in the introductory paragraph of Sec.
450.108(c) because an operator must identify the location of
uncontrolled areas to meet the objectives of Sec. 450.108(c)(2)
through (6).
---------------------------------------------------------------------------
The following sections provide additional detail on the
performance-based flight safety limits objectives derived from the more
prescriptive requirements proposed in the NPRM and respond to public
comments on the proposals in the NPRM to the extent they are relevant
to compliance with the final rule.
Section 450.108(c)(1)
Section 450.108(c)(1) requires that an operator initiate flight
abort to ensure compliance with the safety criteria of Sec. 450.101(a)
and (b). The FAA proposed a related requirement in Sec. 450.123(a)(1),
which stated that an FSA must identify the location of uncontrolled
areas and establish flight safety limits that define when an operator
must initiate flight abort to ensure compliance with the safety
criteria of Sec. 450.101. In the final rule, Sec. 450.108(c)(1)
specifies the relevant subparagraphs in Sec. 450.101 to which this
requirement applies. The FAA makes this change in the final rule
because the requirement in Sec. 450.101(c)(1) is met through use of
flight abort as a hazard control strategy, and Sec. 450.101(d), (e),
and (f) are not relevant to flight abort.
Section 450.108(c)(2)
In the NPRM, proposed Sec. 450.123(a)(2) required the operator to
prevent debris capable of causing a casualty from impacting in
uncontrolled areas if the vehicle is outside the limits of a useful
mission. In the final rule, Sec. 450.108(c)(2) requires that an
operator initiate flight abort to prevent continued flight from
increasing risk in uncontrolled areas if the vehicle is unable to
achieve a useful mission.
Although proposed Sec. 450.123(a)(2) focused on debris impacts in
uncontrolled areas to define when an operator must initiate flight
abort, Sec. 450.108(c)(2), as finalized, acknowledges that debris
impact is not the only risk contributor that must be accounted for in
determining flight safety limits. For example, a release of toxic
propellant following a debris impact may also contribute to risk.
Therefore, in Sec. 450.108(c)(2), an operator must determine and use
flight safety limits to prevent continued flight from increasing risk
once a vehicle can no longer achieve a useful mission. The FAA
recognizes that a vehicle may deviate from the limits of a useful
mission during a period when hazard containment through flight abort is
not possible. In this case, the requirement is not to allow continued
flight to increase risk, though some risk from either flight abort or
continued flight may be unavoidable.
For example, a vehicle may begin an unplanned turn away from a
nominal trajectory while overflying an island. Once the vehicle leaves
the limits of a useful mission, the operator should initiate flight
abort if continued flight would result in an increase in risk. Pursuant
to Sec. 450.108(c)(2), depending on the risk to the public, it may be
better to withhold flight abort until the hazards resulting from the
abort would not affect the island. However, if the turn is towards a
major population center on the island, it may pose less of a risk to
the public to abort the flight as soon as it leaves the limits of a
useful mission, even if it might result in a hazard posed to less-dense
populated areas.
[[Page 79618]]
The concepts of ``useful mission'' and ``limits of a useful
mission'' \94\ are discussed in greater detail in the preamble section
on FSA methods (specifically, in Sec. 450.119 (Trajectory Analysis for
Malfunction Flight)).
---------------------------------------------------------------------------
\94\ A useful mission means a mission that can attain one or
more objectives. Limits of a useful mission means the trajectory
data or other parameters that bound the performance of a useful
mission, including flight azimuth limits.
---------------------------------------------------------------------------
The FAA also notes that the maximum extents of a gate,\95\
determined by the limits of a useful mission in proposed Sec.
450.125(c)(2), are addressed by Sec. 450.108(c)(2) in the final rule,
which requires flight abort to prevent continued flight from increasing
risk in uncontrolled areas if the vehicle is unable to achieve a useful
mission. Therefore, trajectories outside the limits of a useful mission
that intersect flight safety limits that prevent increased risk in
uncontrolled areas must trigger flight abort.
---------------------------------------------------------------------------
\95\ A gate is an opening in a flight safety limit through which
a vehicle may fly, provided the vehicle meets certain pre-defined
conditions such that the vehicle performance indicates an ability to
continue safe flight. Gate analysis has been removed from the final
rule.
---------------------------------------------------------------------------
Virgin Galactic recommended that the term ``prevent'' in proposed
Sec. 450.123(a)(2) be qualified, as it could be taken to mean many
probabilistic values. Although proposed Sec. 450.123(a)(2) has been
removed from the final rule, Sec. 450.108(c) uses the term ``prevent''
in five places including Sec. 450.108(c)(2). In Sec. 450.108 (c)(2),
(3), (5), and (6), prevention is dependent on the proper functioning of
the FSS. There is no expectation that these objectives will be met if
the FSS fails to function properly. In Sec. 450.108(c)(4), when the
reliability of the FSS is accounted for pursuant to Sec.
450.108(d)(5), prevention is considered to be achieved.
Section 450.108(c)(3)
As noted earlier, the FAA proposed in Sec. 450.125 to establish
the requirements for a gate analysis. The FAA explained that the
primary purpose of gates is to establish safe locations and conditions
to abort the flight prior to the vehicle entering a region or condition
where it may endanger populated or other protected areas if flight were
to continue. A gate should be placed where a trajectory within the
limits of a useful mission intersects a flight safety limit as long as
that trajectory meets the risk criteria in Sec. 450.101. In response
to comments that the proposed gate analysis requirements created
confusion and should be more performance-based, Sec. 450.125 is not
included in the final rule.
In the final rule, the concept of gate analysis in proposed Sec.
450.125 is captured in a more performance-based manner in Sec.
450.108(c)(3).\96\ Section 450.108(c)(3) requires that an operator
initiate flight abort to prevent the vehicle from entering a period of
materially increased public exposure in uncontrolled areas, including
before orbital insertion, if a critical vehicle parameter is outside
its pre-established expected range or indicates an inability to
complete flight within the limits of a useful mission. The FAA removes
the term ``gate'' in the final rule to allow operators to use another
method to comply with the requirements. Furthermore, the term ``gate''
can have different meanings within the industry, which can cause
confusion. However, although the term ``gate'' is not used in the final
rule, the FAA expects a similar approach to a gate analysis will be
used by many operators and by Federal launch or reentry sites. With the
removal of explicit gate requirements, the term ``tracking icon'' is no
longer required, and the FAA therefore removes the term from the final
rule.
---------------------------------------------------------------------------
\96\ The performance-based requirement in Sec. 450.108(c)(3)
incorporates elements of proposed Sec. 450.125(a), (b)(1), (b)(2),
and (b)(4).
---------------------------------------------------------------------------
The FAA notes that a period of materially increased public exposure
would include the beginning of a period when the vehicle will overfly a
major landmass prior to orbital insertion (e.g., Europe, Africa, or
South America). Overflight of large islands with substantial population
may also constitute a period of materially increased public exposure,
while overflight of islands with small populations or other areas of
sparse population will not constitute a period of materially increased
public exposure. Consequence may be used to determine if an exposed
area should be considered an area of materially increased public
exposure. Orbital insertion also results in a material increase in
public exposure due to the possibility of a random reentry from a
vehicle that cannot achieve a minimum safe orbit. A vehicle intended
for orbit that cannot achieve a minimum safe orbit would require flight
abort under Sec. 450.108(c)(3). The FAA will provide guidance on what
constitutes materially increased public exposure.\97\
---------------------------------------------------------------------------
\97\ For example, a period of materially increased public
exposure would include any area where the CEC from any
on-trajectory failure mode is greater than 1 x 10-\2\.
---------------------------------------------------------------------------
The FAA notes that, for purposes of Sec. 450.108(c)(3), a
``critical vehicle parameter'' is a parameter that demonstrates the
vehicle is capable of completing safe flight through the upcoming phase
of flight for which population is exposed to hazardous debris effects
from reasonably foreseeable failure modes. An example of a critical
vehicle parameter outside its pre-established expected range is a tank
pressure that is higher than the normal operating range and could lead
to a rupture. An example of a critical vehicle parameter that indicates
an inability to complete flight within the limits of a useful mission
is an acceleration that is too low and would result in a vehicle
failing to reach orbit. The operator must select parameters and their
acceptable ranges that are appropriate for the vehicle and mission,
with consideration of the ability to measure and act on the parameters,
and describe in the application the parameters that will be used and
how their ranges were determined, pursuant to the application
requirement in Sec. 450.108(g)(3).
The intent of the gate analysis in proposed Sec. 450.125 was to
prevent unnecessarily exposing the public to hazards from a mission
that can no longer be useful. Proposed Sec. 450.125(a) required that
an FSA include a gate analysis for an orbital launch or any launch or
reentry where one or more trajectories that represent a useful mission
intersect a flight safety limit that provides containment of debris
capable of causing a casualty. Gate analysis was necessary if a vehicle
on a useful mission needed to fly in an area where population could be
exposed to hazards in the event of a vehicle failure. As long as a
trajectory met the individual and collective risk criteria of Sec.
450.101(a)(1) and (a)(2) for a launch, or (b)(1) and (b)(2) for a
reentry, when treated like a nominal trajectory with normal trajectory
dispersions, the flight safety limit with which it intersected would be
removed (or ``relaxed,'' as described in the NPRM),\98\ so flight of
the vehicle would not be aborted. Alternatively, under proposed Sec.
450.125(b)(1), the flight safety limit could be replaced with a gate
that allowed continued flight as long as a real-time measure of
performance indicated that the vehicle was able to complete a useful
mission.
---------------------------------------------------------------------------
\98\ See 84 FR 15386.
---------------------------------------------------------------------------
Section 450.108(c)(3) achieves the intent in proposed Sec.
450.125(a) because it codifies the goals achieved by gate analysis but
allows for alternative approaches to achieve the same objective.
Similar to the gate analysis in proposed Sec. 450.125(a), the analysis
in Sec. 450.108(c)(3) is required when a trajectory that represents a
useful
[[Page 79619]]
mission approaches an uncontrolled area.
Proposed Sec. 450.125(b)(1) required that a gate analysis
establish a relaxation of the flight safety limits that allows
continued flight or a gate where a decision will be made to abort the
launch or reentry or allow continued flight. This proposed requirement
is addressed in Sec. 450.108(c)(3) because it also either allows
continued flight without a check of critical vehicle parameters if the
upcoming population exposure is not materially increased, or requires a
check of critical vehicle parameters before continued flight if the
upcoming population exposure is materially increased. In this respect,
the final rule provides clarity on the point at which the check of
critical vehicle parameters is required, whereas the proposal was
ambiguous on when a gate would be required.
Proposed Sec. 450.125(b)(2) stated that, if a gate is established,
a gate analysis must include a measure of performance at the gate that
enables the flight abort crew or autonomous FSS to determine whether
the vehicle is able to complete a useful mission or abort the flight if
it is not. In the final rule, this requirement is addressed in Sec.
450.108(c)(3), which states, ``if a critical vehicle parameter is
outside its pre-established expected range or indicates an inability to
complete flight within the limits of a useful mission.'' The pre-
established expected range of the critical vehicle parameters are those
values that do not predict the vehicle will fail or exit the limits of
a useful mission, or simply those that indicate the vehicle is
performing as intended. Accordingly, as with gate analysis under the
proposal, the operator will establish the measure of performance--
referred to as the critical vehicle parameter(s) and pre-established
expected range(s) in the final rule--that will determine whether flight
abort must be initiated.
Proposed Sec. 450.125(b)(4) stated that a gate analysis must
establish, for an orbital launch, a gate at the last opportunity to
determine whether the vehicle's flight is in compliance with the flight
abort rules and can make a useful mission, and to abort the flight if
it is not. This requirement is addressed by the Sec. 450.108(c)(3)
requirement that critical vehicle parameters must be checked before
orbital insertion. Therefore, Sec. 450.108(c)(3) is a more
performance-based requirement that is consistent with the proposed
Sec. 450.125(b)(4).
The FAA notes that certain concepts in proposed Sec. 450.125 are
also captured in Sec. 450.108(c)(2), (c)(4), and (d)(7), as discussed
in the preamble associated with those sections. The FAA finds that the
intent of the proposed gate analysis requirements would be clearer if
these requirements are included as separate flight safety limits
objectives and constraints because they can also be applied outside of
a traditional gate analysis.
The FAA received several comments on proposed Sec. 450.125 focused
on the proposed definition of the term ``gate,'' the prescriptive
nature of the requirements for a gate analysis, and the manner in which
gates would be applied. Boeing, Lockheed Martin, Northrop Grumman, and
ULA commented that the gate analysis must establish a relaxation of the
flight safety limits that allows continued flight or a gate where a
decision will be made to abort the launch or reentry or allow continued
flight. The commenters asserted that flight rules and placards can
constrain allowable trajectories, and that it is appropriate to
disapprove a trajectory if the nominal trajectory is beyond the flight
safety limits. The FAA declined to make the recommended change because
Sec. 450.108(c)(3) allows a nominal vehicle to overfly a populated
area, which is current practice. A flight safety limit that intersects
the nominal trajectory trace can only be enforced if the vehicle has
experienced a malfunction before reaching the limit. These limits are
common, such as gates protecting downrange landmasses before
overflight.
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended
replacing ``flight abort'' with ``flight termination'' to distinguish
between a flight abort for a reason unrelated to public safety. The FAA
did not adopt this change because the term ``flight abort'' is meant to
encompass hazard control strategies that may not include destruction of
a vehicle or termination of thrust. For example, flight abort for a
captive carry mission may entail aborting the mission and returning to
base or landing at a contingency site. The FAA finds that the term
``flight termination'' has connotations that are inconsistent with the
FAA's intent.
Boeing, Lockheed Martin, Northrop Grumman, and ULA requested
clarification on the term ``relaxation of a flight safety limit'' in
the NPRM and questioned whether it is appropriate for an operator to
relax a flight safety limit.
The FAA agrees that the proposed language ``relaxation of a flight
safety limit'' lacked clarity and that the regulation should be clear
about when a vehicle may overfly population without a performance
check. The final rule removes terms related to relaxed flight safety
limits and states in Sec. 450.108(c)(3) that the critical vehicle
parameter check is required prior to entering a period of materially
increased public exposure in uncontrolled areas, including before
orbital insertion. The meaning of ``materially increased public
exposure'' is discussed earlier in this section.
Rocket Lab inquired whether a gate analysis is required for when a
trajectory intersects a flight safety limit, if an operator was using
flight abort only as a hazard control strategy.
In the final rule, pursuant to Sec. 450.108(c)(3), this
performance check is not necessary if the vehicle is not approaching an
area of materially increased public exposure regardless of how the
operator develops flight safety limits, as long as it meets
requirements in Sec. 450.108(c) and (d). The FAA also notes that if
flight abort is not required as a hazard control strategy to meet the
safety criteria of Sec. 450.101, an operator may still choose to use
flight abort at its discretion. Compliance with Sec. 450.108(c)(3) is
only required for an operator required to use flight abort as a hazard
control strategy to meet the safety criteria of Sec. 450.101.
Section 450.108(c)(4)
As noted earlier, proposed Sec. 450.125(c) would have required the
extent of any gate or relaxation of the flight safety limits to be
based on normal trajectories, trajectories that may achieve a useful
mission, collective risk, and consequence criteria. Section
450.108(c)(4) in the final rule is related to proposed Sec.
450.125(c)(1) and (c)(2) in that it describes the consequence
requirements for flight safety limits; however, it contains differences
as explained in this section of the preamble.
In the final rule, Sec. 450.108(c)(4) requires that an operator
initiate flight abort to prevent conditional expected casualties
greater than 1 x 10-\2\ in uncontrolled areas due to flight
abort or due to flight outside the limits of a useful mission from any
reasonably foreseeable off-trajectory failure mode initiating in any
significant period of flight. The purpose of Sec. 450.108(c)(4) is to
ensure that, when an operator cannot develop flight safety limits that
prevent hazards from affecting uncontrolled areas, the failure modes
that result in deviations from the planned trajectory will not result
in a high consequence event if the vehicle is unable to achieve a
useful mission. This scenario can arise when some public exposure must
be accepted to allow useful vehicles to continue during a phase of
flight when flight abort is still used as a hazard control strategy.
[[Page 79620]]
This situation frequently occurs, for example, on northeasterly
missions launched from the Eastern Range that are permitted to overfly
some portions of Nova Scotia and Newfoundland on trajectories within
the limits of a useful mission. If the vehicle fails after the
overflight has begun and reaches flight safety limits protecting more
westerly portions of the uncontrolled areas from flight outside the
limits of a useful mission, the consequence from flight abort must meet
the criteria in Sec. 450.108(c)(4).
Proposed Sec. 450.125(c)(1) and (c)(2) included the consequence
requirements as a part of gate analysis. In the final rule, the
consequence requirements are a standalone flight safety limits
objective in Sec. 450.108(c)(4). The final rule also makes several
revisions. First, the final rule expressly states flight safety limits
are required only to prevent high consequence events in uncontrolled
areas. This concept was implied in the NPRM because, per proposed Sec.
450.123(a)(2), flight safety limits must prevent debris capable of
causing a casualty from impacting in uncontrolled areas if the vehicle
is outside the limits of a useful mission. The consequence criteria in
proposed Sec. 450.125(c)(1) and (c)(2) were applicable to flight
safety limits that did not prevent debris from impacting in
uncontrolled areas following a gate or relaxation in a flight safety
limit developed per Sec. 450.123(a)(2). Therefore, the proposed
consequence criteria only applied to uncontrolled areas.
Second, the requirement in the final rule applies in cases of
flight abort and in cases where the vehicle is outside the limits of a
useful mission. The consequence criteria in proposed Sec.
450.125(c)(1) and (c)(2) were only applicable in cases of flight abort.
If only flight abort action were considered, a high consequence event
resulting from other outcomes (intact impacts, structural breakup,
etc.) outside the limits of a useful mission might not be identified.
Vehicle failures within the limits of a useful mission are excluded
from the consequence criteria in Sec. 450.108(c)(4) in the final rule
because flight abort cannot prevent a failure from affecting
uncontrolled areas that must be exposed to allow a vehicle on a useful
mission to continue flight. For example, if a vehicle begins an
unplanned turn from the nominal trajectory while overflying
uncontrolled areas and breaks up aerodynamically before exiting the
limits of a useful mission, this failure would not count against the
consequence criteria because the vehicle was within the limits of a
useful mission when the outcome of the failure occurred. Collective
risk requirements still apply in these scenarios and ensure that the
risk is met for any trajectory that the operator declares as
representing a useful mission, pursuant to Sec. 450.108(d)(7).
Third, whereas proposed Sec. 450.125(c)(1) and (c)(2) concerned
the consequence from flight abort ``resulting from any reasonable
vehicle response mode,'' Sec. 450.108(c)(4) concerns the consequence
from any ``reasonably foreseeable off-trajectory failure mode.'' The
replacement of ``vehicle response mode'' with ``failure mode'' is
discussed in the preamble section on Sec. 450.101(c)(2).\99\ The term
``off-trajectory'' was added to explain further which types of failures
must result in the consequence criteria being met. Off-trajectory
failures are those for which the vehicle deviates from its intended
flight path--for example due to failures of the guidance, navigation,
or control systems. Outcomes from on-trajectory failures, such as an
explosion or loss of thrust along the intended flight path, are not
able to be fully mitigated by an FSS because once the failure occurs
the hazard cannot be prevented from affecting uncontrolled areas if the
failure occurred during a period in which the uncontrolled areas were
exposed. At best, the hazard can be reduced for some failure modes such
as a loss of thrust that may result in an intact impact unless a
destructive abort that disperses propellants is implemented. In this
case, flight abort may still be required to reduce risk per Sec.
450.108(c)(2) since the vehicle is unable to achieve a useful mission,
but the consequence criteria would not apply.
---------------------------------------------------------------------------
\99\ The FAA also notes that the term ``in any one-second period
of flight'' has been changed throughout the final rule to the term
``in any significant period of flight,'' as described in the
preamble section discussing Sec. 450.101(c).
---------------------------------------------------------------------------
Boeing, Lockheed Martin, Northrop Grumman, and ULA requested
clarification on the intent of the CEC limits in proposed
Sec. 450.125(c)(1) and (c)(2). In the final rule, the FAA retained the
CEC limits related to flight abort. The intent of these
limits is to ensure that, when flight abort or a flight outside the
limits of a useful mission resulting from an off-trajectory failure
mode produces debris capable of causing a casualty, it nonetheless
protects against a high consequence event. In other words, flight abort
provides sufficient protection against a high consequence event when
flight abort is implemented to prevent the CEC from any
reasonably foreseeable off-trajectory failure mode initiating in any
significant period of flight from exceeding 1 x 10-\2\
casualties, even though the public in uncontrolled areas might be
exposed to debris from a flight abort.
SpaceX asked if there were restrictions to using flight safety
limits that met the risk requirements of proposed Sec. 450.101 but did
not meet the 1 x 10-\2\ CEC requirement.
Under Sec. 450.108(c)(4), flight safety limits must not allow
CEC greater than
1 x 10-\2\ unless the consequence resulted from a
vehicle within the limits of a useful mission and therefore could not
be mitigated by flight abort without aborting a vehicle on a useful
mission, or the consequence resulted from an on-trajectory failure
mode.
An example of when the consequence requirement would not apply is
when a vehicle on a normal trajectory suffers a spontaneous breakup.
This on-trajectory event cannot be mitigated by flight abort without
terminating a useful vehicle before it overflies uncontrolled areas. An
operator would not be required to initiate flight abort under the final
rule for this scenario. An example of when the consequence requirement
would apply is if a malfunction causes the vehicle to depart from the
limits of a useful mission. If CEC is used to measure high
consequence events, the flight safety limits must prevent the
consequence from such a failure mode (i.e., a malfunction that causes
the vehicle to depart from the limits of a useful mission) from
exceeding 1 x 10-\2\ CEC, whether produced by
flight abort or other reasonably foreseeable outcomes (such as
aerodynamic/structural breakup, intact impact, etc.).
SpaceX requested guidance on how an operator should balance
EC and CEC when designing flight safety limits
and expressed concern that EC may increase as an operator
attempts to reduce CEC. SpaceX also recommended removing all
numerical values associated with CEC and requiring the
consequence of flight abort at the flight safety limits to be
minimized.
Regarding the balance of EC and CEC, the FAA
notes that flight safety limits must be designed to meet the
EC and CEC requirements as described in Sec.
450.108(c)(1) and (c)(4), respectively. If the flight safety limits
must be modified to reduce the CEC to acceptable levels,
EC must still be kept within acceptable levels. The FAA does
not agree with the recommendation to remove the numerical value
associated with the CEC requirement because this could allow
flight safety limits that result in a high consequence through flight
abort or through flight abort inaction. However, the final rule does
[[Page 79621]]
allow for methods of measuring consequence other than CEC
that provide an equivalent level of safety under Sec. 450.37.
Section 450.108(c)(5)
Section 450.108(c)(5) requires that an operator initiate flight
abort to prevent the vehicle state from reaching identified conditions
that are anticipated to compromise the capability of the FSS if further
flight has the potential to violate a flight safety limit. For example,
if a roll rate of a particular magnitude would preclude ground-based
flight abort commands from being received by the vehicle, a flight
safety limit should be developed that triggers flight abort before the
roll rate reaches this value.
Section 450.108(c)(5) is related to the flight abort rule in
proposed Sec. 450.165(c)(3)(ii), which required that flight abort
rules include that the FSS must abort flight when the vehicle state
approaches conditions that are anticipated to compromise the capability
of the FSS and further flight has the potential to violate the FSS. In
the NPRM, the FAA did not include a flight safety limit objective that
corresponded with the flight abort rule in proposed Sec.
450.165(c)(3)(ii). The FAA adds this flight safety limit objective in
Sec. 450.108(c)(5). The flight abort rule in proposed Sec.
450.165(c)(3)(ii) is in Sec. 450.108(f)(2)(ii) and is discussed
further under Flight Abort Rules in the following paragraphs.
Section 450.108(c)(6)
Section Sec. 450.108(c)(6) states that, in lieu of meeting Sec.
450.108(c)(2) and Sec. 450.108(c)(4), an operator may initiate flight
abort to prevent debris capable of causing a casualty due to any hazard
from affecting uncontrolled areas using an FSS that complies with Sec.
450.145. The FAA adds this regulation to clarify that a CEC
analysis is not required if an FSS that complies with Sec. 450.145
provides hazard containment. Hazard containment is a means of achieving
the goals of Sec. 450.108(c)(2) and (c)(4) because, if an operator
provides for hazard containment, continued flight will not increase
risk in uncontrolled areas and hazard containment would prevent
conditional expected casualties greater than 1 x 10-\2\ in
uncontrolled areas. This requirement is consistent with the NPRM
because if an operator is able to contain hazards throughout the period
when flight abort is used, the proposed consequence requirements in
Sec. 450.125(c)(1) and (c)(2) would not apply since a gate analysis
would not be necessary.
In developing the NPRM, the FAA considered alternatives to a
conditional risk limit, including the current approach employed in
Sec. 417.213.\100\ The FAA rejected using the approach in Sec.
417.213 as a requirement in part 450 because it is unnecessarily
restrictive to require designated impact limit lines to bound the area
where debris with a ballistic coefficient of three pounds per square
foot or more is allowed to impact if the FSS functions properly, as
evidenced by the need for the FAA to grant waivers to allow innovative
missions to proceed safely, such as return of boosters to the launch
site.\101\ However, if an operator satisfies the current requirements
in Sec. 417.213, it would meet the requirement in Sec. 450.108(c)(6).
This strategy is not an option when hazard containment is not possible
during a phase of flight when flight abort must be used as a hazard
control strategy. For example, if an area of overflight occurs on the
nominal trajectory during a phase of flight when flight abort is still
used as a hazard control strategy, an operator cannot claim containment
during this phase and must meet Sec. 450.108(c)(2) and (c)(4). The FAA
notes that its approach in Sec. 450.108(c) to employing conditional
risk limits is consistent with a recommendation made by the National
Academy of Sciences.\102\
---------------------------------------------------------------------------
\100\ The FAA currently requires in Sec. 417.213 that ``a
flight safety analysis must identify the location of populated or
other protected areas, and establish flight safety limits that
define when an FSS must terminate a launch vehicle's flight to
prevent the hazardous effects of the resulting debris impacts from
reaching any populated or other protected area and ensure that the
launch satisfies the public risk criteria.''
\101\ See Waiver of Debris Containment Requirements for Launch.
81 FR 1470, 1470-1472 (January 12, 2016).
\102\ In 2001, the National Research Council published a report
on ``Streamlining Space Launch Range Safety,'' which included a
recommendation that ``destruct lines and flight termination system
requirements should be defined and implemented in a way that is
directly traceable to accepted risk standards.'' See p. 44 of IBSN
0-309-51648-X available at http://www.nap.edu/catalog/9790.html. The
flight safety limit requirements currently in Sec. 417.213(d) are
not directly traceable to accepted risk standards in that they
require the analysis to ``establish designated impact limit lines to
bound the area where debris with a ballistic coefficient of three or
more is allowed to impact if the flight safety system functions
properly.'' As noted earlier, the approach in Sec. 417.213 has been
rejected because it is unnecessarily restrictive, as evidenced by
the need for the FAA to grant waivers to allow innovative missions
to proceed safely, such as return of boosters to the launch site.
The FAA found that those waivers did not jeopardize public safety
based on conditional risk analyses that are inherent in methods the
NAS referred to as accepted risk standards.
---------------------------------------------------------------------------
Virgin Galactic recommended adding an exclusion to the requirement
for flight safety limits in proposed Sec. 450.123 for vehicles that
already meet the public risk criteria, as flight safety limits analysis
amounts to an additional layer of regulation that Virgin Galactic
believed was redundant and unneeded.
The FAA determined that a clarification is required in response to
this recommendation. Pursuant to Sec. 450.108(a), flight safety limits
are only required in phases of flight in which flight abort is used as
a hazard control strategy to meet the safety criteria of Sec. 450.101.
The FAA does not agree that meeting public risk criteria, or just
collective and individual risk, are the only objectives of flight
abort, as explained in the preamble section on CEC. The FAA
finds it necessary to include additional objectives for flight abort in
Sec. 450.108(c) to protect public safety adequately. Lastly, the
preamble section on CEC describes why a conditional risk
assessment is appropriate to provide the public protection from
unlikely but catastrophic events in the context of launch and reentry
operations.
iii. Flight Safety Limits Constraints
Section 450.108(d) in the final rule describes flight safety limits
constraints. This subsection consolidates the flight safety limits
constraints in proposed Sec. Sec. 450.123 through 450.129.
Section 450.108(d)(1)
Proposed Sec. 450.123(b)(1) required flight safety limits to
account for temporal and geometric extents on the Earth's surface of
any vehicle hazards resulting from any planned or unplanned event for
all times during flight.
In the final rule, Sec. 450.108(d)(1) requires that flight safety
limits account for temporal and geometric extents on the Earth's
surface of any reasonably foreseeable vehicle hazards under all
reasonably foreseeable conditions during normal and malfunctioning
flight. The FAA adds ``reasonably foreseeable'' before ``vehicle
hazards'' to be consistent with language elsewhere in the regulation.
As noted earlier, ``reasonably foreseeable'' is a term commonly used in
system safety. The FAA also replaces ``from any planned or unplanned
event for all times during flight'' in proposed Sec. 450.123(b)(1)
with ``under all reasonably foreseeable conditions during normal and
malfunctioning flight'' in Sec. 450.108(d)(1). This revision does not
result in a substantive change from the proposal, but the FAA finds the
revised language to be clearer and consistent with language elsewhere
in the regulation through use of the term ``reasonably foreseeable
conditions'' in place of the proposed ``planned or
[[Page 79622]]
unplanned event.'' This standard does not hold the operator responsible
for unforeseeable events.
Section 450.108(d)(2)
Section 450.108(d)(2) requires that flight safety limits account
for the physics of hazard generation and transport including
uncertainty. This articulation represents a revision of proposed Sec.
450.123(b)(2), which stated flight safety limits must account for
potential contributions to debris impact dispersions. The FAA finds the
NPRM language was unclear as to the scope of the requirement. The NPRM
would have required an operator to consider how factors like winds,
imparted velocities, and uncertainty in mass properties affect where
debris from a failed vehicle may impact. However, direct debris impacts
are not the only hazards posed by vehicle failures. For example, an
intact impact of a vehicle may lead to a blast wave or release of toxic
propellant, both of which must be considered when developing flight
safety limits. Hazard generation and transport are factors that apply
to all hazards, unlike factors that only apply to determining debris
impact dispersions. Hazard generation refers to the process by which a
vehicle becomes a hazard, and transport is how the hazard moves from
the source to an exposed person or asset. Simply accounting for
potential contributions to debris impact dispersions would not
encompass all hazards, though debris impact dispersions also need to be
accounted for under Sec. 450.108(d)(2).
Blue Origin requested clarification of the term ``potential
contributions'' in proposed Sec. 450.123(b)(2). The FAA notes the term
``potential contributions'' to debris impact dispersions are those that
influence the propagation of debris following a vehicle breakup, such
as explosion-induced velocities, winds, uncertainty in aerodynamic
properties, etc. The FAA further notes the term ``potential
contributions'' does not appear in the final rule. The FAA will address
development of debris impact dispersions in guidance, similar to the
existing Flight Safety Analysis Handbook.
Section 450.108(d)(3)
In the NPRM, the FAA proposed to consolidate and update data loss
flight times and planned safe flight states requirements in proposed
Sec. 450.127 (Data Loss Flight Time and Planned Safe Flight State
Analyses). As explained in the proposal, data loss flight time analysis
is necessary to establish when an operator must abort a flight
following the loss of vehicle tracking information. In the NPRM, the
FAA explained that data loss flight time would be the shortest elapsed
thrusting or gliding time during which a vehicle flown with an FSS can
move from its trajectory to a condition in which it is possible for the
vehicle to violate a flight safety limit. Data loss flight times would
have been required from the initiation of flight until the minimum
elapsed thrusting or gliding time was no greater than the time it would
take for a normal vehicle to reach the final gate crossing or the
planned safe flight state.
Section 450.108(d)(3) revises the prescriptive requirements in
Sec. 450.127 to require that flight safety limits account for the
potential to lose valid data necessary to evaluate the flight abort
rules. Data is valid when it is of sufficient quality to be used to
make flight abort decisions. Data used to make flight abort decisions
can be missing or invalid for a number of reasons, but resulting from
an unplanned event, such as disruption or loss of communication
pathways with ground-based or onboard tracking sensors. Despite an
operator's or launch site's best efforts, the potential to lose track
data is a contingency for which operators must plan.
Section 450.108(d)(3) requires an operator to account for the
potential to lose valid data necessary to evaluate the flight abort
rules because the loss of valid data does not absolve the operator from
attempting to meet the flight safety limits requirements in Sec.
450.108(c) and (d). Section 450.108(d)(3) captures the performance-
based intent of proposed Sec. 450.127 (Data Loss Flight Time and
Planned Safe Flight State Analyses). The FAA finds that this revision
allows for the use of data loss flight times as a means of satisfying
Sec. 450.108(d)(3), but also allows operators to propose other methods
of meeting the requirement.
Microcosm and SpaceX requested clarification of the intent for
proposed Sec. 450.127. The FAA notes that the purpose of proposed
Sec. 450.127 was to determine when flight abort is required if track
data used to evaluate the flight abort rules is lost. If a vehicle is
able to reach a flight safety limit when track data is lost, then a
countdown begins that would indicate, upon reaching zero, that a flight
safety limit may have been reached. Under proposed Sec.
450.165(c)(3)(iii), flight abort would have to occur no later than when
the countdown reaches zero. Throughout flight, the time for the
countdown to reach zero is the data loss flight time. If reliable
tracking sources are regained before the countdown reaches zero, then
flight abort rule evaluation resumes and the countdown resets. In
Federal launch site parlance, data loss flight times are known as
``green numbers.''
In the NPRM, data loss flight times would not be used if a
vehicle's tracking icon has potentially passed a final gate when the
countdown reaches zero because this could result in introducing hazards
in uncontrolled areas that the gate protects. As described in proposed
Sec. 450.127(b)(1), there are no data loss flight times when the
minimum elapsed thrusting or gliding time is greater than the time it
would take for a normal vehicle to reach the final gate crossing, to
preclude abort from occurring after a gate crossing.
Proposed Sec. 450.127(c)(1) through (c)(3) described other phases
of flight when data loss flight times would be unnecessary. If a
vehicle cannot reach a flight safety limit, then a data loss flight
time cannot be computed and would be unnecessary. It may seem futile to
have a flight safety limit that cannot be reached, but for purposes of
data loss flight times a flight safety limit is considered unreachable
if the vehicle cannot reach it starting from within normal trajectory
limits when track data is lost. The flight safety limit may still be
reachable if the vehicle was outside of normal trajectory limits at the
time data was lost. Therefore, these flight safety limits may still
have value.
Finally, in the NPRM, data loss flight times would not be necessary
in phases of flight when an FSS is not required. There may still be
flight safety limits during such phases if an operator retains an FSS
and active flight abort rules even though they are not required. Loss
of track data would not require flight abort since the flight safety
limits themselves are unnecessary. This approach would allow operators
to be conservative in the use of flight safety limits in phases of
flight when they are unnecessary, with no threat of flight abort from
loss of track data.
Proposed Sec. 450.127(b)(3) would have permitted the real-time
computation and application of data loss flight times during vehicle
flight, in which case the state vector just prior to loss of data
should be used as the nominal state vector. The FAA finds that Sec.
450.108(d)(3) provides the same level of safety as the proposed
requirement in Sec. 450.127 and provides additional flexibility. The
FAA will provide guidance on compliance with Sec. 450.108(d)(3). The
proposed requirement in Sec. 450.127 can be part of a viable means of
compliance with Sec. 450.108(d)(3). An operator may propose other
means of compliance with Sec. 450.108(d)(3). Microcosm and SpaceX
requested clarification of the intent for proposed Sec. 450.127. The
FAA
[[Page 79623]]
notes that the purpose of proposed Sec. 450.127 was to determine when
flight abort is required if track data used to evaluate the flight
abort rules is lost.
Section 450.108(d)(4)
Proposed Sec. 450.129 (Time Delay Analysis) would have required an
operator to perform a time delay analysis to establish the mean elapsed
time between the violation of a flight abort rule and the time when the
FSS is capable of aborting flight for the purpose of establishing
flight safety limits. The time delay analysis would have been required
to determine a time delay distribution that accounts for all
foreseeable sources of delay.
While proposed Sec. 450.129 does not appear in the final rule, the
objective of proposed Sec. 450.129 is captured by Sec. 450.108(d)(4).
Section 450.108(d)(4) requires that flight safety limits account for
the time delay, including uncertainties, between the violation of a
flight abort rule and the time when the FSS is expected to activate.
The term in the final rule ``time delay including uncertainties'' is
consistent in intent with the NPRM language ``mean elapsed time'' and
``determine a time delay distribution.''
The time delay distribution in proposed Sec. 450.129 is
distribution in a statistical sense. The uncertainties referred to in
Sec. 450.108(d)(4) are the same as the time delay distribution
referred to in proposed Sec. 450.129. To meet Sec. 450.108(d)(4), the
operator must consider the range of values that the actual time delay
could fall between. While proposed Sec. 450.129 stated that the time
delay analysis would be used in establishing flight safety limits, the
final rule specifies that the time delay is a constraint in developing
flight safety limits. Time delays are important in a flight safety
limits analysis because the decision to abort flight must be made in
time to achieve the flight safety limits objectives. This is not
possible unless the time delay between the violation of a flight abort
rule and the time when the FSS is expected to activate is known. The
FAA finds that including this requirement in the flight safety limits
constraints provides more clarity regarding the relation between this
requirement and the flight safety limits.
Section 450.108(d)(5)
Section 450.108(d)(5) requires an operator to determine flight
safety limits that account for individual, collective, and conditional
risk evaluations both for proper functioning of the FSS and failure of
the FSS. To satisfy this requirement, an operator must account for the
reliability of the FSS under two scenarios when determining whether
individual, collective, or conditional risk requirements are met with
the flight safety limits objectives. The applicable flight safety
limits objectives are located in Sec. 450.108(c)(1), which addresses
individual and collective risk, and Sec. 450.108(c)(4), which
addresses conditional risk. Although Sec. 450.108(c)(2) is also
associated with risk, it is independent of the FSS reliability because
it is a comparison between the risk if the FSS is activated and the
risk if it is not activated.
To comply with Sec. 450.108(d)(5), first, the FSS must be assumed
to have a reliability of one, meaning it is presumed to function
without error. The risk evaluations using an FSS reliability of one
ensure that the criteria are met if the FSS functions as intended. This
requirement is important because an FSS failure should not be relied
upon to make flight safety limits compliant with risk requirements. The
decision to implement a flight abort is a deliberate safety
intervention. The FAA wants to be sure that the public is safe given
any deliberate safety intervention. This objective is consistent with
proposed Sec. 450.125(c)(1) and (c)(2), which contain requirements for
consequence from flight abort, implying that the flight abort action
occurs, and is also consistent with current practice for all risk
evaluations.
Second, the risk evaluations must consider the predicted
reliability of the FSS. Predicted reliability of the FSS is important
because even low probabilities of FSS failures can have significant
impacts on risk. This consideration is consistent with the NPRM because
FSS reliabilities are a fundamental component of the viability of
flight abort as a hazard control strategy, and it is expressly stated
in the final rule for clarity. Consideration of the FSS reliability in
risk evaluations is also consistent with current practice.
The final rule allows an operator flexibility to establish the
design, analysis, and testing of its FSS and the conditions that
require initiation of flight abort as long as the CEC is no
greater than 1 x 10-\2\ for any reasonably foreseeable
failure mode in any significant period of flight that could require the
operator to initiate flight abort, accounting for the reliability of
the FSS pursuant to Sec. 450.108(d)(5).
Section 450.108(d)(6)
Proposed Sec. 450.123(b)(3) would have added a requirement to
design flight safety limits to avoid flight abort under conditions that
result in increased collective risk to people in uncontrolled areas,
compared to continued flight. In the NPRM, the FAA explained that the
proposed requirement is equivalent to the U.S. Government consensus
standard that a conditional risk management process should be
implemented to ensure that mission rules do not induce unacceptable
consequences when they are implemented.
Section 450.108(d)(6) requires that flight safety limits be
designed to avoid flight abort that results in increased collective
risk to the public in uncontrolled areas, compared to continued flight.
This language is very similar to proposed Sec. 450.123(b)(3), with one
change. The FAA changes the term ``people'' in the proposed rule to
``the public'' in the final rule because the FAA regulates the safety
of the public. The term ``people'' could be construed as meaning
something broader than ``public,'' such as mission essential personnel
who may be in uncontrolled areas.
Blue Origin stated that proposed Sec. Sec. 450.123(d),
450.125(b)(2), 450.125(c), and 450.125(c)(3) were in conflict and
commented on the definition of a ``useful mission.'' Blue Origin
explained that, even though the intent was to meet the public safety
requirements in proposed Sec. 450.101, terminating a vehicle that may
not meet the definition of a ``useful mission'' may result in an
increase in risk to the public, including those on ships and aircraft,
compared to continued flight that may result in reaching orbit. Blue
Origin commented that, if the limits were defined only with respect to
the risk criteria in proposed Sec. 450.101, allowing the vehicle to
continue flight may result in a safer risk profile.
The FAA agrees that the risk to the public must not be increased by
flight abort. However, if a vehicle intended for orbit is outside the
limits of a useful mission and approaching populated uncontrolled
areas, there is likely an optimum location to abort the flight without
increasing risk. For launches where the instantaneous impact point
(IIP) \103\ approaches a landmass from the ocean, aborting flight
before the resulting debris would encroach on the landmass and dense
coastal shipping traffic would be compliant with Sec. 450.108(d)(6).
Current practice for orbital launches from Federal launch sites is to
allow the vehicle to continue to orbit if it can achieve a minimum safe
orbit and is within the limits of a useful
[[Page 79624]]
mission in the IIP projection. This practice is consistent with the
requirements in Sec. 450.108. If an operator proposes to allow a
vehicle outside the IIP limits of a useful mission to overfly
population to proceed to orbit, it must demonstrate that this option
presents lower risk than aborting the flight before the overflight
begins.
---------------------------------------------------------------------------
\103\ Section 401.5 has a long-standing definition of IIP:
``instantaneous impact point means an impact point, following thrust
termination of a launch vehicle, calculated in the absence of
atmospheric drag effects.''
---------------------------------------------------------------------------
The FAA agrees that a discrepancy existed in the NPRM in proposed
Sec. 450.123(d) but is uncertain if this is the conflict to which Blue
Origin referred. The proposed Sec. 450.123(d) referred to risk
criteria in Sec. 450.101, but mistakenly omitted the requirement to
prevent debris capable of causing a casualty from impacting in
uncontrolled areas if the vehicle is outside the limits of a useful
mission. The option to determine the need for flight abort in real time
as described in proposed Sec. 450.123(d) does not appear in the final
rule because it is just one means of meeting the requirements for
flight safety limits. However, this does not preclude an operator from
determining the need for flight abort entirely in real-time, as long as
requirements in Sec. 450.108 are met.
Section 450.108(d)(7)
As noted in the section on flight safety limits objectives,
proposed Sec. 450.125(c)(1) stated that flight safety limits would be
required to be gated or relaxed where they intersect with a normal
trajectory if that trajectory would meet the individual and collective
risk criteria of proposed Sec. 450.101(a)(1) and (a)(2) or (b)(1) and
(b)(2) when treated like a nominal trajectory with normal trajectory
dispersions. Proposed Sec. 450.125(c)(2) stated that flight safety
limits may be gated or relaxed where they intersect with a trajectory
within the limits of a useful mission if that trajectory would meet the
individual and collective risk criteria of proposed Sec. 450.101(a)(1)
and (a)(2) or (b)(1) and (b)(2) when treated like a nominal trajectory
with normal trajectory dispersions.
In the final rule, Sec. 450.108(d)(7) requires an operator to
determine flight safety limits that ensure that any trajectory within
the limits of a useful mission that is permitted to be flown without
abort would meet the collective risk criteria of Sec. 450.101(a)(1) or
(b)(1) when analyzed as if it were the planned mission pursuant to
Sec. 450.213(b)(2).\104\ The relocation of requirements in proposed
Sec. 450.125 to Sec. 450.108(c)(2) through (c)(4) and Sec.
450.108(d)(7) necessitated a revision to the language in Sec.
450.108(d)(7). Section 450.108(d)(7) requires only that any trajectory
within the limits of a useful mission that is permitted to be flown
without abort would meet the collective risk criteria of Sec.
450.101(a)(1) or (b)(1) when analyzed as if it were the planned mission
pursuant to Sec. 450.213(b)(2). As stated in the NPRM, the philosophy
behind proposed Sec. 450.125(c)(2) was to allow a non-normal flight to
continue as long as the mission does not pose an unacceptable
conditional risk given the present trajectory. The intent of Sec.
450.108(d)(7) is similar but is stated in a different context than in
the NPRM and also revised for clarity. In the final rule, the FAA
removes the individual risk criterion from the requirement because the
intent of the requirement was not to potentially create flight hazard
areas along every azimuth within the limits of a useful mission
wherever an individual risk contour exceeds 1 x 10-\6\.
---------------------------------------------------------------------------
\104\ As part of pre-flight planning, an operator must submit to
the FAA planned mission information, including the vehicle, launch
site, planned flight path, staging and impact locations, each
payload delivery point, intended reentry or landing sites including
any contingency abort location, and the location of any disposed
launch or reentry vehicle stage or component that is deorbited.
---------------------------------------------------------------------------
The FAA found that the phrase ``when analyzed as if it were the
planned mission pursuant to Sec. 450.213(b)(2)'' was more precise than
``when treated like a nominal trajectory with normal trajectory
dispersions.'' A planned mission must be characterized with
uncertainties and assessed for risk from planned events and reasonably
foreseeable failure modes; therefore, trajectories must be within the
limits of a useful mission that are permitted to be flown without
abort, pursuant to Sec. 450.108(d)(6).
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended
replacing the terms ``normal trajectories'' and ``limits of a useful
mission trajectories'' in proposed Sec. 450.123(c) and Sec.
450.125(c) with ``nominal trajectories.'' The FAA finds that such a
change would restrict severely the allowable flight corridor of
vehicles that could achieve a potentially useful mission by requiring
that a vehicle be on a nominal trajectory to enter a period of
materially increased public exposure in uncontrolled areas. As such,
Sec. Sec. 450.108(c)(3) and 450.108(d)(7) in the final rule allow
vehicles within the limits of a useful mission to enter a period of
materially increased public exposure in uncontrolled areas, provided
the trajectory meets the collective risk requirement.
iv. End of Flight Abort
The FAA adds Sec. 450.108(e) in the final rule, which states that
a flight does not need to be aborted to protect against high
consequence events in uncontrolled areas beginning immediately after
critical vehicle parameters are validated, if the vehicle is able to
achieve a useful mission and certain conditions are met for the
remainder of flight. Specifically, the conditions which must be present
are: (1) Flight abort would not materially decrease the risk from a
high consequence event, and (2) there are no key flight safety events.
Section 450.108(e) relieves the operator from the requirement to use
flight abort in certain situations in which high consequence events are
possible but would not be effectively mitigated by an FSS. This change
responds to comments and addresses a common occurrence during a period
of planned overflight of an uncontrolled area before orbital insertion.
Section 450.108(e) applies to a flight beginning immediately after
critical vehicle parameters are validated, if the vehicle is able to
achieve a useful mission. As discussed in the section on flight safety
limits objectives, ``critical vehicle parameters'' are those parameters
that demonstrate the vehicle is capable of completing safe flight
through the upcoming phase of flight where population is exposed to
hazardous debris effects from reasonably foreseeable failure modes. Due
to the wide variety of launch and reentry vehicles that could be
licensed, there is a wide variety of vehicle parameters that could be
considered critical in this context. For example, recent state vector
history data, as well as vehicle health indicators such as motor
chamber pressure, generally will qualify as critical vehicle
parameters.
Section 450.108(e) only applies when the following conditions are
met. The first condition is that flight abort would not decrease the
risk from a high consequence event materially as measured by CEC or
other means identified through ELOS. The FAA expects that the
requirement in Sec. 450.108(e)(1) can be met by implementation of the
current practices at the 45th SW, specifically, performing a comparison
of the CEC and EC in uncontrolled areas with and
without flight abort from each reasonably foreseeable failure mode in
any significant period of flight during the subject phase of flight. If
flight abort would not reduce the CEC and EC
associated with each failure mode materially, then this condition is
met.
[[Page 79625]]
A material decrease would exclude any best estimate of the mean
value that is already two orders of magnitude or more below the
criteria in Sec. 450.101(a) and (b). As the best estimate approaches
the established limits in Sec. 450.101(a) and (b) on the mean
predicted values, a material decrease would be smaller, including: (1)
Any reduction that brings the operation into compliance with Sec.
450.101(a) and (b) limits, (2) any half-order of magnitude reduction in
the best estimate of the mean value of EC, or (3) a
reduction by an amount at least as large as the coefficient of
variation due to uncertainty in the population distribution. Section
450.108(e)(1) uses the phrase ``risk from a high consequence event''
deliberately so that other measures of collective risk and
consequences, not just CEC and EC, can be
considered in evaluating compliance with this requirement, absent a
waiver. The FAA will provide guidance on what constitutes material
decrease.
The second condition in Sec. 450.108(e) requires that there are no
key flight safety events for the remainder of flight. The FAA currently
has a formal definition of the term ``key flight-safety event'' in part
437 (Experimental Permits). Section 437.3 states that key flight-safety
event means a permitted flight activity that has an increased
probability of causing a launch accident compared with other portions
of flight. In addition, Sec. 437.59(a) states that, at a minimum, a
key flight-safety event includes: (1) Ignition of any primary rocket
engine, (2) any staging event, or (3) any envelope expansion. The
current description of key flight safety events in the permit
regulation conveys what the FAA may consider a key flight safety event
in the context of part 450.
Section 401.7 of the final rule has added a definition of ``key
flight safety events'' and states that a key flight safety event means
a flight activity that has an increased probability of causing a
failure compared with other portions of flight. The term key flight
safety event in the context of part 450 includes events that could
compromise any safety-critical system, or otherwise increase the risk
from high consequence events, such as events that subject a safety-
critical system to environments at or near the maximum predicted
environment.
SpaceX commented that launches that overfly major landmasses (e.g.,
Europe, Africa, or South America) prior to orbital insertion would
violate the CEC requirement in proposed Sec. 450.101(c)
during overflight. SpaceX urged the FAA to update the regulation to
clarify that an operator would not have to perform a CEC
analysis for the ''overflight'' phase of flight. SpaceX also
recommended that the CEC requirement apply only to vehicle
response modes that are mitigated by the FSS.
The FAA acknowledges that some launches that overfly major
landmasses prior to orbital insertion produce CEC levels in
excess of the 1 x 10-\2\ threshold and that flight abort
will not mitigate the consequences associated with those failure modes.
The FAA modifies the final rule to address such circumstances by
adopting requirements proposed in the NPRM, such as Sec. 450.125(c).
Specifically, Sec. 450.108(e) identifies conditions that, if met,
demonstrate a high consequence event is sufficiently mitigated. These
conditions are met generally by U.S. launches that overfly downrange
landmasses prior to orbital insertion. Thus, the final rule includes
specific provisions designed to allow the current practice where some
launches proceed through a phase of flight, such as the downrange
overflight of a major landmass just prior to orbital insertion, without
additional protections against low probability, high consequence
events.
The FAA finds that meeting the requirements in Sec. 450.108(e)
demonstrates sufficient protection against the probability of high
consequence events, even though the CEC may exceed the 1 x
10-\3\ or 1 x 10-\2\ thresholds during the
subject phase of flight. The use of collective risk to determine
acceptability of downrange overflight is consistent with current
practice.
Blue Origin, CSF, and SpaceX commented that flight abort may
actually increase risk during overflight where vehicle hazards cannot
be contained. Even for vehicles that implement an FSS with a
reliability of 0.999 at 95 percent, it would still be possible to fall
into the highest risk bin and not improve a risk posture measured by
CEC.
The FAA agrees with the commenters. In the final rule in Sec.
450.108(e), the FAA sets conditions that demonstrate that a high
consequence event is sufficiently mitigated, including if flight abort
in that phase of flight would not materially decrease the risk from a
high consequence event.
vi. Flight Abort Rules
Proposed Sec. 450.165(c) (Flight Commit Criteria) contained the
requirements for flight abort rules. As explained in the NPRM, an
operator would identify the conditions under which an FSS, including
the functions of any flight abort crew, must abort the flight to ensure
compliance with Sec. 450.101. An operator would be required to abort a
flight if a flight safety limit is violated or if some condition exists
that could lead to a violation, such as a compromised FSS or loss of
data.
In the final rule, the FAA revised and relocated the flight abort
rules to Sec. 450.108 consistent with the objective of consolidating
relevant flight abort requirements into a single section in the final
rule. In Sec. 450.108(f), an operator must establish and observe
flight abort rules that govern the conduct of launch and reentry.
Section 450.108(f)(1) requires that vehicle data required to
evaluate flight abort rules must be available to the FSS under all
reasonably foreseeable conditions during normal and malfunctioning
flight. A similar requirement appeared in proposed Sec. 450.165(c)(2),
which required vehicle data necessary to evaluate flight abort rules to
be available to the FSS across the range of normal and malfunctioning
flight. The FAA adds ``under all reasonably foreseeable conditions'' to
Sec. 450.108(f)(1) to acknowledge that some conditions that prevent
vehicle data from being available to evaluate flight abort rules might
be unforeseeable and therefore unpreventable through planning and
design.
Section 450.108(f)(2) describes when the FSS must abort flight,
similar to proposed Sec. 450.165(c)(3). Section 450.108(f)(2)(i)
requires that the FSS must abort flight when valid, real-time data
indicate the vehicle has violated any flight safety limit developed
pursuant to this section. In the final rule, the FAA revised the
language from proposed Sec. 450.165(c)(3)(i) to add ``developed
pursuant to this section'' because the flight safety limits
requirements now appear in the same section as this flight abort rule.
As proposed in Sec. 450.165(c)(3)(ii), the flight abort rules
would have required the FSS to abort flight when the vehicle state
approaches conditions that are anticipated to compromise the capability
of the FSS and further flight has the potential to violate a flight
safety limit.
Blue Origin commented that, while it is possible to write flight
abort rules to account for specific cases, there was not currently a
practical means of writing general rules that would abort flight when
the vehicle state approaches conditions that could result in a
compromise of the FSS for every circumstance proposed in Sec.
450.165(c)(3)(ii). It also commented that the potential to violate a
flight safety limit is vague and outside the capability of current
generation autonomous FSS. Blue Origin
[[Page 79626]]
recommended the rule be reworded as ``the flight safety system must
abort flight when the vehicle state approaches identified conditions
from the system safety analysis that are anticipated to compromise the
capability of the flight safety system and the flight safety system is
required to contain the risk to an acceptable level (as analyzed in the
flight safety analysis).''
In the final rule, the revised requirement in Sec.
450.108(f)(2)(ii) adopts Blue Origin's recommendation to add
``identified'' before ``conditions that are anticipated to compromise
the capability of the flight safety system.'' The FAA finds this
addition reasonable because it avoids requiring protections against
unknown conditions. As revised, Sec. 450.108(f)(2)(ii) requires that
the FSS must abort flight when the vehicle state approaches identified
conditions that are anticipated to compromise the capability of the FSS
and further flight has the potential to violate a flight safety limit.
This requirement is used in conjunction with the flight safety limits
objective in Sec. 450.108(c)(5).
The FAA declines to adopt Blue Origin's recommendation to limit
this requirement to the system safety analysis because a system safety
analysis is not the only means to identify these conditions. For
example, an FSS survivability analysis or a link analysis for a command
destruct architecture may identify conditions anticipated to compromise
the capability of the FSS. The FAA also does not adopt Blue Origin's
recommendation to change Sec. 450.165(c)(3)(ii) by replacing ``and
further flight has the potential to violate a flight safety limit''
with ``and the flight safety system is required to contain the risk to
an acceptable level (as analyzed in the flight safety analysis).''
The FAA finds an acceptable level of risk might be interpreted as
only meeting collective and individual risk requirements, while flight
safety limits must meet other requirements as described in Sec.
450.108 in the final rule. The FAA recognizes that a real-time
determination of whether a particular failure may evolve to reach a
flight safety limit is not possible. The operator must determine in
pre-flight analyses (system safety analysis, link analysis, etc.) which
failure modes can compromise the capability of the FSS. The operator
must then use FSA to determine if those failure modes can potentially
violate a flight safety limit. If it finds a failure mode that can
potentially violate a flight safety limit, the operator must develop
flight abort rules that protect against those modes. If the ability to
reach a flight safety limit via a particular failure mode is uncertain,
the assumption should be made that it is possible during any phase of
flight where flight abort is used as a hazard control strategy. This
approach is consistent with acceptable methods of compliance with
proposed Sec. 450.165(c)(3)(ii).
Section 450.108(f)(2)(iii) requires that the FSS must abort flight
in accordance with methods used to satisfy Sec. 450.108(d)(3) if
tracking data is invalid and further flight has the potential to
violate a flight safety limit. This requirement is similar to proposed
Sec. 450.165(c)(3)(iii), which stated that the FSS must incorporate
data loss flight times to abort flight at the first possible violation
of a flight safety limit, or earlier, if valid tracking data is
insufficient for evaluating a minimum set of flight abort rules
required to maintain compliance with proposed Sec. 450.101.
As noted in the discussion of flight abort constraints, the FAA has
replaced proposed Sec. 450.127, which contained requirements for a
data loss flight time analysis, with the more performance-based
approach in Sec. 450.108(d)(3). Consistent with that change, the FAA
revises the language in proposed Sec. 450.165(c)(3)(iii) in final
Sec. 450.108(f)(2)(iii). Data loss flight times are not the only means
of compliance with the performance-based requirement in Sec.
450.108(d)(3) to account for the potential to lose valid data necessary
to evaluate the flight abort rules. The FAA also removes the
requirement to abort flight at the first possible violation of a flight
safety limit, or earlier, if valid tracking data is insufficient for
evaluating a minimum set of flight abort rules required to maintain
compliance with proposed Sec. 450.101. This statement was associated
with implementation of data loss flight times, but the performance-
based requirement in Sec. 450.108(d)(3) will allow other methods of
compliance that may not be consistent in all cases with the NPRM
language in Sec. 450.165(c)(3)(iii). The FAA will provide guidance on
compliance with Sec. Sec. 450.108(d)(3) and 450.108(f)(2)(iii). The
FAA also does not adopt the proposed definition for ``data loss flight
time'' in Sec. 401.7 in the final rule. The relation between
Sec. Sec. 450.108(d)(3) and 450.108(f)(2)(iii) in the final rule is
substantively the same as that between proposed Sec. Sec. 450.127 and
450.165(c)(3)(iii).
The FAA removes proposed Sec. 450.165(c)(1), which required that
for a vehicle that uses an FSS, the flight abort rules must identify
the conditions under which the FSS, including the functions of any
flight abort crew, must abort the flight. These included proposed Sec.
450.165(c)(1)(i), to ensure compliance with proposed Sec. 450.101, and
proposed Sec. 450.165(c)(1)(ii), to prevent debris capable of causing
a casualty from impacting in uncontrolled areas if the vehicle is
outside the limits of a useful mission. The FAA finds this requirement
to be unnecessary, as flight safety limits requirements and flight
abort rules requirements are clearly stated in Sec. 450.108(c) through
(f). In addition, in the final rule the FAA does not adopt the proposed
definition for ``flight abort crew'' in Sec. 401.7 because the term is
no longer used in the final rule.
Virgin Galactic commented that proposed Sec. 450.165(c)(ii) seems
unachievable for an operator with a nominal trajectory that meets
EC requirements but can result in debris outside of the
controlled area. Virgin Galactic recommended deleting the requirement
or excluding the requirement if EC was met.
The FAA finds, based on the context of the comment, that Virgin
Galactic meant to refer to proposed Sec. 450.165(c)(1)(ii). The FAA
acknowledges that a mission that flies over uncontrolled areas on the
nominal trajectory cannot always prevent debris impacts on the
uncontrolled area, but the requirement only applies to vehicles outside
the limits of a useful mission. A nominal vehicle is on a useful
mission; therefore, this requirement would not apply to the scenario in
Virgin Galactic's comment. In the final rule, the intent of proposed
Sec. 450.165(c)(1)(ii) is covered in Sec. 450.108(f)(2)(i).
The FAA removes the requirement proposed in Sec. 450.165(c)(3)(iv)
that a flight may continue past any gate established under proposed
Sec. 450.125 only if the parameters used to establish the ability of
the vehicle to complete a useful mission are within limits. The
replacement of proposed Sec. 450.125 with performance-based
requirements in Sec. 450.108(c) and (d) makes this requirement
unnecessary.
SpinLaunch commented that the FAA should simplify the proposed
flight safety limits analysis (Sec. 450.123), gate analysis (Sec.
450.125), and time delay analysis (Sec. 450.129) regulations by
stating that the safety analyses must address certain goals and relying
on a training and evaluation structure to assure applicants are
knowledgeable and capable of performing the analyses in a manner that
sufficiently addresses those goals. The FAA revises the requirements in
proposed Sec. Sec. 450.123, 450.125, and 450.129 to be more
[[Page 79627]]
performance-based. However, the FAA does not agree that training
applicants to be capable of performing the subject analyses is
sufficient to ensure compliance with the regulations.
v. Application Requirements
Section 450.108(g) contains application requirements for flight
abort. Section 450.108(g)(1) requires an applicant to submit a
description of the methods used to demonstrate compliance with Sec.
450.108(c), including descriptions of how each analysis constraint in
Sec. 450.108(d) is satisfied in accordance with Sec. 450.115 (Flight
Safety Analysis Methods). This rule is similar to proposed Sec.
450.123(e)(1), which required that an applicant submit in its
application a description of how each flight safety limit would be
computed, including references to the safety criteria of proposed Sec.
450.101.\105\ The intent of the requirement in the final rule is
similar to the proposal. However, the reference to Sec. 450.101 is
excluded in the final rule because not all flight safety limits
objectives in Sec. 450.108(c) refer directly to Sec. 450.101.
---------------------------------------------------------------------------
\105\ Section 450.115 addresses the scope and level of fidelity
required for FSA methods. The level of fidelity must demonstrate
that any risk to the public satisfies the safety criteria of Sec.
450.101.
---------------------------------------------------------------------------
Section 450.108(g)(2) requires that an applicant must submit in its
application a description of how each flight safety limit and flight
abort rule is evaluated and implemented during vehicle flight,
including the quantitative criteria that will be used, a description of
any critical parameters, and how the values required in Sec.
450.108(c)(3) and 450.108(e) are identified. This provision is derived
from three requirements in the NPRM. First, proposed Sec.
450.123(e)(2) would have required an applicant to submit representative
flight safety limits and associated parameters. Second, proposed Sec.
450.125(d)(2) would have required an applicant to submit a description
of the measure of performance used to determine whether a vehicle would
be allowed to cross a gate without flight abort, the acceptable ranges
of the measure of performance, and how these ranges were determined.
Third, proposed Sec. 450.165(d)(2)(i) would have required an applicant
to submit, for flight abort rules, a description of each rule and the
parameters that would be used to evaluate each rule.
As discussed earlier, the FAA has removed Sec. Sec. 450.123 and
450.125 from the final rule and relocated the flight abort rules from
Sec. 450.165 to reflect a more performance-based approach to flight
abort and allow greater flexibility than would have been possible under
the flight safety limits analysis and traditional gate analysis
proposed in the NPRM. Accordingly, the application requirements
associated with those sections have been combined in Sec.
450.108(g)(2) in the final rule. This approach improves organization
and increases flexibility with regard to how an operator demonstrates
compliance with Sec. 450.108.
Section 450.108(g)(3) requires an applicant to submit a graphic
depiction or series of depictions of flight safety limits for a
representative mission, together with the launch or landing point, all
uncontrolled area boundaries, the nominal trajectory, extents of normal
flight, and limits of a useful mission trajectories, with all
trajectories in the same projection as each of the flight safety
limits. This rule is similar to proposed Sec. 450.123(e)(4), which
required that an applicant submit a graphic depiction or series of
depictions of representative flight safety limits, the launch or
landing point, all uncontrolled area boundaries, and vacuum IIP traces
for the nominal trajectory, extents of normal flight, and limits of a
useful mission trajectories.
The final rule clarifies that an applicant will need only to submit
flight safety limits for a representative mission. Also, the FAA finds
that the requirement for depictions of vacuum IIP trajectories would
not be appropriate for flight safety limits in different projections
(such as present position) and revises the final rule to require all
trajectories in the same projection as each of the flight safety
limits. This change will not result in an increased burden compared to
the NPRM because the applicant would have to depict the trajectories in
either case; the final rule simply states explicitly that the
trajectories must be depicted in the appropriate projection.
Section 450.108(g)(4) requires an applicant to submit a description
of the vehicle data that will be available to evaluate flight abort
rules under all reasonably foreseeable conditions during normal and
malfunctioning flight. This section is similar to proposed Sec.
450.165(d)(2)(iii), which required an applicant to submit a description
of the vehicle data that would be available to evaluate flight abort
rules across the range of normal and malfunctioning flight. In the
final rule, the FAA replaces ``across the range of normal and
malfunctioning flight'' with ``under all reasonably foreseeable
conditions during normal and malfunctioning flight'' to be consistent
with language elsewhere in the regulation. It results in no increased
burden on the operator from the application requirement proposed in the
NPRM.
Microcosm requested clarification of proposed Sec.
450.165(d)(2)(i) and (iii), which would require that the applicant
submit, for flight abort rules, a description of each rule, and the
parameters that would be used to evaluate each rule; and a description
of the vehicle data that would be available to evaluate flight abort
rules across the range of normal and malfunctioning flight.
The FAA provides the following examples in response to Microcosm's
comment. An example of a flight abort rule would be a line on the
Earth's surface that, when crossed by an IIP (the parameter), would
trigger flight abort. In this example, the vehicle data would be
position and velocity data necessary to compute the IIP, as provided by
external (such as ground-based) or onboard sensors. The operator should
consider the availability of this data during normal and malfunctioning
flight and the effect on the operator's ability to evaluate the
applicable flight abort rule--which in this example is that flight
abort be initiated if the IIP crosses the line on the Earth's surface.
Another example would be an altitude versus downrange distance
constraint. If the vehicle is outside of a range of altitudes as a
function of the downrange distance, flight abort would be triggered.
The ranges of altitudes and downrange distances are the parameters in
this example. In this example, the vehicle data would be position data,
similarly reported by external or onboard sensors.
Other examples of parameters used in flight abort rules could be
chamber pressure, body rates, health and status of critical systems,
etc. In the final rule, the requirements in proposed Sec.
450.165(d)(2)(i) and (d)(2)(iii) are addressed by Sec. 450.108(g)(2)
and Sec. 450.108(g)(4), respectively.
i. Flight Hazard Analysis (Sec. 450.109)
In the NPRM, the FAA proposed in Sec. 450.109 that, unless an
operator uses physical containment, wind weighting, or flight abort as
a hazard control strategy, an operator would be required to perform and
document a flight hazard analysis and continue to maintain it
throughout the lifecycle of the launch or reentry system. As explained
in the NPRM, the use of a flight hazard analysis to derive hazard
controls would provide flexibility that does not currently exist under
the prescriptive requirements in part 417 and is broadly consistent
with the practice in parts 431 and 435.
[[Page 79628]]
As proposed in Sec. 450.109(a), the flight hazard analysis would
need to identify, describe, and analyze all reasonably foreseeable
hazards to public safety and safety of property resulting from the
flight of a launch or reentry vehicle. Each flight hazard analysis
would need to: (1) Identify all reasonably foreseeable hazards, and the
corresponding vehicle response mode for each hazard, associated with
the launch or reentry system relevant to public safety and safety of
property; (2) assess each hazard's likelihood and severity; (3) ensure
that the risk associated with each hazard would meet certain defined
criteria; (4) identify and describe the risk elimination and mitigation
measures required to satisfy the criteria; and (5) demonstrate that the
risk elimination and mitigation measures would achieve the necessary
risk levels through validation and verification.
In the final rule, the FAA revises Sec. 450.109 by adding a new
applicability paragraph (a) and by re-designating proposed Sec.
450.109(a) through (e) as Sec. 450.109(b) through (f).\106\ The FAA
adds an applicability paragraph in Sec. 450.109(a) that applies to the
use of a flight hazard analysis as a hazard control strategy to derive
hazard controls for the flight, or phase of flight, of a launch or
reentry vehicle. Hazards associated with computing systems and software
are further addressed in Sec. 450.141. This revised language reflects
that performing a flight hazard analysis is included as one of the
hazard control strategies in Sec. 450.107(c) of the final rule.
---------------------------------------------------------------------------
\106\ The FAA changes the term ``vehicle response mode'' in
proposed Sec. 450.109(a)(1) to ``failure mode,'' consistent with
similar changes throughout the final rule as discussed in the
conditional expected casualty section of the preamble.
---------------------------------------------------------------------------
Proposed Sec. 450.109 included several provisions that required
the flight hazard analysis to address hazards to property. For
instance, the FAA proposed in the introductory language to Sec.
450.109(a) that operators identify, describe, and analyze all
reasonably foreseeable hazards to public safety and safety of property.
The FAA proposed in Sec. 450.109(a)(1) that an operator identify all
reasonably foreseeable hazards, and the corresponding vehicle response
mode for each hazard, associated with the launch or reentry system
relevant to public safety and safety of property. The FAA also proposed
in Sec. 450.109(a)(3)(ii) that the likelihood of any hazardous
condition that may cause major damage to public property or critical
assets must be remote.
Blue Origin and Virgin Galactic commented on the property
protection requirements in proposed Sec. 450.109. Blue Origin
acknowledged the FAA's statutory authority to protect property but
noted that FAA regulations do not define property nor the criteria for
the safety of property. Blue Origin also expressed concern that the
requirements in Sec. 450.109 extended to critical assets and property
located in controlled areas. Blue Origin requested clarity on these
issues. Virgin Galactic commented that the protection of property was a
new requirement and also expressed concerns about the criteria
requiring an operator to mitigate the likelihood of any hazardous
condition that can cause a major property damage to ``remote.''
In response, the FAA has not adopted the requirement to identify,
describe, and analyze all reasonably foreseeable hazards to property
resulting from the flight of a launch or reentry vehicle. Although
property protection is codified in current licensing requirements for
reusable launch vehicles in Sec. 431.35(c), launch and reentry
operators have not in the past been required to account for hazards to
property due to flight. However, the FAA retains in the final rule
specific requirements for critical assets and property on orbit, which
have specific safety criteria in Sec. 450.101 and Sec. 450.169,
respectively. The FAA notes that the emergency response requirements in
Sec. 450.173(d), which address fire hazards, may also mitigate hazards
to property. The FAA may address other property and property hazards in
a future rulemaking if launch and reentry flight operations dictate
such a need.
Blue Origin also recommended proposed Sec. 450.109(a) be revised
to require that a flight hazard analysis identify, describe, and
analyze all reasonably foreseeable hazards to public safety and safety
of critical assets and safety of property resulting from the flight of
a launch or reentry vehicle.
The FAA declines to adopt this recommended language because, as
discussed in the preamble section dedicated to critical assets, the FAA
will determine whether an asset is critical in consultation with the
entity responsible for the asset, and either the FAA or a Federal
launch or reentry site will determine whether the proposed activity
would expose critical assets to a risk of loss of functionality that
exceeds the risk criterion in Sec. 450.101(a)(4) or (b)(4), and convey
any necessary constraints to the operator.
Virgin Galactic commented on proposed Sec. 450.109(a)(1)(i)
through (a)(1)(x) and noted the list of error sources, or very similar,
shows up in four other locations: (1) Sec. 437.55, (2) AC 431.35-2A,
(3) FAA Flight Safety Handbook, and (4) the AIAA Safety Critical RLV
guide. Virgin Galactic noted that the wording differed slightly from
one source to another and recommended that the FAA harmonize the
various lists. The FAA notes this comment is outside the scope of this
rulemaking.
Proposed Sec. 450.109(a)(3) stated that a flight hazard analysis
must ensure that the risk associated with each hazard would meet the
following criteria: (1) The likelihood of any hazardous condition that
may cause death or serious injury to the public must be extremely
remote; and (2) the likelihood of any hazardous condition that may
cause major damage to public property or critical assets must be
remote.
In the final rule, the FAA revises this requirement to remove the
property protection requirement in proposed Sec. 450.109(a)(3)(ii), as
discussed earlier. Section 450.109(b)(3) states that a flight hazard
analysis must ensure that the likelihood of any hazardous condition
that may cause death or serious injury to the public is extremely
remote.
Proposed Sec. 450.109(a)(5) stated a flight hazard analysis must
demonstrate that the risk elimination and mitigation measures would
achieve the risk levels of proposed Sec. 450.109(a)(3) through
validation and verification. Verification includes analysis, test,
demonstration, or inspection. The FAA adopts and re-designates proposed
Sec. 450.109(a)(5) as Sec. 450.109(b)(5) in the final rule, with one
revision. In Sec. 450.109(b)(5), the FAA changes the term
``demonstrate'' in the introductory paragraph to ``document.''
Virgin Galactic noted that the NPRM used the term ``demonstrate''
as both part of the introductory paragraph in proposed Sec.
450.109(a)(5) and as a verification method in proposed Sec.
450.109(a)(5)(iii). Virgin Galactic commented that demonstration is a
standard verification method, and use of the word in both places could
drive confusion. Virgin Galactic recommended changing the term
``demonstrate'' in Sec. 450.109(a)(5) to ``verify and validate'' to
clarify that demonstration is not the only method of completing
validation and verification.
The FAA agrees that the proposed language could cause confusion,
and that demonstration is not the only method of completing validation
and verification. The FAA changes ``demonstrate'' to ``document'' to
avoid that confusion. The FAA does not adopt Virgin Galactic's specific
suggestion because ``verification'' and ``validation'' are terms used
later in the sentence, and are defined in Sec. 401.7.
Virgin Galactic commented on proposed Sec. 450.109(c) and
recommended that there be an exclusion
[[Page 79629]]
for vehicles that follow the same standard trajectory each flight.
The FAA disagrees with Virgin Galactic's recommendation. Even if an
operator follows a stable trajectory, vehicle design changes or other
operational changes may introduce new hazards. An operator must confirm
that the flight hazard analysis is valid for each mission in order to
ensure that all hazards are identified and mitigated to an acceptable
level. That said, the FAA expects that operators with stable vehicle
designs and operations will typically not have major updates to their
flight hazard analyses.
The FAA re-designates proposed Sec. 450.109(d) as Sec. 450.109(e)
in the final rule, and removes the term ``operational'' to reflect that
an operator must continually update the flight hazard analysis
throughout the lifecycle of the launch or reentry system, rather than
just address operational changes. As discussed in the preamble
discussion on the system safety program (Sec. 450.103), design and
operational changes to a system can have an impact on public safety.
Virgin Galactic commented that the term ``continually'' in Sec.
450.109(d) is not defined and is vague. In addition, Virgin Galactic
noted that the requirement appears to duplicate the current continuing
accuracy requirements in part 413 and the proposed continuing accuracy
requirements in proposed Sec. 450.211. Virgin Galactic recommends this
requirement be removed.
The FAA notes that, for the purposes of the flight hazard analysis,
``continually'' means that the operator must update the flight hazard
analysis as aspects of the mission change or as new information is
learned about an operation, if potential impacts to the analysis are
identified. Although somewhat redundant with the requirement in Sec.
450.211 for a licensee to maintain the continuing accuracy of
representations in its application, proposed Sec. 450.109(d) (re-
designated Sec. 450.109(e) in the final rule) provides the specific
expectation that the flight hazard analysis must be complete and all
hazards must be mitigated to an acceptable level for every launch or
reentry.
SpinLaunch commented that the requirements in proposed Sec.
450.109(c) and (d) were an onerous burden, and that to achieve a
regulatory framework that can effectively and efficiently oversee
multi-site, multi-vehicle operations, a shift away from the traditional
regulatory verification of each component to a more practical method
would be necessary. SpinLaunch recommended that an applicant just
demonstrate knowledge and skills to perform safe and accepted
operations.
Operators have a responsibility to ensure that public safety
analyses are consistent with their proposed operations and that all
hazards are mitigated to an acceptable level. This practice is
consistent with system safety practices and current commercial space
regulations. The framework recommended by SpinLaunch would not achieve
these public safety outcomes because it is too broad and lacks
performance metrics.
In the final rule, the FAA re-designates proposed Sec. 450.109(e)
as Sec. 450.109(f), (Application requirements). Except for number re-
designations, the FAA adopts the requirements as proposed.
j. Physical Containment (Sec. 450.110)
As discussed earlier, unlike other hazard control strategies, the
FAA did not propose a separate section for the physical containment
hazard control strategy in the NPRM. Rather, proposed Sec. 450.107(b)
simply contained the requirements for physical containment as a hazard
control strategy. The FAA proposed that, to use physical containment as
a hazard control strategy, an operator would be required to ensure that
the launch vehicle does not have sufficient energy for any hazards
associated with its flight to reach outside the flight hazard area
developed in accordance with proposed Sec. 450.133 (Flight Hazard Area
Analysis), and would be required to apply other mitigation measures to
ensure no public exposure to hazards as agreed to by the Administrator
on a case-by-case basis. In addition, proposed Sec. 450.107(e)
included specific application requirements for an operator using
physical containment as a hazard control strategy; namely, that it must
(1) demonstrate that the launch vehicle does not have sufficient energy
for any hazards associated with its flight to reach outside the flight
hazard area developed in accordance with Sec. 450.133, and (2)
describe the methods used to ensure that flight hazard areas are
cleared of the public and critical assets.
In the final rule, the FAA places the requirements for the physical
containment hazard control strategy in a separate section, Sec.
450.110. With one exception, the proposed requirements are unchanged in
the final rule. The one exception, as discussed next in response to a
comment, is that the FAA clarifies that the hazard area must be clear
of the public and critical assets.
As noted earlier in the discussion of Sec. 450.107, Blue Origin
commented that the FAA amend proposed Sec. 450.107(e)(2)(ii), which
proposed to require an applicant to describe the methods used to ensure
that flight hazard areas are cleared of the public and critical assets,
and to require that an applicant describe the methods used to ensure
that risk to the public and critical assets in flight hazard areas meet
allowable criteria. Blue Origin pointed out that critical assets cannot
be cleared from a flight hazard area. In addition, Blue Origin stated
that the proposed definition of ``flight hazard area'' in Sec. 401.5
already captured that the area would be controlled to risk limits and
that can be achieved through methods other than clearing the area.
The FAA disagrees with Blue Origin that proposed Sec.
450.107(e)(2)(ii), now Sec. 450.110(c)(2), should be amended to
require an applicant to describe the methods used to ensure that risk
to the public and critical assets in flight hazard areas meet allowable
criteria, as opposed to ensuring that the area is cleared of the public
and critical assets. Although Blue Origin is correct in noting that the
definition of ``flight hazard area'' is not limited to clearing the
area,\107\ the physical containment hazard control strategy is designed
to be a simple method of protecting public safety by launching within
an area that is cleared of the public and critical assets, and within
an area that contains hazards based on the potential energy of the
vehicle. The FAA modifies what was proposed in Sec. 450.107(b)(1) and
(b)(2), now Sec. 450.110(b)(1) and (b)(2), from what was proposed in
the NPRM, to clarify that the hazard area must be clear of the public
and critical assets.
---------------------------------------------------------------------------
\107\ The proposed definition of ``flight hazard area'' in the
NPRM was ``any region of land, sea, or air that must be surveyed,
publicized, controlled, or evacuated in order to protect public
health and safety and the safety of property.''
---------------------------------------------------------------------------
The FAA also modifies the definition of ``flight hazard area'' in
Sec. 401.7 to change the language from ``in order to protect public
health and safety and the safety of property'' to ``in order to ensure
compliance with the safety criteria in Sec. 450.101.'' The FAA makes
this change to tie flight hazard areas to the safety criteria in Sec.
450.101.
k. Wind Weighting (Sec. 450.111)
In the NPRM, the FAA proposed wind weighting requirements in Sec.
450.141. As discussed earlier, the wind weighting requirements have
been moved to Sec. 450.111 in order to group all hazard control
strategies together. Although the FAA did not receive any comments on
this hazard control strategy, the FAA
[[Page 79630]]
has made a few changes in the final rule.
In the applicability section, the FAA specifies that an operator
may use wind weighting as a hazard control strategy to meet the safety
criteria of Sec. 450.101 to Sec. 450.101(a), (b), and (c), which
address launch risk criteria, reentry risk criteria, and high
consequence event protection. The FAA makes this change because the
criteria in Sec. 450.101(d), (e), (f), and (g)--addressing disposal
safety criteria, the protection of people and property on orbit, the
notification of planned impacts, and the validity of analyses,
respectively--are not relevant to wind weighting. Therefore, an
operator does not need to demonstrate that wind weighting satisfies
these requirements.
In the NPRM, proposed Sec. 450.141(b) would require that for the
flight of an unguided suborbital launch vehicle that uses a wind
weighting safety system, the launcher azimuth and elevation settings
must be wind weighted to correct for the effects of wind conditions at
the time of flight to provide a safe impact location. The FAA has
replaced ``to provide a safe impact location'' with ``to provide impact
locations that will ensure compliance with the safety criteria in Sec.
450.101.'' This change removes any ambiguity as to the meaning of
``safe impact location.''
Also in the NPRM, proposed Sec. 450.141(b) would require that for
the flight of an unguided suborbital launch vehicle that uses a wind
weighting safety system, an operator must use launcher azimuth and
elevation angle settings that ensures the rocket will not fly in an
unintended direction given wind uncertainties. The FAA has replaced
``given wind uncertainties'' with ``accounting for uncertainties in
vehicle and launcher design and manufacturing, and atmospheric
uncertainties.'' This change acknowledges that the uncertainties that
affect an unguided suborbital launch vehicle's ability to fly in an
unintended direction are broader than just wind uncertainties--they
include uncertainties in vehicle and launcher design and manufacturing,
and other atmospheric uncertainties. The FAA makes two grammatical
changes to the application requirements, which in the final rule are in
Sec. 450.111(e). First, in Sec. 450.111(e)(2), the FAA replaces ``and
identify'' with ``including.'' In Sec. 450.111(e)(3), the FAA removes
the word ``provide.''
Lastly, similar to other sections in this rule, the FAA removes the
proposed requirement for an applicant to provide additional products
that allow an independent analysis as requested by the Administrator
because the requirement was redundant with Sec. 450.45(e)(7)(ii).
l. Flight Safety Analysis (Sec. Sec. 450.113 to 450.139)
Regardless of the hazard control strategy chosen or mandated, the
FAA anticipates that an operator will be required to conduct an FSA for
at least some phases of flight. For example, an FSA must determine
flight hazard areas for any vehicle with planned debris impacts capable
of causing a casualty. Also, an FSA must quantitatively demonstrate
that a launch or reentry meets the safety criteria for debris, far-
field overpressure, and toxic hazards. An operator may be required to
conduct additional analyses to use flight abort or wind weighting
hazard control strategies.
Generally, an FSA consists of a set of quantitative analyses used
to determine flight commit criteria, flight abort rules, flight hazard
areas, and other mitigation measures and to demonstrate compliance with
the safety criteria in Sec. 450.101. In the NPRM, the FAA proposed 15
sections associated with FSA requirements in Sec. Sec. 450.113 through
450.141. The final rule moves requirements associated with flight
safety limits to Sec. 450.108, such that 11 interrelated sections
remain component parts of an FSA.
There are 11 performance-based sections with FSA requirements that
fall into three groups. The first group, Sec. Sec. 450.113 and
450.115, provides requirements on the scope and fidelity of the
analyses required by the remaining nine sections. The second group,
which consists of five sections from Sec. 450.117 through Sec.
450.131, specifies the requirements for analyses necessary to develop
quantitative input data used by the last four sections. The last group
consists of four sections that specify quantitative risk analyses with
products necessary to evaluate compliance with the safety criteria in
Sec. 450.101. All of the FSA sections must use methods that comply
with Sec. 450.101(g) because they are essential to demonstrating
compliance with the safety criteria in Sec. 450.101.
To aid in holistically understanding the substance of, and
relationships between, the FSA sections, the following provides a brief
overview, before a more detailed discussion of each FSA section.
Section 450.113 specifies the overall scope of the subsequent analyses
in terms of the period of flight for which the public risks must be
quantified. For example, for an orbital launch, an FSA must account for
all phases of flight from liftoff through orbital insertion and through
all component impacts or landings. Section 450.115 specifies that the
operator's analysis methods must account for all reasonably foreseeable
events and failures of safety-critical systems during nominal and non-
nominal launch or reentry that could jeopardize public health and
safety, and the safety of property. Section 450.115 also specifies that
the operator's methods must have a level of fidelity sufficient (1) to
demonstrate compliance with the safety criteria of Sec. 450.101,
accounting for all known sources of uncertainty, using means of
compliance accepted by the Administrator; and (2) to identify the
dominant source of each type of public risk with a criterion in Sec.
450.101(a) or (b) in terms of phase of flight, source of hazard (such
as toxic exposure, inert, or explosive debris), and failure mode. An
operator must comply with these foundational sections when performing
any of the separate analyses that together comprise the FSA.
Sections 450.117 and 450.119 specify the constraints and objectives
of analyses sufficient to characterize the trajectory of the vehicle
during normal and malfunction flight. Section 450.121 specifies the
constraints and objectives of an analysis sufficient to quantify the
physical, aerodynamic, and harmful characteristics of hazardous debris,
including impact probability distributions generated from normal and
malfunction flight. Section 450.123 specifies requirements to
characterize the population exposed to a significant probability of
impact by hazardous debris, including the vulnerability of people in
various structure types. Section 450.131 specifies requirements for
statistically valid estimates of the probability of reasonably
foreseeable failures based on the outcomes of previous flights.
Depending on the type of operation or the hazard control strategy used,
an operator may be required to perform some or all of these analyses in
developing its FSA.
Finally, Sec. Sec. 450.133, 450.135, 450.137, and 450.139 specify
the requirements for quantitative risk analyses to demonstrate that the
risks to the public from debris, far-field overpressure, and toxic
hazards are consistent with the safety criteria in Sec. 450.101.
Generally, the analyses conducted under Sec. Sec. 450.117 through
450.131 are used to inform the analyses for these final portions of the
FSA. Flight commit criteria, flight hazard areas, flight abort rules,
and other mitigation measures are typically derived as necessary to
demonstrate compliance with the safety criteria in Sec. 450.101, and
thus are typical byproducts of the risk analyses
[[Page 79631]]
performed to satisfy the requirements in Sec. Sec. 450.133, 450.135,
450.137, and 450.139. The requirements for each of the FSA sections are
described in more detail in the following sections.
m. Flight Safety Analysis Requirements--Scope (Sec. 450.113)
In the NPRM, proposed Sec. 450.113 stated the scope and
applicability of FSA requirements. Proposed Sec. 450.113(a), which
covered scope, stated an operator would be required to perform and
document an FSA: (1) For orbital launch, from liftoff through orbital
insertion, and any component or stage landings; (2) for suborbital
launch, from liftoff through final impact; (3) for disposal, from the
beginning of the deorbit burn through final impact; (4) for reentry,
from the beginning of the deorbit burn through landing; and (5) for
hybrid vehicles, for all phases of flight, unless the Administrator
determines otherwise based on demonstrated reliability. Proposed Sec.
450.113(b), which covered applicability, identified what sections
needed to be included in an FSA depending on the type of operation or
hazard control strategy being used.
In the final rule, the FAA has removed the proposed applicability
provision and adopted the scope provisions with some changes and
reorganization. The FAA revised Sec. 450.113(a) to state that an
operator must perform and document an FSA for all phases of flight,
except as specified in Sec. 450.113(b). The FAA also revised Sec.
450.113 to add in paragraph (b) an operator is not required to perform
and document an FSA for a phase of flight if agreed to by the
Administrator based on demonstrated reliability. An operator
demonstrates reliability by using operational and flight history to
show compliance with the risk criteria in Sec. 450.101(a) and (b).
Operational history includes the flight time and/or cycles of an
aircraft, which may have an airworthiness certificate, operating under
part 91, part 135 or part 121 as an example. Flight history could be
represented by flight time accumulated through a period of
developmental and flight tests of a vehicle that does not have an
airworthiness certificate. Although the demonstrated reliability
language was limited to hybrid vehicles in the proposed rule, the FAA
is providing additional flexibility by expanding it to all vehicles.
Some vehicles other than hybrids could conceivably have an extensive
and safe enough flight history to demonstrate compliance with the risk
criteria in Sec. 450.101(a) and (b) based on empirical data in lieu of
the traditional risk analysis.
In the final rule, the FAA modifies Sec. 450.113(a)(1), which
addresses orbital launches, to clarify that an FSA covers from liftoff
through orbital insertion and through ``all component impacts or
landings'' instead of proposed ``any component or stage landings or
final impacts.'' Likewise, for the scope of an FSA for suborbital
launches, the FAA changes Sec. 450.113(a)(2) to ``through all
component impacts or landings'' instead of proposed ``through final
impact.'' These changes reflect the reality that orbital and suborbital
launch vehicles often have multiple components that can either impact
the Earth or land intact. An FSA should address all such impacts or
landings.
The FAA modifies Sec. 450.113(a)(4) for a similar reason. For the
scope of a reentry analysis, the FAA changes Sec. 450.113(a)(4) to
include ``through all component impacts or landings'' instead of
proposed ``through landing.'' This change reflects the reality that
reentry vehicles often have multiple components that can either impact
the Earth or land intact.
The FAA modifies Sec. 450.113(a)(3) and (4) by replacing the term
``the beginning of the deorbit burn'' with ``the initiation of the
deorbit.'' The FAA notes not all deorbit operations will include a
``burn.'' The FAA notes that, for a disposal, an operator could
discontinue the analysis prior to final impact and demonstrate an
equivalent level of safety by presenting evidence of complete demise
due to aerothermal heating. The scope of the FSA is consistent with the
risk criteria in Sec. 450.101 and the long-standing definition of
``reentry'' in Sec. 401.7. The FAA clarifies here that, for the
purposes of the FSA and risk criteria, the initiation of the deorbit
for a reentry or disposal from orbit generally coincides with the final
health check prior to the final command to commit the vehicle to a
perigee below 70 nautical miles.
The final rule removes the language proposed in Sec. 450.113(b)
covering applicability, because the reorganization of the flight abort
related sections means that all FSA sections are applicable, unless
otherwise agreed to by the Administrator based on demonstrated
reliability. Instead, Sec. 450.113(b) in the final rule addresses how
an operator demonstrates reliability, as discussed.
n. Flight Safety Analysis Methods (Sec. 450.115)
In the NPRM, proposed Sec. 450.115 outlined the methods for
conducting FSA. The FAA did not receive comments on this proposal
unique to this section.
In the final rule, the FAA adopts Sec. 450.115 as proposed with
one change. The term ``vehicle response mode'' is changed to ``failure
mode'' to be consistent with the changes to this term made elsewhere in
the final rule. Consistent with the NPRM, Sec. 450.115(c)(4) requires
that an FSA methodology must identify the evidence for validation and
verification required by Sec. 450.101(g), which addresses the required
accuracy and validity of data and scientific principles. For example,
the ``accounting for all known sources of uncertainty'' requirement
specified in Sec. 450.115(b)(1) must produce results consistent with
or more conservative than the results available from previous mishaps,
tests, or other valid benchmarks, such as higher-fidelity methods.
o. Trajectory Analysis for Normal Flight (Sec. 450.117)
In the NPRM, proposed Sec. 450.117 (Trajectory Analysis for Normal
Flight) set requirements for an FSA for normal trajectories. The
proposed provision was meant to distinguish between variability in the
intended trajectory and uncertainties due to random sources of
dispersion such as winds and vehicle performance. The FAA explained
that all FSAs depend on some form of analysis of the trajectory under
normal conditions, otherwise known as a normal trajectory. That is, a
vehicle's trajectory when it performs as intended and under normal
conditions must be understood to determine the effects of malfunctions
along its flight path.
Proposed Sec. 450.117(a)(1) required an FSA to include a
trajectory analysis that established, for any phase of flight within
the scope of proposed Sec. 450.113(a), the limits of a launch or
reentry vehicle's normal flight as defined by the nominal trajectory,
and sets of trajectories sufficient to characterize variability and
uncertainty during normal flight. First, proposed Sec.
450.117(a)(1)(i) required a set of trajectories to characterize
vulnerability. This set would be required to describe how the intended
trajectory could vary due to the conditions known prior to initiation
of flight. Second, proposed Sec. 450.117(a)(1)(ii) required a set of
trajectories to characterize uncertainty. This set would be required to
describe how the actual trajectory could differ from the intended
trajectory due to random uncertainties. The FAA also proposed to
require an FSA to include a trajectory analysis establishing a fuel
exhaustion trajectory in proposed Sec. 450.117(a)(2) and, for vehicles
with an
[[Page 79632]]
FSS, trajectory data or parameters that describe the limits of a useful
mission in proposed Sec. 450.117(a)(3).
In the final rule, the FAA adopts proposed Sec. 450.117 with
revisions. The FAA makes clarifying changes for a number of
requirements regarding trajectory analysis; removes and relocates the
fuel exhaustion trajectory requirement to Sec. 450.119; and removes
and relocates references to ``limits of a useful mission'' to Sec.
450.119. The FAA also makes changes to remove prescriptiveness in favor
of more performance-based language.
Boeing, Lockheed Martin, Northrop Grumman, Sierra Nevada, and ULA
recommended changing the term ``normal'' flight to ``nominal'' flight
in numerous parts of proposed Sec. 450.117. The FAA does not agree
with this recommendation because both of these terms are defined by the
FAA and are distinct. Section 401.7 defines ``nominal'' to mean, in
reference to launch vehicle performance, trajectory, or stage impact
point, a launch vehicle flight for which all vehicle aerodynamic
parameters are as expected, all vehicle internal and external systems
perform as planned, and there are no external perturbing influences
other than atmospheric drag and gravity. Section 401.7 defines ``normal
flight'' to mean the flight of a properly performing vehicle whose
real-time vacuum IIP does not deviate from the nominal vacuum
instantaneous impact point by more than the sum of the wind effects and
the three-sigma guidance and performance deviations in the uprange,
downrange, left-crossrange, or right-crossrange directions. Thus, in
simple terms, a nominal trajectory is a single trajectory that the
vehicle would fly in the absence of wind effects and guidance and
performance variability. Section 401.7 defines ``normal trajectory'' to
mean ``a trajectory that describes normal flight.'' The FAA retains the
definitions of these terms. It is virtually impossible for flights to
be nominal such that all aerodynamic parameters and systems are as
expected without the influence of any uncertainties. To replace
``normal'' with ``nominal'' would substantively change the meaning of
the rule, as uncertainty does not apply to a nominal trajectory.
Requiring normal flight trajectories is a more permissive range of
trajectories than nominal flight and allows the rule to be performance
based within safe parameters. The FAA retains the use of the terms as
proposed.
In the final rule, the FAA narrows the scope of the set of
trajectories to characterize uncertainty due to random uncertainties
``in all parameters with a significant influence on the vehicle's
behavior through normal flight'' in Sec. 450.117(a)(2). Generally, the
FAA considers ``a significant influence'' to include any parametric
uncertainties within three-sigma that affect the crossrange IIP
location or downrange IIP rate by at least one percent because the IIP
location and rate is often a convenient surrogate for the potential
impact locations of hazardous debris. One percent is a typical
threshold value used in RCC 321-20 Standard and Supplement. Thus, the
final rule does not intend for applicants to characterize the influence
of all random uncertainties or variability, but only those with a
significant influence on the potential impact locations for hazardous
debris.
The FAA removes the NPRM requirements for a fuel exhaustion
trajectory in proposed Sec. 450.117(a)(2) and its associated
application requirement in proposed Sec. 450.117(d)(3)(ii). The
requirements for this analysis are more appropriately located in the
malfunction flight section because a fuel exhaustion trajectory is a
malfunction trajectory that results when thrust termination does not
occur as planned. A fuel exhaustion trajectory is not always required;
however, such an analysis could be necessary for certain operations.
For example, a fuel exhaustion trajectory will be necessary under the
final rule Sec. 450.119(a)(2) for a return to launch site scenario. As
a result of this removal, the FAA combines proposed Sec. 450.117
paragraph (a) with paragraph (a)(1) as a new paragraph (a), and re-
designates proposed Sec. 450.117(a)(1)(i) and (a)(1)(ii) as Sec.
450.117(a)(1) and (a)(2), respectively.
The NPRM referenced the limits of a useful mission in proposed
Sec. 450.117(a)(3). In the final rule, the FAA moves all references to
the limits of a useful mission from Sec. 450.117, including proposed
Sec. 450.117(a)(3), to Sec. 450.119 (Trajectory Analysis for
Malfunction Flight). The FAA finds that the requirements associated
with the limits of a useful mission belong in the malfunction flight
section because limits of a useful mission can exceed the bounds of
normal flight.
The FAA received several comments on the proposed use of the term
``limits of a useful mission.'' A summary of the comments and FAA's
responses can be found in the preamble section on Trajectory Analysis
for Malfunction Flight.
The FAA adopts Sec. 450.117(b) as proposed. A final trajectory
analysis must use a six-degree of freedom trajectory model to satisfy
the requirements of Sec. 450.117(a). The FAA did not receive comments
on this proposal.
Proposed Sec. 450.117(c) would have required a trajectory analysis
to account for all wind effects including profiles of winds that are
not less severe than the worst wind conditions under which flight might
be attempted and for uncertainty of the wind conditions. In the final
rule, the FAA revises the requirement to state that a trajectory
analysis must account for ``atmospheric conditions that have an effect
on the trajectory'' rather than ``all wind effects.'' The FAA notes
that the revision captures the intent of (1) the proposed requirement
to account specifically for wind effects under all foreseeable
conditions within the flight commit criteria and consistent with the
flight abort rules, and (2) the proposed requirement in Sec.
450.117(a) to establish sets of trajectories sufficient to characterize
variability and uncertainty during normal flight.
The FAA recognizes that wind is the primary atmospheric
consideration for most vehicles, but, for some (non-traditional)
vehicles, other atmospheric parameters such as density, humidity, or
temperature may affect trajectory and be part of the flight commit
criteria. Although these other conditions would have necessarily been
accounted for in the trajectory analysis for normal flight as
``uncertainties'' in the introductory language to Sec. 450.117(a), the
final rule expressly refers to all atmospheric conditions in Sec.
450.117(c). The FAA also notes that flight in the context of this
section refers to the period of launch or reentry within the scope of
Sec. 450.113.
Boeing commented that it is impossible to account for all wind
effects, as wind models were local and limited in altitude. Boeing
recommended incorporating an altitude limit of 60,000 feet, and
modifying the requirement to state, ``a trajectory analysis must
account for launch and, if different, reentry site wind effects, as
applicable, including profiles of winds that are no less severe than
the worst wind conditions under which flight might be attempted, and
for uncertainty in the wind conditions.''
The FAA notes that the proposed requirement concerning wind
effects, revised to ``atmospheric effects'' in the final rule,
specifies profiles under which flight may be attempted based on the
launch commit criteria and flight abort rules. The NPRM and the final
rule set performance level requirements that avoid placing an arbitrary
altitude limit that may not encompass all the conditions that may have
an effect on a
[[Page 79633]]
normal trajectory. Accordingly, the final rule requires a trajectory
analysis to account not for all wind effects, but instead for
atmospheric conditions that have an effect on the trajectory, including
any uncertainty. Accounting for atmospheric effects on the trajectory
will be addressed in guidance.
Blue Origin stated the requirements in proposed Sec. 450.117(b)
through (d)(2) amount to translating complex vehicle trajectory models
into verbiage for delivery to FAA for licensing. Blue Origin proposed
revising the language to specify vehicle state vector parameters in
terms of position, attitude, velocity, thrust, and mass. In terms of a
statistical distribution of each parameter, Blue Origin recommends
providing a covariance matrix describing vehicle guidance and
performance uncertainty as meeting the intent of the requirement.
The FAA notes Blue Origin's recommendation to specify the vehicle's
position and velocity during normal flight using covariance matrices
would satisfy the requirement in Sec. 450.117(a)(2) because that
approach was identified in Appendix A to part 417 under
A417.7(g)(7)(xiii). The approach in Appendix A to part 417 under
A417.7(g)(7)(xiii) meets the requirement in Sec. 450.117(a)(2) because
a set of covariance matrices for the vehicle position coordinates and
velocity component magnitudes are an acceptable means to describe how
the actual trajectory could differ from the intended trajectory due to
random uncertainties in all parameters with a significant influence on
the vehicle's behavior throughout normal flight. However, the FAA
recognizes that other approaches, including a sufficiently large \108\
set of Monte Carlo sample trajectories,\109\ may also satisfy the
requirement. The FAA does not intend to prescribe a specific method to
characterize normal flight. Therefore, the FAA declines Blue Origin's
recommendation to revise the requirement to specify vehicle state
vector and covariance parameters. Instead, the final rule implements
performance-based trajectory analysis requirements as proposed, such
that an applicant must submit a description of the methods and input
data used to characterize the vehicle's flight behavior throughout
normal flight.
---------------------------------------------------------------------------
\108\ The FAA will determine what constitutes a sufficiently
large set of Monte Carlo trajectories pursuant to the level fidelity
of analysis requirements in Sec. 450.115(b).
\109\ Monte Carlo methods include computational algorithms that,
for example, repeatedly sample from probability distributions that
characterize input parameters (such as the weight, thrust, and drag
of a vehicle) and perform physics-based (such as Newton's laws)
simulations to obtain numerical results (such as a set of
trajectories that characterize flight under normal or malfunction
conditions).
---------------------------------------------------------------------------
The FAA proposed application requirements for trajectory analysis
for normal flight in Sec. 450.117(d). In the final rule, the FAA
adopts proposed Sec. 450.117(d) with revisions. Specifically, the FAA
removes the proposed requirement to describe the methodology used to
determine the limits of a useful mission in Sec. 450.117(d)(1).
Instead, an equivalent requirement appears in Sec. 450.119(c)(2) of
the final rule. The FAA also removes the items proposed in Sec.
450.117(d)(1)(i) through (d)(1)(iv) because they were redundant with
the performance-based requirements that apply to all FSA in accordance
with Sec. 450.115(c).\110\ The FAA removes the prescriptive
requirements in Sec. 450.117(d)(2)(ii) through (d)(2)(iv) proposed in
the NPRM because these requirements are captured with the final rule
requirement in Sec. 450.117(d)(2), as explained later in this preamble
section. In addition, the FAA re-designates proposed Sec.
450.117(d)(2)(i) as (d)(3), and 450.117(d)(3) as (d)(4) with a minor
revision. The FAA removed proposed Sec. 450.117(d)(4), which required
an applicant to submit additional products that allow an independent
analysis, as requested by the Administrator, because the requirement
was redundant with Sec. 450.45(e)(7)(ii).
---------------------------------------------------------------------------
\110\ Section 450.115(c) requires an applicant to submit a
description of the FSA methodology, including identification of: (1)
The scientific principles and statistical methods used; (2) all
assumptions and their justifications; (3) the rationale for the
level of fidelity; (4) the evidence for validation and verification
required by Sec. 450.101(g); (5) the extent that the benchmark
conditions are comparable to the foreseeable conditions of the
intended operations; and (6) the extent that risk mitigations were
accounted for in the analyses.
---------------------------------------------------------------------------
In the NPRM, proposed Sec. 450.117(d)(2) required an applicant to
submit a description of the input data used to characterize the
vehicle's flight behavior throughout normal flight and limits of a
useful mission. The proposal would have required a description of the
wind input data, including uncertainties (Sec. 450.117(d)(2)(ii)); a
description of the parameters with a significant influence on the
vehicle's behavior throughout normal flight, including a quantitative
description of the nominal value for each significant parameter
throughout normal flight (Sec. 450.117(d)(2)(iii)); and a description
of the random uncertainties with a significant influence on the
vehicle's behavior throughout normal flight, including a quantitative
description of the statistical distribution for each significant
parameter (Sec. 450.117(d)(2)(iv)).
Commenters asserted these proposed requirements were too
prescriptive, and the FAA agrees. The FAA revises Sec. 450.117(d)(2)
to require an applicant to submit the quantitative input data,
including uncertainties, used to model the vehicle's normal flight in
six degrees of freedom. This revision in the final rule captures the
parameters of the proposed requirements in Sec. 450.117(d)(2)(ii)
through (d)(2)(iv), while allowing for more flexibility in the
application of the regulatory requirements. Quantitative input data
used to model the vehicle's normal flight in six degrees of freedom
includes comprehensive sets of aerodynamic and mass properties.
Explanation and details on how to comply with these requirements will
be included in Advisory Circular 450.117-1, ``Trajectory Analysis.''
The FAA retains the requirement proposed in Sec. 450.117(d)(2)(i)
and re-designates it as Sec. 450.117(d)(3) in the final rule. In
addition, the FAA changes the term ``wind effects'' to ``atmospheric
effects'' to be consistent with Sec. 450.117(c) of the final rule.
The FAA revises proposed Sec. 450.117(d)(3) as discussed in this
paragraph and re-designates it as Sec. 450.117(d)(4) in the final
rule. The proposal required an applicant to submit representative
normal flight trajectory analysis outputs, including the position,
velocity, and vacuum IIP, for each second of flight. Blue Origin
commented that this requirement created an unnecessary burden to
calculate vacuum IIP for potentially hundreds or thousands of normal
and malfunction vehicle trajectories. Blue Origin stated that vacuum
IIP was not representative of where vehicle hazards may impact the
Earth and believed this requirement should only apply to the nominal
trajectory.
The FAA disagrees that the IIP application requirement would have
created an unnecessary burden; however, the final rule removes the
application requirement because vacuum IIP can be readily computed if
necessary from the position and velocity vectors, which are a part of
the application materials. In the final rule, Sec. 450.117(d)(4)
specifies that the representative normal flight trajectory analysis
outputs include orientation of the vehicle in addition to the position
and velocity data specified in the proposal. The FAA notes that
orientation is inherent in any six-degree of freedom trajectory model,
as required by both the proposed and final Sec. 450.117(b).
Orientation is important to
[[Page 79634]]
public safety when the induced velocities have a preferred direction.
The FAA also removes the requirement proposed in Sec.
450.117(d)(3)(ii) that applies to fuel exhaustion trajectory under
otherwise nominal conditions, because a fuel exhaustion trajectory is
merely one specific type of malfunction trajectory and is not
necessarily required for all applicants. For example, a fuel exhaustion
trajectory would be necessary under the final rule for a return to
launch site scenario but not for a typical unguided suborbital rocket.
The requirement in Sec. 450.119(a)(2) of the final rule is used to
determine whether an applicant must include a fuel exhaustion
trajectory.
p. Trajectory Analysis for Malfunction Flight (Sec. 450.119)
In the NPRM, the FAA proposed requirements associated with
trajectory analysis for malfunction flight in Sec. 450.119. As stated
in the NPRM, a malfunction trajectory analysis is necessary to
determine how far a vehicle can deviate from normal flight. This
analysis helps determine potential impact points in the case of a
malfunction and is therefore a vital input for the analyses needed to
demonstrate compliance with risk criteria.
In the final rule, the FAA adopts proposed Sec. 450.119 with
revisions. The FAA removes, as unnecessary, proposed Sec.
450.119(a)(1), which required that an FSA include a trajectory analysis
that establishes the vehicle's capability to depart from normal flight,
formally defined in terms of IIP in Sec. 401.7. Proposed Sec.
450.119(a)(2) is re-designated (a)(1) and requires that a trajectory
analysis establish the vehicle's deviation capability in the event of a
malfunction during flight. The FAA adds a new requirement, designated
as Sec. 450.119(a)(2), which requires that an FSA must include a
trajectory analysis that establishes the trajectory dispersion
resulting from reasonably foreseeable malfunctions. This language
retains the concept of proposed Sec. 450.119(a)(1), but revises the
regulatory language to allow for a medium-fidelity FSA approach (e.g.,
corridor method) for which the vehicle vacuum IIP during a malfunction
is not specified, as explained in the FAA's Flight Safety Analysis
Handbook.\111\ More specifically, the proposed requirement in Sec.
450.119(a)(1) to establish the vehicle's capability to depart from
normal flight would have required the analysis to account for the IIP
in modeling of a malfunction trajectory because normal flight is
defined in terms of IIP. Thus, the proposed requirement in Sec.
450.119(a)(1) would have foreclosed a valid medium-fidelity FSA
approach. In the final rule, Sec. 450.119(a)(1) and Sec.
450.119(a)(2) provide flexibility and permit at least one approach that
allows a simpler computation of risk but still preserves safety. Not
all operations are eligible for this corridor method, but it is valid
when the vehicle debris risks are due to flight phases where the IIP is
moving steadily downrange, and when the failure modes do not involve
distorted impact distributions.\112\ In the final rule, the FAA amended
the requirement to allow this and other simplified methods for those
operations for which they may be valid.
---------------------------------------------------------------------------
\111\ See Flight Safety Analysis Handbook, V1.0, August 2009
(available at https://www.faa.gov/about/office_org/headquarters_offices/ast/media/Flight_Safety_Analysis_Handbook_final_9_2011v1.pdf).
\112\ Distorted impact distributions are often caused by actions
taken in response to abort criteria.
---------------------------------------------------------------------------
The FAA adds Sec. 450.119(a)(3) in the final rule. Section
450.119(a)(3) states that an FSA must include a trajectory analysis
that establishes, for vehicles using flight abort as a hazard control
strategy under Sec. 450.108, trajectory data or parameters that
describe the limits of a useful mission. This requirement was found in
Sec. 450.117(a)(3) of the NPRM. The FAA finds that trajectory analysis
requirements associated with the limits of a useful mission belong in
the malfunction flight section because presumably normal flight can
attain the one or more objectives within the flight azimuth limits.
The requirement in Sec. 450.119(a)(3) is related to the
requirement proposed in Sec. 450.119(a)(1) because trajectories that
are outside of the normal envelope can still be ``useful,'' even though
they involve a malfunction.\113\ The FAA notes that an operator can
elect to designate the normal mission trajectories as the limits of a
useful mission and meet the application requirement to submit data that
describes the limits of a useful mission, but this may result in the
termination of a flight that could still achieve a mission objective.
---------------------------------------------------------------------------
\113\ Publicly available information indicates that the flight
of the Ariane 5 VA241 that occurred from the Guiana Space Centre on
January 25, 2018 may be a potential empirical example. There the
flight path anomaly was evident from the beginning of flight and the
payloads were deployed into an orbital inclination that was
approximately 18 degrees from the intended orbit, yet the payloads
were still able to deliver useful data.
---------------------------------------------------------------------------
The FAA received several comments on the NPRM's proposal to use the
``limits of a useful mission'' to inform the development of flight
safety limits and when flight abort was necessary, and to establish the
width of a gate. Microcosm requested that the FAA define ``a useful
mission.'' Boeing, Lockheed Martin, Northrop Grumman, and ULA
recommended changing the definition of ``limits of a useful mission''
to mean the trajectory or other parameters that bound performance of a
mission that can attain its primary objective. Blue Origin disagreed
with the addition of ``limits of a useful mission'' to the regulation
and stated that regulating what is considered a useful mission was
outside of the FAA's jurisdiction.
In the final rule, the FAA adopts a new definition of a ``useful
mission'' in Sec. 401.7 and amends the proposed definition of ``limits
of a useful mission'' to mean the trajectory data or other parameters
that bound the performance of a useful mission, including flight
azimuth limits. A ``useful mission'' means a mission that can attain
one or more objectives and is based on the definition of ``limits of a
useful mission'' proposed in the NPRM. The definition of ``limits of a
useful mission'' adopted in the final rule removes the language
``describe the limits of a mission that can attain the primary
objective'' and replaces it with ``bound the performance of a useful
mission,'' consistent with the commenters' recommendation. In this
context, bounding the performance will include flight azimuth limits
and could include limits on the altitude versus distance downrange or
other physics-based limits depending on the nature of the operation.
The FAA makes these changes because it recognizes that pursuit of
objectives other than the primary objective may be considered a useful
mission. However, when all other objectives can no longer be achieved
the FAA does not consider the collection of data related to a failure
in and of itself to be a useful mission. This is because mere failure
data collection alone does not justify continued risk to the public.
Therefore, the final rule states in Sec. 450.119(a)(3) that the FAA
does not consider the collection of data related to a failure to be a
useful mission.
The FAA finds the requirements associated with ``useful mission''
and ``limits of a useful mission'' are central to the hazard control
strategies. The FAA is not attempting to regulate what the operator or
its customer considers a useful mission. The FAA instead is simply
requiring that the applicant identify which missions are useful so that
vehicles that fly outside of these parameters erroneously are not
permitted to threaten the public. The FAA finds it necessary to include
a
[[Page 79635]]
requirement that would prevent a launch or reentry vehicle from
continued flight that would increase risk to the public if that vehicle
can no longer achieve an objective of the operator, outside of the
collection of data related to a failure.
Blue Origin recommended replacing ``limits of a useful mission''
with ``limits to meet public risk criteria.'' The FAA does not agree
with this recommendation. As described in the section on
CEC, public risk criteria alone are inadequate to establish
the need for an FSS, the reliability of the FSS, or the timing of an
FSS activation to ensure public safety. Similarly, while some might
consider risk-based flight safety limits as a reasonable approach to
risk management when a vehicle is on a potentially useful mission, once
a malfunction results in a mission that can no longer achieve an
objective, then hazard containment should be the goal and flight abort
must be used to protect the public against high consequence events.
Application of the limits of a useful mission benefits the operator
because flights with trajectories that are outside of the normal
envelope, but still useful according to the operator, will be permitted
to continue without flight abort as long as they comply with Sec.
450.108(d)(7), including trajectories that overfly the public. This was
the intent of proposed Sec. 450.123(b)(6) in the NPRM, and remains the
intent of Sec. 450.108(d)(7) in the final rule.
Boeing, Lockheed Martin, Northrop Grumman, and ULA commented that
limits of a useful mission were already addressed in flight termination
triggers, and that proposed Sec. 450.117(a)(3) requiring trajectory
data or parameters that describe the limits of a useful mission should
be replaced with limits that trigger flight termination.
The FAA declines to adopt this recommendation because of the
relationship between the limits of a useful mission and flight safety
limits. Pursuant to Sec. 450.108(c)(2) in the final rule (similar to
proposed Sec. 450.123(a)(2) of the NPRM), flight safety limits define
when an operator must initiate flight abort to prevent continued flight
from increasing public risk in uncontrolled areas if the vehicle is
unable to achieve a useful mission. Under the final rule, flight safety
limits will be developed after the limits of a useful mission are
identified. An operator can elect to designate the normal mission
trajectories as the limits of a useful mission and meet the application
requirement to submit data describing the limits of a useful mission,
but this may result in the termination of a flight that could still
achieve a mission objective. As an example, during an operation for
which a gate width was determined using only a vehicle's normal
trajectory envelope, a failure before the gate resulted in the flight
nearly being terminated at the gate, even though it went on to achieve
the mission's primary objective. In that instance, if the limits of a
useful mission data included flight azimuth limits, this vehicle would
have had more margin in the form of a wider gate. Under the final rule,
if an operator decides that placing a payload in any orbit or
withholding abort for crewed flights is more useful than terminating a
flight, it may declare that flight is useful at any azimuth or altitude
and may fly the vehicle on any trajectory that meets Sec.
450.108(d)(7). However, flight safety limits that terminate flights
that are no longer useful should be placed so that they do not increase
risk compared to continued flight, pursuant to Sec. 450.108(d)(6).
The FAA found it necessary to move all references to the limits of
a useful mission from Sec. 450.117 to Sec. 450.119 (Trajectory
Analysis for Malfunction Flight), including proposed Sec.
450.117(a)(3). The FAA finds that the requirements associated with the
limits of a useful mission belong in the malfunction flight section
because limits of a useful mission can exceed the bounds of normal
flight.
In the NPRM, the FAA proposed in Sec. 450.119(b) that a
malfunction trajectory analysis must account for each cause of a
malfunction flight, including software and hardware failures. For each
cause of a malfunction trajectory, the analysis would have been
required to characterize the foreseeable trajectories resulting from a
malfunction. The proposal included six items in Sec. 450.119(b)(1)
through (b)(6) that would be required to be included in the analysis.
In the final rule, the FAA adopts proposed Sec. 450.119(b) with
revisions. The FAA removes proposed Sec. 450.119(b)(1) through (b)(3)
because they are no longer needed due to the adoption of performance-
based standards and re-designates proposed Sec. 450.119(b)(4) through
(b)(6) as (b)(1) through (b)(3). Also, the FAA revises the introductory
language in Sec. 450.119(b) to improve clarity and remove prescriptive
language.
Blue Origin commented that it was not feasible to model a
malfunction turn trajectory for each software or hardware cause, only
for vehicle responses to the cause as proposed in Sec. 450.119(b).
Blue Origin recommended striking the phrase, ``for each cause of a
malfunction trajectory,'' and instead indicate that a malfunction
trajectory analysis must characterize the foreseeable trajectories
resulting from a malfunction.
The FAA partially agrees with Blue Origin's recommendations. The
FAA deletes the proposed language in Sec. 450.119(b), ``for each cause
of a malfunction trajectory, the analysis must characterize the
foreseeable trajectories resulting from a malfunction,'' but retains
the phrase ``for each cause of a malfunction flight'' in the first
sentence of Sec. 450.119(b). The FAA notes the analysis must account
for the probability of each set of trajectories that characterize a
type of malfunction flight, and that probability must account for each
cause of a malfunction flight, including software and hardware
failures, for every period of normal flight.
The FAA notes that use of the phrase ``for each type of
malfunction'' in Sec. 450.119(b) of the final rule addresses Blue
Origin's comment that it is not feasible to model a malfunction turn
trajectory for each cause, but only for vehicle responses to the cause.
The term ``each type of malfunction'' refers to the vehicle response to
the cause and multiple causes could result in a similar vehicle
response. For example, under part 417 a malfunction turn analysis would
account for a series of ``tumble turns,'' as enumerated in Appendix A
to part 417 under A417.9(d)(5), which result in the launch vehicle
rotating due to a constant thrust vector offset angle. The FAA
recognizes that there could be multiple causes for a constant thrust
vector offset, such as a jammed mechanism, loss of electrical power, or
loss of hydraulic fluid pressure. Thus, the probability of a tumble
turn must account for ``each cause of a malfunction flight, including
software and hardware failures,'' in accordance with Sec. 450.119(b).
Furthermore, the FAA recognizes that multiple sets of trajectories are
necessary to characterize the vehicle behavior in response to a
malfunction. An example is a malfunction that results in a constant
thrust vector offset, because a range of thrust vector offsets is
reasonably foreseeable (from very small angles that would cause a slow
departure from normal flight up to the maximum feasible thrust offset
that would typically result in a rapid tumble of the vehicle). Thus,
there is a natural question regarding the appropriate resolution of the
malfunction trajectory analysis. The intent of the requirements in
Sec. 450.119 is to produce sets of trajectories that are sufficient to
characterize the public risks posed by each type of malfunction. Thus,
the final rule sets a performance standard in Sec. 450.119(b) that the
analysis for each
[[Page 79636]]
type of malfunction must have sufficient temporal and spatial
resolution to establish flight safety limits, if any, and individual
risk contours that are smooth and continuous.
In order to be less prescriptive, the FAA further amends Sec.
450.119(b) in response to Blue Origin's comment. The NPRM proposed in
Sec. 450.119(b)(1) through (b)(3) that the malfunction trajectory
analysis must account for (1) all trajectory times during the thrusting
phases, or when the lift vector is controlled, during flight; (2) the
duration, starting when a malfunction begins to cause each flight
deviation throughout the thrusting phases of flight; and (3) trajectory
time intervals between malfunction turn start times that are sufficient
to establish flight safety limits, if any, and individual risk contours
that are smooth and continuous. The FAA removes proposed Sec.
450.119(b)(1) through (b)(3) and consolidates these requirements into
Sec. 450.119(b). This revision sets more performance-based
requirements for the scope and resolution of the malfunction trajectory
analysis to create flexibility in demonstrating the trajectory
dispersion resulting from reasonably foreseeable malfunctions. In the
final rule, Sec. 450.119(b) will require the analysis for each type of
malfunction to have sufficient temporal and spatial resolution to
establish flight safety limits, if any, and individual risk contours
that are smooth and continuous.
In the NPRM, proposed Sec. 450.119(b)(2) required that a
malfunction trajectory analysis account for the duration, starting when
a malfunction begins to cause each flight deviation throughout the
thrusting phases of flight. Virgin Galactic commented that a
malfunction turn analysis would not apply to operations for which a
pilot is in control of a winged vehicle because the pilots act as an
FSS.
The FAA is aware that having pilots onboard and in control of a
vehicle during flight may mitigate the need for certain malfunction
analyses; however, there may still be instances when pilots may become
incapacitated during flight. In any such instances, a trajectory
analysis for malfunction flight would still potentially be necessary to
identify impact points as an essential input for risk analyses to
demonstrate compliance with risk criteria in Sec. 450.101. The FAA
notes that flight simulators can facilitate the development of
representative malfunction trajectory analysis outputs in cases in
which pilot responses have a significant influence on the trajectory
dispersion resulting from reasonably foreseeable malfunctions.
Virgin Galactic also recommended a wording change to Sec.
450.119(b)(2) to define the duration as, ``starting when a malfunction
begins . . . until such time the effects of the malfunction are
mitigated.'' As previously discussed, the FAA does not adopt proposed
Sec. 450.119(b)(2) in the final rule. However, the FAA notes in the
final rule, the combination of the requirement for sufficient temporal
resolution to establish smooth and continuous individual risk contours,
along with the requirement to account for the timing of each
malfunction trajectory's termination due to means other than flight
abort, including vehicle breakup, ground impact, or orbital insertion,
provide a sufficient performance-based specification to establish the
duration of the malfunction trajectory analysis. In addition, the FAA
finds that the commenter's suggestion that the duration of the analysis
continue only ``until such time the effects of the malfunction are
mitigated'' would not analyze both the success and the failure of the
mitigation necessary to quantify the risk and consequence in the event
that the FSS fails.
As a result of removing proposed Sec. 450.119(b)(1) through
(b)(3), the FAA re-designates proposed Sec. 450.119(b)(4) as Sec.
450.119(b)(1) in the final rule. Proposed Sec. 450.119(b)(4) required
that a trajectory analysis for malfunction flight account for the
relative probability of occurrence of each malfunction turn for which
the vehicle is capable. In the final rule, the FAA revises Sec.
450.119(b)(1) to reflect that the analysis must account for the
relative probability of occurrence of each malfunction, and not
specifically a malfunction turn. The FAA views the term ``malfunction
turn'' as outdated. The requirement in the final rule is consistent
with the proposal.
The FAA re-designates proposed Sec. 450.119(b)(5) as Sec.
450.119(b)(2) in the final rule. The FAA also revises Sec.
450.119(b)(2) to correct an omission of the word ``trajectory.''
Furthermore, the FAA adds ground impact and orbital insertion as
potential termination states. The FAA found the exclusion of these
states in the NPRM to be a deficiency that would have resulted in an
operator's inability to meet regulatory requirements for quantifying
the risk because malfunctions can result in trajectories that result in
ground impact or orbital insertion, as well as vehicle break-up, and
those additional outcomes can pose significant public risks as well.
The FAA re-designates proposed Sec. 450.119(b)(6) as Sec.
450.119(b)(3) in the final rule and revises the requirements. Section
450.119(b)(3) requires that a malfunction trajectory analysis account
for the parameters with a significant influence on a vehicle's flight
behavior from the time when a malfunction begins to cause a flight
deviation until each malfunction trajectory will terminate due to
vehicle breakup, ground impact, or orbital insertion. The FAA adds the
phrase ``parameters with a significant influence on vehicle's flight
behavior'' because the analysis must account for these parameters to
characterize sufficiently the vehicle's flight behavior. This language
was proposed in the application requirements in Sec.
450.119(c)(2)(iii) and has been added to paragraph (b)(3) in the final
rule. The FAA received no comments on this language. The FAA also
clarifies that a malfunction trajectory can terminate due to orbital
insertion, not just ground impact or predicted structural failure
(vehicle breakup), as specified in the NPRM, for the same reason that
those outcomes were added to Sec. 450.119(b)(2). Finally, the FAA
replaces the proposed term ``predicted structural failure'' with the
term ``vehicle break-up'' in the final rule. This change is consistent
with the terminology used in Sec. 450.121 (Debris Analysis).
Blue Origin commented that smooth and continuous contours were not
typically feasible unless flight limits were also included in the
malfunction turn analysis. Blue Origin also recommended adding flight
abort to the list of vehicle end state conditions.
The FAA did not add flight abort to the list of vehicle end state
conditions based on Blue Origin's comment because of the relationship
between trajectory analysis for malfunction flight and risk analyses
that produce risk contours. Risk analyses must consider outcomes of
flight abort and FSS inaction, whether through failure of the FSS or
because no flight abort rules were violated, which could result in
vehicle breakup, ground impact, or orbital insertion. If the
trajectories for malfunction flight were terminated when flight abort
was predicted, no trajectory data would exist for cases when the FSS
failed. The rule ensures that complete trajectory data exists to
account for flight abort action and inaction in risk analyses. More
specifically, ending the malfunction trajectories at the flight safety
limits conflicts with the requirement in Sec. 450.108(d)(5) to account
for proper functioning of the FSS and failure of the FSS in individual,
collective, and conditional risk evaluations. It was not necessary to
amend the rule according
[[Page 79637]]
to Blue Origin's comment because flight abort is already a necessary
end case to be analyzed when producing risk contours in accordance with
Sec. 450.133(e)(2)(iii), which is a separate analysis from producing
trajectories for malfunction flight.
Section 450.119(b)(4) explicitly requires a malfunction trajectory
analysis to account for potential FSS failure, if an FSS is used,
because that can also influence the termination condition of a
malfunction trajectory. For example, if a malfunction trajectory
triggers a flight abort rule, potential outcomes of the trajectory are
abort (through destruct, thrust termination, or other method) or
continued flight resulting in aerodynamic breakup, intact impact, or
orbital insertion if the FSS fails. The requirement in Sec.
450.119(b)(4) is consistent with the proposal because both the proposed
and final Sec. 450.115(a) explicitly require that an operator's FSA
method must account for all failures of safety-critical systems during
nominal and non-nominal launch or reentry that could jeopardize public
health and safety and the safety of property. Furthermore, any FSS
required to comply with Sec. 450.143 or Sec. 450.145 necessarily will
meet the definition of a safety-critical system. Therefore, the
proposed requirement Sec. 450.123(a) would have necessitated that the
malfunction trajectory analysis account for the potential failure of
the FSS.
In the NPRM, Sec. 450.119(c) addressed the application
requirements associated with trajectory analysis for malfunction
flight. In the final rule, the FAA adopts the application requirements
in proposed Sec. 450.119(c) with revisions. The revisions include
adding a new Sec. 450.119(c)(2), re-designating proposed Sec.
450.119(c)(2) through (c)(4), and removing proposed Sec.
450.119(c)(1)(i) through (c)(1)(iv).
Proposed Sec. 450.119(c)(1) required an applicant to submit a
description of the methodology used to characterize the vehicle's
flight behavior throughout malfunction flight. In the final rule, the
FAA adopts the proposal and adds a reference to the requirements in
Sec. 450.115(c), which sets the standards for the methodologies used
in the FSA. Also, the FAA removes the items proposed in Sec.
450.119(c)(1)(i) through (c)(1)(iv) because they were redundant with
the performance-based requirements that apply to all FSA in accordance
with Sec. 450.115(c).
In the final rule, a new Sec. 450.119(c)(2) requires an applicant
to submit a description of the methodology used to determine the limits
of a useful mission, in accordance with Sec. 450.115(c). This
requirement was proposed as Sec. 450.117(d)(1) in the NPRM. Moving
this application requirement to Sec. 450.119 is consistent with the
relocation of its associated analysis requirement to Sec.
450.119(a)(3). The FAA re-designates proposed Sec. 450.119(c)(2) as
Sec. 450.119(c)(3) in the final rule. The FAA captures the
requirements of proposed Sec. 450.119(c)(2)(i) and (c)(2)(ii) and
relocates them in Sec. 450.119(c)(3)(i) and (c)(3)(ii).
The FAA re-designates proposed Sec. 450.119(c)(2)(iii) as Sec.
450.119(c)(3)(iii) in the final rule and revises the final Sec.
450.119(c)(3)(iii) to specify the need for an applicant to submit a
quantitative description of the parameters, including uncertainties,
with significant influence on the vehicle's malfunction behavior for
each type of malfunction flight characterized. Proposed Sec.
450.119(c)(2)(iii) required an applicant to submit a description of the
input data used to characterize the vehicle's malfunction flight
behavior, including a description of the parameters with a significant
influence on the vehicle's behavior throughout malfunction flight for
each type of malfunction flight characterized. Proposed Sec.
450.119(c)(2)(iii) also required a quantitative description of the
nominal value for each significant parameter throughout normal flight.
The FAA specifically replaces the proposed requirements in Sec.
450.119(c)(2)(iii) and (c)(2)(iv) \114\ with the requirement in Sec.
450.119(c)(3)(iii) in the final rule. This revision retains the intent
of the requirements proposed in the NPRM but is more flexible in its
application because, although it still requires a quantitative
description, the regulation permits something other than the
statistical distribution that would have been required by the proposal.
---------------------------------------------------------------------------
\114\ Proposed Sec. 450.119(c)(2)(iv) required an applicant to
submit a description of the random uncertainties with a significant
influence on the vehicle's behavior throughout malfunction flight
for each type of malfunction flight characterized, including a
quantitative description of the statistical distribution for each
significant parameter.
---------------------------------------------------------------------------
The FAA re-designates proposed Sec. 450.119(c)(3) as Sec.
450.119(c)(4) in the final rule. The FAA also removes the need for the
vacuum IIP for each second of flight. The FAA makes this change in
response to Blue Origin's comment on computing vacuum IIP for a large
number of trajectories, as addressed in the preamble section on Sec.
450.117.
The FAA adopts the requirements in Sec. 450.119(c)(4)(i) as
proposed in Sec. 450.119(c)(3)(i) in the NPRM. The FAA received no
comments on proposed Sec. 450.119(c)(3)(i). The FAA adopts, with
revisions, the requirements in Sec. 450.119(c)(4)(ii) as proposed in
Sec. 450.119(c)(3)(ii) in the NPRM. Proposed Sec. 450.119(c)(3)(ii)
required submission of the probability of each trajectory that
characterizes a type of malfunction flight. Blue Origin commented that
delivering probabilities for each trajectory modelled was not practical
or useful for independent assessment. Instead, Blue Origin proposed
revising the regulatory language to require the applicant to submit the
probability of each set of malfunction trajectories. The FAA agrees
with this comment and revises Sec. 450.119(c)(4)(ii) in the final rule
to reflect Blue Origin's recommendation.
In the final rule, Sec. 450.119(c)(4)(iii) requires an applicant
to submit a representative malfunction flight trajectory analysis
output, including the position and velocity as a function of flight
time for a set of trajectories that characterize the limits of a useful
mission as described in Sec. 450.119(a)(3) of this section. This
requirement was proposed as Sec. 450.117(d)(3)(v) in the NPRM. As
discussed earlier, the FAA moves the limits of a useful mission
requirement from proposed Sec. 450.117 to Sec. 450.119 in the final
rule.
Lastly, similar to other sections in this rule, the FAA removes the
requirement for an applicant to provide additional products that allow
an independent analysis, as requested by the Administrator. The FAA
finds the requirement redundant with Sec. 450.45(e)(7)(ii). Blue
Origin and the CSF objected to proposed Sec. 450.119(c)(4). Blue
Origin strongly disagreed that the FAA should be in the business of
recreating analysis completed by operators. It submitted that the FAA
should vet the process used by the operator to conduct the analysis,
along with the products of the analysis, to determine whether approval
was warranted. Blue Origin further stated that such independent
recreation of the analysis could lead to protracted back and forth
between an operator and the FAA that was unnecessary if the FAA had
vetted the process used by the operator to conduct the analysis. Blue
Origin proposed to delete this requirement in order to limit the scope
to what was required to establish confidence in the validity of an
operator's analysis. CSF stated that the FAA's practice of recreating
an applicant's analysis should be ended, as it was expensive and
burdensome. CSF recommended that an AC should guide and inform this
analysis.
Virgin Galactic noted that numerous regulations under part 450,
including proposed Sec. 450.119(c)(4), call for additional products
that allow an
[[Page 79638]]
independent analysis, as requested by the Administrator. Virgin
Galactic stated that ``additional products'' was neither defined nor
constrained, permitting the FAA to request any information from
operators at any time. This would create uncertainty regarding the kind
of products an applicant or operator would need to prepare for the FAA.
Virgin Galactic recommended striking the above references in their
entirety. Virgin Galactic commented that, based on prior experience
under part 431 with the FAA requesting additional information, these
regulations may have a significant time and monetary impact on an
operator, if implemented.
The FAA does not agree with the commenters' recommendation to
delete this requirement in its entirety from the final rule. The goal
is for the FAA to evaluate, in an efficient and thorough manner, the
validity of an analysis, along with the products of the analysis
submitted by an operator. The FAA finds that at times it may be
necessary to conduct an independent analysis of the process used by the
operator in order to ensure safety. Additional product requests under
part 431 may have been more frequent due to a lack of well-defined
application requirements. However, under part 450, the FAA expects the
application requirements are sufficient and will generally not request
additional products beyond those that are necessary to protect public
safety. Furthermore, as noted in the NPRM, the FAA has evaluated the
validity of an applicant's proposed methods by comparing the results to
valid benchmarks such as data from mishaps, tests, or validated high-
fidelity methods. Once that has occurred, the FAA can issue an
operator's license for a repeatable operation at a specific site for a
specified range of trajectory azimuths.
Using published benchmarks, the FAA intends to facilitate the
validation and verification of FSA methods to alleviate some of the
needs for the FAA to perform independent analyses. However, the FAA
finds that relying on an approved process alone is insufficient when
certain critical variables may change that affect flight safety or the
MPL determination, or in cases in which the operator proposes launch or
reentry operations that are so unique that relevant benchmarks are
unavailable. Also, the FAA will continue to verify flight operations
for new vehicles, for existing vehicles conducting operations at new
sites, for vehicles flying a trajectory outside the accepted range of
trajectory azimuths, and vehicles that have undergone significant
modifications to vehicle design or flight safety critical systems.
Thus, the FAA foresees continuing to perform independent analyses in
certain circumstances to assure that it has met its statutory
obligation to ensure public health and safety and safety of property.
Although the FAA declines to remove the ``additional products''
reference in Sec. 450.45(e)(7)(ii) of the final rule, the FAA does not
include the redundant references proposed in other sections.
``Additional products'' refers to data that will allow the FAA to
conduct an independent safety analysis in support of its application
assessment and licensing determination. It would be impractical to list
everything needed for every independent analysis. As explained in the
NPRM, the FAA's decision to conduct an independent analysis is usually
reserved for new vehicle concepts, new analysis methods, or proposals
involving unique public safety cases. In all instances, the request for
information is bounded by the regulatory requirements for obtaining a
license and the FAA's need to ensure compliance with the safety
criteria. The FAA adopts the requirement that an applicant submit
additional products to facilitate an independent analysis, as requested
by the Administrator in Sec. 450.45(e)(7)(ii).
q. Debris Analysis (Sec. 450.121)
The NPRM proposed in Sec. 450.121 to require a debris analysis
that characterized the debris generated for each foreseeable vehicle
response mode as a function of vehicle flight time, accounting for the
effects of fuel burn and any configuration changes. The proposal
required that the debris analysis account for each foreseeable cause of
vehicle breakup, including any breakup caused by an FSS activation or
by impact of an intact vehicle. As noted in the NPRM, this would
include debris from a vehicle's jettisoned components and payloads
because such debris could cause a casualty due to impact with an
aircraft or waterborne vessel or could pose a toxic or fire
hazard.\115\ Under proposed Sec. 450.121(c), the debris analysis would
include inert, explosive, and other hazardous vehicle debris from both
normal and malfunctioning flight during launch or reentry.
---------------------------------------------------------------------------
\115\ 84 FR 15383.
---------------------------------------------------------------------------
In the final rule, the FAA adopts proposed Sec. 450.121 with
revisions. Specifically, the FAA preserves the scope of the debris
analysis from the NPRM but consolidates, clarifies, and increases the
flexibility of the regulations in this section. The final rule's
revisions include (1) replacing the requirement to characterize the
debris from ``each foreseeable vehicle response mode'' with ``debris
generated from normal and malfunctioning vehicle flight,'' (2) relying
upon a new definition for ``hazardous debris,'' (3) replacing ``flight
time'' with ``flight sequence,'' and (4) removing prescriptive
thresholds for various debris hazards in favor of a performance-based
standard of ``capable of causing a casualty or loss of functionality to
a critical asset.'' Each of these changes is discussed in the following
paragraphs.
Proposed Sec. 450.121(a) required that an FSA include a debris
analysis that characterizes the debris generated for each foreseeable
vehicle response mode as a function of vehicle flight time, accounting
for the effects of fuel burn and any configuration changes. The NPRM
noted that an operator's debris list generally changes over time with
variations in the amount of available propellant and the jettisoning of
hardware.
In the final rule, the FAA adopts proposed Sec. 450.121(a) with
revisions. The FAA replaces the proposed requirement to characterize
``the debris generated for each foreseeable vehicle response mode as a
function of vehicle flight time, accounting for the effects of fuel
burn and any configuration changes'' with a more flexible and
performance-based requirement to characterize ``the hazardous debris
generated from normal and malfunctioning vehicle flight as a function
of vehicle flight sequence.''
Several commenters suggested changing the term ``foreseeable''
vehicle response modes in Sec. 450.121(a) of the NPRM to ``credible''
vehicle response modes. The commenters stated that credibility was
determined during the system safety analysis, and that the debris
analysis should not have to include extremely improbable, non-credible
failure modes.
The FAA does not agree that the term ``foreseeable'' should be
replaced by the term ``credible'' in this section or throughout the
final rule. The term ``foreseeable'' is used in Sec. 431.35 and also
commonly used in system safety; therefore, the FAA is not changing
these references. The FAA finds that the term ``credible'' is
unacceptably prone to errors in judgment whereas the term
``foreseeable'' is more readily discerned by analysis (e.g., fault
trees). With regard to Sec. 450.121(a) of the final rule, the FAA
adopts the more flexible and performance-based requirement recommended
by the commenters to characterize the hazardous debris generated from
normal and malfunctioning vehicle flight as a
[[Page 79639]]
function of vehicle flight sequence. With the removal of the reference
to ``each foreseeable vehicle response mode'' in Sec. 450.121(a), the
final rule standard for the scope is set by the language in Sec.
450.115(a), specifically by the reference to reasonably foreseeable
events. In addition, the resolution of the failure modes accounted for
in the debris analysis is set by the level of fidelity necessary to
comply with Sec. 450.115(b). The FAA also notes that, in the context
of Sec. 450.121, reasonably foreseeable events that can generate
hazardous debris during malfunctioning vehicle flight generally include
engine/motor explosion, exceeding structural limits due to aerodynamic
loads, inertial loads, aerothermal heating, and activation of a flight
termination system.
In reference to the use of the term ``hazardous debris'' in Sec.
450.121(a), the final rule in Sec. 401.7 includes a definition of this
term. Hazardous debris means any object or substance capable of causing
a casualty or loss of functionality to a critical asset. Hazardous
debris includes inert debris and explosive debris such as an intact
vehicle, vehicle fragments, any detached vehicle component, whether
intact or in fragments, payload, and any planned jettisoned bodies.
This definition is based on proposed Sec. 450.121(c)(1), which
required a debris analysis to identify all inert debris that could
cause a casualty or loss of functionality of a critical asset. The FAA
clarifies that the clause ``whether intact or in fragments'' applies to
the payload and jettisoned bodies as well.
The final rule's definition of ``hazardous debris'' facilitated
streamlining in proposed Sec. Sec. 450.113 through 450.139. For
example, the term hazardous debris in Sec. 450.121(a) establishes a
performance-based threshold, which resulted in the elimination of the
prescriptive debris thresholds proposed in Sec. 450.121(c)(1)(i)
through (v).\116\ Section 450.121(a) retains the essential performance
standards in proposed Sec. 450.121(c)(1) and (c)(2) (i.e., that the
analysis must identify all inert and explosive debris capable of
causing a casualty or loss of functionality to a critical asset), and
allows operators to propose impact vulnerability models appropriate for
the materials used in their licensed operations.
---------------------------------------------------------------------------
\116\ As proposed, an operator would have been required to
include all debris that could impact a human being with a mean
expected kinetic energy at impact greater than or equal to 11 ft-
lbs; impact a human being with a mean impact kinetic energy per unit
area at impact greater than or equal to 34 ft-lb/in2; cause a
casualty due to impact with an aircraft; cause a casualty due to
impact with a waterborne vessel; or pose a toxic or fire hazard.
---------------------------------------------------------------------------
For example, recent research and development sponsored by the FAA
demonstrates that the threshold kinetic energy capable of causing a
casualty from a collision with a rigid object is substantially lower
than for a collision with an object made of certain composite
materials.\117\ The FAA will provide an AC with valid debris impact
thresholds, such as those proposed in Sec. 450.121(c)(1)(i) and (ii).
Thus, in the final rule, Sec. 450.121(a) uses the definition of
``hazardous debris'' in a way that will enable those debris impact
thresholds to be updated as appropriate based on future research and
development. In addition, the definition of ``hazardous debris'' is
used in Sec. 450.121(a) in a way that replaces the relatively verbose
requirement in proposed Sec. 450.121(c) that ``a debris analysis must
account for all inert, explosive, and other hazardous vehicle, vehicle
component, and payload debris foreseeable from normal and
malfunctioning vehicle flight.''
---------------------------------------------------------------------------
\117\ ``The crash test results and subsequent analysis strongly
suggest that RCC-based thresholds are overly conservative because
they do not accurately represent the collision dynamics of
elastically-deformable sUAS with larger contact areas in comparison
to the metallic debris analysis methods for high speed missiles on
the national test ranges.'' Final Report for the FAA UAS Center of
Excellence Task A4; UAS Ground Collision Severity Evaluation
Revision 2, Arterburn et al, 2017. http://www.assureuas.org/projects/deliverables/a4/ASSURE_A4_Final_Report_UAS_Ground_Collision_Severity_Evaluation.pdf.
---------------------------------------------------------------------------
In summary, the final rule uses the performance-based definition of
``hazardous debris'' that currently equates to the same debris
thresholds as proposed in the NPRM because ``hazardous debris'' means
any object or substance capable of causing a casualty, including people
in aircraft or waterborne vessels or loss of functionality to a
critical asset. Thus, by relying on the definition of ``hazardous
debris,'' the final rule retains the standard in proposed Sec.
450.121(c) of debris capable of causing a casualty or loss of
functionality to a critical asset and allows operators to propose
impact vulnerability models appropriate for the materials used in their
vehicle.
In the final rule, the FAA replaces the term ``flight time'' in
Sec. 450.121(a) with the more flexible term ``flight sequence''
because it is a better independent variable. For example, during a
reentry operation, the transitions between phases of flight, which
generally produce substantially different hazardous debris, such as
prior to and after peak aero-thermal heating, can occur at widely
variable flight times. Also, imparted velocities due to break-up
typically correlate with propellant load better than flight time does.
Therefore, the final rule uses ``flight sequence'' as a less
prescriptive and more accurate independent variable. The FAA notes that
the term ``sequence'' is used in the common meaning of the word, which
is a series of related things or events, or the order in which things
or events follow each other. The phrase ``as a function of vehicle
flight sequence'' would naturally include ``accounting for the effects
of fuel burn and any configuration changes,'' so the final rule deletes
those elements of the proposed requirement as redundant.
In Sec. 450.121(b) of the NPRM, the FAA proposed to require that
the debris analysis account for each foreseeable cause of vehicle
breakup, including any breakup caused by FSS activation, and for impact
of an intact vehicle. Consistent with Sec. 450.133(a)(4), this
proposal included debris from a vehicle's jettisoned components and
payloads because such debris could cause a casualty due to impact with
an aircraft or waterborne vessel or could pose a toxic or fire
hazard.\118\
---------------------------------------------------------------------------
\118\ The preamble to the NPRM stated that ``this proposal would
include debris from a vehicle's jettisoned components and payloads
because such debris could cause a casualty due to impact with an
aircraft or waterborne vessel or could pose a toxic or fire
hazard,'' but the proposed regulatory text did not include that
specific language.
---------------------------------------------------------------------------
Section 450.121(b) retains the requirement that a debris analysis
account for each reasonably foreseeable cause of vehicle breakup and
intact impact. As explained in the NPRM, this would include ``engine or
motor explosion, or exceeding structural limits due to aerodynamic
loads, inertial loads, or aerothermal heating.'' \119\
---------------------------------------------------------------------------
\119\ 84 FR 15383.
---------------------------------------------------------------------------
In addition, the final rule requires an operator to account for
vehicle structural characteristics and materials and energetic effects
during break-up or at impact. Although these items would be necessary
considerations in any debris analysis, the FAA has added them expressly
in Sec. 450.121(b). The requirement to account for energetic effects
in Sec. 450.121(b)(3) is consistent with the requirement in proposed
Sec. 450.135(d)(3)(iii) which addresses ``indirect or secondary
effects such as bounce, splatter, skip, slide, or ricochet.'' \120\
Moreover, accounting for the fundamental physical phenomena identified
in Sec. 450.121(b)(2) of the final rule would logically be necessary
to comply with the requirement in
[[Page 79640]]
proposed Sec. 450.135(d) to ``model the casualty area, and compute the
predicted consequences of each reasonably foreseeable vehicle response
mode.'' As explained in the NPRM, ``the casualty area and consequence
analysis would be required to account for all relevant debris fragment
characteristics.'' The characteristics of all relevant debris
fragments, such as the size and kinetic energy at impact, depend on the
three fundamental physical phenomena identified in the final rule.
---------------------------------------------------------------------------
\120\ This language in proposed Sec. 450.135(d)(3)(iii) is
removed in the final rule, as discussed in the preamble associated
with that section.
---------------------------------------------------------------------------
As noted earlier, the NPRM proposed to require in Sec. 450.121(c)
that a debris analysis account for all inert, explosive, and other
hazardous vehicle, vehicle component, and payload debris foreseeable
from normal and malfunctioning vehicle flight. The NPRM also specified
a set of items for which a debris analysis would be required to
account, at a minimum. These items included highly specific and
prescriptive debris thresholds requirements. With the addition of the
hazardous debris definition, Sec. 450.121 no longer requires a
specific subsection establishing debris thresholds.
In the final rule, new Sec. 450.121(c) contains requirements
associated with the propagation of debris that are relocated from the
proposed debris risk analysis requirements in Sec. 450.135(b).
Specifically, a debris analysis must compute statistically valid debris
impact probability distributions. The propagation of debris from each
predicted breakup location to impact must account for all foreseeable
forces that can influence any debris impact location, and all
foreseeable sources of impact dispersion, including, at a minimum: The
uncertainties in atmospheric conditions; debris aerodynamic parameters,
including uncertainties; pre-breakup position and velocity, including
uncertainties; and breakup-imparted velocities, including
uncertainties. The FAA notes that a quantitative description of the
physical, aerodynamic, and harmful characteristics of hazardous debris
is a prerequisite to compute statistically valid debris impact
probability distributions and to quantify the risks to the public.
The propagation of debris is a physics-based analysis that predicts
where debris impacts will occur given a debris event while the vehicle
is in flight, such as jettison of a vehicle stage or an explosion. The
FAA moves the requirements in proposed Sec. 450.135(b) to Sec.
450.121(c) because the computation of statistically-valid debris impact
distributions naturally depends on the nature of the debris and the
trajectory analysis products from Sec. Sec. 450.117 and 450.119.
Similarly, the final rule requirements in Sec. 450.121(c) are nearly
identical to those in proposed Sec. 450.135(b), except that the final
rule removes the term ``including uncertainties'' from the regulation.
The FAA finds inclusion of this term to be superfluous, as accounting
for foreseeable sources of impact dispersion naturally includes the
uncertainties in the debris aerodynamic parameters, pre-breakup state
vectors, and breakup-imparted velocities. The FAA notes that the debris
analysis must compute statistically valid debris impact probability
distributions of all hazardous debris to be consistent with the scope
identified in Sec. 450.121(a).
Virgin Galactic recommended that the FAA allow operators to provide
their own assessments of casualty causing debris. The FAA agrees that
the specific impact vulnerability thresholds specified in the NPRM were
overly prescriptive and potentially overly conservative for some non-
rigid debris impacts. Thus, the final rule removes these proposed
requirements in Sec. 450.121(c) entirely.
In the NPRM, Sec. 450.121(d) provided the debris analysis
application requirements. In the final rule, the FAA relocates and
revises proposed Sec. 450.121(d)(1), which was a requirement to submit
a description of the debris analysis methodology, to Sec.
450.121(d)(2). The FAA re-designates and revises proposed Sec.
450.121(d)(2) as Sec. 450.121(d)(1) in the final rule. In the NPRM,
proposed Sec. 450.121(d)(2) required an operator submit a description
of all vehicle breakup modes and the development of debris lists. In
the final rule, the re-designated Sec. 450.121(d)(1) makes use of the
formal definition of ``hazardous debris,'' requiring a description of
all scenarios that can lead to hazardous debris.
In the final rule, Sec. 450.121(d)(2) and (d)(3) require an
operator to submit a description of the methods used to perform the
vehicle impact and breakup analysis in accordance with Sec.
450.115(c), which is consistent with similar changes in other FSA
sections. The final rule also moves the requirements relevant to the
debris propagation analysis from proposed Sec. 450.135(e)(2) and
(e)(5) to Sec. 450.121(d)(3) and (d)(4).
The FAA re-designates and revises proposed Sec. 450.121(d)(3) as
Sec. 450.121(d)(5). In the NPRM, proposed Sec. 450.121(d)(3) required
an applicant to submit all debris fragment lists necessary to describe
the physical, aerodynamic, and harmful characteristics of each debris
fragment or fragment class quantitatively. Section 450.121(d)(5) of the
final rule requires a quantitative description of the physical,
aerodynamic, and harmful characteristics of hazardous debris. The FAA
finds that ``quantitative description'' will allow alternative
approaches for the applicant to demonstrate compliance with this
section.
Virgin Galactic stated the proposal would introduce additional
workload to the company. Virgin Galactic raised concern that proposed
Sec. 450.121 introduced requirements for waterborne vessels that were
not referenced in other parts of the rule. The NPRM proposed, and the
final rule requires in Sec. 450.133(b), that a flight hazard area
analysis must determine waterborne vessel hazard areas. Also, the NPRM
preamble explained that the requirement includes people on ships in the
collective risk computation (see proposed Sec. 450.101(a)(1) and
(b)(1)), and thus explicitly allows the application of risk management
principles to protect people on waterborne vessels. The FAA finds that
the scope of the FSA requirements in the final rule are consistent with
current practice and will not introduce additional workload.
Virgin Galactic stated that the FAA should quantify the debris that
could cause a casualty on a waterborne vessel. The FAA notes that it
provided guidance on debris thresholds for waterborne vessels in Table
10 of the draft AC on High-Fidelity FSA published with the NPRM.
r. Population Exposure Analysis (Sec. 450.123)
In the NPRM, the exposure model requirements were addressed in the
debris risk analysis section in proposed Sec. 450.135(c) and (d)
because a complete risk analysis must account for the distribution of
people and how those people may be sheltered. The FAA received numerous
comments stating the proposed requirements were too prescriptive. The
FAA agrees and has revised the requirements to be more performance-
based.
In the final rule, the FAA revises the exposure model requirements
and moves them from proposed Sec. 450.135(c) and (d) to Sec. 450.123
(Population Exposure Analysis). The FAA moves the population exposure
analysis requirements out of the proposed debris risk analysis section
because this analysis informs other sections of the FSA. A population
exposure analysis must also be used to provide input to other public
risk analyses to address toxic hazards and far-field overpressure blast
effects, if any. This change does
[[Page 79641]]
not an expand the scope of the final rule beyond what was proposed in
the NPRM because the NPRM identified the need for population exposure
input to address toxic hazards for flight and far-field overpressure
blast effects.\121\ The rationale for the final rule requirements
remains the same as proposed in the NPRM: An exposure model provides
critical input data on the geographical location of people and critical
assets at various times when the launch or reentry operation could
occur. While the rationale remains the same, the FAA makes two changes
in Sec. 450.123. Consistent with the change discussed in the critical
assets section of the preamble, the FAA removes the requirement for an
operator to characterize the distribution and vulnerability of critical
assets. The FAA also revises the population exposure analysis to
require that input data must account for the vulnerability of people to
hazardous debris effects. The FAA will issue a Population Exposure
Assessment AC to describe a possible means of compliance.
---------------------------------------------------------------------------
\121\ Specifically, in Sec. 450.139(f) the FAA proposed to
require an applicant submit (ii) the population density in receptor
locations that are identified by toxic dispersion modeling as toxic
hazard areas; and (iv) the identity of the population database used.
Also, in Sec. 450.137(c)(1) the FAA proposed to require an
applicant submit a description of the population centers, terrain,
building types, and window characteristics used as input to the far-
field overpressure analysis.
---------------------------------------------------------------------------
Section 450.123(a) requires that an FSA must account for the
distribution of people for the entire region where there is a
significant probability of impact of hazardous debris. This final rule
is consistent with the requirement in proposed Sec. 450.135(c)(1) that
the population exposure data would be required to include the entire
region where there is a significant probability of impact of hazardous
debris. The definition of ``hazardous debris'' in Sec. 401.7 informs
the scope of this requirement. In Sec. 450.123(a), the standard of
``significant'' means that the scope of the population exposure
analysis is bounded by what is necessary to demonstrate compliance with
the risk criteria in Sec. 450.101(a) and (b), consistent with the
scope requirements set in Sec. Sec. 450.113 and 450.115.
Section 450.123(b) sets constraints on the population exposure
analysis consistent with proposed Sec. 450.135(c)(2) through (c)(7).
Specifically, Sec. 450.123(b) requires that the exposure analysis must
characterize the distribution of people both geographically and
temporally; account for the distribution of people among structures and
vehicle types; and use reliable, accurate, and timely source data.
Section 450.123(b)(1) relocates the requirements in proposed Sec.
450.135(c)(2), but removes the term ``vulnerability'' and the reference
to critical assets, as discussed earlier.\122\ The final rule removes
proposed Sec. 450.135(c)(4), which would have required the exposure
model to have sufficient temporal and spatial resolution that a uniform
distribution of people within each defined region can be treated as a
single average set of characteristics without degrading the accuracy of
any debris analysis output. By removing this requirement, an operator
may demonstrate compliance with Sec. 450.123(b) in the manner set
forth in proposed Sec. 450.135(c)(4), but also has flexibility to
demonstrate compliance through other means.
---------------------------------------------------------------------------
\122\ However, the proposed requirement in Sec. 450.135(c)(4)
to characterize the vulnerability of people both geographically and
temporally is effectively preserved in the final rule requirement in
Sec. 450.123(b)(4) to account for vulnerability of people to
hazardous debris effects in the population exposure analysis.
---------------------------------------------------------------------------
Section 450.123(b)(2) replaces the more prescriptive requirements
in proposed Sec. 450.135(c)(3) by removing the requirement that, in
accounting for the distribution of people among structures and vehicle
types, an exposure analysis includes ``a resolution consistent with the
characteristic size of the impact probability distributions for
relevant fragment groups.'' The language removed from the final rule
remains a valid means for an operator to demonstrate compliance with
Sec. 450.123(b)(2) in the final rule.
Section 450.123(b)(3) replaces the more prescriptive requirements
in proposed Sec. 450.135(c)(5) and (c)(6) so that an exposure analysis
must use reliable, accurate, and timely source data.
Section 450.123(b)(4) consolidates and replaces the requirements to
account for the vulnerability of people to hazardous debris effects
that were proposed in Sec. 450.135(d)(3)(i) and (ii), as well as
proposed in Sec. 450.137(b)(4). In the final rule, the FAA removes the
requirement in proposed Sec. 450.135(c)(7) altogether. Proposed Sec.
450.135(c)(7) is redundant in conjunction with the requirements in
Sec. 450.115(b), which specify the necessary fidelity of any FSA, and
the requirement in Sec. 450.101(g) that an operator must use accurate
data and scientific principles and the analysis must be statistically
valid.
The FAA moves and revises the application requirements in proposed
Sec. 450.135(e)(3) as Sec. 450.123(c)(1) in the final rule. The FAA
revises the final Sec. 450.123(c)(1), which requires an applicant to
submit a description of the FSA methodology, to reference Sec.
450.115(c). As previously noted, the population exposure analysis must
also be used to provide input to other public risk analyses to address
toxic hazards and far-field overpressure blast effects, if any. Section
450.123(c)(2) requires an applicant to submit complete population
exposure data, in tabular form, which is a more concise statement
equivalent to proposed Sec. 450.135(e)(4). In the final rule, the FAA
specifies that the complete population exposure data must be in tabular
form and deletes the requirement that the description of the exposure
input data include, for each population center, a geographic definition
and the distribution of population among shelter types as a function of
time of day, week, month, or year. The population exposure data
provided under Sec. 450.123(c)(2) may reflect some or all of the
information described in proposed Sec. 450.135(e)(4).
s. Probability of Failure Analysis (Sec. 450.131)
In the NPRM, proposed Sec. 450.131 covered probability of failure
analysis requirements for all launch and reentry vehicles. In the final
rule, the FAA adopts proposed Sec. 450.131 with minor revisions
codifying current practices and eliminating the proposed classes of
mishaps referenced in Sec. 450.131.
Section 450.131(a) proposed that for each hazard and phase of
flight, an FSA for a launch or reentry would be required to account for
vehicle failure probability. The probability of failure would be
required to be consistent for all hazards and phases of flight. For a
vehicle stage with fewer than two flights, the failure probability
estimate would be required to account for the outcome of all previous
flights of vehicles developed and launched or reentered in similar
circumstances. For a vehicle or vehicle stage with two or more flights,
vehicle failure probability estimates would be required to account for
the outcomes of all previous flights of the vehicle or vehicle stage in
a statistically valid manner. The outcomes of all previous flights of
the vehicle or vehicle stage would be required to account for data on
any partial failure and anomalies, including Class 3 and Class 4
mishaps, as defined in proposed Sec. 401.5. The FAA adopts Sec.
450.131(a) as proposed with a minor change to the language pertaining
to mishaps to reflect revisions to the definition of ``mishap'' in
Sec. 401.7. The FAA notes that the final rule replaced the term
``partial failures'' with ``mishap'' in Sec. 450.131(a)(2)
[[Page 79642]]
because the proposed language referenced both anomalies and mishaps,
and ``partial failure'' is redundant since any partial failure could
qualify as an anomaly or a mishap under Sec. 401.7, depending on the
nature of the failure.
Virgin Galactic commented that the proposed requirements to gather
and account for anomaly data in the probability of failure analysis
introduced additional workload compared to the current regulation. It
recommended the FAA adopt a performance-based standard in an SNPRM.
The FAA does not agree that this requirement results in additional
workload from current regulations. The FAA notes that the final rule
requirement in Sec. 450.101(g) is relevant here because it requires
that a method must produce results consistent with, or more
conservative than, the results available from previous mishaps, tests,
or other valid benchmarks, such as higher-fidelity methods.\123\ Hence,
an operator has the option to use a more conservative approach to avoid
any unnecessary additional workload. For example, an operator can
assume one more failure than the actual outcomes of all previous
flights of the vehicle or vehicle stage. Therefore, the FAA does not
find that the requirements in the final rule constitute additional
workload compared to current regulations.
---------------------------------------------------------------------------
\123\ Because the FSA is necessary to demonstrate compliance
with the risk criteria in Sec. 450.101, the requirements set forth
in that section regarding the validity of analysis apply to all
parts of the FSA.
---------------------------------------------------------------------------
Boeing requested clarification on what is meant by a ``consistent''
probability of failure in this section. The FAA clarifies that the
vehicle or vehicle stage probability of failure must be consistent
internally with outcomes of previous flights, as described in Sec.
450.131(a)(1) and (a)(2). Furthermore, the probability of failure input
data must be consistent for all phases of flight and hazards. In this
context, ``consistent'' does not mean identical and does not preclude
an operator from varying the probability of failure within statistical
confidence limits for the same event in different contexts, in order to
bias an analysis towards a conservative outcome.\124\ The probability
of failure input data should be reasonably conservative and consistent
across phases of flight and for various hazards given the uncertainty
in each probability of failure.
---------------------------------------------------------------------------
\124\ Section 450.115(b)(1) requires an operator to demonstrate
that any risk to the public satisfies the safety criteria of Sec.
450.101 accounting for all known sources of uncertainty.
---------------------------------------------------------------------------
A hypothetical example is a proposed launch of a two-stage launch
vehicle from both CCAFS and Vandenberg Air Force Base (VAFB). In this
case, the best-available data indicates the mean conditional
probability of a failure during first stage and second stages of flight
are both 50 percent, with plus or minus 10 percent uncertainty at a
minimal level of confidence (e.g., 60 percent lower and upper bound
confidence limits at 40 percent and 60 percent based on the binomial
distribution).
Given the fact that the public exposure to hazardous debris effects
for launches from VAFB is relatively high during stage one, and the
opposite is true for launches from CCAFS, a consistent and reasonably
conservative probability of failure analysis would use a 60-40 split in
the conditional probability of failure during stage one and stage two
flight for launches from VAFB, but a 40-60 split in the conditional
probability of failure during stage one and stage two flight for
launches from CCAFS. Furthermore, the conditional probability of a
failure applied to different hazards, such as debris and toxics, must
be consistent with each other. More details on means of compliance are
provided in the High Fidelity FSA Methods AC published with this rule,
and a future AC on probability of failure.
Leo Aerospace asked if the FAA would consider a balloon platform to
be a stage.
The FAA will discuss project-specific information, including
whether a balloon platform is part of a launch vehicle stage, during
pre-application consultation.
Boeing, Blue Origin, and Sierra Nevada commented on the lack of
availability of previous flight information for vehicles not operated
or owned by the applicant.
The FAA responded to this comment in the FAA's ``Responses to the
Public's Clarifying Questions Received by July 12, 2019,'' \125\ which
is posted in the docket. An operator should use the best-available
data, which in many cases would be limited to publicly available data.
The FAA will also provide data and guidance on failure mode and phase
of flight allocations in the High Fidelity FSA Methods AC, which will
be finalized with this rule.
---------------------------------------------------------------------------
\125\ See FAA-2019-02290-0134.
---------------------------------------------------------------------------
In the final rule, the FAA replaces all references to Class 3 and
Class 4 mishaps in Sec. 450.131 with the term ``mishap.'' As
previously noted, the FAA eliminates the proposed classes of mishaps in
the revised definition of mishap in Sec. 401.7 of the final rule.
In the NPRM, the FAA proposed that, for FSA purposes, a failure
occurs when a vehicle does not complete any phase of normal flight or
when any anomalous condition exhibits the potential for a stage or its
debris to impact the Earth or reenter the atmosphere outside the normal
trajectory envelope during the mission or any future mission of similar
vehicle capability. It further stated that Class 1 or Class 2 mishaps
would constitute failures.
Blue Origin commented that defining failure as not completing any
phase of normal flight is ``overly punitive'' as proposed in Sec.
450.131(b). Operators may define secondary mission objectives for
research and development purposes that, if not achieved, do impact
mission success but do not impact safety. Blue Origin proposed deleting
the language ``when a vehicle does not complete any phase of normal
flight or'' and anchor the definition in impacts outside the normal
envelope. Virgin Galactic recommended that the FAA should only account
for failures, partial failures, and anomalies that affect public
safety. Blue Origin also commented that including anomalies that might
impact a future mission conflicts with the causal logic that an anomaly
experienced on a given mission will be subject to corrective actions
prior to the next mission.
The FAA understands the concerns raised by the commenters but finds
it unnecessary to change the regulatory text to address these concerns.
An operator may adjust its final failure probability estimates to
account for various extenuating circumstances, as will be described in
a future Probability of Failure Analysis AC. For example, the
probability of failure may be adjusted based on extenuating
circumstances with justification (e.g., if the failure is not public
safety related or if corrective actions implemented after a failure
were demonstrated to be successful). If an operator makes any
adjustments to the final failure probability estimates to account for
various extenuating circumstances, it can update its FSA in accordance
with Sec. 450.103(d).
The FAA notes that, for FSA purposes, the vehicle failure
probability accounts for any failure of the launch or reentry system
because of the way failure is defined in Sec. 450.131(b).
Specifically, for FSA purposes, a failure occurs when a vehicle does
not complete any phase of normal flight or when any anomalous condition
exhibits the potential for a stage or its debris to impact the Earth or
reenter the atmosphere outside the normal trajectory envelope during
the mission or any future mission of similar vehicle
[[Page 79643]]
capability. Therefore, in the context of FSA, any failure of the launch
or reentry system, including pilot error, that produced vehicle failure
as defined in Sec. 450.131(b) must be taken into account.\126\
---------------------------------------------------------------------------
\126\ The SpaceShipTwo accident on October 31, 2014, is an
example of this situation.
---------------------------------------------------------------------------
Proposed Sec. 450.131(c) defined ``previous flight'' by stating
that the flight of a launch vehicle begins at a time when a launch
vehicle normally or inadvertently lifts off from a launch platform and
the flight of a reentry vehicle or deorbiting upper stage begins at a
time when a vehicle attempts to initiate a deorbit. The FAA adopts
Sec. 450.131(c)(1) as proposed with a minor change. The FAA strikes
the words ``normally or inadvertently'' as redundant, since any lift
off, whether normal or inadvertent, would count as a flight under the
proposed and final rule requirements in Sec. 450.131(c)(1).
Boeing, Lockheed Martin, Northrop Grumman, ULA, and Virgin Galactic
requested explanation on whether the proposed requirement in Sec.
450.131(c) would apply to hybrid vehicles.
In the final rule, the FAA revises the regulatory text in response
to these comments. The FAA changes ``launch platform'' to ``surface of
the Earth'' as the point at which flight begins for a probability of
failure analysis. This change reflects the fact that various types of
vehicles, such as hybrids, do not lift off from launch platforms. The
probability of failure analysis must account for the probability of
failure during all phases of flight to ensure public safety, including
captive carry, unless the exception in Sec. 450.113(b) applies to that
phase of flight. For example, an aircraft crash with a rocket attached
can present much higher risks to the public from an explosion, toxic
release, or inert impact, than the risks posed by an aircraft crash
without a rocket attached.
For the purposes of Sec. 450.131(c)(1) and (c)(2), a previous
flight may include flights conducted outside FAA licensed activity,
such as amateur, permitted, U.S. government, or foreign launches,
reentries, or flights. For the purposes of Sec. 450.131(c)(1) and
(c)(2), a previous flight may include FAA-licensed activity, such as
the Falcon 9 launch vehicle anomaly which destroyed the vehicle and its
AMOS-6 payload,\127\ if the outcome exhibited the potential for a stage
or its debris to impact the Earth or reenter the atmosphere outside the
normal trajectory envelope during the mission or any future mission of
similar vehicle capability. The FAA also changes the word ``deorbit''
to ``reentry'' to accommodate a reentry that starts on a suborbital
trajectory.
---------------------------------------------------------------------------
\127\ On September 1, 2016.
---------------------------------------------------------------------------
In the NPRM, Sec. 450.131(d) proposed to require that a vehicle
probability of failure be distributed across flight times and vehicle
response modes. The distribution would be consistent with the data
available from all previous flights of vehicles developed and launched
or reentered in similar circumstances and data from previous flights of
vehicles, stages, or components developed and launched or reentered by
the subject vehicle developer or operator. As proposed, the data could
include previous experience involving, among other things, a similar
level of experience of the vehicle operation and development team
members.
The FAA adopts Sec. 450.131(d) with revisions. Specifically, the
FAA changes ``flight time'' to ``flight phase.'' ``Flight phase'' gives
applicants more flexibility in their analysis because it is less
specific than ``flight time.'' The FAA also changes ``vehicle response
mode'' to ``failure mode,'' consistent with similar changes throughout
the final rule. Finally, the FAA replaces the phrase ``launched or
reentered'' in Sec. 450.131(d)(2) to ``launched, reentered, flown, or
tested.'' This change will enable the probability of failure allocation
across flight phases and failure modes to account for data from
previous flights of vehicles, stages, or components by the subject
vehicle developer or operator that did not qualify as launch or reentry
operations, such as drop tests or glide flights. The FAA also revises
``flight phases'' and ``failure modes'' to be plural in the final rule.
This amended language is a minor grammatical change and is consistent
with the intent of the proposed requirement.
Virgin Galactic commented that the FAA should not employ a
subjective measure of ``level of experience'' and requested this
language be stricken.
The FAA asserts that this measure is not subjective. The High
Fidelity FSA Methods draft AC contained specific quantitative
thresholds that have been used for many years as guidelines to
distinguish new versus experienced developers for the purposes of
probability of failure analyses. Because the quantitative thresholds
are in guidance, the FAA may consider other quantitative thresholds as
appropriate. Furthermore, the data available from previous flights of
ELVs developed by experienced and inexperienced operators demonstrates
a statistically significant difference between the relative frequency
of failures during the first and second phases of flight. Therefore,
because the required input data may involve a similar level of
experience of the vehicle operation and development team members, the
final rule in Sec. 450.131(d)(2)(iii) retains that consideration.
The FAA adopts the observed and conditional failure rate
requirements in Sec. 450.131(e) as proposed and the application
requirements in Sec. 450.131(f) with revisions. Section 450.131(f)(1)
to require methods used in probability of failure analysis be in
accordance with Sec. 450.115(c) because that section sets out the
requirements for FSA methodologies. In Sec. 450.131(f)(2), the FAA
changes the term ``vehicle response mode'' to ``failure mode,'' which
is consistent with similar changes throughout this final rule.
t. Flight Hazard Area Analysis (Sec. 450.133)
In Sec. 450.133, the NPRM proposed general requirements for the
flight hazard area analysis as well as requirements specific to
waterborne vessel hazard areas, land hazard areas, airspace hazard
volumes, and the license application. In the final rule, the FAA adopts
Sec. 450.133 with revisions. The revisions include changing terms
proposed in the NPRM and removing redundant requirements.
Proposed Sec. 450.133(a) stated that an FSA would be required to
include a flight hazard area analysis that identifies any region of
land, sea, or air that would be required to be surveyed, publicized,
controlled, or evacuated in order to control the risk to the public. A
flight hazard area analysis would be required to account for all
reasonably foreseeable vehicle response modes during nominal and non-
nominal flight that could result in a casualty. The NPRM specified six
items that would be required to be included in a flight hazard area
analysis, at a minimum.
The FAA adopts Sec. 450.133(a) with revisions. The FAA moves the
requirement in Sec. 450.133(a) that a flight hazard area analysis must
account for all reasonably foreseeable vehicle response modes during
nominal and non-nominal flight that could result in a casualty to Sec.
450.133(a)(1). This text is also revised, as discussed below. The
replacement of ``vehicle response modes'' with ``failure modes'' was
discussed in the preamble section on Sec. 450.101(c)(2).
In Sec. 450.133(a)(1), the FAA proposed that the flight hazard
analysis must account for the regions of land, sea, and air potentially
exposed to debris impact resulting from normal flight events and from
debris hazards resulting from any
[[Page 79644]]
potential malfunction. The FAA revises proposed Sec. 450.133(a)(1) by
adding the term ``hazardous debris'' as discussed in the preamble
section for Sec. 450.121 (Debris Analysis). As defined, hazardous
debris includes any object or substance capable of causing a casualty
or loss of functionality to a critical asset, such as an intact
vehicle, vehicle fragments, any detached vehicle component, whether
intact or in fragments, payload, and any planned jettison bodies. The
FAA also replaces ``vehicle response mode'' with ``failure modes'' for
consistency throughout the final rule.
In Sec. 401.7, the FAA modifies the definition of ``flight hazard
area'' as applied to part 450. The NPRM proposed that flight hazard
area means any region of land, sea, or air that must be surveyed,
publicized, controlled, or evacuated in order to ``protect public
health and safety and the safety of property.'' This language was
inconsistent with the language in Sec. 450.133. As such, in the final
rule, the definition has been revised in Sec. 401.7 for consistency to
state that a flight hazard area is any region of land, sea, or air that
must be surveyed, publicized, controlled, or evacuated in order to
``ensure compliance with the safety criteria in Sec. 450.101.''
Boeing, Lockheed Martin, Northrop Grumman, and ULA suggested
replacing ``all reasonably foreseeable'' with ``credible'' because
credibility is established in the system safety analysis. As discussed
previously, the FAA does not agree with the recommendation because the
term credible is prone to errors in judgment whereas the term
foreseeable is more readily discerned by analysis (e.g., fault trees).
The final rule moves the term ``reasonably foreseeable'' from proposed
Sec. 450.133(a) to Sec. 450.133(a)(1), where it more appropriately
modifies the language in Sec. 450.133(a)(1) that specifies the
analysis must account for the regions of land, sea, and air potentially
exposed to hazardous debris generated during normal flight events and
all reasonably foreseeable failure modes.
The FAA adopts Sec. 450.133(a)(2) with a minor correction. The FAA
replaces ``control risk to any hazard'' in the NPRM with ``control risk
from any hazard'' in the final rule.
In Sec. 450.133(a)(3), the FAA proposed that the analysis account
for the limits of a launch or reentry vehicle's normal flight,
including winds that were no less severe than the worst wind conditions
under which flight might be attempted and uncertainty in the wind
conditions. The FAA adopts Sec. 450.133(a)(3) with revisions. The FAA
changes ``wind conditions'' to ``atmospheric conditions'' because in
some cases, such as far-field overpressure blast and toxics analyses,
the temperature profile is an atmospheric condition that may also be
stipulated as part of the flight commit criteria (in addition to the
wind profile). This change does not create any additional burden to the
operator because the proposed and final requirements in Sec.
450.135(e)(1) and Sec. 450.165(b)(2) already require an operator to
account for and identify the conditions immediately prior to enabling
the flight of a launch vehicle or the reentry of a reentry vehicle that
are necessary to demonstrate compliance with the safety criteria in
Sec. 450.101, such as the atmospheric conditions and any
meteorological conditions. The final rule in Sec. 450.133(a)(3)
clarifies that all atmospheric conditions are considerations when the
operator establishes the worst conditions under which flight might be
attempted.
In Sec. 450.133(a)(4), the FAA proposed that the analysis account
for the debris identified for each foreseeable cause of breakup, and
any planned jettison of debris, launch or reentry vehicle components,
or payload. The FAA adopts Sec. 450.133(a)(4) with a revision. For
reasons previously discussed, the FAA replaces this section with ``all
hazardous debris,'' which uses the term defined in Sec. 401.7 of the
final rule. This revision does not change the intent of the
requirement.
In Sec. 450.133(a)(5), the FAA proposed that the analysis account
for all foreseeable sources of debris dispersion during freefall,
including wind effects, guidance and control, velocity imparted by
breakup or jettison, lift, and drag forces. The FAA adopts Sec.
450.133(a)(5) with revisions. In the final rule, the analysis must
account for sources of debris dispersion in accordance with Sec.
450.121(c). The FAA makes this revision to avoid replication of
requirements between Sec. Sec. 450.133(a)(5) and 450.121(c) and to
ensure consistency in the FSA.
AOPA commented that the FAA should provide the public an
authoritative source of flight hazard area information as well as
guidance on various flight hazard area analysis methodology. The FAA is
working on the NOTAM/Aeronautical Information Service (AIS)
Modernization effort, which will redesign the current NOTAM management
information system with a single technology gateway for entering,
processing, and retrieving all NOTAM data, making it easier for all
users of the airspace to access safety-critical information. The FAA
finds that the issue raised by AOPA is best addressed by the NOTAM/AIS
Modernization effort rather than this rulemaking. Industry can provide
input on this effort through the Aeronautical Information Systems
Coalition. Information regarding temporary flight restrictions (TFR)
can be found at: https://tfr.faa.gov/tfr2/list.html and is searchable
by the type of TFR being implemented. The FAA plans to complete the
NOTAM/AIS Modernization effort by late 2022. In addition, an acceptable
flight hazard area analysis methodology is addressed in the High
Fidelity FSA AC.
Boeing, Lockheed Martin, Northrop Grumman, and ULA also provided
suggested regulatory text that stated the airspace hazard volume was
only necessary for airspace up to 60,000 feet mean sea level. The FAA
agrees that the analysis only needs to account for reasonably expected
air traffic in a given region, but, in order to account for operations
in different regions, does not change the text to a specific altitude.
The FAA adopts Sec. 450.133(b), (c), and (d) as proposed. Section
Sec. 450.133(b)(1), (c)(1), and (d)(1) state that flight hazard areas
must be determined as necessary to contain, with 97 percent probability
of containment, all debris resulting from normal flight events capable
of causing a casualty to any person located on land, sea, or air. In
the NPRM, the FAA explained that proposed Sec. 450.133(b)(1), (c)(1),
and (d)(1) would align FAA regulations with practices at the Federal
launch or reentry sites by allowing operators to reduce or otherwise
optimize the size of the regions for warnings of potential hazardous
debris resulting from normal flight events.
Virgin Galactic stated that, given the currently available
information and tools regarding debris, the 97 percent probability of
containment requirement in proposed Sec. 450.133(b)(1), (c)(1), and
(d)(1) would result in inflated hazard area determinations. Boeing,
Lockheed Martin, Northrop Grumman, and ULA commented on proposed Sec.
450.133(b)(1) and suggested it reference current 3-sigma standards.
Boeing stated that, given the new limitation on debris, changing from
99.7 percent to 97 percent containment appeared less safe.
The final rule retains the 97 percent containment requirement
proposed in the NPRM. The FAA notes that the comments demonstrate a
difference of opinion in the industry regarding the appropriate
probability of containment requirement for flight hazard areas, with
Virgin Galactic claiming the proposal would result in inflated hazard
area determinations, as opposed to the other commenters calling for
more stringent
[[Page 79645]]
hazard area requirements to maintain public safety. The FAA finds the
97 percent containment requirement strikes an appropriate balance,
particularly when coupled with the requirement to include the
collective risk contribution from people in waterborne vessels in the
public risk criteria in Sec. 450.101. As noted in the NPRM, the FAA
adopts flight hazard area regulations for waterborne vessels consistent
with past waivers that the FAA granted to ensure they align with
current practices at the Federal launch ranges, where most commercial
launches take place currently. Recent experience from commercial and
U.S. Government launch and reentry operations demonstrates that the
requirements adopted eliminate unnecessary launch delays while ensuring
that the overall level of safety provided to the public remains
consistent with the public risk criteria in Sec. 450.101. The FAA
notes that the application of a risk management approach to ensure the
safety of people in waterborne vessels is consistent with
recommendations made by the National Academy of Sciences.\128\ The FAA
finds that public safety is not compromised by changing 99.7 percent
containment to 97 percent containment because the overall public risk
criteria must also be met, irrespective of the size of the hazard
areas. From a policy perspective, the final rule approach to protect
people in waterborne vessels achieves the goal of common standards for
launches from any U.S. launch site, Federal or non-Federal. Both
industry and the National Space Council have urged government agencies
involved in the launch and reentry of vehicles by commercial operators
to work towards common standards.
---------------------------------------------------------------------------
\128\ In 2001, the NRC published a report on ``Streamlining
Space Launch Range Safety,'' which included a recommendation that
``safety procedures based on risk avoidance should be replaced with
procedures consistent with the risk management philosophy specified
by EWR 127-1.'' See p. 44 of IBSN 0-309-51648-X available at http://www.nap.edu/catalog/9790.html.
---------------------------------------------------------------------------
Boeing also requested clarification on how containment boxes for
nominal impacts can use the same standard as hazard areas intended to
contain debris in the much less likely event of a failure. The FAA
notes that planned hazardous debris impacts must use a probability of 1
in the analysis in accordance with Sec. 450.133(a)(6), while hazardous
debris impacts due to a failure will have a probability applied as
determined from the Sec. 450.131 probability of failure analysis.
The FAA adopts Sec. 450.133(b)(2), (c)(2), and (d)(2) as proposed.
These sections use probability of impact contours or probability of
casualty contours to meet the risk requirements in Sec. 450.101 for
sea, land, and air.
Blue Origin commented that the intent of these requirements seems
to be to establish hazard areas for normal operations and mishaps, but
the requirements do not explicitly state that the risk criteria applies
to malfunction trajectories. Blue Origin proposed that the FAA should
specify that risk contours should be conducted for malfunction
trajectories.
The FAA notes the proposed requirement in Sec. 450.133(a) that a
flight hazard area analysis must account for all reasonably foreseeable
vehicle response modes during nominal and non-nominal flight that could
result in a casualty also specified that the risk contours required in
proposed Sec. 450.133(e)(2)(iii) through (v) must account for
malfunction trajectories. However, the FAA revises the requirement to
state in Sec. 450.133(a)(1) that the flight hazard area analysis must
account for the regions of land, sea, and air potentially exposed to
hazardous debris generated during normal flight events and ``all
reasonably foreseeable failure modes,'' which includes malfunction
trajectories. In addition, the FAA revises the risk contour requirement
in Sec. 450.133(e)(2)(iii), which is explained below in the discussion
on that requirement. The FAA notes that the High-Fidelity FSA Methods
AC describes one acceptable methodology for flight hazard areas, which
accounts for malfunction trajectories.
Virgin Galactic commented that requirements for waterborne vessels
should also be in Sec. 450.101. The FAA notes that the operator must
meet individual and collective risk requirements, as stated in Sec.
450.101. People on waterborne vessels are included in the collective
and individual risk calculations. However, as explained in the NPRM,
operators have the option to use the current approach in part 417 as a
means of compliance, which requires surveillance to ensure no ship is
exposed to more than 1 x 10-\5\ probability of impact,
because that will be generally sufficient to ensure compliance with
Sec. 450.101.
In Sec. 450.133(e)(1), the FAA proposed that the applicant submit
a description of the methodology to be used in the flight hazard area
analysis including all assumptions and justifications for the
assumptions, vulnerability models, analysis methods, and input data. In
the final rule, the FAA revises this requirement by adding that the
analysis must be done in accordance with Sec. 450.115(c) to avoid
replication of requirements and ensure consistency throughout subpart C
of part 450.
In Sec. 450.133(e)(1)(i), the FAA proposed that an applicant
provide input wind data and justification in the application. The FAA
did not adopt this proposal in the final rule. Rather, the FAA deletes
proposed Sec. 450.133(e)(1)(i) because this application requirement is
covered in Sec. 450.117(c). Section 450.117(c) accounts for all
atmospheric conditions that have an effect on the trajectory, including
worst case atmospheric profile conditions under which flight might be
attempted.
In Sec. 450.133(e)(2), the FAA proposed that an applicant submit
tabular data and graphs of the results of the flight hazard area
analysis, including in Sec. 450.133(e)(2)(iv) and (v) the following:
if applicable, representative 1 x 10-\5\ and 1 x
10-\6\ probability of impact contours for all debris capable
of causing a casualty to persons on a waterborne vessel regardless of
location; and representative 1 x 10-\6\ and 1 x
10-\7\ probability of impact contours for all debris capable
of causing a casualty to persons on an aircraft regardless of
location.\129\
---------------------------------------------------------------------------
\129\ The FAA received no comments on Sec. 450.133(e)(2)(i) and
(ii) and adopts Sec. 450.133(e)(2)(i) as proposed and Sec.
450.133(e)(2)(ii) a revision include a cross-reference to the hazard
area publication requirement in Sec. 450.161.
---------------------------------------------------------------------------
Blue Origin commented that, by requiring 1 x 10-\6\ and
1 x 10-\7\ risk contours for waterborne vessels and
aircraft, respectively, the FAA was extending application requirements
beyond those either currently codified in part 400 or proposed in part
450.
The FAA notes that, as stated in the NPRM preamble, these contours
are necessary for the applicant to demonstrate to the FAA sufficient
computational resolution and analysis fidelity for the results that are
critical to public safety. Thus, the FAA declines to adopt the
recommended change. For these reasons, the FAA adopts Sec.
450.133(e)(2)(iv) and (e)(2)(v) as proposed.
In Sec. 450.133(e)(2)(iii), the FAA proposed that an applicant
would be required to submit representative individual probability of
casualty contours regardless of location.
Virgin Galactic requested clarification on the meaning of the term
``regardless of location.'' Based on the context in proposed Sec.
450.133(a), which required the flight hazard area analysis to identify
any region of land, sea, or air that must be surveyed, publicized,
controlled, or evacuated in order to control the risk to the public,
the term ``regardless of location'' referred to whether the contours
are on land, sea,
[[Page 79646]]
or air. In the final rule, the FAA changes the term ``regardless of
location'' to ``for all locations specified in paragraph (a)'' for more
specificity. The FAA further specifies that ``representative
probability of casualty contours'' must account for both neighboring
operations personnel (at the 1 x 10-\5\ probability of
casualty level) and other members of the public (at the 1 x
10-\6\ probability of casualty level). Hence, the
requirement in Sec. 450.133(e)(2)(iii) of the final rule specifies
that representative individual probability of casualty contours include
tabular data and graphs showing the hypothetical location of any member
of the public that could be exposed to a probability of casualty of 1 x
10-\5\ or greater for neighboring operations personnel, and
1 x 10-\6\ or greater for other members of the public, given
all foreseeable conditions within the flight commit criteria.
The FAA adds this explicit language to the application requirement
to reflect what is necessary to demonstrate compliance with the
substantive requirements for flight hazard area analysis as proposed in
the NPRM and as set forth in the final rule. Specifically, the
substantive requirements proposed in Sec. 450.133(b)(2) and (c)(2),
which required an operator to determine the areas of water and land
where the individual probability of casualty for any person on a vessel
or on land would exceed the criterion in Sec. 450.101(a)(2) or (b)(2),
would necessarily have required a demonstration consistent with the
revised application requirements.
u. Debris Risk Analysis (Sec. 450.135)
In the NPRM, the FAA proposed to require that a debris risk
analysis be performed to determine whether the individual and
collective risk of public casualties meet the safety criteria in Sec.
450.101. The debris risk analysis would be required to compute
statistically-valid debris impact probability distributions using the
input data produced by FSAs required in proposed Sec. Sec. 450.117
through 450.133. In the final rule, the FAA adopts Sec. 450.135 with
revisions.
Proposed Sec. 450.135(a) stated that a debris risk analysis would
be required to demonstrate compliance with safety criteria in proposed
Sec. 450.101, either prior to the day of the operation, by accounting
for all foreseeable conditions within the flight commit criteria or
during the countdown using the best available input data. The FAA
adopts Sec. 450.135(a) with revisions. Specifically, the FAA adds in
Sec. 450.135(a)(2) that the ``best available input data'' used during
the countdown must include any applicable ``flight commit criteria and
flight abort rules'' if such controls are necessary to ensure
compliance with the public risks as required in proposed and final
Sec. 450.165(b).
There is no additional burden on the operator due to the updated
language in Sec. 450.135(a)(2), because this requirement is consistent
with the proposed requirements in Sec. Sec. 450.135(e)(1) and
450.165(b)(2). An operator is required to account for and identify the
conditions immediately prior to enabling the flight of a launch vehicle
or the reentry of a reentry vehicle that are necessary to demonstrate
compliance with the safety criteria in Sec. 450.101, such as the
atmospheric conditions and any other commit criteria. The final rule in
Sec. 450.135(a)(2) now explicitly acknowledges that a valid debris
risk analysis must account for any applicable flight commit criteria
and flight abort rules when the operator establishes if the present
conditions produce public risks consistent with the safety criteria in
Sec. 450.101.
In Sec. 450.135(b), the FAA proposed performance-based
requirements to address the physical phenomena that influence the
propagation of debris, which the analysis would be required to account
for to compute the probability of impact of debris on people and
critical assets. In the final rule, the FAA adopts and moves these
requirements with revisions to Sec. 450.121(c), as discussed in the
section of this preamble on Debris Analysis. There were two reasons for
moving the proposed propagation of debris requirements in Sec.
450.135(b) to Sec. 450.121(c). First, the computation of valid impact
probability distributions is relevant to more than the debris risk
analyses; for example, valid impact probability distributions are
necessary for the development of flight hazard areas and the yield-
probability pairs used as input to the far-field overpressure analysis.
Second, although the relationships between the FSA sections are complex
and interdependencies exist, the FAA sought to lay out the FSA
requirements in a sequential order.
In Sec. 450.135(c), the FAA proposed the features of a valid
population exposure analysis. In the final rule, the FAA adopts and
moves these requirements with revisions to Sec. 450.123, as discussed
in the preamble associated with that section. As noted, the FAA moved
the population exposure analysis requirements out of the proposed
debris risk analysis section because a population exposure analysis
must also be used to provide input to other public risk analyses to
address toxic hazards and far-field overpressure blast effects, if any.
As discussed earlier, this is not an expansion of the scope because the
NPRM identified the need for population exposure input to address toxic
hazards for flight and far-field overpressure blast effects.
In proposed Sec. 450.135(d), the FAA set forth the features of a
valid casualty area and consequence analysis. Proposed Sec. 450.135(d)
stated that a debris risk analysis would be required to model the
casualty area and compute the predicted consequences of each reasonably
foreseeable vehicle response mode in any one-second period of flight in
terms of CEC. The NPRM also specified that the contents of a
casualty area and consequence analysis must account for, at a minimum,
the items proposed in Sec. 450.135(d)(1) through (d)(3).\130\
---------------------------------------------------------------------------
\130\ The FAA received no comments on Sec. 450.135(d)(1), which
requires the casualty and consequence analysis to account for all
relevant debris fragment characteristics and the characteristics of
a representative person exposed to any potential hazard. The FAA
adopts this requirement without change.
---------------------------------------------------------------------------
In the final rule, the FAA revises and re-designates the
requirements proposed in Sec. 450.135(d) to Sec. 450.135(b). In
addition, the FAA replaces the term ``vehicle response mode'' with
``failure mode,'' consistent with similar changes made throughout the
final rule and discussed further in Sec. 450.101(c)(2) of this
preamble. The FAA also replaces the term ``one-second period of
flight'' with ``significant period of flight,'' as discussed in the
preamble section associated with high consequence event protection.
In the NPRM, the FAA included a definition of ``casualty area'' in
Sec. 401.5, defined as the area surrounding each potential debris or
vehicle impact point where serious injuries, or worse, can occur. The
FAA adopts this definition as proposed.
SpaceX commented the FAA should modify proposed Sec. 450.135(d) to
require that the casualty area and consequence analysis not only
account for the items in proposed Sec. 450.135(d)(1) through (d)(3)
but also model them conservatively. The FAA notes that the term
``account for'' already includes using conservative data or assumptions
for all inputs and results of an analysis, pursuant to Sec.
450.101(g). Thus, this change would be redundant.
As previously discussed, the requirements for debris propagation in
Sec. 450.135(b) have been relocated in the final rule to Sec.
450.121(c). As a result, the FAA adds a requirement in Sec.
450.135(b)(2) that a casualty area and consequence analysis must
account for
[[Page 79647]]
statistically-valid debris impact probability distributions. This
requirement is derived from the requirements in proposed Sec.
450.135(b). The FAA notes that without statistically-valid impact
probability distributions it would be impossible to compute the
predicted consequences of each reasonably foreseeable failure mode in
any significant period of flight in terms of conditional expected
casualties, as required in proposed Sec. 450.135(d) and Sec.
450.135(b) of the final rule, because the consequence of any failure
depends on the characteristics of the debris (such as the casualty
area) predicted to impact exposed populations. Thus, the FAA finds the
final rule is consistent with the NPRM in requiring this information as
part of a debris risk analysis.
In the NPRM, the FAA proposed to require that the casualty area and
consequence analysis account for any direct impacts of debris
fragments, intact impact, or indirect impact effects, in proposed Sec.
450.135(d)(2). It also proposed that the analysis account for the
vulnerability of people and critical assets to debris impacts including
all hazard sources, such as the potential for any toxic or explosive
energy releases, in proposed Sec. 450.135(d)(3)(ii) and indirect or
secondary effects such as bounce, splatter, skip, slide or ricochet,
including accounting for terrain, in proposed Sec. 450.135(d)(3)(iii).
In the final rule, the FAA consolidates the three proposed
requirements into Sec. 450.135(b)(3). Section 450.135(b)(3) more
simply states that the analysis must account for ``any impact or
effects of hazardous debris,'' because the new definition of
``hazardous debris'' in Sec. 401.7 reflects the scope of the NPRM
requirements. In the final rule, the use of the defined term
``hazardous debris'' in Sec. 450.135(b)(3) replaces the requirement in
proposed Sec. 450.135(d)(3)(ii) to account for all hazard sources,
such as the potential for any toxic or explosive energy releases. It
also replaces the requirement in proposed Sec. 450.135(d)(2) to
account for any direct impacts of debris fragments, intact impact, or
indirect impact effects. Also, the final rule uses the phrase ``any
impact or effects'' of hazardous debris to replace the proposed
requirements to account for any direct or indirect effects, including
indirect or secondary effects such as bounce, splatter, skip, slide, or
ricochet, including accounting for terrain. The FAA's use of the
defined term hazardous debris, discussed previously, allows for
consistency throughout the final rule with regard to the scope of the
FSA requirements. This revision does not change the scope of the
proposed requirements because the definition includes the concept of
all hazard sources and the direct impacts of debris fragments, intact
impact, or indirect impact effects.
In the NPRM, the FAA required in proposed Sec. 450.135(d)(3) that
the analysis account for the vulnerability of people and critical
assets to debris impacts. In the final rule, the FAA moves proposed
Sec. 450.135(d)(3) as Sec. 450.135(b)(4) and strikes the reference to
critical assets, as explained in the preamble section on critical
assets. The FAA also re-designates and adopts proposed Sec.
450.135(d)(3)(i) as Sec. 450.135(b)(4)(i) in the final rule. As
discussed, the proposed requirements in Sec. 450.135(d)(3)(ii) and
(d)(3)(iii) are captured in Sec. 450.135(b)(3) in the final rule.
In the NPRM, the FAA proposed in Sec. 450.135(d)(3)(iv) that the
analysis must account for the effect of wind on debris impact vector
and toxic releases. In the final rule, the FAA re-designates proposed
Sec. 450.135(d)(3)(iv) as Sec. 450.135(b)(4)(ii). The FAA also
revises the requirement so that the analysis must account for the
effect of atmospheric conditions on debris impact and effects known to
influence the vulnerability of people to hazardous debris impacts. For
example, wind can typically have a pronounced effect on the debris
impact vector as illustrated in the FAA FSA Handbook. In addition,
other atmospheric conditions, such as the presence of a temperature
inversion can have a significant effect on the vulnerability of people
to toxic releases.\131\
---------------------------------------------------------------------------
\131\ The FAA re-designates and adopts proposed Sec.
450.135(d)(3)(v) as Sec. 450.135(b)(4)(iii) without substantive
changes in the final rule. The FAA received no specific comments on
the proposed requirement.
---------------------------------------------------------------------------
The change from the proposed Sec. 450.135(d)(3)(iv) implemented in
the final rule in Sec. 450.135(b)(4)(ii) does not create any
additional burden to the operator because this requirement is
consistent with the proposed requirements in Sec. Sec. 450.135(e)(1)
and 450.165(b)(2). An operator is required to account for and identify
the conditions immediately prior to enabling the flight of a launch
vehicle or the reentry of a reentry vehicle that are necessary to
demonstrate compliance with the safety criteria in Sec. 450.101, such
as the atmospheric conditions and any meteorological conditions.
Furthermore, given the proposed requirement in Sec. 450.135(d)(vi) to
account for the uncertainty in fragment impact parameters in assessing
the vulnerability of people to debris impacts, an operator already
would have contemplated the need to account for the effect of
atmospheric conditions on debris impact effects now explicitly required
under Sec. 450.135(b)(4)(ii).
In the NPRM, proposed Sec. 450.135(d)(3)(vi) specified that the
analysis account for uncertainty in fragment impact parameters. In the
final rule, the FAA re-designates proposed Sec. 450.135(d)(3)(vi) as
Sec. 450.135(b)(4)(iv). The FAA also requires in the final rule that
the analysis account for uncertainty in the input data, such as
fragment impact parameters. Although the uncertainty in fragment impact
parameters typically has a pronounced effect, it is conceivable that
uncertainties in the input data more generally could affect the
vulnerability of people to hazardous debris effects. The FAA finds
these changes consistent with the proposed and final requirements in
Sec. 450.115(b)(1) that an operator's FSA method must have a level of
fidelity sufficient to account for all known sources of
uncertainty.\132\
---------------------------------------------------------------------------
\132\ The FAA re-designates and adopts proposed Sec.
450.135(d)(3)(vii) as Sec. 450.135(b)(4)(v) without substantive
change in the final rule. The FAA received no specific comments on
the proposed requirement.
---------------------------------------------------------------------------
In the NPRM, proposed Sec. 450.135(e) listed the application
requirements associated with the debris risk analysis, including the
casualty area and consequence analysis. Proposed Sec. 450.135(e)(1)
required an applicant to submit a description of the methods used to
compute the parameters required to demonstrate compliance with the
safety criteria in proposed Sec. 450.101, including a description of
how the operator would account for the conditions immediately prior to
enabling the flight of a launch vehicle or the reentry of a reentry
vehicle, such as the final trajectory, atmospheric conditions, and the
exposure of people and critical assets.
In the final rule, the FAA re-designates and adopts proposed Sec.
450.135(e)(1) as Sec. 450.135(c)(1) with revisions. The FAA removes
the proposed requirement to submit a description of the methods ``used
to compute the parameters'' required to demonstrate compliance with the
safety criteria in Sec. 450.101. Instead, the FAA replaces this
requirement with a requirement to submit a description of the methods
used to demonstrate compliance with the safety criteria in Sec.
450.101, in accordance with Sec. 450.115(c). This change is consistent
with other FSA sections. Also, the FAA strikes the reference to
critical assets as explained in the preamble section associated with
critical assets.
[[Page 79648]]
In the NPRM, the application requirements in Sec. 450.135(e)(2)
addressed the methods used to compute debris impact distributions. In
the final rule, the FAA moves proposed Sec. 450.135(e)(2) to Sec.
450.121(d)(3). Proposed Sec. 450.135(e)(3) and (e)(4) addressed
population exposure data. In the final rule, those requirements are
moved to Sec. 450.123(c). These changes are described in the preamble
sections associated with those sections.\133\
---------------------------------------------------------------------------
\133\ The FAA adopts without change and re-designates proposed
Sec. 450.135(e)(5) through (e)(7) as Sec. 450.135(c)(2) through
(c)(4) in the final rule. The FAA received no specific comments on
these proposals.
---------------------------------------------------------------------------
The FAA moves the application requirements in proposed Sec.
450.135(e)(8)(i) through (iii) regarding the collective and individual
debris risk outputs to Sec. 450.135(c)(5)(i) through (iii) and removes
the proposed requirement to report critical asset results in Sec.
450.135(e)(8)(iv), as discussed further in the critical asset section
of this preamble.
The FAA revises and re-designates the application requirements in
proposed Sec. 450.135(e)(9) on the collective and individual debris
risk outputs as Sec. 450.135(c)(6). The FAA replaces the term
``vehicle response mode'' with ``failure mode.'' This revision is
consistent with changes throughout the final rule. The FAA also changes
the term ``one-second interval'' to ``significant period,'' as
explained in the preamble section on CEC.
SpaceX commented that it was not clear why proposed Sec.
450.135(e)(8) and (9) would require debris risk analysis to include
both representative conditions and the worst foreseeable conditions,
arguing that if the worst foreseeable conditions meet requirements,
then representative conditions are of no consequence. The FAA responds
that, for the purposes of Sec. 450.135(c)(5) and (c)(6), worst
foreseeable conditions means those conditions that produce the highest
individual, collective, and conditional risks under which the operator
would initiate the launch or reentry. An operator can submit the same
debris risk analysis results for representative conditions and the
worst foreseeable conditions in cases where there is no difference
between representative conditions and the worst foreseeable conditions
that are significant to public safety.
However, the FAA foresees the potential for situations where the
differences between the representative conditions and the worst
foreseeable conditions would require additional operational
mitigations. An example would be running the debris risk analysis using
input data for atmospheric conditions that lead to risks just below the
limits set in Sec. 450.101 (i.e., worst foreseeable conditions) and
running the debris risk analysis using more typical atmospheric
conditions that produce risks clearly below the limits. Under the worst
foreseeable conditions, the collective risk results for people on land
could be such that the operator would need to perform additional
surveillance of areas to ensure the absence of waterborne vessels,
whereas under representative conditions such surveillance would not be
necessary to ensure compliance with collective risk limits in Sec.
450.101(a)(1) and (b)(1). The FAA does not anticipate that there will
be significant additional burden in providing the analysis for
representative conditions.
v. Far-Field Overpressure Blast Effect Analysis, or Distant Focus
Overpressure (DFO) (Sec. 450.137)
In the NPRM, Sec. 450.137 proposed requirements for far-field
overpressure blast effects analysis. Proposed Sec. 450.137(a) required
that a far-field overpressure blast effect analysis demonstrate
compliance with safety criteria in proposed Sec. 450.101 either prior
to the day of the operation, accounting for all foreseeable conditions
within the flight commit criteria, or during the countdown using the
best available input data. In the final rule, the FAA adopts Sec.
450.137(a) with one revision.
The final rule in Sec. 450.137(a)(2) specifies that far-field
overpressure analysis performed during the countdown using the best
available input data must also include flight commit criteria and
flight abort rules. The FAA notes that the best available input data
specified in proposed Sec. 450.137(a)(2) would naturally include
flight commit criteria and flight abort rules because those would
generally have a significant influence on the public risks posed by
hazardous debris effects. Hence, the phrase ``including flight commit
criteria and flight abort rules'' is consistent with the requirement
for a debris risk analysis in Sec. 450.135(a)(2).
Virgin Galactic commented that Sec. 450.137(a)(1) appeared to
require an FSA the day before launch for the portion of its launches
involving its carrier aircraft's captive carriage of the spaceship.
Virgin Galactic expressed a concern about the operational impact and
additional workload of a day of launch analysis. Microcosm requested
clarification on whether the regulations required a day of launch
analysis if meteorological conditions did not present an environment
conducive to far-field overpressure.
Section 450.137(a)(1) does not require a full FSA the day before
launch. Instead, Sec. 450.137(a) requires the far-field overpressure
blast effect analysis be performed either as a ``screening'' analysis
prior to the day of the operation, accounting for all foreseeable
conditions within the flight commit criteria, or during the countdown
using the best available input data. The requirement in Sec.
450.137(a)(1) does not have a time constraint for when the ``screening
analysis'' must be completed. In response to Microcosm's comment, the
FAA notes that, in order to determine that local meteorological
conditions do not present an environment conducive to far-field
overpressure, an operator would necessarily be required to perform an
analysis under Sec. 450.137(a)(1). As such, Sec. 450.137(a)(1), as
proposed and adopted without change, allows an operator to demonstrate
that a far-field overpressure analysis need not be performed during the
countdown if the flight commit criteria are sufficient to ensure
compliance with Sec. 450.101.
In the NPRM, the FAA proposed requirements associated with analysis
constraints in Sec. 450.137(b) that set required performance outcomes
and the specific factors that a far-field overpressure blast effect
analysis must consider. Blue Origin commented that the proposed
requirements in Sec. 450.137(b) were prescriptive. The FAA agrees that
the proposal was unnecessarily specific in Sec. 450.137(b)(3) through
(5) and revises these requirements.
In the NPRM, Sec. 450.137(b)(3) proposed that the analysis account
for the explosive capability of the vehicle at impact and at altitude,
and potential explosions resulting from debris impacts, including the
potential for mixing of liquid propellants. In the final rule, the FAA
revises the language in proposed Sec. 450.137(b)(3) and relocates it
to Sec. 450.137(b)(1) to reflect the order in which the FAA expects
the analysis will be conducted. As rewritten, Sec. 450.137(b)(1) in
the final rule requires the analysis to account for the explosive
capability of the vehicle and hazardous debris at impact and at
altitude. As discussed previously, the FAA uses the definition for
``hazardous debris'' to reflect the scope of the NPRM requirements. The
final rule also removes the phrase ``potential for mixing of liquid
propellant'' because it is redundant with ``explosive capability,''
which is already included in the requirement. The FAA has also removed
reference to solid propellant
[[Page 79649]]
impacts because they are part of the explosive capability.
In the NPRM, proposed Sec. 450.137(b)(1) required that the
analysis account for the potential for distant focus overpressure or
overpressure enhancement given current meteorological conditions and
terrain characteristics. In the final rule, the FAA re-designates
proposed Sec. 450.137(b)(1) as Sec. 450.137(b)(2). The FAA also
requires in Sec. 450.137(b)(2) that the analysis must account for the
influence of meteorological conditions and terrain characteristics. The
FAA notes meteorological conditions are known to have a potentially
substantial influence on the propagation and attenuation of blast waves
with peak incident overpressures at or below 1.0 psi. In the final
rule, the FAA removes the reference to current meteorological
conditions in proposed Sec. 450.137(b)(1) to reflect that an applicant
may use a screening analysis pursuant to Sec. 450.137(a)(1) to
demonstrate additional analysis is not required by accounting for all
foreseeable conditions within the flight commit criteria.
In the NPRM, proposed Sec. 450.137(b)(2) required that the
analysis account for the potential for broken windows due to peak
incident overpressures below 1.0 psi and related casualties. In the
final rule, the FAA re-designates proposed Sec. 450.137(b)(2) as Sec.
450.137(b)(3) and adds the essential elements from proposed Sec.
450.137(b)(4) through (b)(6). Those sections contained unnecessary
details regarding shelter types, time of day, characteristics of
potentially affected windows including size, location, glazing
material, and characteristics of potential glass shards.
Section 450.137(b)(3) removes these details and captures the
concept of the requirements proposed in Sec. 450.137(b)(4) through
(b)(6) by adding language to reflect that the potential for broken
windows due to peak incident overpressures below 1.0 psi and related
casualties must ``be based on the characteristics of exposed windows
and the population's susceptibility to injury, with considerations
including, at a minimum, shelter types, window types, and the time of
day of the proposed operation.''
Blue Origin commented that the constraints could be accomplished by
an analysis tool available only to the government. The FAA disagrees
that the far-field overpressure analyses can only be accomplished using
a tool available to the U.S. government. Currently available materials
contain a detailed technical description of a valid approach.\134\
Furthermore, the FAA confirms that the analysis tool in use by the U.S.
government has been used by the U.S. commercial space transportation
industry at non-Federal sites as well.
---------------------------------------------------------------------------
\134\ A valid approach is described in ``Safety Design for Space
Operations,'' Allahdadi, Firooz A., Isabelle Rongier, Tommaso
Sgobba, Paul D. Wilde (Eds.), ``Safety Design for Space
Operations,'' Sponsored by The International Association for the
Advancement of Space Safety, published by Elsevier, Watham, MA,
2013. The only three topics not addressed in that reference (updated
explosive impact yield models, launch availability analyses based on
past measurements of meteorological conditions, and satisfaction of
license application requirements) are addressed in AC 450.137
``Distant Focusing Overpressure Risk Analysis Supplemental Topics,''
which is planned to be published after this final rule.
---------------------------------------------------------------------------
The FAA adopts Sec. 450.137(c) with only two minor modifications.
In the NPRM, Sec. 450.137(c)(6) explicitly identified that an
applicant would be required to submit the analysis results given
foreseeable meteorological conditions, yields, and population
exposures.
In the final rule, Sec. 450.137(c)(6) requires that the
application include the individual risk data given foreseeable
conditions. The FAA also revises Sec. 450.137(c)(7) in this manner.
The FAA notes generally that the same elements of the foreseeable
conditions listed in the NPRM influence the results of the far-field
overpressure blast effects analysis. Thus, the reworded final rule
maintains the same scope and intent of the NPRM application
requirements. The FAA adds this language because the proposal was
unnecessarily limited.
w. Toxic Hazards (Sec. Sec. 450.139 and 450.187)
In the NPRM, the FAA proposed to consolidate requirements for toxic
release analysis into two performance-based regulations: Sec. Sec.
450.139 (Toxic Hazards for Flight) and 450.187 (Toxic Hazards
Mitigation for Ground Operations). Although the two proposed sections
contained a number of similarities, the FAA divided them into two
sections because ground operations and flight operations had different
proposed criteria to establish an acceptable level of public safety.
Proposed Sec. Sec. 450.139(a) and 450.187(a) made the sections
applicable to any launch or reentry vehicle, including all vehicle
components and payloads, that use toxic propellants or other toxic
chemicals.
Virgin Galactic requested that the FAA create an exception to
Sec. Sec. 450.139 and 450.187 for carrier aircraft on hybrid systems
that already possess a standard airworthiness certificate or
experimental airworthiness certificate from FAA, as these aircraft most
commonly carry jet fuel. Virgin Galactic commented that, although jet
fuel may be considered a toxic substance, it is carried by thousands of
aircraft every day and thus performing a toxic release hazard analysis
for jet fuel would not have a material effect on public safety.
The FAA acknowledges that, historically, no toxic release hazard
analysis has been required for kerosene-based fuels, such as jet fuel,
and agrees that such an analysis would be unnecessary in most
instances. Therefore, in the final rule, the FAA revises the
applicability language in Sec. Sec. 450.139(a) and 450.187(a) to
create an exception from the toxic release hazard analysis for
kerosene-based fuels unless the Administrator determines that an
analysis is necessary to protect the public safety. The FAA anticipates
that such an analysis will be required for uses of kerosene-based fuels
that are novel or inconsistent with standard industry practices. The
FAA will work with operators during pre-application consultation to
identify any kerosene-based propellants requiring a toxic release
hazard analysis under Sec. Sec. 450.139 or 450.187.
Proposed Sec. 450.139(b) required an operator to conduct a toxic
release hazard analysis and manage the risk of casualties from exposure
to toxic release either through containing hazards in accordance with
proposed Sec. 450.139(d) or by performing a toxic risk assessment,
under proposed Sec. 450.139(e), that protects the public consistent
with the safety criteria proposed in Sec. 450.101. Furthermore,
proposed Sec. 450.139(b)(3) required an operator to establish flight
commit criteria based on the results of its toxic release hazard
analysis, containment analysis, or toxic risk assessment for any
necessary evacuation of the public from any toxic hazard area. The FAA
adopts Sec. 450.139(b) as proposed.
In the NPRM, paragraph (b) was inadvertently omitted from the
regulatory text to Sec. 450.187; however, the preamble discussed that
proposed Sec. 450.187(b) would, like proposed Sec. 450.139(b),
require an operator to manage the risk of casualties from exposure to
toxic release by either containing the hazards or performing a toxic
risk assessment. The preamble stated that for ground operations, an
operator using a toxic risk assessment must demonstrate compliance with
proposed Sec. 450.109(a)(3), rather than Sec. 450.185(c).\135\ The
FAA adds paragraph (b) to Sec. 450.187 in the final rule. As discussed
later in this section,
[[Page 79650]]
the FAA revises the toxic risk assessment criteria for ground
operations by replacing the reference to proposed Sec. 450.109(b)(3)
with a reference to Sec. 450.185(c). The FAA also revises Sec.
450.139(b)(3) to refer to ``toxic containment,'' rather than a ``toxic
containment analysis,'' as this term does not appear in the regulation.
---------------------------------------------------------------------------
\135\ 84 FR 15395.
---------------------------------------------------------------------------
Proposed Sec. Sec. 450.139(c) and 450.187(b) set forth the
requirements for toxic release hazard analysis. The FAA adopts the
substance of those provisions in the final rule, but re-designates
proposed Sec. 450.187(b) as Sec. 450.187(c), to account for the
addition of new Sec. 450.187(b).
As noted, Sec. Sec. 450.139(b) and 450.187(b) in the final rule
require an operator to manage the risk of casualties that could arise
from the exposure to toxic release through toxic containment or by
using a toxic risk assessment. Toxic containment, as proposed in
Sec. Sec. 450.139(d) and 450.187(c), required an operator to manage
the risk of casualty from the exposure to toxic release either by
evacuating, or being prepared to evacuate, the public from a toxic
hazard area, or by employing meteorological constraints. In either
scenario--evacuation or employment of meteorological constraints--the
operator would be required to demonstrate that an average member of the
public would not be exposed to greater than one percent conditional
individual probability of casualty in the event of a worst-case release
or maximum credible release scenario. The FAA received a formal comment
from NASA during the interagency review on proposed Sec. 450.139(d)
and Sec. 450.187(c). The FAA revised these provisions in the final
rule consistent with the updated definition of toxic hazard area
described below. Specifically, Sec. 450.139(d)(1) and Sec.
450.187(c)(1) require an operator using toxic containment to manage the
risk of casualty from the exposure to toxic release either by
evacuating, or being prepared to evacuate, the public from any toxic
hazard area. These revisions are consistent with current practice. The
FAA also re-designates proposed Sec. 450.187(c) as Sec. 450.187(d) to
account for the addition of new Sec. 450.187(b).
The FAA proposed to define ``toxic hazard area'' in Sec. 401.5
(Sec. 401.7 in the final rule) as ``a region on the Earth's surface
where toxic concentrations and durations may be greater than approved
toxic thresholds for acute casualty, in the event of a release during
launch or reentry.''
In the final rule, the FAA revises the proposed definition of
``toxic hazard area'' to include the language from proposed Sec. Sec.
450.139(d) and 450.187(c) regarding the ``a worst-case toxic or maximum
credible release scenario.'' Thus, in the final rule, a ``toxic hazard
area'' means ``a region on the Earth's surface where toxic
concentrations and durations may be greater than accepted toxic
thresholds for acute casualty in the event of a worst-case toxic or
maximum credible release scenario during launch or reentry.'' The FAA
revises this definition to ensure that the toxic hazard area is
consistent whether the operator performs a toxic risk assessment or
toxic containment. The revised definition of ``toxic hazard area'' is
consistent with the approach taken in current regulation in Appendix I
to part 417 under I417.5(c), which directly links the toxic
concentration thresholds to the size of the toxic hazard area. The FAA
anticipates that the toxic concentration thresholds used in an accepted
means of compliance for Sec. Sec. 450.139 and 450.187 will generally
be consistent with those in Appendix I to part 417 under I417.5(c).
The final rule's requirements for a toxic risk assessment under
Sec. 450.139(e) are unchanged from the proposal. A toxic risk
assessment must meet the safety criteria of Sec. 450.101 and account
for: Airborne concentration and duration thresholds of toxic
propellants or other chemicals; physical phenomena expected to
influence any toxic concentration and duration; the toxic hazard area
and the meteorological conditions involved; and all members of the
public that may be exposed to the toxic release.
In the final rule, Sec. 450.187(e), which contains the
requirements for a toxic risk assessment for ground operations,
includes one revision from the proposal. As mentioned, proposed Sec.
450.187(d) required an operator using toxic risk assessment to manage
the risk from any toxic release hazard and demonstrate compliance with
the criteria in Sec. 450.109(a)(3). The FAA replaces the reference to
proposed Sec. 450.109(a)(3) with a reference to Sec. 450.185(c)
because the flight hazard analysis risk criteria were removed from
Sec. 450.109. The standard in Sec. 450.185(c) is the same as in
proposed Sec. 450.109(a)(3); therefore, there is no substantive change
in the criteria. As a result, an operator complies with the
requirements for a toxic risk assessment by demonstrating no more than
an extremely remote likelihood of toxic exposure causing death or
serious injury to the public, using toxic concentration and duration
thresholds accepted by the Administrator as a means of compliance.
In the final rule, the FAA amends the application requirements
proposed in Sec. Sec. 450.139(f) and 450.187(e). Although proposed
Sec. Sec. 450.139(d) and 450.187(c) detailed the two ways in which an
operator could perform toxic containment, the NPRM did not specify how
an operator would demonstrate compliance with the toxic containment
requirements in their application. In the final rule, the FAA adds an
application requirement for toxic containment, in Sec. Sec.
450.139(f)(8)(i) and 450.187(f)(8), which reflects the substantive
requirements for performing toxic containment. That is, if toxic
containment is selected, the applicant must identify the evacuation
plans or meteorological constraints and associated launch commit
criteria or ground hazard controls that it will employ to ensure that
the public will not be within a toxic area in the event of a worst-case
or maximum credible release scenario. The FAA notes that an applicant
will need to submit the information required by this subsection in
order to demonstrate compliance with the substantive requirements for
toxic containment in Sec. Sec. 450.139(d) and 450.187(c).
The FAA revises the application requirements, in Sec. Sec.
450.139(f)(8)(ii) and 450.187(f)(9), to reflect the substantive
requirements of toxic risk assessment. If a toxic risk assessment is
performed, then the applicant must account for the public that may be
exposed to airborne concentrations above the toxic concentration and
duration thresholds, describe any risk mitigations applied in the toxic
risk assessment, describe the population exposure input data used in
accordance with Sec. 450.123 (Population Exposure Analysis), and
demonstrate compliance with the applicable public risk criteria (for
flight, the risk criteria in Sec. 450.101; for ground operations, the
risk criteria in Sec. 450.185(c)). Lastly, the FAA replaced the term
``population density'' with ``population characteristics'' in Sec.
450.139(f)(8)(ii)(2) and Sec. 450.187(f)(9)(ii) because
characteristics other than density (e.g., vulnerability of population)
would be relevant to assessing potential effects of toxic release, as
indicated by the Population Exposure Analysis criteria in Sec.
450.123.
Blue Origin commented that toxic risk analysis tools were not
currently available to operators, and that, unless the FAA facilitated
access to these tools, a sole-source provider of this service may
arise. One individual commenter asked what dispersion models were
acceptable to the FAA and commented that the FAA should provide
specific examples of allowable and acceptable toxic release and
dispersion mitigations.
[[Page 79651]]
The FAA disagrees that the tools needed to analyze risks associated
with a potential release of toxic substances during launch or reentry
are not currently available to operators. However, the FAA will issue
an AC entitled, ``Toxic Hazards for Flight,'' that will provide
guidance and examples of publicly available tools for conducting the
required toxic release hazard analyses, as well as a toxic risk
assessment and toxic containment. This guidance will include
information on:
Determining the airborne toxic concentration threshold or
level of concern (LOC) for each toxic propellant or toxic combustion
by-product;
Determining the worst-case quantity of any toxic release
that might occur during the proposed flight of a launch vehicle, or
that might occur in the event of a flight mishap;
Determining the worst-case quantity of any toxic release
that might occur during normal launch processing, and that might occur
in the event of a mishap during launch processing;
Characterizing the terrain, as a precursor for modeling
the atmospheric transport of a toxic release from its source to
downwind receptor locations;
Determining the meteorological conditions for the
atmospheric transport of any toxic release from its source to downwind
receptor locations;
Performing air quality dispersion modeling to predict
concentrations at selected downwind receptor locations (by
characterizing the atmospheric processes that disperse a toxic
substance emitted by a source); and
Determining the population density in receptor locations
that could potentially be identified by air quality dispersion modeling
as toxic hazard areas.\136\
---------------------------------------------------------------------------
\136\ SpaceX made a comment referencing an agreements subsection
of Sec. 450.139(b), but no such subsection existed in the NPRM.
---------------------------------------------------------------------------
x. Computing Systems (Sec. 450.141)
In the NPRM, the FAA proposed in Sec. 450.111 (Computing Systems
and Software) to require operators to develop a process that identifies
and assesses hazards to public safety and the safety of property
arising from computing systems and software. Operators would have
needed to identify all safety-critical functions associated with its
computing systems and software and to classify software based on degree
of autonomy. In the NPRM, software safety requirements would have
increased in rigor with the rise in the degree of autonomy of the
software. Conversely, software safety requirements would have decreased
in rigor with reductions in the software's degree of autonomy.
In the final rule, the FAA revises proposed Sec. 450.111 and re-
designates it as Sec. 450.141 (Computing Systems). Although the scope
of the requirements for operators under Sec. 450.141 does not differ
substantially from the proposed version, the FAA replaces prescriptive
requirements with performance-based standards and provides increased
flexibility for operators to demonstrate compliance with Sec. 450.141.
The final rule levies requirements for computing system safety items in
proportion to their criticality rather than their autonomy; requires
independent verification and validation for safety-critical computing
system safety items; and retains the NPRM's focus on development and
testing processes instead of direct inspection of software by the FAA.
The FAA removed the term, ``software,'' from the section heading since
``computing systems'' would include software. The FAA also removes the
definition of ``control entity'' proposed in Sec. 401.5 because the
term is no longer used in the final rule.
A number of commenters stated the requirements proposed in Sec.
450.111 were overly prescriptive or difficult to meet. SpaceX stated
that the proposed software process would be more burdensome and costly
for applicants than it had been under current regulations and would
prevent applicants from utilizing safer methods to construct a safety
case. Blue Origin and SpaceX argued the proposed requirement would
hinder technological advances that could improve safety. Blue Origin
stated the proposal threatened innovation towards lower cost, higher
quality, and safer software approaches, but did not specify the
approaches that would be impeded by the NPRM. Rocket Lab similarly
asserted that the proposal would hinder the development of software for
FSS, the automation of which is currently a major area for innovation.
Rocket Lab commented that the proposal did not allow flexibility to use
other means of functional system safety from equivalent industries or
government standards, and that the requirements would become quickly
outdated as software technologies and best practices evolve. CSF also
viewed the proposal as highly prescriptive and uneconomical for the FAA
or for industry.
CSF and SpaceX specifically rejected the degree of autonomy
approach proposed in Sec. 450.111, noting that human involvement did
not always produce a safer system. CSF suggested the FAA scale the
levels of rigor based on hazard effects and architectural mitigations.
Virgin Galactic stated that software need not be categorized by levels
of consequence and degrees of control if the software development
process was linked to a system safety program.
The FAA agrees that some of the requirements proposed in Sec.
450.111 were too prescriptive, potentially overly burdensome, and could
have the effect of discouraging technological innovation to improve
safety.\137\ The FAA also agrees with the commenters' discussion of the
limitations of autonomy as a criterion for level of rigor. In the final
rule, the FAA revises the requirements for computing systems, which are
now located in Sec. 450.141 to address the commenters' concerns.
Section 450.141 scales level of rigor for computing system requirements
based on system-level criticality rather than on degree of autonomy,
and is designed to parallel the requirements of computing system safety
responses to the existing regulations. The existing regulations require
plans for software development and validation and verification plans
but remain silent on the acceptable content of those plans. The final
rule requirements are designed to align with current software safety
submissions. The FAA also removes prescriptive requirements from Sec.
450.141, as detailed in the following paragraphs, to increase
flexibility in application to current and future computing system
designs.
---------------------------------------------------------------------------
\137\ As an example, the FAA acknowledges the commenter's
concerns in particular with regard to the requirements to document a
process for identifying hazards arising from software; to meet
software testing standards and hazard analyses based on levels of
autonomy; and to detail the functionality of all software having no
safety impact.
---------------------------------------------------------------------------
Section 450.141 requires the identification and assessment of the
public safety-related computing system requirements, functions, and
data items, in order to streamline the evaluation of computing system
safety. The final rule retains the requirement proposed in Sec.
450.111 to identify and assess the public safety implications of
computing systems, which derives from the current requirements in
Sec. Sec. 417.123(a) and 431.35(c) to perform this assessment as part
of a system safety process. The explicit identification of the public
safety related aspects of computing systems enables a reduction in the
scope of FAA's evaluation compared to the current regulations.
In the final rule, Sec. 450.141(a) requires an operator to
identify computing system safety items, meaning any software or data
that implements a capability that could present a hazard to
[[Page 79652]]
the public, and the criticality of each computing system safety item,
commensurate with its degree of control over hazards to the public and
the severity of those hazards. For purposes of this section, a
computing system safety item is any item that is a computing system or
software that has some degree of control over hazards to the public; a
computing system that is either a cause of or a mitigation for a hazard
that can affect the public. Computing system safety items include not
only software, but also software elements, including data, and
interfaces that present or control risks to the public (e.g., software/
hardware interfaces, and software/human interfaces). The FAA uses the
term ``computing system safety item'' in order to provide a clean
interface between software safety, which controls risks due to flaws in
logic, and system safety, which controls risk. Software runs on
hardware in response to commands and inputs, so a computing system
safety item is often more than just software. ``Level of criticality''
here means the combination of a computing system safety item's
importance in the causal chain for a given hazard, which is
commensurate to its degree of control, and the severity of that hazard.
Computing system safety items that are more influential on a causal
chain for a hazard of a given severity would be subject to a
proportionally higher level of rigor in development and testing. The
degree of control may be evident in (1) a system's tolerance to a given
computing system fault, (2) the computing system's autonomy in causing
or preventing a hazard, (3) the number and characteristics of other
system faults or failures required for the hazard to manifest itself,
or (4) some other measure devised by the applicant.
The requirement proposed in Sec. 450.111(c) to allocate
development process rigor according to degree of autonomy has been
replaced with the requirement in Sec. 450.141(a)(2) to use system-
level criticality to set the minimum level of rigor in developing and
testing each computing system safety item. The FAA agrees with the
comments received on the shortcomings of allocation by degree of
autonomy and the recommendation to use a system safety approach to
computing system safety. System safety allocates level of rigor
according to the criticality of each item in the system, and the
revised regulation aligns software and computing system level of rigor
allocation with system safety's level of rigor allocation, erasing a
difference between the two safety analyses.\138\ For some systems,
system-level criticality and degree of autonomy will produce the same
or similar allocations of rigor in computing system development. An
applicant can propose to use degree of autonomy as a proxy for system-
level criticality based on that similarity, as it is an industry
standard method of determining level of rigor allocation. This revision
achieves the objective stated in the NPRM of tailoring safety
requirements based on criticality but eliminates the prescriptive
criticality levels proposed in the NPRM. The criticality of each
computing system or function must be assessed at the system level so
the applicant can clearly demonstrate to the FAA how the system uses
computing systems and the influence of each computing system safety
item on public safety.
---------------------------------------------------------------------------
\138\ Since the approach in proposed Sec. 450.111 of using
degrees of autonomy was largely informed by MIL-STD-882E, this
revised approach in Sec. 450.141 of the final rule will reduce
confusion and error caused by translating between different
allocation schemes already adopted by other industry standards. This
will also improve the rule's resilience to future changes to
standards.
---------------------------------------------------------------------------
Section 450.141(b) requires an operator to develop safety
requirements for each computing system safety item. A safety
requirement specifies the implementation of one or more public safety-
related functions, capabilities, or attributes in a computing system
safety item. The FAA notes that it uses the phrase ``safety
requirements'' in the final rule differently than it did in the NPRM.
In the NPRM, ``software safety requirements'' referred to regulatory
requirements for software. In Sec. 450.141 of the final rule, ``safety
requirements'' means computing system requirements that specify
computing system attributes or functionality that have public safety
significance. Identification of this subset of computing system
requirements related to public safety is essential to focus an
operator's safety efforts on those parts of the computing system safety
item that have public safety consequences. It will also streamline the
scope and depth of data required of applicants and the FAA's evaluation
process relative to current requirements, to the same extent as
proposed Sec. 450.111.
Section 450.141(b)(1) requires an operator to identify and evaluate
safety requirements for each computing system safety item. Safety
requirements are the subset of requirements that define features,
capabilities, or behaviors that have public safety implications. This
identification and evaluation process may identify new computing system
safety items if safety requirements are identified for items that did
not previously have known safety requirements.
Section 450.141(b)(2) requires an operator to ensure the safety
requirements are complete and correct. A computing system requirement
set is complete if it contains all of the requirements necessary to
specify all of the functions and attributes needed for the computing
system to perform its required tasks. A computing system requirement is
correct if it specifies the correct functionality or attributes for the
item to perform its intended system-level functions. This can be
accomplished as part of an applicant's normal software and computing
system requirement review process. The FAA does not require the
applicant to conduct a separate public safety-specific review, provided
the applicant's computing system requirement review process
accomplishes the intent of Sec. 450.141(b)(2).
Section 450.141(b)(3) requires an operator to implement each safety
requirement. That is, the safety requirements reviewed in accordance
with Sec. 450.141(b)(2) must be built into the system for verification
in Sec. 450.141(b)(4). Requirements are normally implemented by
operators, and no special implementation process is required for safety
requirements.
Section 450.141(b)(4) requires that the applicant verify and
validate the implementation of each safety requirement using a method
appropriate for the level of criticality of the computing system safety
item. Computing system requirements are normally verified and validated
by a combination of testing, analysis, and inspection. The NPRM
proposed to require specific testing and verification methods that have
not been retained in the final rule due to the removal of specific
criticality levels for software. The final rule allows sufficient
flexibility for operators to implement methods and levels of rigor
appropriate for their operations. For example, a development process
that traces from computing system requirements to verification and
validation evidence is necessary but may not be the only process for
adequate verification and validation; a process that traces from
verification and validation tests to the intended computing system
functionality may be more appropriate for third-party products.
Operators may use many different processes that accomplish traceability
as long as the process demonstrates that the verification and
validation evidence is sufficient to verify and validate all of
[[Page 79653]]
the computing system safety requirements.
Section 450.141(b)(4) further specifies that, for each computing
system safety item that meets the definition of ``safety critical'' in
Sec. 401.7, verification and validation must include testing by a test
team independent of the development division or organization. As
defined in Sec. 401.7, a safety-critical item means a system,
subsystem, component, condition, event, operation, process, or item,
whose proper recognition, control, performance, or tolerance, is
essential to ensuring public safety. A safety-critical computing system
safety item is a computing system safety item of which proper
recognition, control, performance, or tolerance is essential to
ensuring public safety. As described in the NPRM, the FAA uses the term
``independent'' to designate a verification and validation group that
has substantial and credible independence from the development team.
This independent group has a separate personnel structure through at
least senior leadership, operates under distinct performance,
technical, schedule, and incentive pressures, and has the latitude to
develop and test requirements independently. This independent
verification and validation group can be a third party or an in-house
group but in either case must have the technical, managerial, schedule,
and incentive independence \139\ to carry out its functions without
undue pressure from the development team. The requirement for
independent verification and validation of safety-critical computing
system safety items is broadly aligned with current practices for
verification and validation. Specifically, the minimum expectation is
that safety-critical computing systems, such as autonomous FSS, are
subjected to a level of verification and validation rigor that can only
be achieved by verification and validation staff that are independent
of the development organization.
---------------------------------------------------------------------------
\139\ Incentive independence means that the independent
verification and validation group is rewarded based on some metric
other than schedule or throughput, so that the schedule or
throughput demands that drive error rates upward do not also drive
testing thoroughness downward.
---------------------------------------------------------------------------
The requirement in proposed Sec. 450.111(b) to identify all
safety-critical functions involving software is revised and included in
Sec. 450.141(b) of the final rule. Section 450.141(b) requires the
applicant to identify all safety requirements performed by computing
system safety items, check that the safety requirements are complete
and correct, implement the safety requirements, and verify and validate
their implementation including independent verification and validation
for safety-critical computing system safety items. These regulatory
requirements have the net effect of identifying all safety-critical
functions involving computing systems, since safety requirements
necessarily include all safety-critical functions, capabilities, and
attributes of computing systems.
Section 450.141(c) requires operators to implement and document a
development process for computing system safety items identified in
Sec. 450.141(a) appropriate for the level of criticality of the
computing system safety item. The requirement to implement and document
such a development process for all computing system safety items is
substantially similar to both existing rules and the requirements
proposed in Sec. 450.111, except in the final rule the requirement is
no longer contained in separate subsections for each level of autonomy
(proposed Sec. 450.111(d) through (g)). As explained in the NPRM
preamble, the FAA needs to understand the computing system development
processes used for each computing system safety item, relative to its
effect on public safety, in order to assess computing system safety.
The final rule calls for a development ``process,'' rather than a
``plan,'' that achieves the same objectives key to a development plan
but affords applicants greater flexibility to structure their processes
as needed to satisfy Sec. 450.141(c). Operators need not employ a
separate development process for each computing system item. However,
the development process must be appropriate to the level of criticality
of each computing system safety item to which it is applied, and must
satisfy the criteria listed in Sec. 450.141(c), at a minimum.
In order to demonstrate that a development process is appropriate
to the level of criticality of each computing system safety item, an
operator would need to identify the tasks associated with each safety
item, along with its processes for reviewing, verifying, and validating
computing system safety requirements. Section 450.141(c)(1) requires a
development process to define responsibilities for each task associated
with a computing system safety item. This requirement derives from the
requirement proposed in Sec. 450.111(d)(5) for a software development
plan; in order to be acceptable, the development process must assign
responsibilities for its execution. This requirement intends to ensure
that development tasks for computing system safety items are carried
out by defined personnel in the organization, though not necessarily
individuals by name.
Under Sec. 450.141(c)(2), a development process must include
processes for internal review and approval, including review that
evaluates the implementation of all safety requirements, such that no
person approves their own work. This is consistent with proposed Sec.
450.111(d)(4), which required independent verification and validation,
and proposed Sec. 450.111(d)(5)(i), which required coding standards.
Neither of those requirements could be met in absence of a review and
approval process that meets Sec. 450.141(c)(2) of the final rule,
since acceptable performance of those tasks inherently includes review
and approval by a person independent of those who did the work.
Software and computing system development is a complex set of actions,
and some subsets of those actions are milestones that require review
and approval. This requirement means that those reviews and approvals
must have some degree of independence such that no person approves
their own work, and requires that the minimum set of reviews and
approvals contains reviews of the implementation of safety
requirements. This association is defined by generation, such as code
written to implement a safety requirement, or by interaction, such as
code that must function in order for a safety requirement to be met.
Code reviews conducted to meet this requirement need not be single
events but may be modularized in a manner similar to the code itself as
long as comprehensive understanding is communicated between modular
reviews. Computing system development efforts that use pre-commit and
post-commit reviews to conduct a modularized code review process could
meet Sec. 450.141(c)(2). The intent is that code developed to
implement safety requirements should be checked by at least one
independent technical reviewer prior to its release.
Section 450.141(c)(3) requires the operator to ensure that
development personnel are trained, qualified, and capable of performing
their roles. This is consistent with Sec. 450.111(d)(5)(i) of the
NPRM, which required coding standards, which are an implicit part of
the training of development personnel. The final rule makes this
implicit requirement in the NPRM explicit. Personnel responsible for
public safety tasks must have training and experience that enables them
to discharge their responsibilities effectively. In its
[[Page 79654]]
application review, the FAA does not intend to verify the
qualifications of individual development personnel, but rather to
verify that the operator has a process in place to put appropriately-
trained and experienced personnel in public safety roles.
Section 450.141(c)(4) requires a development process to define
processes that trace requirements to verification and validation
evidence. This requirement is a performance criterion that was implicit
in the proposed Sec. 450.111(d)(5) software development plan; FAA is
making this criterion explicit and performance-based in the final rule
to address commenters' concerns. Traceability from computing system
requirement to verification and validation evidence significantly
streamlines computing system safety evaluations by connecting the
requirements that define a computing system's capabilities to evidence
of their implementation. Importantly, this requirement applies to all
requirements for computing system safety items, as a lack of rigor
inmanaging requirements on any computing system safety item is an
opportunity for undocumented or unintended computing system safety
requirements to be introduced into the system.
Section 450.141(c)(5) requires a development process to define
processes for configuration management that specify the content of each
released version of a computing system safety item. This requirement is
a performance-based version of proposed Sec. 450.111(d)(5)(ii), which
required configuration control. Configuration management at this level
of performance is the baseline expectation for any computing system
safety item because a known configuration with a known history is
required to provide adequately for safety. The revised requirement
contains the performance criteria that were implicit in the NPRM.
Section 450.141(c)(6) requires a development process to define
processes for testing that verify and validate all safety requirements
to the extent required by Sec. 450.141(b)(4). This means that safety
requirements must be tested in a manner consistent with their level of
criticality. The FAA removed a prescriptive requirement proposed in the
NPRM for testing on flight-like hardware \140\ to increase flexibility.
The FAA requires verification and validation that is appropriate for
the level of criticality of the computing system safety item, and
allows the operator to define the levels of criticality that are
appropriate for its operations. The operator must determine, and the
FAA will verify, which of the operator's levels of criticality affect
public safety and which of the computing systems described in the
proposed operation are in each of those public safety levels. Operators
must then define verification and validation procedures to test
computing system safety items in appropriately representative
environments.
---------------------------------------------------------------------------
\140\ For each level of criticality in proposed 450.111(d)
through (g), the FAA proposed that the software component's safety-
critical functions must be tested on flight-like hardware, which
must include nominal operation and fault responses for all safety-
critical functions.
---------------------------------------------------------------------------
Section 450.141(c)(7) requires a development process to define
reuse policies that verify and validate the safety requirements for
reused computing system safety items. This requirement was retained
from proposed Sec. 450.111(d)(5)(v), which similarly required an
operator to develop and implement software development plans, to
include descriptions of a policy on software reuse. In essence, the
applicant is required to have processes in place to understand the
safety implications of any computing system safety item developed for a
different project or purpose.
Section 450.141(c)(8) requires a development process to define
third-party product use policies that verify and validate the safety
requirements for any third-party product. This requirement was retained
from proposed Sec. 450.111(d)(5)(iv), which required an operator to
develop and implement software development plans, to include a
description of a policy on use of any commercial-off-the-shelf
software. The FAA replaces the term ``commercial-off-the-shelf
software'' in the proposal with ``third-party product'' because
commercial software is not the only kind of third-party computing
system that an applicant could use; government-off-the-shelf and free,
open source products need strategies for safe use, and the policy does
not need to vary based on the nature of the third party. The important
characteristic is that the computing system was not developed by the
applicant, so FAA now uses ``third-party'' to describe it. The final
rule sets performance criteria for this requirement with the addition
of the phrase ``that verify and validate the safety requirements in any
third-party product.'' This means that the safety requirements
implemented by third-party products must be subjected to verification
and validation just like applicant-developed computing system safety
items.
Section 450.141(d) contains the application requirements for this
section. Each of the first five requirements in paragraph (d) mirrors a
key aspect of computing system safety, allowing the applicant and FAA
to understand the rigor of development in terms of public safety. This
structure is meant to reflect the typical formats of computing system
safety data submissions received by the FAA to date. The regulation
requires an applicant to describe the computing system safety items,
identify the safety requirements implemented by each computing system
safety item, provide the development processes that generated them,
provide evidence that the development process was followed, and provide
data verifying the correct implementation of the safety requirements.
These application requirements need not be met in separate documents.
The application requirements of Sec. 450.141(d) essentially
replicate those proposed in Sec. 450.111(h), except that the revised
regulation allows greater latitude to implement development processes
that achieve the same goals by different means. An example of such an
alternative process would be a formal mathematical proof that the code
will function only as designed and that the design meets all of its
requirements. A formal proof is preferable to an iterative development
and testing process, whenever practical, because a formal proof
demonstrates that every possible action that a computing system system
can take is safe whereas iterative development can only approximate
that demonstration. A formal proof would have required waivers under
proposed Sec. 450.111 but will not under Sec. 450.141.
Several commenters recommended that hazards associated with
computing systems and software be addressed through other sections in
part 450, rather than in a dedicated section on computing systems and
software. CSF, SpaceX, Virgin Galactic, and Virgin Orbit stated that
hazards associated with computing systems and software should be
addressed through the system safety requirements for flight hazard
analyses, proposed Sec. 450.109. CSF commented that a computing system
was just one of many critical subsystems integrated into a larger
complex system, that all systems and subsystems should be analyzed and
controlled for hazards, and that the fact that a particular system may
contain software should be irrelevant to top level performance-based
safety requirements. Blue Origin and CSF recommended that the
requirements for safety-critical systems in Sec. 450.143 be used for
software
[[Page 79655]]
systems. SpaceX recommended that hazard analyses be limited to
demonstrating one fault tolerance for safety-critical functions,
including tolerance to faults in any inputs to the functions (e.g.,
data loss, data corruption) and any downstream hardware or software
effects required for public safety (e.g., effecting thrust
termination).
The FAA will retain a separate section for computing system
requirements in the final rule. As stated in the NPRM preamble, the FAA
consolidated the computing system safety requirements applicable to
launch or reentry operations under a single section in Sec. 450.141 of
the final rule to address software, firmware, and data, and the way
they operate in computing systems. The FAA based this approach on a
determination that software safety cannot be evaluated outside of the
computing system in which it operates. Software and computing systems
are decision engines that, like humans, control other vehicle systems
that can present hazards to the public and therefore merit analysis of
their control logic. Although computing systems and software must be
factored into an operator's system safety process and hazard control
strategies, the FAA has determined that computing systems warrant
separate consideration due to distinct characteristics that make them
uniquely ill-suited to most traditional system safety methods.
Software assurance is often a more appropriate mitigation strategy
than fault tolerance for software faults. The FAA anticipates that any
emergent method for system safety analysis that handles software and
computing systems well will meet Sec. 450.141 because such a method
would necessarily produce the essential elements of computing system
safety embodied in the regulation. That is, Sec. 450.141 applies
equally well to dedicated computing system safety analyses and to
system safety analyses that handle computing systems in an integrated
manner.
Furthermore, although computing systems can be ``safety critical,''
as defined in Sec. 401.7, the FAA declines to apply the requirements
set forth in Sec. 450.143 regarding safety-critical system design,
test, and documentation to computing systems because those requirements
do not adequately address the idiosyncrasies of computing systems. For
example, Sec. 450.143(b) in the final rule requires an operator to
design safety-critical systems to be fault-tolerant, fail safe, damage-
tolerant, or otherwise designed such that no fault can lead to
increased risk to the public beyond nominal safety-critical system
operation. Fault tolerance is not achievable for many software faults.
Similarly, the predicted environments are defined and evaluated very
differently for software than for other safety-critical systems under
Sec. 450.143. The predicted operating environment for computing
systems is defined in computing system requirements, but those
requirements are derived from the mathematical relationships that the
software must embody, so the requirement to provide predicted
environments for computing systems is indistinguishable from providing
the computing system requirements and design documentation for
computing systems.
Blue Origin, CSF, Sierra Nevada, Virgin Galactic, and Virgin Orbit
commented that any prescription in the regulation should be moved to an
AC as a means of compliance. Virgin Galactic commented that guidance
material should be based on industry standard development assurance
processes. CSF suggested that ACs reference industry standards and to
refer to new or existing FAA ACs, such as AC 20-115C, AC 20-152, AC 20-
153, AC 20-170, and AC 20-174, to provide a detailed means of
compliance to performance-based regulations for computing systems.
As discussed, the FAA has revised the proposed requirements to be
less prescriptive in the final rule. The FAA regulates software
assurance only to the extent that it is used as a mitigation strategy
for computing system hazards. The FAA plans to issue guidance that will
provide further clarity on the requirements in Sec. 450.141, including
the integration of existing software assurance standards, such as the
referenced ACs, with computing system safety processes. The FAA
considers these changes in the final rule to be consistent with the
comments received.
Blue Origin, CSF, Rocket Lab, SpaceX, and Virgin Galactic commented
that the requirements in proposed Sec. 450.111 did not integrate well
with most industry applications and best practices. CSF and SpaceX
commented that the methods prescribed by the proposal were incompatible
with proven industry standards such as ISO 26262 \141\ and DO-
178C.\142\
---------------------------------------------------------------------------
\141\ ISO 26262 is an adaptation of the Functional Safety
standard IEC 61508 for Automotive Electric/Electronic Systems. ISO
26262 defines functional safety for automotive equipment applicable
throughout the lifecycle of all automotive electronic and electrical
safety-related systems.
\142\ DO-178C, Software Considerations in Airborne Systems and
Equipment Certification, is the primary document by which the
certification authorities such as FAA, EASA, and Transport Canada
approve all commercial software-based aerospace systems. The FAA
approved AC 20-115C July 2013, making DO-178C a recognized
``acceptable means, but not the only means, for showing compliance
with the applicable airworthiness regulations for the software
aspects of airborne systems and equipment certification.''
---------------------------------------------------------------------------
The FAA revises the regulation in a way that aligns better with the
system safety process and replaces the prescriptive requirements
identified by commenters with performance-based metrics. The final rule
also aligns better with industry standards, including ISO 26262 and DO-
178C. Virgin Galactic noted similarities between proposed Sec. 450.111
and existing standards, and this similarity is intentional as the FAA
was attempting to codify those parts of industry standards that were
well suited to standardization. The final rule bears less similarity to
existing standards, instead specifying the goals of those standards as
requirements in Sec. 450.141. The FAA has revised the computing
systems and software safety requirements to contain the minimum set of
performance requirements necessary to address the public safety
implications of a given operation. The FAA also removed many
prescriptive requirements from the regulation. This revision allows for
more flexibility and thus consistency with industry standards.
CSF, SpaceX, and Virgin Galactic commented that the proposed rule
was not comprehensive enough and was missing items such as aeronautical
databases, integrated modular avionics, regression testing, and other
details. Blue Origin, CSF, and SpaceX stated that the proposal failed
to address object-oriented technology, model-based development, machine
learning, tool qualification, load control, formal methods, robust
protection and partitioning, integrated modular avionics, and
integration with the system process.
As discussed, the final rule has been revised to remove
prescriptiveness and increase flexibility. Therefore, because such
prescription was removed from the final rule, the FAA does not find the
changes recommended by these comments to be necessary. The FAA will
address items like aeronautical databases, integrated modular avionics,
regression testing, and other details in guidance documents. These
items will be addressed by Sec. 450.141(c), which implements safety
requirements for these and all other computing system safety items.
An individual commenter suggested that all hardware dependent on
software be vertically integrated and signal proof to protect against
issues posed by cyber
[[Page 79656]]
security or signal interference. The FAA does not believe a change to
the regulations is necessary. Issues posed by cyber security or signal
interference that could pose a threat to public safety are adequately
addressed by the hazard identification and mitigation requirements in
Sec. 450.141.
SpinLaunch recommended that the proposed set of software
requirements, compliance plans, and test data be replaced with the
requirement either to submit a software plan and sample results or to
demonstrate the capability of the software to perform as required.
The requirement that an operator either submit a software plan and
sample results or demonstrate the capability of the software would not
protect public safety adequately for three reasons. First, a software
plan is insufficient without evidence of its execution. Section 450.141
requires an operator to document a development process for all
computing system safety items and provide evidence of its execution.
Second, the minimum set of sample results that would be sufficient to
verify protection of the public is the set that meets the requirements
in Sec. 450.141(b)(4) for verification of public safety-related
functionality. Third, an adequate demonstration of software capability
necessarily will include the level of testing specified by Sec.
450.141. For these reasons, the FAA does not see a distinction between
Sec. 450.141 and either the submission of a software plan and sample
results or a demonstration of software capability.
y. Safety-Critical Systems Design, Test, and Documentation (Sec.
450.143)
In the NPRM, the FAA proposed standalone performance-based
requirements for safety-critical systems in Sec. 450.143. The proposed
requirements covered fault tolerance, qualification testing, acceptance
of hardware, and lifecycle management for all safety-critical systems
including FSS.\143\ In the NPRM, the FAA noted that applicants using an
FSS of any reliability threshold would be required to meet the proposed
Sec. 450.143 safety-critical system design, test, and documentation
requirements.\144\ In addition, under proposed Sec. 450.143(a),
operators required to use an FSS under Sec. 450.101(c) would be
required to meet the standards in Sec. 450.145.
---------------------------------------------------------------------------
\143\ As noted in the NPRM, an FSS is an integral tool to
protect public health and safety and the safety of property from
hazards presented by a vehicle in flight. An FSS allows an operator
to exercise positive control of a launch or reentry vehicle,
enabling an operator to destroy the vehicle, terminate thrust, or
otherwise achieve flight abort. A highly reliable FSS that controls
the ending of vehicle flight according to properly established rules
nearly ensures containment of hazards within acceptable limits. For
that reason, the FAA considers an FSS a safety-critical system. See
84 FR 15326.
\144\ See 84 FR 15329.
---------------------------------------------------------------------------
The FAA also proposed to revise the definition of ``safety
critical'' in Sec. 401.5. As proposed, ``safety critical'' retained
the longstanding definition of being something ``essential to safe
performance or operation,'' and the proposed definition further
explained that a safety-critical system, subsystem, component,
condition, event, operation, process, or item, is one whose proper
recognition, control, performance, or tolerance, is essential to
ensuring public safety. The FAA proposed to remove language in the
existing definition stating that something is ``safety critical'' if it
creates a safety hazard or provides protection from a safety hazard,
because that language is redundant.
In the final rule, the FAA adopts Sec. 450.143 with some revisions
discussed later in this section. The FAA also adopts the proposed
definition of ``safety critical'' without substantive change and
relocates it to Sec. 401.7. Based on the change to the definition of
``public'' in the final rule, the FAA changes the reference to ``public
safety'' in the definition of ``safety critical'' to ``public safety
and the safety of property.''
Blue Origin, CSF, and one individual commented that the term
``safety critical'' was ambiguous in light of the proposed revision to
Sec. 401.5.
A system is safety critical if its performance is essential to safe
performance or operation. If the failure of a system can create a
hazard to the public, then the system is a safety-critical system.
Section 450.143 would apply to a safety-critical system unless an
operator demonstrates through its flight hazard analysis that the
likelihood of any hazardous condition associated with the system that
may cause death or serious injury to the public is extremely remote,
pursuant to Sec. 450.109(b)(3). Due to the inherent risk to the
public, an operator must demonstrate the reliability of a safety-
critical system by meeting the requirements of Sec. 450.143.\145\
---------------------------------------------------------------------------
\145\ In addition to Sec. 450.143, requirements in the final
rule that apply to safety-critical systems are also found in
Sec. Sec. 450.45(e)(3)(ii)(C), 450.103(c)(1), 450.103(d)(4),
450.107(b)(2), and 450.107(d)(1)(ii). These requirements are
discussed within those sections.
---------------------------------------------------------------------------
The applicant's identification and proper management of safety-
critical systems is fundamental to mitigating potential hazards and
ensuring public safety, and the FAA will work with an applicant if it
believes the applicant has failed to identify all safety-critical
systems. The potential failure of safety-critical systems is integral
to the FSA, and the vulnerabilities of safety-critical systems must be
accounted for in the flight commit criteria, hazard analyses, lightning
protection criteria, management of radio frequency to prevent
interference, and communications plans.
Virgin Galactic commented that the requirements of Sec. 450.143
are costly, time-consuming, burdensome, and contrary to the Commercial
Space Launch Act requirement to only regulate to the extent necessary.
Virgin Galactic requested that an applicant not be mandated to comply
with Sec. 450.143 if it can provide proof that a safety-critical
system meets the safety criteria.
The FAA acknowledges that, under certain circumstances, an operator
could demonstrate that a safety-critical system would not need to have
the robust design and testing required of Sec. 450.143. The FAA
considered relieving an operator from the requirements in Sec. 450.143
if the safety criteria in Sec. 450.101 were met. However, the FAA
found that use of the safety criteria for this purpose is not
appropriate because whereas the requirements in Sec. 450.143 apply to
safety critical systems--which, as defined, can be a system, subsystem,
component, condition, event, operation, process, or item--the safety
criteria in Sec. 450.101 measure the effects of the failure modes of
the vehicle as a whole, as analyzed in the FSA. Therefore,
demonstrating compliance with the safety criteria in Sec. 450.101 is
not sufficient to relieve an operator from the requirements in Sec.
450.143, because that alternative would relieve the operator from
analyzing the vehicle's discrete systems, subsystems, components,
conditions, events, operations, processes, and items. The FAA finds
that analysis at this more discrete level is necessary to ensure safety
of the public.
The FAA finds that a more appropriate method to provide flexibility
and be responsive to Virgin Galactic's concern is to rely on the flight
hazard analysis in Sec. 450.109. Specifically, the FAA revises Sec.
450.143(a) to exclude safety-critical systems for which an operator
demonstrates through its flight hazard analysis that the likelihood of
any hazardous condition specifically associated with the system that
may cause death or serious injury to the public is extremely remote,
pursuant to Sec. 450.109(b)(3). As explained in the preamble section
associated with
[[Page 79657]]
Sec. 450.109, the flight hazard analysis focuses on the reasonably
foreseeable hazards to public safety resulting from the flight of a
launch or reentry vehicle. In performing the flight hazard analysis,
the operator is required in Sec. 450.109(b)(1)(ii) to identify
reasonably foreseeable hazards and corresponding failure modes relevant
to public safety resulting from system, subsystem, and component
failures or faults. Therefore, unlike the safety criteria in Sec.
450.101, the flight hazard analysis explicitly requires the operator to
examine the hazards associated with the discrete systems, subsystems,
and components of the vehicle.
Thus, to provide increased flexibility without reducing safety, the
final rule excludes certain safety-critical systems from the
requirements of Sec. 450.143 if an operator demonstrates through its
flight hazard analysis that the likelihood of any hazardous condition
specifically associated with the system that may cause death or serious
injury to the public is extremely remote, pursuant to Sec.
450.109(b)(3). That is, the operator must show that specific
requirements in Sec. 450.143, which ensure that the system will
function reliably, are not entirely necessary to mitigate the hazards
specifically associated with the system to an extremely remote level.
For example, an operator's launch vehicle may have a number of
systems whose failure could potentially cause hazardous debris to
impact the public. If an operator chooses to launch in a sparsely
populated area and limit propellant loading to minimize risk to the
public to an extremely remote level despite the failure of one or more
safety-critical systems, then those systems would not need to be
designed or tested to the level set forth in Sec. 450.143. The
operator must show that the exception in Sec. 450.143(a)(2) applies
for a particular safety-critical system through its flight hazard
analysis. If the operator cannot show that all hazards involving the
system are sufficiently mitigated to an extremely remote level despite
a failure of that system, then that system must meet the design and
testing requirements in Sec. 450.143.
However, the FAA anticipates that certain systems will not qualify
for the exception in Sec. 450.143(a)(2). Specifically, safety critical
systems that prevent hazards from reaching the public given other
system failures would likely be required to meet Sec. 450.143. This is
also true of systems that create hazards to the public that are not
otherwise mitigated by other hazard controls. The FAA anticipates that
it is unlikely that an operator would be able to demonstrate that the
hazards associated with these systems meet the ``extremely remote''
standard in Sec. 450.109(b)(3) without subjecting them to the
reliability requirements in Sec. 450.143. Furthermore, FSS required by
Sec. 450.108(b)(2) must meet Sec. 450.143 without exception.
The FAA also revises Sec. 450.143(a) and removes the proposed
requirement that all FSS required by Sec. 450.101(c) must meet
Sec. Sec. 450.143 and 450.145. Instead, Sec. 450.143(a) requires all
safety-critical systems except for the highly reliable FSS required by
Sec. 450.108(b)(1) to meet the requirements in Sec. 450.143. As
discussed in the flight abort section of this preamble, an FSS required
by Sec. 450.108(b)(2) must comply only with Sec. 450.143 rather than
meeting the additional requirements proposed in Sec. 450.145.
Likewise, an operator who chooses to use flight abort as a hazard
control strategy for reasons other than protecting against a high
consequence event under Sec. 450.101(c)(1) must also satisfy the
requirements of Sec. 450.143 for its FSS. For reasons explained later
in this section, highly reliable FSS under Sec. 450.145 do not need to
comply with the general safety-critical systems requirements of Sec.
450.143 as was proposed in the NPRM.
The FAA proposed in Sec. 450.143(b) to require that all safety-
critical systems follow reliable design principles. Specifically, an
operator would be required to design those systems to be fault-tolerant
so that no single credible fault could lead to increased risk to the
public.
Both Sierra Nevada and Virgin Galactic commented that requiring
fault tolerance would be so burdensome to the applicant that several
current operators would not be able to meet the requirement for systems
on existing vehicles. Sierra Nevada commented that using fault
tolerance as a catch-all hazard control can add risk in certain cases,
and the determination regarding whether something is fault-tolerant is
not straightforward.
Fault tolerance \146\ is the idea that a system must be designed so
that it is able to perform its function in the event of a failure of
one or more of its components. In a fault-tolerant design of a safety-
critical system, no single credible fault should be capable of
increasing the risk to public safety beyond that of a nominal
operation. Although the FAA proposed fault tolerance for the design of
safety-critical systems in the regulatory text, the FAA intended to
accept other methods of safety design, including fail-safe \147\ and
damage-tolerant \148\ systems like primary structures that generally
cannot be redundant. This broader view of safe design allows an
operator to factor planned operational restrictions, testing, and
inspection into the design to demonstrate that a system is broadly
fault-tolerant.
---------------------------------------------------------------------------
\146\ Typically, a fault-tolerant design applies redundancy or a
system of safety barriers to ensure the system can function, though
perhaps with reduced performance. An example of a fault-tolerant
design is an aircraft with multiple engines that can continue flying
even if one of the engines fails.
\147\ A fail-safe design is a system that can fail in a
controlled way, such that the failure will still ensure public
safety, like elevator brakes held open by the tension of the
elevator cable such that, if the cable snaps, the brakes engage and
stop the elevator from falling.
\148\ Damage-tolerant design allows for robust design, or design
to fail gracefully, for systems like a vehicle hull that cannot be
redundant or fail-safe. Fault-tolerant, fail-safe, and damage-
tolerant designs are all design concepts meant to prevent credible
faults or prevent increased risk to the public if failures do occur.
---------------------------------------------------------------------------
The FAA acknowledges that its articulation of a fault-tolerant
design requirement in the proposed regulation did not accurately
reflect the FAA's statements in the NPRM preamble allowing other
methods of safe design, like fail-safe systems, damage-tolerant
systems, or other designs for graceful degradation.\149\ A system that
is designed to be fail-safe or degrade gracefully, whether it functions
at a reduced level or fails completely, does so in a way that protects
people and property from injury or damage, or generally prevents a more
serious failure event. Such design is desirable, and was intended to be
captured in the FAA's design requirements for safety-critical systems.
In the final rule, the FAA amends Sec. 450.143(b) to state only that
safety-critical systems must be designed such that no credible fault
can lead to increased risk to the public beyond nominal safety-critical
system operation. The final rule gives the operator flexibility to
achieve this requirement through a design that is fault-tolerant, fail-
safe, damage-tolerant, or any other solution.
---------------------------------------------------------------------------
\149\ 84 FR 15325-15326.
---------------------------------------------------------------------------
The FAA views design for reduced risk as a necessary characteristic
of any reliable system. The FAA recognizes there may be other
acceptable design principles that protect the public adequately from or
in spite of a credible fault. In the final rule, the FAA removed the
word ``single'' from Sec. 450.143(b) to clarify that some design
concepts may allow faults, but that the faults should not lead to
increased risk to the public. The FAA also removed ``safety'' from
Sec. 450.143(b) because ensuring no increased risk to the public
necessarily addresses public safety. An applicant
[[Page 79658]]
may demonstrate that no credible fault can lead to increased risk
through analysis, identification of possible failure modes,
implementation of redundant systems or other mitigation measures, and
verification that the mitigation measures will not fail simultaneously.
Safety-critical systems requirements necessitate testing that
accounts for the operating environment the system will encounter. For
that reason, the FAA proposed to define ``operating environment'' in
Sec. 401.5 (Sec. 401.7 in the final rule) as ``an environment that a
launch or reentry vehicle component will experience during its
lifecycle.'' The proposed definition further stated that operating
environments include shock, vibration, thermal cycle, acceleration,
humidity, and thermal vacuum.
In the final rule, the FAA adopts the proposed definition with
additional language indicating that operating environments also include
other environments relevant to system or material degradation. As
stated in the NPRM, the list of examples in the definition is not
exhaustive, and the additional language in the final rule establishes a
standard for operators to consider in assessing relevant environmental
factors when qualifying an FSS or other safety-critical system design
through testing and analysis.
In addition to meeting the design requirements of Sec. 450.143(b),
the FAA proposed qualification testing \150\ requirements in Sec.
450.143(c) that required, in part, that an operator demonstrate the
design of the vehicle's safety-critical systems functionally at
conditions beyond its predicted operating environment. An operator must
select environmental test levels that ensure the design is sufficiently
stressed to demonstrate that system performance is not degraded due to
design tolerances, manufacturing variances, or uncertainties in the
environment. Qualification testing will demonstrate margin over all
operating and non-operating environments to which the flight unit can
be exposed, including margin over all component acceptance tests. Valid
qualification testing environments should--
---------------------------------------------------------------------------
\150\ Qualification testing is an assessment of a prototype or
other structural article to verify the structural integrity of a
design. Generally, functional demonstration of the design's
qualification at operating environments involves testing the design
under a number of different environmental factors to stress the
design, with a multiplying factor applied to the expected
environmental testing limit. This qualification testing is conducted
for temperatures, tensile loads, handling shocks, and other expected
environmental stressors relevant to system or material degradation.
---------------------------------------------------------------------------
Account for material variation, because all materials have
properties that have a variance from nominal values.
Account for manufacturing variation, because the
functionality of a system is not only dictated by the quality of
materials used, but also the quality of the manufacturing processes
employed.
Account for environmental variation, because environmental
predictions can have a great deal of uncertainty, particularly early in
a program.
Demonstrate margin against failure, because safety-
critical systems often fail in complex and unpredictable ways.
The FAA also proposed requirements for acceptance \151\ of hardware
in Sec. 450.143(d) that required, in part, an operator to demonstrate
any safety-critical system functionally while exposed to its predicted
operating environment with margin to demonstrate that it is free of
defects, free of integration and workmanship errors, and ready for
operational use. Acceptance testing on flight units should uncover
critical workmanship errors, and damaged, weak, or out-of-specification
components before they fail in flight. Because this testing is done on
flight units, valid acceptance testing should avoid over-testing
safety-critical components. This avoidance is accomplished by testing
significantly under qualification levels and durations, but still over
nominal operation levels and durations. The FAA adopts these
requirements as proposed, with minor editorial corrections.
---------------------------------------------------------------------------
\151\ Unlike qualification testing that is performed on
qualification units, acceptance testing or other functional
demonstration of acceptance required by Sec. 450.143(d) is
performance testing conducted on the actual hardware to be used on a
vehicle after the completion of the manufacturing process.
Generally, acceptance tests are performed on each article of the
safety-critical flight hardware to verify that it is free of
defects, free of integration and workmanship errors, and ready for
operational use. Acceptance testing includes testing for defects,
along with environmental testing similar to the qualification
testing described earlier.
---------------------------------------------------------------------------
Lastly, the FAA proposed requirements pertaining to the lifecycle
of safety-critical systems in Sec. 450.143(e), which required an
operator to monitor the flight environments experienced by safety-
critical system components to the extent necessary to validate the
predicted operating environment.\152\
---------------------------------------------------------------------------
\152\ Applicants must account for environments that any safety-
critical system is expected to encounter throughout the lifecycle of
the system in accordance with Sec. 450.143(e), including storage,
transportation, installation, and flight, which generally are built
into qualification and acceptance testing levels.
---------------------------------------------------------------------------
In the final rule, the FAA makes one minor revision to Sec.
450.143(c), (d), and (e). In each of those subsections, the FAA has
changed the term ``operating environment'' to ``operating
environments'' because all systems will experience multiple operating
environments. As stated in the NPRM preamble,\153\ applicants must
account for all operating environments that any safety-critical system
is expected to encounter throughout the lifecycle of the system in
accordance with Sec. 450.143(e), including storage, transportation,
installation, and flight, which generally are built into qualification
and acceptance testing levels. Other than this minor revision, the FAA
adopts these subsections as proposed. Note also that in the means of
compliance table released with the NPRM, the FAA identified SMC-S-016,
``Test Requirements For Launch, Upper-Stage and Space Vehicles,'' as an
acceptable means of compliance with Sec. 450.143. SMC-S-016 is an Air
Force standard that defines environmental test requirements for launch
vehicles, upper-stage vehicles, space vehicles, and their subsystems
and units. The FAA maintains that the environmental test levels in that
standard are acceptable for safety-critical systems under Sec.
450.143, except, as noted in the means of compliance table,
protoqualification testing testing found in 4.2.3 and B.1.3-4, and
protoqualification by similarity in 4.10.1.\154\
---------------------------------------------------------------------------
\153\ 84 FR 15323.
\154\ Protoqualification is used when test hardware is planned
to be used for flight, generally for designs that will have limited
production. Tests conducted to demonstrate satisfaction of design
requirements use reduced margins, supplemented with other analyses
and tests.
---------------------------------------------------------------------------
As noted earlier, FSS required pursuant to Sec. 450.108(b)(2),
when the consequence of any reasonably foreseeable failure mode in any
significant period of flight is between 1 x 10-\2\ and 1 x
10-\3\ CEC for uncontrolled areas, must satisfy
the requirements in Sec. 450.143. This approach is consistent with the
NPRM, which required all safety-critical systems including all FSS to
satisfy the general requirements in Sec. 450.143. For the reasons
explained more fully in the next section, the final rule does not adopt
the additional requirements for such an FSS that were proposed in Sec.
450.145(a)(2), which would have required the FSS to have a design
reliability of 0.975 at 95 percent confidence and commensurate design,
analysis, and testing. The FAA no
[[Page 79659]]
longer finds this reliability value necessary because, as a commenter
noted, it was unnecessarily prescriptive.\155\ Moreover, as discussed
in the NPRM, there are no established standards to demonstrate the
0.975 reliability number, other than a single string FSS that otherwise
meets the requirements of RCC 319.
---------------------------------------------------------------------------
\155\ CSF commented that by binning the CEC of a
vehicle and then prescribing a fixed reliability requirement for the
FSS, the risk of an unmitigated CEC event is not
consistent because the binning requires the same FSS even though the
risk varies by an order of magnitude. Although the FAA does not
agree with CSF's solution to move the entire concept of
CEC into an Advisory Circular, as discussed earlier, the
FAA does agree that it is unnecessary to establish a fixed
reliability number for all Sec. 450.108(b)(2) flight FSS required
for operations with CECs that could be an order of
magnitude apart.
---------------------------------------------------------------------------
Instead, the FAA requires Sec. 450.108(b)(2) FSS to meet the
requirements in Sec. 450.143. This regulatory approach should support
ongoing innovation in the development of FSS. As noted in the NPRM, the
commercial space transportation industry has continued to mature and
operators have proposed FSS alternatives. These alternative approaches
include fail-safe single string systems that trade off mission
assurance and redundancy, other fail-safe consequence mitigation
systems, and dual-purpose systems such as FSS that reuse the output of
safety-critical GPS components for primary navigation avionics. The FAA
is publishing a ``Safety-Critical Systems'' AC to provide an acceptable
means of compliance with Sec. 450.143. However, the FAA does not claim
that an FSS approved under Sec. 450.143 necessarily has a reliability
of 0.975. Although some standard in the future may be able to establish
a reliability of 0.975 at 95 percent confidence, that standard does not
exist today. FSS are discussed more fully in the next section of this
preamble.
The FAA amends the proposed application requirements in Sec.
450.143(f) for safety-critical systems to require that applicants
describe the methods used to validate the predicted operating
environments. In order to comply with Sec. 450.143(e)(2)(i),
applicants must validate the predicted operating environments for their
safety-critical systems. However, the NPRM inadvertently omitted the
corresponding application requirement from proposed Sec. 450.143(f).
This change results in no additional burden as an operator would have
to demonstrate compliance with the substantive provision by providing
this information.
The FAA also adds new Sec. 450.143(f)(7) to the application
requirements, which requires an applicant to describe the standards
used in each phase of a safety-critical system's lifecycle. This
addition is consistent with current practice and will not increase the
burden on operators, because an operator would likely provide this
information to support its finding that a safety-critical system is
designed such that no credible fault can lead to increased risk to the
public beyond nominal safety-critical system operation. In addition,
this description of standards is necessary to help identify previous
flights of a vehicle developed and launched or reentered in similar
circumstances, as required under Sec. 450.131(d)(1).
Virgin Galactic asked how the requirements of Sec. 450.143 would
apply to safety-critical systems that have been licensed previously.
Virgin Galactic generally objected to proposed Sec. 450.143, arguing
its requirements were similar to aircraft certification rules and would
be appropriate for a more mature industry. Virgin Galactic requested an
exclusion from proposed Sec. 450.143 for hybrid vehicles that have
been issued an experimental airworthiness certificate by the FAA and
operate as aircraft.
As discussed in the preamble section on Hybrid Vehicles, the FAA
does not agree that an airworthiness certificate issued by the FAA
should automatically exempt a vehicle used in a launch or reentry from
the safety-critical system requirements in Sec. 450.143. An applicant
may make an ELOS case for a component of a launch vehicle, such as a
carrier aircraft, if it holds a airworthiness certificate with an
acceptable flight test history. Section 450.143 is flexible and broad
enough that the FAA is not aware of any currently licensed vehicles or
operators in formal pre-application consultation that would not meet
the new requirements. For example, operators licensed under parts 431
or 435 use a system safety process to verify and validate the
reliability and mitigation of hazards for any safety-critical system.
The treatment of safety-critical systems under part 431 and 435
provides an ELOS to the safety-critical systems requirements in Sec.
450.143. Flight Safety Systems (Sec. Sec. 450.143 and 450.145)
z. Flight Safety Systems (Sec. Sec. 450.143 and 450.145)
As previously discussed, proposed Sec. 450.101(c) would have
required an operator to use flight abort with an FSS that meets the
requirements of Sec. 450.145 if the consequence of any reasonably
foreseeable vehicle response mode, in any one-second period of flight,
was greater than 1 x 10-\3\ CEC for uncontrolled
areas.\156\
---------------------------------------------------------------------------
\156\ As explained in the section of the preamble on high
consequence events, this proposed requirement would have applied to
all phases of flight unless otherwise agreed to by the Administrator
based on the demonstrated reliability of the launch or reentry
vehicle during that phase of flight.
---------------------------------------------------------------------------
As proposed in Sec. 450.145(a)(1), if the consequence of any
vehicle response mode was 1 x 10-\2\ CEC or
greater for uncontrolled areas, an operator would have been required to
employ an FSS with design reliability of 0.999 at 95 percent confidence
and commensurate design, analysis, and testing. The FAA noted that RCC
319 is the only government standard that would meet the requirement for
a design reliability of 0.999 at 95 percent confidence and commensurate
design, analysis, and testing.
Proposed Sec. 450.145(a)(2) required that, if the consequence of
any vehicle response mode was between 1 x 10-\2\ and 1 x
10-\3\ CEC for uncontrolled areas, an operator
would have been required to employ an FSS with a design reliability of
0.975 at 95 percent confidence and commensurate design, analysis, and
testing. In the NPRM, the FAA acknowledged that, although no standard
exists for an FSS with this design reliability, it expected individual
applicants to create their own FSS requirements based on RCC 319 and
have them approved as an accepted means of compliance by the FAA prior
to application submittal.\157\ The FAA anticipated the industry would
develop voluntary consensus standards for FSS, particularly for those
FSS that are only required to have a design reliability of 0.975 at 95
percent confidence.
---------------------------------------------------------------------------
\157\ The FAA indicated that this approach would be akin to
``tailoring'' RCC 319, which is current practice at Federal launch
ranges.
---------------------------------------------------------------------------
The FAA explained the proposed lower reliability by noting that,
for operations in which the consequence of a flight failure is lower,
the FSS, while still being reliable, may not need to be as highly
reliable as an FSS for a vehicle operating in an area where the
consequence of a flight failure is higher. As such, in order to make
regulations adaptable to innovative operations while maintaining
appropriate levels of safety, the FAA proposed to allow an FSS with
less demonstrated design reliability for operations with lower
potential consequences. In the final rule, the FAA removes the proposed
requirement for an FSS with design reliability of 0.975 at 95 percent
confidence, as will be discussed later in this preamble section.
In the final rule, the FAA has maintained the proposed requirement
[[Page 79660]]
for an operator to employ an FSS with design reliability of 0.999 at 95
percent confidence and commensurate design, analysis, and testing if
the consequence of any reasonably foreseeable failure mode in any
significant period of flight is greater than 1 x 10-\2\
CEC in uncontrolled areas.\158\ Operators currently meet
this requirement for launches conducted under legacy regulations by
tailoring RCC 319, and an operator could submit a tailored version of
RCC 319 to the FAA as a means of compliance for Sec. 450.145(b).
---------------------------------------------------------------------------
\158\ As previously explained, the FAA has replaced the term
``vehicle response mode'' with ``failure mode'' and the term ``one-
second period of flight'' with ``significant period of flight,''
throughout the final rule. The basis for these changes is discussed
in the preamble section on flight abort.
---------------------------------------------------------------------------
In the final rule, the FAA has revised the section heading for
Sec. 450.145 from ``Flight safety system'' to ``Highly reliable flight
safety system'' because it now contains only those requirements for an
FSS required by Sec. 450.108(b)(1) when the consequence of any
reasonably foreseeable failure mode in any significant period of flight
is greater than 1 x 10-\2\ CEC in uncontrolled
areas. The FAA has also reorganized the section and moved the
reliability requirements in proposed Sec. 450.145(a) to Sec.
450.145(b) with revisions.
While the design reliability required for a highly reliable FSS
remains 0.999 at 95 percent confidence and commensurate design,
analysis, and testing, the FAA has specified in Sec. 450.145(b)(1) of
the final rule that this reliability applies to the portion of the FSS
onboard the vehicle. In addition, if a portion of an operator's FSS is
ground-based, space-based, or otherwise not onboard the vehicle, the
FAA has specified in Sec. 450.145(b)(2) of the final rule that it must
have the same reliability as the onboard portion; that is, 0.999 at 95
percent confidence and commensurate design, analysis, and testing.
Although not all FSS have a ground portion, this requirement reflects
past and current practice for launches from both Federal and non-
Federal sites, in which the ground portion of an FSS and the airborne
portion of an FSS are independently designed, tested, and operated to
rigorous standards. This independence ensures that the appropriate
command is sent by the ground-based system with a high reliability, and
received and acted upon with high reliability by the onboard portion of
the system, to result in the desired termination action.
The reference in Sec. 450.145(a) to an FSS ``on the launch or
reentry vehicle'' did not reflect the FAA's intention accurately, as
stated in the NPRM, to include FSS not onboard the vehicle in the
design reliability requirements in Sec. 450.145.\159\ Conventional FSS
with onboard flight termination receivers and not-onboard command
transmitter systems will have both onboard and not-onboard subsystems.
Many current autonomous FSS only have onboard systems. As discussed
previously, the final rule requires both onboard and not-onboard FSS
systems independently to demonstrate 0.999 at 95 percent reliability.
This requirement is because FSS with both onboard and not onboard
systems that individually meet 0.999 at 95 percent reliability could
have a combined reliability as low as 0.998 at 95 percent confidence,
whereas FSS with only onboard systems would be required to have a
reliability of at least 0.999 at 95 percent confidence. To ensure that
FSS all meet the same standard required to protect public safety, the
final rule requires that onboard systems and not onboard independently
meet the 0.999 at 95 percent confidence level of reliability. The
collective FSS design reliability requirement is not specifically
stated in the final rule since the onboard FSS and not-onboard FSS
design reliability requirements are independently defined in Sec.
450.145 and the overall FSS design reliability is dependent on the type
of FSS employed.\160\
---------------------------------------------------------------------------
\159\ In the NPRM, the FAA stated that the reliability standard
in proposed Sec. 450.145(a)(1) would be consistent with various
sections of part 417, in particular Sec. 417.309(b)(2), that
require major FSS component systems, such as onboard flight
termination systems and ground-based command control systems, to be
tested to demonstrate 0.999 design reliability at 95 percent
confidence. The FAA further noted that this reliability threshold
would have to be demonstrated for the operation of the entire
system, including any systems located on-board the launch or reentry
vehicle, any ground-based systems, and any other component or
support systems. 84 FR 15328.
\160\ As discussed earlier in the preamble, if the consequence
of any vehicle response mode is less than 1 x 10-\3\, the
FAA will not require an FSS or mandate its reliability if an
operator chooses to use one.
---------------------------------------------------------------------------
For Sec. 450.108(b)(1) FSS that must meet the requirements of
Sec. 450.145, unless alternative methods are accepted by the
Administrator, the FAA has identified RCC 319 as an existing means of
compliance to demonstrate FSS reliability. This standard is currently
used by applicants that employ traditional flight abort under part 417.
The FAA expects to continue the current practice of working with
applicants to tailor RCC 319 in order to comply with Sec. 450.145. A
tailored RCC 319 that is used as a means of compliance for Sec.
450.145(b) must be submitted to the FAA for acceptance prior to being
included in a license application.
As noted in the previous preamble section, the FAA has removed the
additional requirements proposed in Sec. 450.145(a)(2), and is relying
on requirements in Sec. 450.143 to ensure that an FSS required by
Sec. 450.108(b)(2) is sufficiently reliable. As with the NPRM, the
final rule reduces the burden on operators that have a lower potential
for causing high consequence events. This change maintains the intent
of the proposal to protect against high consequence events using a
means different from the traditional highly reliable FSS.
As noted in the previous section, the Safety-Critical Systems AC
will provide an approach to compliance with Sec. 450.143 that modifies
the provisions in RCC 319. The approach uses a menu of potential
options that, when met, would demonstrate that an operator has met
Sec. 450.143. The AC will provide combinations of various tailored RCC
319 requirements that the FAA has determined demonstrate compliance
with Sec. 450.143. Some of the tailored requirements include:
Reducing the random vibration and thermal cycle
qualification test margins to a level and duration that remains above
acceptance test levels;
Reducing the number of required qualification test units;
Reducing the minimum required sample size for ordnance lot
acceptance testing and ordnance qualification testing;
Allowing qualification by similarity with deviations to
RCC 319 qualification by similarity criteria;
Reducing the required number of thermal cycles for
component level qualification thermal cycle test requirements;
Reducing the radio frequency link margin requirements for
traditional commanded FSS;
Allowing single string fail-safe FSS;
Reducing electronic piece parts requirements; and
Allowing use of vehicle components or systems for FSS use
such as vehicle power source or flight computer.
An operator could work with the FAA to determine what combination
of options would satisfy Sec. 450.143 for specific FSS. In addition,
an operator could develop its own combination of tailored RCC
requirements to demonstrate compliance, or could elect to use a
different means of compliance outside of the RCC 319 requirements.
An operator may demonstrate compliance with Sec. 450.143 through
other means that adequately establish
[[Page 79661]]
design, qualification testing, and acceptance testing. As mentioned
earlier, the environmental test levels in SMC-S-016 are acceptable for
safety-critical systems under Sec. 450.143, including some FSS
components, except protoqualification testing found in 4.2.3 and B.1.3-
4, and protoqualification by similarity in 4.10.1.
Lastly, the FAA also makes minor changes to the application
requirements in Sec. 450.145. In the NPRM, Sec. 450.145(d) stated
that an FSS includes any FSS located onboard a launch or reentry
vehicle; any ground based command control system; any support system,
including telemetry subsystems and tracking subsystems, necessary to
support a flight abort decision; and the functions of any personnel who
operate the FSS hardware or software. This provision has been moved to
the definition of ``flight safety system'' and deleted from Sec.
450.145(d).\161\
---------------------------------------------------------------------------
\161\ In the final rule, the definition of FSS is ``a system
used to implement flight abort. A flight safety system includes any
flight safety system located onboard a launch or reentry vehicle;
any ground based command control system; any support system,
including telemetry subsystems and tracking subsystems, necessary to
support a flight abort decision; and the functions of any personnel
who operate the flight safety system hardware or software.'' In the
NRPM, the definition also included that a human can be a part of an
FSS. The FAA removed this sentence from the definition because ``the
functions of any personnel who operate the flight safety system''
covers this circumstance.
---------------------------------------------------------------------------
The FAA received several comments on the limited means of
compliance available to demonstrate compliance with the FSS reliability
requirements. Blue Origin commented that the industry had only been
given one means of compliance for both tiers of FSS reliability. Blue
Origin also commented that the proposal indicated the only accepted
means of complying with Sec. 450.145 would be an untailored RCC 319.
Blue Origin and CSF suggested that there exist other industry and
government standards that should be accepted means of compliance with
the reliability requirements of Sec. 450.145. Blue Origin and
Microcosm stated that a tailored RCC 319 or SMC-S-016 should also be an
accepted means of compliance. SpaceX commented that RCC 319 was an
acceptable standard, but only if the document may be tailored for each
operator.
The FAA clarifies that RCC 319 is a means of compliance the FAA has
identified to date that ensures compliance with Sec. 450.145, but RCC
319 is not the only possible means of compliance that the FAA will
consider. The performance-based nature of Sec. 450.145 allows an
operator to submit its own unique means of compliance to the FAA. An
applicant may propose a tailored version of RCC 319 prior to submitting
its application as a unique means of compliance to be accepted by the
Administrator. As discussed earlier, the Safety-Critical Systems AC
will provide guidance to operators on how to comply with the
requirements for Sec. 450.108(b)(2) FSS. This approach uses RCC 319 as
one starting point. The AC will also refer to SMC-S-016, as discussed
earlier. The FAA notes that, unlike for highly reliable FSS required to
meet Sec. 450.145, for an FSS required by Sec. 450.108(b)(2) an
operator is not required to have a means of compliance with Sec.
450.143 accepted in advance of application submittal. However, it would
be advisable for an operator to consult with the FAA early in its
program's development on the approach to compliance with Sec. 450.143,
whether for an FSS or other safety-critical systems.
The performance-based nature of Sec. Sec. 450.143 and 450.145 also
allows an industry consensus standards body to submit a proposed means
of compliance to the FAA for general use. This process is discussed in
more detail in the Means of Compliance section of the preamble.
Applicants are encouraged to work with the FAA in pre-application
consultation to discuss potential unique means of compliance. For
example, for Sec. 450.108(b)(1) FSS, an applicant could work with the
FAA during pre-application consultation to tailor RCC 319 to the
operation while still ensuring compliance with Sec. 450.145. The FAA
will review the documents tailored to vehicle programs and mission-
specific applications as unique means of compliance for a given
license.
Blue Origin, CSF, and Virgin Galactic expressed concern that a
vehicle that did not require an FSS under parts 431 or 435 might
require one under part 450. The FAA disagrees. This rule maintains the
level of safety required under parts 415, 417, 431, and 435 for FSS.
Furthermore, as discussed in the High Consequence Event Protection
section of this preamble, the ACTA study results indicate that no
changes would be required under the final rule regarding the need for
an FSS for any currently licensed launch vehicle launched from a
Federal or commercial launch or reentry site. Therefore, the FAA does
not expect to require an FSS under part 450 for any launch vehicle that
would not have been required to have an FSS under parts 431 and 435.
CSF commented that the NPRM's proposed structure for requiring
flight abort was overly prescriptive and would not give an operator
flexibility to define the type of FSS to implement. CSF recommended
requiring operators to make a safety case and moving CEC and
the reliability requirements for FSS of the NPRM to an AC.
The FAA disagrees that a safety case should take the place of
discrete CEC thresholds and the requirements for FSS in
Sec. Sec. 450.143 and 450.145. Although a safety case is a potential
approach to applying for an ELOS determination for many of the
regulatory requirements, the FAA does not believe that requiring a
safety case, by itself, provides sufficient regulatory clarity as to
what is expected of a launch or reentry operator to obtain and maintain
a license.
Blue Origin commented that the means of compliance for FSS
requirements in the NPRM was unclear, particularly for systems not on
the launch vehicle such as tracking systems, ground systems, and flight
abort crew. As examples, Blue Origin mentioned RCC 324 \162\ and EWR
127-1 \163\ for tracking systems, AFSPCI 91-701 \164\ for ground
systems, and AF 13-602 \165\ for flight abort crew.
---------------------------------------------------------------------------
\162\ RCC 324-01 Global Positioning and Inertial Measurements
Range Safety Tracking Systems' Commonality Standard.
\163\ Eastern and Western Range (EWR) 127-1 Range Safety
Requirements.
\164\ AFSPCI 91-701, Launch and Range Safety Program Policy and
Requirements.
\165\ AFI 13-602 Ready Spacecrew Program Training.
---------------------------------------------------------------------------
As discussed above, Sec. 450.145(b) has been amended to address
more clearly the part of the FSS onboard the vehicle and the part not
onboard the vehicle, such as ground-based and space-based systems. In
addition, this preamble addresses means of compliance for FSS
requirements specifically, as well as means of compliance used to meet
the requirements of part 450 more generally. As discussed previously,
an untailored RCC 319-19 is currently the only means of compliance the
FAA has reviewed and accepted to meet the Sec. 450.145 FSS
requirements; however, the FAA anticipates operators will provide
unique tailored versions of RCC 319-19 to the FAA for acceptance under
part 450. In addition, RCC 324 is an acceptable means of compliance for
the airborne tracking sources such as C-Band transponders used with
ground based command systems and for GPS receivers and inertial
measurement units used as airborne tracking data sources. EWR 127-1 is
not a current means of compliance for tracking systems because it is
out of date. AFSPCI 91-701 is an acceptable means of compliance for
FSS-related ground systems. Lastly, AFI 13-602 is an acceptable means
of compliance for flight abort crew.
[[Page 79662]]
Blue Origin noted that proposed Sec. 450.143 appeared to be
appropriately performance-based and applicable to all safety-critical
systems, including software. Except for Sec. 450.108(b)(1) FSS and
software, the FAA agrees with Blue Origin that Sec. 450.143 is
appropriately performance-based and applicable to all safety-critical
systems. The requirements in Sec. 450.143 are not sufficient for Sec.
450.108(b)(1) FSS because those systems require a higher reliability
due to the potential for high consequence events, as measured by
CEC. As discussed earlier, the unique hazards due to
software have a separate set of requirements in Sec. 450.141.
Otherwise, Sec. 450.143 is sufficient for safety-critical systems and
FSS that do not fall under Sec. 450.145 because it includes
performance standards for design, testing, and lifecycle management.
Note that Sec. 450.143 covers a Sec. 450.108(b)(2) FSS that an
operator uses to comply with the high consequence protection
requirements of Sec. 450.101(c), as well as an FSS that an operator
uses when it chooses flight abort as a hazard control strategy under
Sec. 450.107, notwithstanding Sec. 450.101(c). The requirements are
the same for either FSS because, although the potential for a high
consequence event is less of a concern in the latter case, each FSS is
critical to meeting the collective, individual, aircraft, and critical
asset risk criteria in Sec. 450.101(a) and (b).
Blue Origin sought clarification as to whether an operator would
need to comply with the software requirements of RCC 319 under the
requirements proposed for Sec. 450.145, in addition to the software
requirements under Sec. 450.141. An operator is not required to comply
with the software requirements of RCC 319 under the requirements for
Sec. 450.145. Section 450.141 applies to any software or data that
implements a capability that, by intended operation, unintended
operation, or non-operation, can present a hazard to the public.
Section 450.141 applies to FSS under either Sec. 450.108(b)(1) or
(b)(2). An operator is not required to meet RCC 319 in order to satisfy
Sec. 450.141, but RCC 319 is an acceptable means of demonstrating
compliance with Sec. 450.141.
Blue Origin and CSF commented that the NPRM's assertion that to get
a 0.999 design reliability at 95 percent confidence by testing at
predicted environment levels, an operator would have to test 2,995
units was incorrect because it did not take into account the dual
redundant string architecture traditionally implemented for an FSS. The
FAA concurs that its statement in the NPRM was an oversimplification
that did not describe typical FSS component testing adequately. FSS
testing generally consists of testing a certain number of units of an
individual component to determine its reliability and confidence level,
and that testing is part of determining the overall FSS system
reliability. The FAA maintains that, for most operators, testing a few
units at greater than expected operating environments is significantly
less burdensome than testing many units at expected operating
environments. Operating environments include shock, vibration, thermal
cycle, acceleration, humidity, and thermal vacuum, or other
environments relevant to system or material degradation. The
opportunity for operators to submit new means of compliance to be
accepted by the Administrator prior to application submission will
allow applicants to propose their own means of compliance if they
believe that another method of FSS design reliability, testing, and
analysis is less burdensome than a means of compliance currently
accepted by the FAA.
Microcosm asked if all orbital operators launching from the United
States would be required to have a 0.999 design reliability FSS in
accordance with proposed Sec. 450.145. The FAA does not expect that
all orbital operators launching from the U.S. will have operations with
a potential consequence of a reasonably foreseeable failure mode in any
significant period of flight that is greater than 1 x 10-\2\
CEC in uncontrolled areas. The FAA notes that, as described in
reference to the high consequence event protection requirements of
Sec. 450.101(c), operators will be required to have an FSS if the
consequence of any reasonably foreseeable failure mode in any
significant period of flight is greater than 1 x 10-\3\
CEC in uncontrolled areas, and, as proposed, that FSS will
need to have the high design reliability of 0.999 at 95 percent
confidence if the consequence of any reasonably foreseeable failure
mode in any significant period of flight is greater than 1 x
10-\2\ CEC in uncontrolled areas. However, the
FAA has removed the additional requirements proposed in Sec.
450.145(a)(2) in the final rule if the consequence of any reasonably
foreseeable failure mode is between 1 x 10-\2\ and 1 x
10-\3\ CEC, and in that scenario will only
require an operator to use an FSS that complies with Sec. 450.143.
SpaceX commented that RCC 319, section 1.10, allowed previously
approved components and systems to be grandfathered such that they not
be required to meet subsequent versions of RCC 319 unless certain
criteria apply. SpaceX suggested that this approach be taken by the FAA
in accepting previously tailored documents. SpaceX further recommended
allowing such grandfathered acceptance of different standards such as
AFSPCMAN 91-710.
The FAA's current practice is to accept FSS that have been approved
under a standard such as AFSPCMAN 91-710 and RCC 319 even after updated
versions of those standards are released. Licensing under part 450
should be consistent with that practice; a licensee should be able to
renew its license without changes to its FSS simply because a standard
that was used as a means of compliance has evolved with time. There
would be exceptions, however, if a significant flaw was discovered in
the earlier version of the standard.
SpaceX also commented on proposed Sec. 450.145(d)(3), which stated
that an applicant must submit any analyses and detailed analysis
reports of all FSS subsystems necessary to demonstrate the reliability
and confidence levels required by proposed Sec. 450.145. SpaceX
pointed out that while other government requirements, such as RCC 319,
provide guidance on what analyses and reports are necessary, the
proposed rule was unclear as to what specific analyses and reports are
necessary.
As noted earlier, RCC 319 is an accepted means of compliance for
Sec. 450.145. An FSS design, testing, and analysis process that
complies with the analysis requirements for RCC 319, or other accepted
means of compliance, will satisfy the FSS analysis requirements of
Sec. 450.145.
Rocket Lab requested clarification as to whether the FSS design
reliability is for hardware components only, and how to apply
reliability requirements to safety systems that include software. The
FAA notes that design reliability is for hardware only. The computing
system safety requirements in Sec. 450.141 do not provide an estimated
reliability, but instead establish process controls that prevent or
mitigate computing system faults.
The International Space Safety Foundation commented that FSS is the
only system of a launcher for which the operational experience did not
provide reliability significant data, because the system was ready but
rarely operated. The FAA concurs with the comment that there is a lack
of operational experience with FSS as far as terminating vehicles.
However, operational parameters are captured throughout flights,
whether the result is termination or not, and this data verifies many
of the expected operating modes.
[[Page 79663]]
Also, reliability is gained from design and thorough test programs, as
well as review of post-flight data.
The International Space Safety Foundation also commented that to
base the approval of a safety-critical system on reliability
predictions was not advisable considering the key role played by
software, which cannot be taken into account in the reliability
prediction. The International Space Safety Foundation recommended that
the FAA should instead define fault tolerance requirements for the FSS,
and specific software and computing system requirements in addition to
generic software development processes.
The FAA disagrees, noting that FSS reliability is also based on
design architecture, component selection, and testing that accounts for
fault tolerance and the overall system. Recognizing that there are some
difficulties in establishing reliability standards below a design
reliability of 0.999 at 95 percent confidence and commensurate design,
analysis, and testing, the FAA removes the proposed additional
requirements for Sec. 450.108(b)(2) FSS and instead relies solely on
Sec. 450.143 for design, testing, and monitoring requirements. In
addition, recognizing the importance of computing systems to system
reliability and public safety, the FAA proposed, and is including in
the final rule robust computing system requirements in Sec. 450.141.
Computing system requirements are further discussed in the preamble
section on Computing Systems and Software.
The International Space Safety Foundation recommended that the FAA
set up a multidisciplinary team of design and operation experts to draw
a strategy for the definition of FSS design performance requirements,
and for addressing the above issues. The FAA believes that standards
for FSS should continue to evolve and that industry should be
significantly involved in their development. An industry-led
development of a voluntary consensus standard or standards addressing
design, analysis, or testing of FSS would be particularly beneficial.
These standards could become new acceptable means of compliance with
FAA regulations.
aa. Hybrid Vehicles
In the NPRM, the FAA proposed one set of requirements for all
vehicle types without distinction between traditional and hybrid
vehicles. Hybrid vehicles are launch or reentry vehicles that have some
characteristics of aircraft and other characteristics of traditional
launch or reentry vehicles.
The FAA acknowledges that hybrid operations differ from traditional
rocket launches. Part 450 has been revised to accommodate better all
vehicle operators, including hybrid vehicle operators. The
accommodations include more performance-based requirements,
alternatives to flight abort, FSA requirements based on demonstrated
reliability, use of equivalent level of safety, and allowing
application process alternatives as agreed to by the Administrator. The
regulations allow currently licensed hybrid vehicle operators to
continue to use a flight hazard analysis as a hazard control strategy.
However, one or more hazard control strategies may be required to meet
the safety criteria in Sec. 450.101.
The FAA received numerous comments from industry regarding safety
requirements for hybrid vehicles, hybrid configurations, component
systems, and related operations. The FAA addresses the hybrid vehicle
comments that would be applicable to other operators in the applicable
topic area sections of this preamble. This section of the preamble
addresses the comments that are specific to hybrid operations, such as
aircraft certification, piloted vehicles, part 91 applicability, and
space support vehicles.
Two commenters stated that the applicability of hybrid systems
should be clarified and consolidated in a separate section of the
regulation. An individual commenter recommended that the preamble
material include a discussion of how the regulations would be applied
to hybrid configurations since their characteristics and operations are
significantly different from the more traditional RLV or ELV vertical
launch systems.
The FAA notes that the final rule provides flexible performance-
based regulations that work for all vehicle types, including hybrid
vehicles and other innovative architectures. Like all operators, an
operator of a hybrid launch or reentry vehicle must choose one or more
hazard control strategies for each phase of flight in accordance with
Sec. 450.107. The FAA anticipates that hybrid vehicle operators will
elect to use a flight hazard analysis as their hazard control strategy
for at least some phases of flight because the flight hazard analysis
is most similar to the existing system safety process in part 431.
An individual commenter stated that for hybrid vehicles, flying
qualities should be identified as safety critical and as a safety
element eligible for a safety element approval.
The FAA will work with operators during pre-application
consultation and throughout the application review to understand a
specific operation to determine what systems are safety critical as
defined in Sec. 401.7. All launch vehicles, reentry vehicles, safety
systems, processes, services, or personnel are eligible for safety
element approvals. The FAA will consider safety element approvals on a
case-by-case basis for hybrid vehicles. This concept is discussed in
the Safety Element Approval section of the preamble.
An individual commenter recommended that the FAA consider other
demonstrated measures of reliability for carrier aircraft to estimate
the public risk, such as ``attributed reliability'' and ``validated
reliability.''
In the final rule, the FAA uses the term ``demonstrated
reliability'' in Sec. Sec. 450.101(c)(3) and 450.113(b). The use of
this phrase in Sec. 450.101(c)(3) allows an operator to protect
against a high consequence event in uncontrolled areas for each phase
of flight by establishing the launch or reentry vehicle has sufficient
demonstrated reliability as agreed to by the Administrator based on
CEC criteria during that phase of flight. The use of this
phrase in Sec. 450.113(b) provides an exception for an operator from
performing and documenting an FSA for a phase of flight, if agreed to
by the Administrator, based on demonstrated reliability. These
requirements are discussed in more detail in the High Consequence Event
Protection and FSA preamble sections, respectively.
As discussed in the Conditional Expected Casualties section of this
preamble and in the NPRM, demonstrated reliability refers to
statistically valid probability of failure estimates based on the
outcomes of all previous flights of the vehicle or stage in accordance
with Sec. 450.131, which is discussed later in the preamble. The draft
High Fidelity FSA Methods AC,\166\ published with the NPRM, described
acceptable methods, including Bayesian and binomial methods, to
calculate demonstrated reliability and demonstrate compliance with
Sec. 450.131. As discussed in the draft AC, the prior estimate for the
probability of failure during a captive carry phase of flight could be
based on a different flight history database \167\ compared to
traditional ELVs. For example, the prior estimate for the probability
of failure during a captive carry phase of flight could be based on the
flight history of aircraft that also used certain proven or
[[Page 79664]]
industry standard design, manufacturing, or quality methods. Similarly,
if a carrier vehicle were based on or modified from a type certificated
commercial aircraft or used certified aircraft components, then the
carrier vehicle could be considered a derived vehicle.\168\ In this
example, the certification results and operational history for the
unmodified components of the aircraft would be accounted for in the
calculation of the demonstrated reliability. Under a performance-based
regulation, an applicant is free to propose a unique means of
compliance with other methods to calculate demonstrated reliability.
The FAA will consider other methods to calculate demonstrated
reliability for hybrid vehicles such as binomial methods consistent
with Appendix A to part 417 under A417.25(b)(5), and other methods used
in the past for launch and reentry vehicles.
---------------------------------------------------------------------------
\166\ See FAA-2019-0229-0019.
\167\ More specifically, a different set of outcomes of all
previous flights of vehicles developed and launched or reentered in
similar circumstances.
\168\ A derived vehicle is a term used when analyzing a new
variant of a known rocket. A derived vehicle should be alike in
substance or essentials considering the following factors that can
influence the probability of failure: (1) The development and
integration processes of the vehicle, including the extent of
testing; (2) the design and manufacture of safety-critical systems,
including but not limited to the structure (including the payload
faring), propulsion, guidance, control, and navigation; (3) all
aspects of the environment experienced by the vehicles, stages, and
components that can affect performance and reliability, including
but not limited to aerodynamic, thermal, acoustic, vibration, and
inertial environments; (4) vehicle performance in terms of payload
capability, maximum dynamic pressure, and maximum velocity.
---------------------------------------------------------------------------
The FAA notes that other vehicle characteristics, such as flying
qualities, do not lend themselves to analysis with statistical
reliability measures. For example, acceptable flying qualities in one
portion of the envelope do not necessarily predict good flying
qualities throughout the full operational envelope, and small
aerodynamic modifications or changes to the flight control system can
lead to disproportionally large and potentially hazardous changes in
flying qualities. In these cases, the FAA would consider flight test
results using proven flight test techniques and data analysis methods
as validated reliability.
An individual commenter urged the FAA to consider more than just
the fact that a vehicle holds an airworthiness certificate as evidence
of demonstrated reliability.
The FAA agrees that possession of an airworthiness certificate
alone does not guarantee that a vehicle or operation will have a level
of reliability sufficient to meet the part 450 public safety
requirements. The FAA considers other factors to determine reliability.
The FAA will consider the aircraft's original certification, its
current certification, and any modifications introduced through
issuance of supplemental type certificates. For example, a transport
category aircraft that has held a standard airworthiness certificate
and then been recertified to a restricted or experimental category. Any
modifications to the aircraft design certification may affect the
aircraft's reliability for the purposes of part 450, and the FAA
therefore will take these modifications into consideration. An
understanding of an aircraft's past and current operating environments
and its maintenance history are also relevant to the current
reliability estimate.
In addition, the FAA may consider other factors outside of
certification, such as a rigorous flight test program. Some launch
operators have or are developing new, purpose-built launch vehicles
that may serve as a component of a hybrid launch or may be designed as
rocket-powered aircraft and transitioned to licensed launch operations
following flight testing. These operators may hold experimental
airworthiness certificates for testing design concepts and aircraft
operating techniques. Experimental airworthiness certificates may also
be offered as part of a hybrid operator's application to establish the
vehicle's demonstrated reliability. The FAA's Office of Commercial
Space Transportation will continue to coordinate with the FAA's
Aviation Safety organization on issuance of an experimental
airworthiness certificate and the vehicle's developmental program to
understand its demonstrated reliability.
The FAA will also consider each crewmember's level of pilot
certification and flight experience, as well as the recency of that
experience as evidence of demonstrated reliability of the launch or
reentry system.\169\ While part 460 requires flight crew to hold at
least a private pilot certificate with an instrument rating, operators
using flight crew with higher levels of certification, operationally
related flight experience, and recent flight experience and training
can demonstrate higher reliability. For example, a crewmember holding
commercial and airline transport pilot certificates have more flight
experience and have been tested to a higher level of proficiency than a
crewmember who holds a private pilot certificate. In addition,
crewmembers with operationally related flight experience will have an
understanding of the decision-making required for high-altitude flight
and airspeed regimes, and the recent flight experience and training of
all crewmembers is recognized as foundational to ensuring a safe
operating environment of an aircraft or launch vehicle.
---------------------------------------------------------------------------
\169\ For FSA purposes, the vehicle failure probability accounts
for any failure of the launch or reentry system because of the way
failure is defined in Sec. 450.131(b). In the context of FSA, any
failure of the launch or reentry system, including pilot error, that
produced vehicle failure as defined in Sec. 450.131(b) must be
accounted for to establish the demonstrated reliability. Therefore,
the FAA would consider the pilot experience and training in making a
demonstrated reliability determination.
---------------------------------------------------------------------------
An individual commenter stated that the phase of a hybrid vehicle
operation in which the carrier vehicle is alone would be required to
take into account any potential aggressive maneuvers the vehicle may
have to make to clear a just-released rocket. The commenter further
stated that a civil airworthiness certificate may not be adequate to
cover the risks posed to the public by these unusual maneuvers.
The FAA agrees that the entirety of a launch or reentry operation
must be analyzed for hybrid operations. The FAA notes that once a
rocket is released, the carrier vehicle remains in the launch phase
until all components of the launch system have impacted or landed on
the earth and been rendered safe. Therefore, any maneuvers the carrier
vehicle makes after a rocket is released but before both components
have impacted or landed and been returned to a safe condition will
occur under the license and be assessed consistent with the
requirements of part 450.
Virgin Galactic expressed concerns that rather than streamlining
the requirements to create performance-based standards, the FAA is
combining its requirements for ELVs and hybrid RLVs so that each type
of operator might be subject to inappropriate or ambiguous
requirements. Virgin Galactic commented that it appreciated the
flexibility that some of the new regulations would provide but noted
that others seem too vague.
The FAA finds the final rule provides sufficient flexibility for
hybrid vehicles. The performance-based regulations in the final rule
allow operators like Virgin Galactic to propose an alternate approach
by demonstrating an equivalent level of safety or use a unique means of
compliance. To retain the maximum flexibility to adjust to dynamic
industry changes, the FAA will continue to offer operators the choice
to request ELOS determinations. In addition, 51 U.S.C. 50905(b)(3)
allows the Secretary to waive a requirement in the public interest and
will not jeopardize public health and safety, safety of property, and
national security and foreign policy interests of the United States.
Rather than explicitly
[[Page 79665]]
reference hybrid vehicles, the final rule provides the flexibilities to
all operators, including operators of hybrid vehicles and other
innovative concepts.
Virgin Galactic also stated that the intent of the requirement
should be publicly articulated in the regulations and not reside in the
preamble. The FAA notes both the preamble and the regulations are
publicly available. The intent behind the regulations correctly resides
in the preamble because the regulations contain only the regulatory
requirements by which regulated entities are bound. The preamble
provides further explanation as to why the FAA has elected to adopt the
regulatory requirements in order to provide transparency and further
elaborate on the agency's intent.
An individual commenter stated that hybrid configurations, carrier
aircraft flying alone, and reentry vehicles using aerodynamic controls
should follow controller instructions and abide by the general
operating and flight rules of aviation found in 14 CFR part 91. The
individual commented that hybrid launch vehicles with pilot-in-the-loop
control systems spend much more time than RLV and ELV systems in
restricted airspace and overflying populated areas and that this
requires hybrid configurations to have the capability to operate safely
in a controlled airspace environment like other aircraft.
The FAA agrees and notes that applicants may elect to mitigate
hazards to the public by proposing applicable sections of part 91 to
demonstrate compliance with specific requirements in part 450. However,
all components of a hybrid vehicle operate solely under a license when
the intent of flight is to conduct a launch or reentry.
Virgin Galactic stated that the FAA should have a narrowly tailored
CEC exemption from the flight abort requirements of proposed
Sec. Sec. 450.101(c) and 450.145 for piloted aircraft because the
pilot would already provide an FSS with abort capability. Virgin
Galactic further stated that a carrier aircraft in a hybrid system that
operated safely under its experimental airworthiness certificate should
not be subjected to the CEC requirement in proposed Sec.
450.101(c).
The FAA does not agree with Virgin Galactic's comment to include an
exemption from demonstrating protection against a high consequence
event for a piloted carrier vehicle because the operation of such a
vehicle may result in a high consequence event. As discussed earlier in
this preamble, operators must protect against a high consequence event
because such an event could result in a large number of casualties. The
FAA notes that the final rule allows an operator to seek an ELOS
determination for Sec. 450.101(c)(2). However, an exemption for all
piloted carrier vehicles would not be appropriate for launch or reentry
vehicle systems that have not yet been evaluated. Hence, an applicant
can use another method of measuring the potential for a high
consequence event that demonstrates an equivalent level of safety in
accordance with Sec. 450.37. Reusable vehicles and other innovative
architectures may be required by Sec. 450.101(c) to have a method to
achieve flight abort reliably to mitigate flight risks and consequences
fully, either in the form of a pilot that can safely abort flight using
system controls or a more traditional FSS. A pilot may provide
protection against a high consequence event. The FAA may consider a
pilot to be an FSS performing a flight abort if the pilot can initiate
and accomplish a controlled ending to vehicle flight reliably to limit
or restrict the hazards to public health and safety, and the safety of
property. Under the provision in Sec. 450.101(c)(3), the flight of a
carrier vehicle carrying a rocket to a drop point could be an example
of sufficient protection against a high consequence event, even if the
CEC were above the 1 x 10-\3\ threshold, if the
carrier vehicle has sufficient demonstrated reliability. Demonstrated
reliability and other flexibilities are discussed more fully in the
High Consequence Protection section of this preamble.
Virgin Galactic noted that a carrier aircraft operating under an
airworthiness certificate should be exempt from proposed Sec.
450.101(f), which, for any launch, reentry, or disposal, requires an
operator to notify the public of any region of land, sea, or air that
contains, with 97 percent probability of containment, all debris
resulting from normal flight events capable of causing a casualty.
Virgin Galactic stated that the requirement was unclear because it
discussed debris resulting from normal flight events. Virgin Galactic
requested further clarification on the purpose of public notification
if the proposed requirement was intended to address returning vehicles
that remain intact and on a nominal trajectory to the intended reentry
site. Virgin Galactic recommended that, if this regulation was intended
to apply to jettisoning of orbital rocket stages and the return/
disposal of upper stages, it should state as much.
The FAA agrees that returning vehicles on a normal trajectory do
not constitute ``debris'' as the term is used in Sec. 450.101(f).
However, the FAA will not exempt all hybrid vehicle operators from the
requirement in Sec. 450.101(f) because future hybrid operators could
possibly generate debris capable of causing a casualty from normal
vehicle flight. If an operation has no planned impacts from debris
capable of causing a casualty, then no notification will be necessary
to comply with Sec. 450.101(f).
Several commenters, including ALPA, Starfighters, and Virgin
Galactic, submitted comments regarding the applicability of FSA
requirements for hybrid vehicles under proposed Sec. 450.113(a)(5).
Virgin Galactic noted that, for the captive carry phase of a hybrid
vehicle mission, the FAA should exempt operators from performing an FSA
for a piloted aircraft that operated in accordance with aviation
regulations. Virgin Galactic stated the FAA should include such an
exemption because the pilot would already provide abort capability as
an FSS. Starfighters commented that an FSA should be required only for
the air-release launch phase of a hybrid vehicle mission, not the
earlier captive-carry phase, which might be many miles away from the
actual release point. However, ALPA stated that the FAA should require
an FSA for all phases of flight until sufficient quantitative data for
hybrid commercial space vehicles becomes available for analysis and to
conduct a regulatory process to standardize airworthiness requirements
for hybrid commercial space vehicles. An individual commenter noted
airworthiness certificates issued by the FAA are part of a safety
analysis but are not conclusive evidence of demonstrated reliability
for the purpose of proposed Sec. 450.113(a)(5). ALPA noted that flight
test results using proven flight test techniques and data analysis
methods should serve to validate reliability of hybrid vehicles'
carrier aircraft under proposed Sec. 450.113(a)(5), without requiring
documentation and statistical analysis of all previous flights.
In the final rule, the FAA is not providing a blanket exemption to
the FSA requirements for hybrid operations. The final rule removes
Sec. 450.113(a)(5) but maintains the flexibility proposed in the NPRM
to enable an operator of a hybrid vehicle with a high level of
demonstrated reliability to be exempt from performing some FSAs for
some phases of flight without seeking a waiver. The FAA will work with
hybrid vehicle applicants during pre-application consultation on how to
comply with FSA, CEC, and FSS requirements utilizing the
flexibilities that may be applicable depending on the applicant's
vehicle and concept of
[[Page 79666]]
operations. For example, the FAA might determine the quantitative FSA
requirements for those portions of an operation for which the vehicle
operates similarly to a civil aviation aircraft governed by civil
aviation regulations are unnecessary because the vehicle has
demonstrated reliability for operations using a certificated aircraft
or a valid airworthiness certificate with an acceptable flight test
history.
The FAA expands the flexibility for hybrid vehicles in proposed
Sec. 450.113(a)(5) to all vehicle operators in the final rule in Sec.
450.113, as discussed in more detail in the preamble section for FSA
Requirements Scope and Applicability. The FAA finds this flexibility
should be available to all operators if agreed to by the Administrator
based on demonstrated reliability. This wider availability will provide
a common regulatory construct across different operators to identify
the phases of flight for which FSA must be performed. Based on current
licensed operations, the FAA anticipates that initially only carrier
vehicles that have an airworthiness certificate and extensive flight
history would be able to meet the demonstrated reliability standard.
Aside from some carrier aircraft used as a component of a launch
vehicle, no existing launch vehicle has enough history to ensure
sufficient protection against a high consequence event based on
demonstrated reliability in accordance with Sec. 450.101(c) or enough
empirical evidence to demonstrate compliance with the public risk
criteria in Sec. 450.101(a) or (b).\170\
---------------------------------------------------------------------------
\170\ The L-1011 carrier vehicle used for Pegasus launches is an
example of a carrier aircraft with enough empirical evidence to
demonstrate compliance with the public risk criteria in Sec.
450.101(a) or (b). Using flight history to demonstrate compliance
with the risk criteria in Sec. 450.101(a) and (b) is relatively
simple, given a statistically significant number of flights relative
to the expected casualty limit of 1 x 10-\4\. As
discussed elsewhere in the preamble, the FAA notes that the operator
must also perform a system safety analysis to demonstrate that any
modifications made to the carrier vehicle introduce only hazards to
the public that are extremely remote.
---------------------------------------------------------------------------
Virgin Galactic asked about the applicability of the rule for
hybrid vehicles, including certain operational exemptions. Virgin
Galactic commented that the safety-critical system requirements in
Sec. 450.143 should not apply to hybrid carrier aircraft that operate
under an FAA-issued license and hold an airworthiness certificate
issued by the FAA. Virgin Galactic noted the requirements of this
section were akin to aircraft certification, which are spelled out in
the applicable parts of 14 CFR Chapter 1 that have been developed over
decades as the aviation industry matured. Virgin Galactic stated that
the commercial space industry is not at the state of maturity as
commercial aviation, and applying these similar ``certification''
requirements is contrary to the requirement in the Commercial Space
Launch Act to promote the commercial space launch industry and only
regulate to the extent necessary.
The FAA does not agree that carrier vehicles operating under an
FAA-issued license with an airworthiness certificate issued by the FAA
should be exempt from the safety-critical system requirements in Sec.
450.143. While airworthiness certification likely indicates increased
reliability because a certificated aircraft has satisfied many separate
FAA regulations, the satisfaction of those regulations does not alone
demonstrate that the carrier vehicle will meet the applicable
requirements under chapter III. However, an applicant may make a safety
case supporting an equivalent level of safety for a component of a
launch system if it holds a valid airworthiness certificate with an
acceptable flight test history. In the final rule, Sec. 450.143
includes the requirements for all safety-critical system components and
eliminates the ambiguity that existed in the part 431 regulations
regarding required testing of safety-critical systems. Section
450.143(e)(3) also requires a summary of the analysis detailing how
applicants arrived at the predicted operating environment and duration
for all qualification and acceptance testing. Such a summary is current
practice, and Sec. 450.143(e) makes this requirement explicit for all
vehicles. In response to Virgin Galactic's comments regarding the
relative maturity of commercial aviation versus the commercial space
industry and the appropriate approach to regulating the commercial
space industry, the FAA believes that the performance-based
requirements of the final rule fulfill statutory mandates and are
appropriate for the commercial space industry's capabilities now and as
they will evolve in the future.
An individual commenter stated that the carrier aircraft portion of
their launch system would also be capable of conducting operations as a
space support vehicle (SSV). The commenter sought clarification as to
whether part 450 would require adjustment to be consistent with new SSV
operations. SSVs and SSV flight are defined in section 50902 of title
51. Requirements to conduct the flight of a space support vehicle would
be promulgated pursuant to Section 44737, and are beyond the scope of
this rulemaking.
bb. Agreements and Airspace (Sec. 450.147)
In the NPRM, the FAA proposed to streamline the existing
requirements for agreements by removing specific requirements for a
variety of agreements and procedures and allowing an operator to
determine what agreements would be needed for its particular operation.
As proposed in Sec. 450.147, a vehicle operator would be required to
have written agreements with any entity that provides a service or use
of property to meet a requirement in part 450. The regulation
identified various entities for which agreements may be required
including a Federal launch range operator, a licensed launch or reentry
site operator, any party that provides access to or use of property and
services required to support a safe launch or reentry under part 450,
the U.S. Coast Guard, and the FAA.
In the final rule, the FAA adopts the proposal with one minor
change. The FAA has replaced the words ``Federal launch range'' in
Sec. 450.147(a)(1) with ``Federal launch or reentry site'' to
encompass all Federal sites used for licensed activities.
AAAE asked whether proposed Sec. 450.147(a)(1) would require
agreements with alternative or contingent landing sites and requested
that the FAA expressly require such agreements to ensure that they are
included in the licensing and launch preparation process. In Sec.
450.147(a)(1), the FAA requires agreements with any entity that
provides access to property required to support a safe launch or
reentry. Contingency abort locations are taken into consideration by
the applicant as part of its public safety analyses and by the FAA in
its environmental review. Because contingency abort locations
necessarily involve planned access to property, the FAA will not revise
the regulation to expressly require agreements with alternative or
contingent landing sites. The language in Sec. 450.147(a)(1) is
sufficient to ensure agreements are in place for all planned locations.
The FAA will not require such agreements for emergency landing sites or
other locations that are being considered, but have not been finalized
by the operator.\171\
---------------------------------------------------------------------------
\171\ The FAA notes that it has distinguished emergency abort
landing sites from planned contingency abort sites in other
rulemakings. For example, in the Commercial Space Transportation
Reusable Launch Vehicle and Reentry Licensing Regulations final
rule, Sec. 431.23 required an operator to identify contingency
abort sites in its application. The FAA stated that contingency
abort sites are pre-planned, and their potential use may be
identified as part of an application in order to meet mission risk
criteria and, therefore, are separate and distinct from emergency
abort landing situations that may potentially be anywhere. 65 FR
56617, 56635 (November 20, 2000).
---------------------------------------------------------------------------
[[Page 79667]]
Section 450.147(a)(3) requires operators to have written agreements
with FAA's Air Traffic Organization (ATO) or foreign air navigation
service providers (ANSP) to establish procedures for the issuance of a
Notices to Airmen (NOTAM) prior to a launch or reentry.
AOPA recommended that the FAA establish procedures for the issuance
of a Notices to Airmen (NOTAM) at least 72 hours prior to a launch or
reentry to forewarn the public about activation of different airspace.
It would not be appropriate within this commercial space rulemaking
to impose a requirement on the FAA ATO or a foreign ANSP to issue
NOTAMs within a particular time frame. Each ANSP is responsible for the
safe and efficient use of its airspace and can be expected to provide
notification consistent with its obligations. As such, notification
requirements necessary to protect the public, including any minimum
times for notification, should be determined as part of the agreement
development process with the FAA ATO or foreign ANSP.
Section 450.147(a)(4) requires an operator to enter into such
agreements with emergency response providers, including local
government authorities, as necessary to satisfy the requirements of
Sec. 450.173 (Mishap plan--reporting, response, and investigation
requirements).
SpaceX recommended that proposed Sec. 450.147(a)(4) exclude
government installations where responsibilities and mutual aid protocol
rendered separate agreements with local authorities unnecessary. SpaceX
believes this addition would manage expectations where multiple Federal
entities may have overlapping jurisdiction for addressing mishap
response.
Because Sec. 450.173(d)(5) requires an operator to implement
agreements with government authorities and emergency responders ``as
necessary'' to satisfy the requirements of Sec. 450.173, no change to
the proposed language in Sec. 450.147(a)(4) is required. An operator
that is launching from a Federal launch site is not required to execute
agreements with local authorities if the Federal site already has the
necessary coordination in place to satisfy the requirements in Sec.
450.173.
Section 450.147(b) requires that agreements clearly delineate the
roles and responsibilities of each party to support the safe launch or
reentry under part 450. SpaceX suggested adding language to require
parties to delineate roles and responsibilities ``within their
jurisdiction.'' Indeed, an entity may only enter into an agreement to
the extent they are authorized, but the FAA disagrees that this
language is needed in the regulation.
Section 450.147(d) requires operators to describe each agreement
submitted in accordance with the section.
SpaceX asked the FAA to clarify in a guidance document the intent
of proposed Sec. 450.147(d) and allow operators to provide other
acceptable documentation (e.g., business processes like the Universal
Documentation System) to avoid literal interpretations of requirements.
To comply with this requirement, the operator will enumerate those
services that the site operator is providing through various
agreements. The FAA may request a specific agreement that the site
operator has established to provide such a service. As long as each
agreement required by this section meets the criteria set forth in
Sec. 450.147, the operator may choose the format of the agreement.
Therefore, the FAA adopts the proposed rule without change.
Virgin Galactic asked whether an agreement would be required with
local authorities to ensure that the area is cleared of the public and
critical assets if an operator cannot meet conditional risk factor
criteria for an uncontrollable area of land. The FAA notes that
conditional risk does not trigger the need for an agreement with a
local authority. Instead, it is related to the need for an FSS.
However, such an agreement might be a means of mitigating conditional
risk, potentially to a degree at which the operator does not need to
employ an FSS.
A number of commenters expressed concern that the NPRM did not
require that airspace efficiency be taken into consideration as part of
a launch or reentry operation. AAAE, A4A, ACI, ALPA, AOPA, CAA, NATCA,
RAA, and Southwest Airlines recommended the FAA incorporate airspace
efficiency consideration into the licensing process to minimize
negative operational and financial impacts for airlines, passengers,
cargo shippers, and the public that will result from this rulemaking.
A4A, AAAE, and Southwest Airlines advocated increased transparency and
collaboration with airspace stakeholders in developing agreements
pursuant to proposed Sec. 450.147. A4A, AAAE, ACI, ALPA, AOPA, CAA,
NATCA, and RAA recommended the FAA ensure the safety requirements for
commercial space operations, particularly those addressing risks to
other aviation users, are commensurate with the expectations of the
flying public. AOPA recommended the FAA prioritize funding and
implementation of the Aeronautical Information Management Modernization
program, which would provide real-time airspace information. A4A, AAAE,
ACI, and AOPA recommended the FAA incorporate and implement various
recommendations from the Airspace Access Priorities ARC and Spaceport
Categorization ARC.
The FAA acknowledges the commenters' concerns regarding airspace
efficiency, but these issues are not within the scope of this
rulemaking. Operational oversight and management of airspace impacts
are managed at the FAA Air Traffic Control System Command Center. As
noted in the Flight Hazard Area Analysis section of this preamble, FAA
is working to address this issue through the Airspace Access ARC and
other initiatives.
cc. Safety-Critical Personnel Qualifications (Sec. 450.149)
In the NPRM, the FAA proposed to remove the certification
requirements found in Sec. Sec. 417.105, 417.311, and 415.113 and
replace them with performance-based requirements in proposed Sec.
450.149 (Safety-Critical Personnel Qualifications). Section 450.149(a)
would require an operator to ensure safety-critical personnel are
trained, qualified, and capable of performing their safety-critical
tasks, and that their training is current. Under proposed Sec.
450.149, an applicant would be required to identify in the application
all safety-critical tasks and internal requirements or standards for
personnel to meet prior to performing the identified tasks. The
application would be required to identify internal training and
currency requirements, completion standards, or any other means of
demonstrating compliance with the requirements of proposed Sec.
450.149. The applicant would also be required to describe the process
for tracking training currency.
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended that
the FAA require that safety-critical personnel comply with the Federal
Drug-Free Workplace requirements set forth in 14 CFR 120. These
commenters noted that the Federal Drug-Free Workplace requirements
apply to government contractors, but commercial operators are only
subject to company policy, which may not address the use of drugs and
alcohol. The FAA did not propose to require drug and alcohol testing
and finds that such a requirement would exceed the scope of
[[Page 79668]]
this rulemaking. The FAA may consider proposing such action in a future
rulemaking.
The FAA received a comment from Blue Origin supporting the changes
to the safety-critical personnel qualifications requirements. In the
final rule, the FAA adopts Sec. 450.149 as proposed.
dd. Work Shift and Rest Requirements (Sec. 450.151)
In the NPRM, the FAA proposed to combine the rest requirements of
Sec. Sec. 417.113(f) and 431.43(c)(4) into Sec. 450.151 (Work Shift
and Rest Requirements), which would require an applicant to document
and implement rest requirements that ensure safety-critical personnel
are physically and mentally capable of performing assigned tasks. These
requirements would apply to operations of all launch and reentry
vehicles and would allow operators flexibility to employ rest rules
that fit their particular operations. Section 450.151(b)(1) would
require an operator's rest rules to include the duration of each work
shift and the process for extending this shift, including the maximum
allowable length of any extension. An operator's rest rules would be
required to include the number of consecutive work shift days allowed
before rest is required. Section 450.151(b)(3) would also require an
operator's rest rules to include the minimum rest period required
between each work shift, including the period of rest required
immediately before the flight countdown work shift. Applicants would be
required to submit their rest rules during the license application. In
the final rule, the FAA adopts Sec. 450.151 as proposed.
The FAA received seven comments on its proposed work shift and rest
requirements. Blue Origin, Rocket Lab, Virgin Galactic, and an
individual commenter agreed with FAA's proposed requirements permitting
greater flexibility in ensuring sufficient rest for safety-critical
personnel. Rocket Lab commented that the proposed approach would enable
operators to develop work shift and rest requirements that are
appropriate for the individual operating conditions, environment, and
mitigations that exist.
Virgin Galactic requested the FAA provide further guidance of what
would satisfy proposed Sec. 450.151 beyond the example of Sec.
431.43(c)(4). Section 431.43(c)(4) or the crew rest requirements of
AFSPCMAN 91-710 are two possible, but not the only, means of compliance
with Sec. 450.151.
ALPA opposed the performance-based approach to work shift and rest
requirements, stating that prescriptive duty limits were necessary to
reduce the likelihood of human error related to fatigue. ALPA indicated
the proposed rule made it possible for a commercial space operator ``to
set unrealistic crew rest requirements for cost management (doing more
with less) instead of safety.'' ALPA recommended the FAA adopt the rest
rules contained in Sec. 437.51.
The FAA elected a performance-based requirement over a prescriptive
one akin to Sec. 437.51 in order to allow operators to develop
requirements that are suited to their particular operations. In
addition, prescriptive requirements fail to account for the various
factors that can affect crew rest, such as the time of day of an
operation, length of pre-flight operations, and travel to and from the
launch or reentry site. The performance-based requirement set forth in
Sec. 450.151 allows operators to take into account such factors
affecting crew rest and adopt mitigations and procedures unique to each
launch operation. The FAA also disagrees that Sec. 450.151 will enable
operators to set unrealistic crew rest requirements in the interest of
cutting costs. Although operators can develop rest rules that fit their
operations, operators must demonstrate in their application that their
rest rules ensure safety-critical personnel are physically and mentally
capable of performing assigned tasks. The FAA will evaluate the rest
rules during review of the license application, and, if accepted, they
will become part of the license. The FAA finds that no change to the
proposed regulation is warranted.
ALPA and Blue Origin stated the commercial space operator should be
responsible for monitoring compliance with work shift and rest
requirements. Blue Origin noted the companies should be responsible for
monitoring compliance after the FAA accepts an operator's rules through
the application and approval process. Rocket Lab commented that a
specific requirement for operators to monitor compliance with work
shift and rest requirements was unnecessary as the regulation
explicitly required that the rest rules implemented ensure safety-
critical personnel are physically and mentally capable of performing
all assigned tasks.
Operators are expected to monitor compliance with their approved
crew rest rules so that personnel are fit to perform safety-critical
tasks and to provide records of compliance with those rules, as
required by Sec. 450.219(a), where requested by the FAA. The FAA finds
that a specific requirement for operators to monitor compliance with
work shift and rest requirements is unnecessary. The rest requirements
in Sec. 450.151(b) ensure safety-critical personnel are physically and
mentally capable of performing all tasks. It is up to the company to
monitor compliance with its work shift and rest rules to ensure
personnel are mentally and physically capable of performing safety-
critical tasks. An operator must comply with the rest rules accepted by
the FAA as part of the license because it must comply with the
representations in its application. Therefore, even absent an express
requirement, an operator must monitor compliance with its rest rules in
order to ensure that the objectives of Sec. 450.151 are met and that
the operator does not act contrary to its application.
Blue Origin asked the FAA to clarify the time period to which the
rest rules apply in finalizing the rest requirements and the scope of
license rule (Sec. 450.3). Blue Origin suggested the rest requirements
should only apply during the period an action could present a distinct
impact to safety, akin to how NASA closely monitors astronauts' rest/
work periods but does not mandate crew rest requirements for aerospace
employees in manufacturing plants or NASA mission control staff.
Although the FAA declines to limit the scope of Sec. 450.151 as
Blue Origin recommends, the FAA clarifies that Sec. 450.151 is
intended to ensure safety-critical personnel are prepared to perform
tasks that have an inherent impact on public safety. Operators must
document and implement rest rules to ensure that safety-critical
personnel have received adequate rest before they perform any safety-
critical task. Operators would not be able to ensure that personnel are
physically and mentally prepared to perform safety-critical tasks if
the rest rules set forth in Sec. 450.151 applied only during
activities that could distinctly affect safety (i.e., during safety-
critical tasks). For example, the rest rules apply to safety-critical
tasks such as end to end testing and safety-critical hardware
installation that may occur before hazardous pre-flight operations
trigger the start of launch. Operators must therefore comply with Sec.
450.151 for the duration of their license. The regulation is flexible
enough that an operator can develop rules that treat different parts of
launch activity differently. The FAA finds that no change to the
regulation is warranted.
Blue Origin suggested removing the definition of ``vehicle safety
operations personnel,'' as it has caused confusion in the industry. The
FAA agrees and does not adopt the definition.
Boeing, Lockheed Martin, Northrop Grumman, and ULA asserted the
[[Page 79669]]
requirements proposed in Sec. 450.151(b) reflect a relaxation of work
rule standards compared to the current FAA and range policies. They
further noted other DOT-regulated industries have explicit rest
criteria and recommended that the FAA publish the acceptable criteria
rather than having operators negotiate the hours deemed safe.
The requirements proposed in Sec. 450.151(b) are not a relaxation
of work rule standards compared to current FAA and range policies
because, as previously stated, two of the ways an operator can show
compliance with Sec. 450.151 are to meet current FAA rules (Sec.
431.43(c)(4)) or AFSPCMAN 91-710, and the FAA retains oversight to
determine that an operator's rules achieve the standard.
As previously stated, the FAA will issue an AC on a means of
compliance for Sec. 450.151. The crew rest requirements previously set
forth in part 431 and the current crew rest requirements in AFSPCMAN
91-710 will satisfy Sec. 450.151.
ee. Radio Frequency (Sec. 450.153)
In the NPRM, the FAA proposed that, for any radio frequency used,
an operator would be required to: (1) Identify each frequency, all
allowable frequency tolerances, and each frequency's intended use,
operating power, and source; (2) provide for the monitoring of
frequency usage and enforcement of frequency allocations; and (3)
coordinate use of radio frequencies with any site operator and local
and Federal authorities. Proposed Sec. 450.153(b) contained
application requirements and required an applicant to submit procedures
or other means to demonstrate compliance with the radio frequency
requirements.
Blue Origin, SpaceX, and Sierra Nevada commented the proposed
requirements were duplicative of Federal Communications Commission
(FCC) licensing requirements and, according to Blue Origin, were an
unnecessary burden on operators. Blue Origin explained that operators
coordinate frequency management through the FCC licensing process,
which is robust in its technical review of transmitter capabilities.
Blue Origin also noted FCC licenses are public information that the FAA
can verify. Sierra Nevada suggested the regulation should either
require only that the applicant demonstrate it has coordinated with the
FCC or be omitted altogether.
The FAA agrees that the proposed requirements in Sec.
450.153(a)(1) and (a)(2) are duplicative of FCC requirements for
radiating systems and overly burdensome. The FCC requires in Section
308(b) of the Communications Act of 1934, as amended, all the items in
proposed Sec. 450.153(a)(1) and (a)(2) as part of an FCC license for
radiating systems that an operator must obtain to operate radiating
equipment as part of a launch. The purpose of radio frequency
management, as stated in the NPRM,\172\ is to mitigate hazards
associated with radio frequency usage including interference that could
adversely affect the FSS or any safety-critical system of a vehicle,
including RLVs and reentry vehicles. The intent of proposed Sec.
450.153 (a)(1) and (a)(2) was to ensure radio transmissions would not
interfere with commanded flight termination systems and would be
compatible with the receiving system on the vehicle. The FAA finds that
operators can identify and mitigate hazards affecting FSS or safety-
critical systems effectively without duplicating information required
by the FCC. In the final rule, the FAA amends Sec. 450.153(a) by
replacing (a)(1) and (a)(2) with the performance-based objective
central to Sec. 450.153 that requires operators to ensure radio
frequency interference does not adversely affect performance of any FSS
or safety-critical system. Proposed Sec. 450.153(a)(3) is re-
designated as (a)(2) and continues to require operators to coordinate
use of radio frequencies with any site operator and any local and
Federal authorities, including any State, tribal, or territorial
authorities.
---------------------------------------------------------------------------
\172\ 84 FR 15334, footnote 98.
---------------------------------------------------------------------------
Blue Origin commented that proposed Sec. 450.153 added to the
burden previously placed on operators under part 431, which ought to be
included in the FAA's cost analysis. Blue Origin explained an applicant
would be required to submit to FAA the substantive content of a
frequency management plan and submit procedures to demonstrate
compliance with that plan. Blue Origin pointed out that under part 431,
the FAA did not require operators to prove they acquired FCC licenses
for a mission or that they coordinated the use of radio frequencies.
As previously explained, the FAA has removed the duplicative
provisions from Sec. 450.153, which would have amounted to a greater
burden on operators than has previously been required under part 431.
As such, in the final rule, Sec. 450.153 requires no more of operators
than what part 431 required for analysis of hazards associated with
licensed activities, creating no additional cost to operators.
Blue Origin recommended proposed Sec. 450.153 be removed since
applicants were already required to address and mitigate hazards
associated with frequency coordination or radiation exposure or power
limits as part of their hazard analysis. Blue Origin added that, for
launches at Federal launch or reentry sites, proposed Sec. 450.153
would duplicate much of the information submitted to the Federal site,
whose frequency management office typically works with range scheduling
to regulate radiation and power limits to prevent exceeding radiation
exposure and power limits while on the pad and harming the vehicle or
payload. For operations that do not occur on Federal sites, Blue Origin
indicated an operator would proceed as under the current part 431 by
identifying hazards and mitigation measures required to meet the public
safety limits. According to Blue Origin, operators should incorporate
hazards associated with this issue in their hazard analysis, including
identifying mitigation issues.
The FAA disagrees that Sec. 450.153 is unnecessary or duplicative
of hazard analysis requirements. As stated in the NPRM, the FAA has
determined that the public safety risks posed by radio frequency
interference warrant specific attention apart from the general
requirement that operators identify and mitigate hazards associated
with licensed activity. To the extent Federal launch or reentry site
procedures provide for coordination of radio frequencies used, an
operator may rely on those procedures to demonstrate compliance with
Sec. 450.153. The FAA does not prescribe the manner in which an
operator ensures that radio frequency interference does not adversely
affect a vehicle's FSS or any safety-critical system. The FAA merely
requires that operators set forth in their applications a means of
complying with Sec. 450.153 so that the FAA can ensure that radio
interference issues are appropriately addressed.
In an effort to streamline radio frequency requirements, SpaceX
recommended the FAA revise proposed Sec. 450.153(a)(2) to require that
operators ensure frequency utilization according to frequency
authorization parameters. SpaceX also recommended the FAA revise
proposed Sec. 450.153(b) to require coordination with site operators
and local and Federal authorities only for launches that do not occur
on a Federal launch or reentry site with existing radio frequency
policies and procedures.
The FAA disagrees that any frequency authorization parameters
issued by the FCC, which are geared toward managing
[[Page 79670]]
frequency use and operation, would be sufficient to assess hazards to
public safety posed by radio frequency interference, which are properly
within the FAA's purview. As previously discussed, the FAA has removed
the prescriptive requirements that it deemed duplicative of FCC
requirements in proposed Sec. 450.153(a) and replaces them with a
central performance-based objective. The FAA declines to accept
SpaceX's suggestion to amend Sec. 450.153(b). The coordination
required by Sec. 450.153(b) allows an operator to operate a command
transmitter at a frequency and power that ensures a flight termination
system signal can be successfully transmitted, and thereby prevent
harmful radio interference, in the interest of public safety. The FAA
declines to remove the requirement that all operators coordinate use of
radio frequencies with any site operator and local and Federal
authorities in order to protect the public and public property, because
such coordination is necessary to prevent radio interference that could
affect public safety. Users of Federal launch or reentry sites may use
Federal site procedures for radio frequency to demonstrate compliance
with Sec. 450.153.
Virgin Galactic asked if an operator could contract a third party
to meet the frequency management requirements.
The FAA does not prescribe the means by which an operator complies
with Sec. 450.153. An operator could therefore enter into an agreement
in accordance with Sec. 450.147 to have a third party, such as a
spaceport or Federal launch or reentry site, satisfy the radio
frequency management requirements contained in Sec. 450.153.
As noted, the FAA adopts Sec. 450.153 (Radio Frequency Management)
with revisions. The FAA replaces paragraphs (a)(1) and (a)(2) with
performance-based objectives central to radio frequency management.
Operators will be required to ensure that radio frequency does not
adversely affect the performance of FSS or safety-critical systems and
to coordinate use of radio frequencies with any site operator and local
and Federal authorities.
ff. Readiness and Rehearsals (Sec. 450.155)
In the NPRM, the FAA proposed an operator would be required to
document and implement procedures to assess readiness to proceed with
the flight of a launch or reentry vehicle. As part of the application
requirements, proposed Sec. 450.155(b)(2) would require an applicant
to describe the criteria for establishing readiness to proceed with the
flight of a launch or reentry vehicle.
Rocket Lab expressed support for the proposed requirements as
reducing the risk of unintended consequences that resulted from
stringent time requirements. SpaceX recommended that the FAA clarify
its intent for flight commit criteria in proposed Sec. 450.155(b)(2)
to ensure that mission success is not a factor by having applicants
describe the criteria ``to ensure public safety'' for establishing
readiness to proceed with the flight of a launch or reentry vehicle.
The FAA agrees that a change to the proposed regulatory language
would clarify the scope of the requirement. Therefore, the FAA revises
Sec. 450.155(b)(2) by adding the phrase ``so that public safety is
maintained'' to the end of the paragraph. The FAA did not adopt the
language recommended by SpaceX because the requirement calls for
criteria that establish readiness to proceed with flight or reentry
while ensuring public safety. The FAA's revision maintains the emphasis
on developing criteria to determine readiness to proceed with launch or
reentry, and clarifies that the operator need only identify those
criteria that affect public safety.
gg. Communications (Sec. 450.157)
In the NPRM, the FAA proposed to preserve the substantive
communications requirements from parts 417 and 431 but eliminate the
requirement to implement a communications plan. Proposed Sec.
450.157(a) would require an operator to define the authority of
personnel to issue ``hold/resume,'' ``go/no go,'' and abort commands,
assign communication networks so those personnel have direct access to
real-time safety-critical information, ensure those personnel monitor
each common intercom channel during countdown and flight, and implement
a protocol for using defined radio telephone communications
terminology. Proposed Sec. 450.157(c) would also require an operator
during each countdown to record all safety-critical communications
network channels that are used for voice, video, or data transmissions
to support safety-critical systems. This requirement is substantially
the same requirement in Sec. Sec. 417.111(l)(5)(vii) and 431.41. In
the final rule, with the exception of proposed Sec. 450.157(a)(3) as
discussed later in this preamble section, the FAA adopts Sec. 450.157
as proposed.
As explained in the NPRM, operators would not need to submit their
communication procedures during the application process as those
procedures generally are not mature at that time. The FAA will verify
compliance with Sec. 450.157 during inspections.\173\ The inspections
will be consistent with current practice, in which FAA inspectors often
review the operator's final communications procedures. Given that
operators do not need to demonstrate compliance with Sec. 450.157 at
the application stage, operators may be required to revise their
communication procedures to resolve issues identified during compliance
monitoring.
---------------------------------------------------------------------------
\173\ 84 FR 15337.
---------------------------------------------------------------------------
The FAA received three comments addressing the communications
requirements proposed in Sec. 450.157. AAAE recommended the FAA
require procedures and protocols on how the operator would communicate
with contingency or alternative landing sites, and emergency
responders. AAAE also suggested the FAA consider providing these same
stakeholders with the ability to monitor countdown and communications
channels, just as operators would be required to provide the FAA with
such access under proposed Sec. 450.209.
The FAA finds no additional requirements are necessary, as the
accident investigation and agreement requirements address AAAE's
concerns. Operators must include emergency response procedures in their
mishap plans pursuant to Sec. 450.173, which could, in many instances
include communication procedures with emergency response service
providers. In addition, operators must enter into and implement any
necessary agreements with local authorities and emergency response
services, such as first responders. Any other stakeholder, such as a
contingency abort site, may request to monitor channels as part of its
agreement with the operator, but the FAA does not find it necessary for
safety to mandate this type of monitoring in all situations.
Sierra Nevada commented that the requirement to monitor each common
intercom channel is excessive and would decrease the safety of an
operation. It noted that, for operators with multiple channels (e.g.,
more than 10), monitoring each channel would serve to decrease the
overall situational awareness of the controller. Sierra Nevada
recommended the FAA revise proposed Sec. 450.157(a)(3) to require that
personnel monitor only the applicable intercom channels during
countdown and flight.
The FAA agrees with Sierra Nevada's recommendation and removes
Sec. 450.157(a)(3). The persons responsible for the launch need to
maintain situational awareness and have all
[[Page 79671]]
safety-critical information in order to make decisions that affect
public safety. In cases in which there are multiple channels, all
channels do not have to be monitored at the same time. It is common
practice to turn down or turn off channels in order to listen to a
channel that has critical information. Each person identified in
paragraph (a)(1) of this section is not required to listen actively at
all times. Operator personnel other than those listed in (a)(1) may
listen to channels as necessary to relay critical information to the
personnel listed in (a)(1).
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended the
FAA qualify the requirement to record safety-critical communications
channels in Sec. 450.157(c) as ``subject to records retention
requirements of Sec. 450.219.'' The FAA agrees that an operator must
record all safety-critical channels and retain them for the time
periods specified in Sec. 450.219, but does not agree that a change to
the regulatory text is necessary.
hh. Pre-Flight Procedures (Sec. 450.159)
In the NPRM, the FAA proposed to streamline countdown procedures
and requirements. Specifically, the FAA proposed not to include in part
450 the requirements for safety directives or safety notebooks in Sec.
431.37(a)(2) and for a countdown plan in Sec. 417.111(l), as well as
the requirement to file such plans, because there are many methods of
documenting pre-flight procedures that do not involve a plan or
notebook. In addition, the FAA proposed a performance-based requirement
in which an operator who needs to implement pre-flight procedures would
verify that all flight commit criteria are satisfied before flight and
ensure the operator is capable of returning the vehicle to a safe state
after a countdown abort or delay. In the final rule, the FAA adopts
Sec. 450.159 (Pre-flight Procedures) as proposed.
Virgin Galactic commented that, if the FAA knows which events must
take place as a part of a countdown, it should require them in proposed
Sec. 450.159(a)(1). Virgin Galactic recommended the FAA require
operators to identify the sequence of events that must take place to
initiate flight in order to verify that flight commit criteria are
satisfied.
Flight commit criteria involve much more than the launch sequence
of events, including interdependent conditions such as meteorological
conditions, lightning protection equipment measurements, and status of
safety system components. Therefore, the requirements of Sec. 450.159
cannot be satisfied by merely having operators identify the launch
sequence of events. Furthermore, the FAA does not think a prescriptive
requirement listing which events must take place as part of a countdown
is necessary to ensure safety. Rather, this section takes a performance
based approach that focuses more comprehensively on verification of
flight commit criteria and the operator's ability to ensure that it can
return the vehicle to a safe state after a countdown abort or delay.
The FAA notes that the requirements for the flight commit criteria
itself are clearly provided in Sec. 450.165(b).
ii. Control of Hazard Areas (Sec. 450.161)
In the NPRM, the FAA proposed that an operator would be required to
publicize, survey, and evacuate each flight hazard area before
initiating flight or reentry to the extent necessary to ensure
compliance with proposed Sec. 450.101. Proposed Sec. 450.161(a) did
not change the need for surveillance relative to the current
requirements in parts 417 and 431 \174\ for people on land or aircraft
because an operator must continue to ensure all regions where any
individual member of the public would be exposed to more than 1 x
10-\6\ PC (probability of casualty) are
evacuated. However, the FAA proposed to revise the requirement to
evacuate and monitor areas where a waterborne vessel would be exposed
to greater than 1 x 10-\5\ PI (probability of
impact) currently required by Appendix B to part 417 under B417.5(a).
The NPRM allowed an operator to include people in waterborne vessels in
collective risk computations, rather than clearing a waterborne vessel
from a hazard area because the vessel is exposed to 1 x
10-\5\ PI. The NPRM proposal to include people on
ships in the collective risk computation in Sec. 450.101(a)(1) and
(b)(1) would allow the application of risk management principles to
protect people on waterborne vessels. In the final rule, the FAA adopts
Sec. 450.161 with revisions. It updates Sec. 450.161 to be consistent
with the language in flight hazard area analysis section, Sec.
450.133, and adds an application requirement for a description of how
the applicant will provide for any publication of flight hazard areas.
---------------------------------------------------------------------------
\174\ Part 417 requirements for establishing and surveying
hazard areas for ELVs are found in Sec. Sec. 417.205, 417.223, and
part 417 appendix B. Part 431 does not set explicit requirements for
surveillance but both Sec. Sec. 417.107(b)(2) and 431.35(b)(1)(ii)
require that an operator ensure all members of the public are
cleared of all regions, whether land, sea, or air, where an
individual would be exposed to more than 1 x 10-\6\ PC.
---------------------------------------------------------------------------
The FAA changes the title of this section from ``Surveillance and
Publication of Hazard Areas'' to ``Control of Hazard Areas'' to
describe the contents of this section fully, as the requirements cover
more than surveillance and publication. The FAA also changed the
proposed wording in Sec. 450.161(a) from ``publicize, survey, and
evacuate'' to ``survey, publicize, control or evacuate'' to match the
language in Sec. 450.133(a), which describes flight hazard area
analysis. The term ``control'' is used to describe the overall
management of hazard areas, including control of entry and exit points
such as roadblocks and security checkpoints. The FAA also adds language
in Sec. 450.161(a) that references the flight hazard area requirements
in Sec. 450.133, which requires an applicant to identify the flight
hazard areas it needs to control.
The FAA notes that the requirements in Sec. 450.161 are consistent
with the recommendations made by the National Academy of Sciences
National Research Council.\175\ An applicant could apply conservative
estimates of the ship traffic and vulnerability to demonstrate
acceptable public risks. However, as explained in the NPRM, the
operators still have the option to use the current approach in part
417, where surveillance is required to ensure no ship is exposed to
more than 1 x 10-\5\ PI, because that would be
sufficient to ensure compliance with Sec. 450.101.
---------------------------------------------------------------------------
\175\ In 2001, the National Research Council published a report
on ``Streamlining Space Launch Range Safety,'' which included a
recommendation that ``safety procedures based on risk avoidance
should be replaced with procedures consistent with the risk
management philosophy specified by EWR 127-1.'' See p. 44 of IBSN 0-
309-51648-X available at http://www.nap.edu/catalog/9790.html.
---------------------------------------------------------------------------
Boeing, Lockheed Martin, Northrop Grumman, and ULA proposed that
the phrase ``unless otherwise assigned through agreement with a launch
or reentry facility'' be added to proposed Sec. 450.161(a) for
clarification. Virgin Galactic also recommended that this requirement
be handled through Letters of Agreement. Although the operator may
contract with another party for the provision of services to meet this
requirement, the licensee remains responsible for complying with the
requirement. As such, the FAA does not agree that this recommended
addition is necessary.
SpinLaunch commented that the goals of the NOTAM required under
proposed Sec. 450.161 can be addressed through area designations on
Sectional Aeronautical Charts, controlled airspace designation, and
coordination with Air Traffic Control. The FAA is responsible for the
[[Page 79672]]
management of the NAS and establishes the regulations, processes, and
procedures for restricting airspace including airspace restrictions for
commercial space activity. Under Sec. 450.147, when an operator enters
into a letter of agreement with the FAA, the airspace needed to
accomplish the proposed operation safely is notionally identified and
air traffic control coordination procedures are established
accordingly. The FAA did not propose changes to airspace management
regulations or processes, so SpinLaunch's comment is beyond the scope
of this rulemaking.
AOPA commented that airspace hazard volumes are not communicated in
a standardized manner today, nor are pilots educated on what to do with
this information. AOPA further commented that a publicly accessible,
authoritative source for launch information would greatly increase
awareness and mitigate adverse impacts caused by short notice
announcements of launches. The commenter also suggested that
prospective users of the system should be part of this capability's
development process.
As discussed more fully in the preamble section associated with
Flight Hazard Area Analysis, the FAA finds that the issue raised by
AOPA is best addressed by the NOTAM/AIM Modernization effort rather
than this rulemaking.
Boeing commented that, currently, not all areas that are publicized
are also surveyed, controlled, and evacuated. Boeing stated that the
need to survey and evacuate should be scalable and dependent upon the
risk magnitude and area, remoteness of the hazard areas, capabilities
for monitoring, and overall risk/benefit tradeoff. The FAA does not
believe a change to the proposed rule is necessary to address these
concerns. The requirement to survey, publicize, control, and evacuate
each flight hazard area is scalable, as these measures are required
``to the extent necessary to ensure compliance with Sec. 450.101.''
This reference to Sec. 450.101 means that the need to control the
hazard areas is dependent on the public risk criteria, as well as the
inputs and assumptions used in the FSA.
Sierra Nevada commented that Sec. 450.161 would be an increase in
regulatory burden due to surveillance over a large area being cost-
prohibitive and nearly impossible to implement for smaller companies.
Sierra Nevada recommended that operators only be required to ensure
NOTAMs and Notices to Mariners are in place prior to operation, and
should not bear consequences if the public breaches those areas. Sierra
Nevada also asked how an operator could reasonably survey an aircraft
hazard area over a large area of ocean.
The FAA disagrees with this comment and notes that this requirement
codifies current practice. The FAA further notes that the only change
to current practice--the inclusion of people on ships in collective
risk--actually decreases regulatory burden for waterborne vessel hazard
areas. An operator is no longer required to evacuate and monitor areas
where a waterborne vessel would be exposed to greater than 1 x
10-\5\ PI. In issuing its first waiver of the
existing requirement in Sec. 417.107(b)(3),\176\ the FAA explained
that successful application of the public risk management for the
protection of people in waterborne vessels has the potential for
reducing launch costs by reducing delays due to ship traffic in warning
areas while maintaining a high level of public safety. For example,
prior to the waiver of Sec. 417.107(b)(3), a launch from Cape
Canaveral Air Force Station was delayed, in order to meet the
requirements of Sec. 417.107(b)(3), by the presence of a tug boat
towing a large barge inside the ship hazard area. The final rule
addresses Sierra Nevada's concerns regarding surveillance of a large
portion of ocean by including people on ships in the collective risk
criterion. Furthermore, the FAA notes that this requirement could be
met a number of ways, including through an operator agreement with a
Federal launch or reentry site or the FAA.
---------------------------------------------------------------------------
\176\ See Waivers of Ship Protection Probability of Impact
Requirement, 81 FR 28930 (May 10, 2016).
---------------------------------------------------------------------------
Virgin Galactic asked whether it is necessary to require an
operator to meet the EC criteria if the operator is using a
flight hazard area, thus ensuring no member of the public is in the
area. The FAA addressed this issue during the public comment period in
``Responses to the Public's Clarifying Questions Received by July 12,
2019.'' An EC analysis is still required even if launch
hazards are contained over regions of land, sea, or air that are
completely void of members of the public because the systems necessary
to achieve such containment, such as an FSS, may fail. If an FSS fails,
debris may fall outside of hazard areas where members of the public are
present. The EC analysis ensures that the potential failure
of those systems is accounted for when calculating risk to the public.
In the NPRM, proposed Sec. 450.161(b) would have required an
operator to perform surveillance sufficient to verify or update the
assumptions, input data, and results of the FSA. The NPRM preamble
stated that, given that there are numerous assumptions and input data
that are critical to the validity of the FSA, this requirement could
have a variety of surveillance implications beyond the surveillance
necessary to ensure the public exposure at the time of the operation is
consistent with the assumptions and input data for the FSA. As
described in the NPRM preamble, an example would be that an FSA could
assume that a jettisoned stage remains intact to impact or breaks up
into pieces that are not all capable of causing casualties to people on
the ground but could still be capable of causing casualties to people
in a particularly vulnerable class of aircraft, such as helicopters.
In the final rule, the FAA maintains the requirement that an
operator employ some type of surveillance (e.g., telemetry data, or
remote sensors such as a camera or radar) to verify that the jettisoned
stage behaves in a manner consistent with the FSA if that behavior is
germane to the size of the aircraft hazard area. The FAA clarifies that
if an FSA includes conservative assumptions and inputs, or a
sensitivity analysis to demonstrate that the assumptions regarding
break-up of a jettisoned stage are not germane to the size of the
aircraft hazard area, the operator will only be required under Sec.
450.161(b) to demonstrate surveillance sufficient to verify the
accuracy of the FSA. If the assumptions and inputs are sufficiently
conservative, this contingency could mean an operator does not need to
employ surveillance at all.
Blue Origin provided suggested text for Sec. 450.161(b) related to
vehicle tracking rather than surveillance. The FAA declines to adopt
this change because vehicle tracking requirements in Sec. 450.167
(Tracking) are distinct from the requirement to surveil the flight
hazard areas in Sec. 450.161. The requirements and comments regarding
vehicle tracking are discussed in the preamble section associated with
Sec. 450.167.
CSF, Sierra Nevada, and SpaceX also commented that if a member of
the public or another Federal agency chooses to breach a hazard area
and put itself at risk, the operator should not bear the consequences.
Many commenters identified this possibility as a problem in the case of
a hazard area violation that occurs after the decision to commit to a
reentry.
The FAA understands the unique challenges of reentry operations
with respect to the control of hazard areas because of the long time
lag between the commitment to reenter and the planned or potential
unplanned vehicle presence
[[Page 79673]]
in a hazard area. The FAA will work with operators during the license
application process in applying this requirement to ensure verification
procedures protect the public adequately for each unique operation.
In the NPRM, proposed Sec. 450.161(c) would require an applicant
to publicize warnings for each flight hazard area, except for regions
of land, sea, or air under the control of the vehicle or site operator
or other entity by agreement. If the operator relies on another entity
to publicize these warnings, the proposed rule required the operator to
verify that the warnings have been issued. CSF and SpaceX commented
that operators would have very little ability to ensure and enforce
closures when launching from a Federal launch or reentry site or if the
hazard area falls within a foreign country's airspace.
The FAA agrees with these comments. To address this issue, the FAA
changes the language in proposed Sec. 450.161(c) from ``verify that
the warnings have been issued'' to ``determine whether the warnings
have been issued'' in Sec. 450.161(c)(1) in the final rule. The FAA
recognizes that an operator would be unable to meet the proposed
regulation to verify the warnings have been issued if the foreign Air
Navigation Service Provider (ANSP) fails to publicize the warnings. The
FAA also adds in Sec. 450.161(c)(2) of the final rule that the
operator must notify the FAA if the warnings have not been issued so
that the FAA can determine if the launch or reentry can be conducted in
a manner that protects the public sufficiently, and that this
notification must provide sufficient information to enable the FAA to
issue warnings to U.S. aircraft. An involved party could determine
whether the warnings have been issued pursuant to the agreements the
operator has with, for example, a Federal launch or reentry site or a
foreign government. In cases in which a foreign ANSP does not issue the
warnings in a timely manner, the operator must notify the FAA in
accordance with a means of compliance accepted by the FAA. The means of
compliance will describe information that the operators should
communicate to the FAA to (1) show due diligence in the fulfillment of
their requirements in accordance with agreements in place, and (2)
enable FAA to issue warnings to U.S. aircraft. The FAA finds that the
final rule requirement in Sec. 450.161(c)(2) is responsive to the
comment that operators have very little ability to enforce closures
when launching from a Federal launch or reentry site or if the hazard
area falls within a foreign country's airspace.
The FAA proposed in Sec. 450.161(d)(1) that an applicant must
submit a description of how the applicant will provide for day-of-
flight surveillance of flight hazard areas, if necessary, to ensure
that the presence of any member of the public in or near a flight
hazard area is consistent with flight commit criteria developed for
each launch or reentry as required by Sec. 450.165(b). In the final
rule, the FAA adds in Sec. 450.161(d)(1) that the applicant must also
provide for day-of-flight control of flight hazard areas. The FAA notes
that the nature of any surveillance (in terms of extent and frequency)
necessary to ensure conditions consistent with flight commit criteria
is naturally linked to the level of control an operator can exercise to
limit access to a flight hazard area.
In Sec. 450.161(d)(2), the FAA adds as an application requirement
that the applicant must submit a description of how they will provide
for any publication of flight hazard areas necessary to meet the
requirements of Sec. 450.161(c). This application requirement is
necessary for the FAA to evaluate compliance with the requirements of
Sec. 450.161(c), including verifying whether the warnings have been
issued.
jj. Lightning Hazard Mitigation (Sec. 450.163)
In the NPRM, the FAA proposed to require operators to mitigate
natural and triggered lightning by (1) implementing flight commit
criteria that avoid and mitigate the potential for intercepting or
initiating lightning strike or encountering discharge; (2) using a
vehicle designed to continue safe flight if struck by lightning or
encountering a nearby discharge; or (3) ensuring satisfaction of the
safety criteria set forth in proposed Sec. 450.101 in the event of a
lightning strike on the vehicle.
In the final rule, the FAA adopts Sec. 450.163 (Lightning Hazard
Mitigation) with modification. It revises Sec. 450.163 to remove
paragraphs (a)(3) and (b)(3). It adds the modifier ``direct'' to
``lightning strike'' in paragraph (a)(1), to match the application
requirement in paragraph (b)(1). The FAA also modifies Sec.
450.163(a)(2) in response to a comment as described below.
Blue Origin commented that proposed Sec. 450.163(a)(3) diverged
from the preamble to Sec. 450.163 and the rest of the proposed rule,
which clearly convey that satisfaction of the safety criteria in
proposed Sec. 450.101 was not optional. An operator would be required
to satisfy proposed Sec. 450.101 regardless of whether it chooses to
implement flight commit criteria or utilize a lightning-resistant
vehicle.
The FAA agrees with Blue Origin's comment and revises Sec.
450.163(a) by removing proposed Sec. 450.163(a)(3). Proposed Sec.
450.163(a)(3) was intended to cover an operator's use of physical
containment as a hazard control strategy when damage to a vehicle
caused by a lightning strike would not impact the safety of the launch.
The FAA has found this section to be unnecessary because lightning
would not be a concern for an operator using physical containment as a
hazard control strategy since, by definition, the launch vehicle does
not have sufficient energy for any hazards associated with its flight
to reach outside the flight hazard area.
Blue Origin requested that the FAA define ``continue safe flight''
in proposed Sec. 450.163(a)(2). In response, the FAA modifies Sec.
450.163(a)(2) to require the operator to use a vehicle designed to
protect safety-critical systems in the event of a direct lightning
strike or nearby discharge. Thus, the final rule requirement in Sec.
450.163(a)(2) mirrors the proposed application requirement in Sec.
450.163(b)(2) to submit documentation providing evidence that the
vehicle is designed to protect safety-critical systems against the
effects of a direct lightning strike or nearby discharge.
Virgin Galactic expressed concern for the amount of time it would
take operators to redesign their vehicles to satisfy proposed Sec.
450.163(a)(2) and asked that the FAA ``grandfather'' currently licensed
operators out of this requirement. The FAA notes that Sec. 450.163(a)
provides two ways for an operator to mitigate natural and triggered
lightning and does not mandate a lightning-related design change. The
decision to pursue flight commit criteria versus a lightning-resistant
vehicle rests with the operator.
The performance-based standards set forth in Sec. 450.163 will be
accompanied by AC 450.163-1 ``Lighting Hazard Mitigation'' in the
future, which will contain one, but not the only, acceptable means of
compliance for Sec. 450.163(a)(1). The AC will include references to
NASA-STD-4010, as well as relevant standards for the design of a
vehicle to withstand the direct and indirect effects of a lightning
discharge. Commenters largely supported this approach. Blue Origin
noted that, while the Lightning Flight Commit Criteria adopted by the
FAA have successfully prevented lightning attachment to vehicles in the
past, operators may demonstrate that the avoidance criteria can be
satisfied with their specific mission profile and vehicle design.
Aerospace Corporation echoed support for enabling operators to
[[Page 79674]]
develop new methods and evaluations for lighting avoidance and
mitigation.
Regarding proposed Sec. 450.163(a)(1), two commenters expressed
concern that the FAA, in adopting only NASA-STD-4010 as an accepted
means of compliance for now, may not accept unique means of compliance
in the future. The Aerospace Corporation and Weather Modification
International argued the FAA should adopt prelaunch in situ measurement
of electric fields as a means of demonstrating compliance with Sec.
450.163, noting that NASA-STD-4010 is imperfect because it relies
exclusively on observable ground data.
The FAA considered using direct measurement of the electric field
within a cloud as an option for compliance with Sec. 450.163. However,
the ambient electrostatic field within and near electrified clouds can
vary rapidly in both space and time because of the charge separation
and redistribution processes inside and around the clouds, and because
lightning can rearrange this charge abruptly over distances of many
kilometers. Because no measuring technique today can be applied
everywhere simultaneously and it is difficult to prove that electric
field measurements taken near the flight path at an earlier time will
remain valid at the time of launch or landing, this option is not
viable on its own.
The FAA agrees that the optimal standards for avoiding and
mitigating natural and triggered lightning may be achieved through
technological advancement in the future. Currently, NASA-STD-4010 is
the only standard of which the FAA is aware that will satisfy the
requirements of Sec. 450.163(a)(1). However, ongoing research efforts
could soon allow for modifications of the NASA's Lightning Launch
Commit Criteria, providing additional means of compliance. As stated in
the NPRM, the FAA anticipates that industry will develop and submit new
standards to the FAA to serve as unique means of compliance under Sec.
450.35(b).
The FAA also acknowledges the suggestion of Weather Modification
International that the FAA take the lead in developing a definitive set
of lightning standards. The FAA has traditionally relied upon the
Lightning Advisory Panel, with its technical expertise in mitigating
lightning hazards, to develop lightning standards. The FAA relied upon
the lightning standards recommended by the Lightning Advisory Panel in
developing the lightning requirements in part 417. Given the
performance-based nature of this rule, the FAA is not prescribing a
particular standard for mitigating lightning hazards, but instead will
allow applicants to develop their own means of complying with Sec.
450.163. The FAA notes, however, that the means of compliance
identified, NASA-STD-4010, was developed by the Lightning Advisory
Panel, and thus, would achieve the same result that the commenter
requests.
Blue Origin commented that, to the extent the FAA looks to aircraft
lightning protection standards (e.g., AC 20-136B, AC 20-107B) to
determine the appropriate industry standards applicable to Sec.
450.163(a)(2), the agency should adopt only those standards clearly
applicable to space vehicles. The commenter added that the use of SAE
recommended practices would create an undue burden on applicants since
the SAE protection rules apply to transport aircraft, which require a
much higher level of safety than that prescribed by part 450.
The FAA agrees that only those aircraft standards which are
appropriate to apply to space vehicles should be used to assess
compliance with Sec. 450.163(a)(2).
kk. Flight Commit Criteria (Sec. 450.165)
In the NPRM, the FAA proposed in Sec. 450.165 that an operator
establish and observe flight safety rules in order to initiate flight.
The proposed rule also required an operator to establish and observe
flight abort rules in order to end flight. Proposed Sec. 450.165 would
require that an operator's flight safety rules include flight commit
criteria identifying each condition necessary to satisfy proposed Sec.
450.101 prior to initiating flight. These flight commit criteria would
include: (1) Surveillance; (2) monitoring of meteorological conditions;
(3) implementing window closures for the purpose of collision
avoidance; (4) monitoring the status of any FSS; and (5) any other
hazard controls derived from system safety, computing system safety, or
FSA.
In the final rule, the FAA adopts proposed Sec. 450.165 with
revisions. The FAA moves the flight abort rules proposed in Sec.
450.165(c) to Sec. 450.108. The discussion of the revisions related to
abort rules in proposed Sec. 450.165 is in the Flight Abort Rules
section of the preamble. The FAA combines proposed Sec. 450.165(a) and
(b) into a single paragraph (a) to reflect that this section now only
relates to flight commit criteria.
In addition, the FAA adds a requirement that the flight commit
criteria must include confirmation from the FAA that the risk to
critical assets satisfies the requirements of Sec. 450.101(a)(4) or
(b)(4). This requirement is consistent with the changes to the critical
asset requirements discussed earlier in the preamble and ensures that a
flight is not initiated if it does not meet the risk criteria. The FAA
will work with the applicant to create a streamlined process to achieve
this confirmation. The FAA anticipates that it will generally be able
to provide this confirmation well before the actual flight countdown.
Sierra Nevada commented that the use of the term ``surveillance''
may be broader than the FAA intended. The FAA discusses surveillance in
the preamble section for Control of Hazard Areas (Sec. 450.161).
ll. Tracking (Sec. 450.167)
In the NPRM, the FAA proposed vehicle tracking requirements,
including that an operator would be required to measure and record in
real time the position and velocity of the vehicle. The system used to
track the vehicle would be required to provide data to determine the
actual impact locations of all stages and components, and to obtain
vehicle performance data for comparison with the pre-flight performance
predictions. The FAA intended the proposed requirements to capture
current practice. As explained in the NPRM, tracking data sufficient to
identify the location of any vehicle impacts following an unplanned
event are necessary to ensure a proper response to an emergency.\177\
---------------------------------------------------------------------------
\177\ See 84 FR 15344.
---------------------------------------------------------------------------
CSF, SpaceX, SpinLaunch, and Virgin Orbit commented that the
proposed language in Sec. 450.167(a) could be interpreted as tracking
stages and components all the way down to the earth or body of water.
CSF also sought clarity regarding the intent of the requirement to
``provide data to determine the actual impact locations of all stages
and components,'' and whether this requirement would mean that
operators must predict the expected impact locations or actual impact
locations. To clarify this point, CSF, SpaceX, and Virgin Orbit
suggested using the phrase ``predict the expected impact locations''
rather than ``determine the actual impact locations.'' The FAA concurs
and adopts the recommended change in the final rule. The change more
accurately reflects the intent of the requirement.
Blue Origin commented that RCC 321 requirements to coordinate with
the FAA to ensure timely notification of any expected air traffic
hazard do not actually mention vehicle tracking, and that it may be
possible to provide
[[Page 79675]]
notification of traffic hazards without the need for tracking (such as
a straight up suborbital trajectory \178\).
---------------------------------------------------------------------------
\178\ A straight up suborbital trajectory is a nearly vertical
suborbital trajectory. ``Suborbital trajectory'' is defined in Sec.
401.5 as the intentional flight path of a launch vehicle, reentry
vehicle, or any portion thereof, whose vacuum instantaneous impact
point does not leave the surface of the Earth.
---------------------------------------------------------------------------
Tracking data is an important element of current practice used to
ensure the safety of people in aircraft. In the past, tracking vehicles
was inherently a part of flight abort and an important means to ensure
safety in the event of a mishap in which hazardous debris falls outside
of designated hazard areas. During launch or reentry operations that
lack the ability to inform the FAA rapidly of the volume and duration
of airspace for which an aircraft hazard is predicted following a
mishap, the FAA must close inordinately large regions of airspace to
provide a sufficient level of safety to aircraft flying in regions
where hazardous debris could fall in the event of a break-up. Although
RCC 321 does not call for tracking per se, the FAA finds tracking
essential to the safe and efficient integration of launch and reentry
operations into the NAS. For example, the Columbia accident in 2003
\179\ demonstrated that there is often a significant period of time
between a vehicle break-up and when hazardous debris reaches aircraft
altitudes. The time between vehicle break-up and when hazardous debris
reaches aircraft altitudes enables the FAA to close a minimum amount of
airspace while ensuring a high level of safety for aircraft flying in
regions where hazardous debris could fall in the event of a break-up.
As explained in the NPRM preamble, tracking data are generally
necessary to ensure a proper response to an emergency, facilitate
flight abort, obtain vehicle performance data for comparison with the
preflight performance predictions in accordance with Sec. 450.103(d),
and facilitate safe and efficient integration of launch and reentry
operations into the NAS. Therefore, the final rule is consistent with
the NPRM and current practice.
---------------------------------------------------------------------------
\179\ See Report of Columbia Accident Investigation Board at
https://www.nasa.gov/columbia/home/CAIB_Vol1.html.
---------------------------------------------------------------------------
CSF, Leo Aerospace, Microcosm, Sierra Nevada, and SpaceX commented
that the proposed language regarding tracking was too broad and would
seem to require an operator to track pieces of debris to impact during
an off-nominal event. As clarified by the FAA during the public comment
period in ``Answers to Clarifying Questions Received by June 28, 2019''
and ``Answers to Clarifying Questions Received by July 29, 2019,'' the
term ``all stages and components'' does not mean that all debris must
be tracked to the ground after a vehicle breakup.
CSF and SpaceX suggested adding the word ``nominal'' to this
requirement when referring to flight tracking. The FAA declines to
adopt this change because it is important to track during off-nominal
trajectories as well, including during normal flight and for off-
trajectory malfunctions at least until flight abort is initiated or
vehicle break-up occurs. Tracking data can enable an appropriate
response to an off-nominal situation, such as where to evacuate the
public to protect against predicted toxic fumes or where to apply fire
suppression resources.
Blue Origin, CSF, and SpaceX commented that real time telemetry is
often not possible for the entire mission, such as when a vehicle
passes over the horizon or during a reentry blackout period. The FAA
concurs with the commenters that real time telemetry is not always
possible. In the past, there were times during reentry that the
presence of plasma typically blocked vehicle-to-ground communications.
More recently, space-based tracking and communications have made it
feasible to overcome reentry plasma and over the horizon limitations.
However, the final rule does not require operators to use space-based
tracking and communications to meet Sec. 450.167 unless it is
necessary to protect public safety, safety of property, and national
security and foreign interests of the United States. The FAA does not
currently foresee any licensed launch or reentry activity that will
require the use of space-based tracking to protect public safety,
safety of property, and national security and foreign interests of the
United States. Furthermore, ``real time'' does not mean ``zero lag
time.'' The tracking must be sufficient to meet the requirements in
Sec. 450.167(a) to predict the expected impact locations and obtain
vehicle performance data for comparison with pre-flight predictions.
The FAA would not hold an operator accountable if there was some lag
for reasons outside of the operator's control. The FAA believes that
this leeway answers Blue Origin's recommendation that tracking
requirements be limited to phases of launch or reentry vehicle flight
identified in Sec. 450.113(a), since on-orbit tracking is not
practical.
mm. Launch and Reentry Collision Avoidance Analysis Requirements (Sec.
450.169)
In the NPRM, the FAA proposed to update the information required
for launch collision avoidance (LCOLA) and expand the analysis
requirements to determine launch and reentry window closures, including
updated protections for human spaceflight and additional closures to
protect active payloads and prevent orbital debris generation. The FAA
proposed that all operators would be required to come into compliance
with the LCOLA requirements by the effective date of the rulemaking.
In the final rule, the FAA adopts Sec. 450.169 with revisions. The
finalized LCOLA rules better align with the existing processes used at
Federal sites, provide adequate orbital safety measures for launch and
reentry operations, and incorporate updated options for collision
avoidance analysis. The FAA maintains that all operators must come into
compliance with the LCOLA requirements by the effective date of this
rule. The FAA adds the words ``are met'' to Sec. 450.169(b) to fix a
typographical error in the NPRM.
For an orbital or suborbital launch or reentry, Sec. 450.169(a)
requires an operator to establish window closures needed to ensure that
the launch or reentry vehicle, any jettisoned components, or payloads,
meet the identified requirements with respect to orbiting objects, not
including objects being launched or reentered as part of the same
launch or reentry activity (e.g., dual manifested payloads). In
performing a launch or reentry collision avoidance analysis against
inhabitable objects, an operator may choose to stipulate an ellipsoidal
separation distance, a spherical separation distance, or satisfy the
probability of collision threshold (1 x 10-\6\). Collision
avoidance analyses must also account for other orbital objects, such as
spacecraft, and tracked debris. For these uninhabitable active objects,
operators must satisfy either a less restrictive probability of
collision threshold (1 x 10-\5\) or a spherical separation
distance of 25 km. As discussed more fully later, in response to
comments, the FAA revises Sec. 450.169(a)(3), which covers all other
known orbital debris, so that operators must maintain either a
spherical separation distance of 2.5 km or a less restrictive
probability of collision threshold (1 x 10-\5\) from orbital
debris that is medium or large in size (radar cross section greater
than 0.1m\2\), as identified by the FAA or another Federal Government
entity.
The FAA also received a number of comments to proposed Sec.
450.169(d), which identified when LCOLA analysis would not be required.
This section was not a new requirement, but a consolidation of the
existing regulations, Sec. 417.231(d) and Appendix C to part 417 under
C417.11. As
[[Page 79676]]
proposed, an LCOLA analysis would not be required if the maximum
altitude attainable by a launch operator's suborbital launch vehicle
and any released debris is less than 150 km. The proposed requirement
stated that the maximum altitude attainable is an optimized trajectory,
assuming maximum performance within 99.7 percent confidence bounds,
extended through fuel exhaustion of each stage, to achieve a maximum
altitude.
SpaceX opposed the requirement that LCOLA exclusions (launch and
reentry window closures) be based on fuel depletion trajectories or the
maximum attainable altitude of a launch vehicle. SpaceX commented that
both bases exceeded the scope of past requirements and requested that
LCOLA exclusions be based exclusively on the maximum performance case.
SpaceX also recommended the FAA delete proposed Sec. 450.169(d) due to
unclear technical or public safety benefits. Blue Origin recommended
that fuel exhaustion from each stage be excluded from proposed Sec.
450.169(d) because remaining fuel will always be required to land RLVs.
The FAA disagrees with the recommendation to remove Sec.
450.169(d). The FAA notes that, without this subsection, operators
would need to conduct LCOLA analyses for all launches, regardless of
altitude. The FAA has determined that no LCOLA analysis is needed for
missions that do not exceed 150 km in altitude because orbital objects
below this level are exceedingly sparse and usually are not present for
long durations. Furthermore, launch operators currently do not provide
trajectories for stages or objects that do not exceed 150 km. As such,
it is appropriate to specify in the regulation when the LCOLA analysis
is not required.
The FAA agrees, however, that the language proposed in Sec.
450.169(d) did not reflect current practice and could prove
impracticable. The requirement for accomplishing LCOLA for all objects
launched over 150 km was complicated by existing regulatory language on
maximum altitude calculations. LCOLA is accomplished using only the
nominal trajectory provided by the launch or reentry operator. No
screening is accomplished using maximum possible altitudes because
there is no planned trajectory to screen, and the FAA did not intend
for operators to develop alternate trajectories. Therefore, the FAA
revises Sec. 450.169(d) so that no LCOLA is required if the object's
maximum planned altitude is less than 150 km.
Similarly, the FAA revises Sec. 450.169(b)(1) to require LCOLA
analysis only for the entire segment of flight of a suborbital launch
vehicle above 150 km. The FAA agrees with SpaceX's comment that
requiring operators to conduct LCOLA analyses below 150 km is
unnecessary and would prove burdensome. This revision is consistent
with the requirements for orbital vehicles and acknowledges that only
the portions of flight above 150 km are screened in either case.
Virgin Galactic recommended that proposed Sec. 450.169(d) be
retitled, ``Applicability.'' SpaceX recommended the regulation refer to
a ``body'' or ``object,'' rather than ``suborbital'' or ``debris.'' The
FAA agrees with Virgin Galactic and SpaceX that these terms and the
title could be clearer and more consistent with current usage. The FAA
retitles Sec. 450.169(d) ``Exception,'' which more accurately
describes this subsection, and substitutes ``object'' in place of
suborbital vehicle in Sec. 450.169(d).
Regarding requirements proposed in Sec. 450.169(a) and (b), the
FAA received numerous comments questioning the need for a 200 km keep-
away distance for human spaceflight and the absence of probability of
collision screening for debris. Numerous commenters also recommended a
narrower trajectory data requirement for suborbital launches.
An individual commenter stated that a spherical separation distance
of 200 km from inhabitable objects, as set forth in proposed Sec.
450.169(a)(1)(ii) and (a)(1)(iii), may not be appropriate due to
advances in spaceflight systems such as autonomous flight termination
systems (AFTS) and autonomous flight systems (AFS). The commenter
recommended the FAA allow the 200-km limit to be tailored depending on
the reaction time of the flight termination system. The commenter also
suggested the 200-km limit could be tailored if the launch vehicle
contains a traffic collision avoidance system (TCAS) (akin to what
aircraft use to avoid planes) that can reasonably avoid nearby crewed
vehicles.
The FAA disagrees that a spherical separation distance of less than
200 km is appropriate for inhabitable objects. No termination systems
are currently used in orbit, and termination systems are not likely to
be viable safety measures in orbit. The 200 km safety standoff distance
is only for orbital spaceflight protection; it is not a separation
standard for airspace integration. An orbital termination system would
increase the danger to human spaceflight and increase the orbital
debris population. Safety and efficiency must be accomplished with a
screening prior to launch. Launch vehicles do not have TCAS-like
operations and are not expected to acquire such capabilities.
SpaceX asked the FAA to explain why Sec. 450.169(a)(3) requires
operators to screen orbital debris greater than 10 cm\2\ against a
spherical miss distance of 2.5 km, rather than meet a probability of
collision threshold, as the FAA allows for inhabitable objects and
active payloads. SpaceX stated that the requirement to maintain a
spherical miss distance, without the option to evaluate probability of
collision, is more restrictive than current requirements and
inconsistent with USAF practices. SpaceX argued there should be an
option to waive miss distance less than 2.5 km if probability of
collision is sufficiently low, as is done for active payloads.
The FAA agrees with SpaceX that probability of collision could be
used for medium and large orbital debris because those objects are
routinely well-tracked and have valid orbital covariances available.
This option would provide for higher fidelity screening of collisions
that could produce significant amounts of orbital debris. As such, the
FAA revises Sec. 450.169(a)(3) to allow operators to screen for
orbital debris identified by the FAA or other Federal Government entity
using either a spherical separation distance of 2.5 km or a less
restrictive probability of collision threshold (1 x 10-\5\).
The use of probability of collision will require realistic covariance
data on both the launching object and the screened orbital object to
produce meaningful results. Operators who do not provide realistic
covariance will be required to have the launch or reentry screened with
stand-off distance. The probability of collision threshold required for
debris is the same as that required for active payloads in Sec.
450.169(a)(2), which mirrors current USAF requirements. The USAF
requirements for debris screening use the same probability of collision
as a high-fidelity analysis in place of both 25 km and 2.5 km standoff
screening. The FAA slightly relaxed the debris screening size
requirement to include only medium (0.1 m\2\ to 1 m\2\) and large
objects (greater than 1 m\2\) in order to provide for accurate use of
probability of collision analysis. Medium and large debris objects are
well-tracked, and the U.S. Government maintains accurate covariance on
these objects. This requirement achieves the objectives stated in the
NPRM of avoiding conjunction analysis with micro-debris, while
preventing the generation of space debris since these objects are well-
tracked and capable of
[[Page 79677]]
creating significant amounts of persistent space debris in the event of
a collision.
In proposed Sec. 450.169(f), the FAA would require an operator to
prepare a collision avoidance analysis worksheet for each launch or
reentry using a standardized format that contains the input data
required by Appendix A to part 450. Proposed Sec. 450.169(f)(1) would
require an operator to file the input data with a Federal entity
identified by the FAA and with the FAA at least 15 days before the
first attempt at the flight of a launch vehicle or the reentry of a
reentry vehicle or in a different time frame in accordance with
proposed Sec. 404.15. Proposed Sec. 450.169(f)(2) would require an
operator to obtain a collision avoidance analysis performed by a
Federal entity identified by the FAA 6 hours before the beginning of a
launch or reentry window.
CSF and SpaceX requested the FAA alter proposed Sec. 450.169(f)(1)
to require operators to file input data 7 days before launch or reentry
rather than 15 days. The commenters stated the 15-day requirement
conflicts with current processes at Federal launch or reentry sites,
which allow submissions 7 to 10 days before launch or reentry. CSF and
SpaceX stated that 7 days prior to launch has proven sufficient to
produce screening results by 6 hours before launch. CSF and SpaceX also
indicated that the requirement to obtain final results 6 hours before
launch was inconsistent with current practice. The Federal entity
performing LCOLA screenings delivers the final data hours before
launch. CSF and SpaceX recommended adding a clause to proposed Sec.
450.169(f)(2) allowing trajectory data to be delivered within timelines
agreed to by the launch operator and the entity performing the
screening. Alternatively, SpaceX recommended the FAA either require the
data be submitted 3 hours before launch in Sec. 450.169(f)(2), as
currently practiced by the USAF, or allow operators flexibility to
obtain LCOLA data ``within'' 6 hours of the launch or reentry window
beginning, but no later than 3 hours before launch.
The FAA partially agrees with CSF's and SpaceX's recommended
changes to the timelines established in Sec. 450.169(f)(1) and (f)(2).
For launch or reentry operations that have successfully developed an
internal process that results in repeatable LCOLA data submission, the
FAA recognizes that 7 days prior to launch is an adequate time for
Federal entities to process the LCOLA data based on recent LCOLA
submissions reviewed for the last year. The FAA revises Sec.
450.169(f)(1) to require that most operators submit LCOLA data at least
7 days in advance of launch or reentry. However, the FAA disagrees that
a shorter time frame would be appropriate for operators that have not
yet conducted launch or reentry activities. The FAA has repeatedly
noted that LCOLA data submitted from first-time launch or reentry
operators often require significant reiterative work to achieve an
acceptable submission. As such, the FAA will require operators that
have not yet received conjunctive assessments to submit LCOLA data at
least 15 days in advance of launch or reentry. This approach is similar
to that of the USAF, which requires entities that have not yet received
conjunctive assessments to submit LCOLA data 30 days in advance of
launch. The FAA revises Sec. 450.169(f)(1)(i) to require that entities
that have not yet received conjunctive assessments to submit LCOLA data
at least 15 days in advance of launch. All other operators must submit
LCOLA data at least 7 days in advance of launch.
The FAA agrees that the requirement to receive results within 6
hours before beginning of the launch or reentry window could be reduced
to 3 hours. Later delivery will produce LCOLA results that are timelier
and therefore more accurate for orbital safety purposes. Therefore, the
FAA revises Sec. 450.169(f)(2) to alter delivery to 3 hours before
beginning of the launch or reentry window.
Boeing, Lockheed Martin, Northrop Grumman, and ULA commented that
much of proposed Sec. 450.169(a) focused on analysis that was not
applicable to operators since applicants do not have the data and tools
to perform LCOLA analysis, but merely provide inputs and implement
operational windows based on closures provided. The commenters
advocated for a streamlined commercial process for licensed launches or
reentries that do not occur at a Federal launch or reentry site, in
which the FAA would take the applicant's trajectory inputs to the
Federal agency responsible for LCOLA analysis and establish stay-out
windows. The commenters argued a standardized process would eliminate
the need for multiple applicants to establish interfaces and procedures
with an agency that rarely deals with commercial (space transportation)
entities.
The FAA declines to streamline the LCOLA process further by
removing the analysis requirements of Sec. 450.169(a), such that
applicants only need to provide data and abide by results. Transparency
in LCOLA analysis provides confidence and understanding of the LCOLA
process for launch, reentry, and payload, for operators as well as the
public.
The same commenters noted that the FAA could act as a go-between
entity for all operators in a similar manner to Federal sites'
processes. The FAA agrees that operators could use the FAA or the
Federal sites as conduits to the LCOLA processing entity and recognizes
that this flexibility remains in the final rule language. This type of
activity is appropriately coordinated during the launch operator or
reentry operator pre-application discussions. The FAA disagrees with
requiring the FAA to act as a pass-through because the FAA believes
that removing launch operators from direct contact with the USAF 18th
Space Control Squadron could have unintended negative consequences. For
instance, an early orbit breakup emergency may require prompt exchange
of data between launch operators and on-orbit support services
providers using processes already tested during LCOLA development and
adding a pass-through element could hamper or slow analysis,
notifications, and potential mitigation actions. Moreover, the FAA does
not place orbital safety analysts on duty during launch or reentry
operations. To adequately support the passthrough, the FAA would need
to establish launch support teams and exercise the team in advance of
emergency operations.
Blue Origin and SpaceX recommended the FAA allow LCOLA analyses to
be conducted by non-Federal entities. Blue Origin recommended that
proposed Sec. 450.169(e) require LCOLA analyses be obtained from
Federal entities, unless otherwise agreed to by the Administrator.
SpaceX recommended proposed Sec. 450.169(f) allow operators to file
input data and obtain LCOLA analyses from approved third parties, as
opposed to Federal entities. SpaceX argued the FAA should foster a
competitive market and allow flexibility in using commercial services
as commercial entities enter the space situational awareness (SSA)
market and aim to provide the same services as Federal entities. Virgin
Galactic asked if the FAA anticipated a cost associated with obtaining
the analysis from the Federal entity.
The FAA declines to remove the reference to Federal entities in
Sec. 450.169. Although commercial entities are developing space
traffic support services that could eventually provide adequate safety
for launch collision avoidance, to date, only Federal entities have
full access to the authoritative catalog maintained by the DOD. Rather
[[Page 79678]]
than remove this clause, the FAA adds the phrase, ``or another entity
agreed to by the Administrator,'' to Sec. 450.169(e) in order to
provide flexibility should the space traffic authority and framework
change over time. The Administrator may allow another entity to provide
this service based on a demonstration that the data includes a complete
and accurate catalogue of all identifiable objects in the relevant
space environment. Currently, the DOD is the only entity that meets
this criterion. In response to Virgin Galactic's question regarding
cost, the current LCOLA analysis from the U.S. Government is provided
free of charge.
SpaceX recommended the FAA defer to or allow operators to use the
LCOLA processes and standards of Federal launch or reentry sites for
launches from Federal sites as means of compliance. SpaceX argues that
doing so would minimize confusion regarding the applicable standards
and procedures at different operating sites. SpaceX also suggested that
Sec. 450.169(e) be revised to state that operators may use Federal
launch or reentry site services with existing policies and processes to
ensure acceptable compliance.
The FAA declines to defer to the Federal launch or reentry sites.
The FAA and Federal sites have different waiver requirements and
processes. The FAA finds the language as proposed in the NPRM is
adequate when coupled with the existing waiver process and equivalent
level of safety process. In addition, the FAA notes that launches from
non-Federal sites are not required to follow Federal site practices,
and using a single FAA standard minimizes confusion both on and off
Federal launch or reentry sites.
Citing the discrepancy between the proposed collision avoidance
analysis and current USAF practice, CSF stated the proposed rule
attempted to ``fix'' parts of the licensing process that were not
broken.
The FAA disagrees that the collision avoidance analysis process is
incompatible with the current USAF practice. The procedures for launch
collision avoidance under Sec. Sec. 417.107, 417.231, 417.31, and
417.43 did not reflect current practice as they excluded any
probability of collision, referenced outdated processes and agencies,
and required outdated adjustments to closures. The updated LCOLA
process is compatible with USAF practices where appropriate (e.g.,
LCOLA timelines, screening options for human spaceflight protection,
and active payload protection), noting that the FAA regulation must
also guide operations of launch and reentry operations at non-Federal
sites.
nn. Safety at End of Launch (Sec. 450.171)
In the NPRM, the FAA proposed in Sec. 450.171 (Safety at End of
Launch) requirements for the prevention of creating orbital debris,
with which an applicant would be required to demonstrate compliance in
its application.
In the final rule, the FAA adopts Sec. 450.171 as proposed. The
FAA did not receive comments on these proposed requirements.
oo. Mishap (Definition, Sec. Sec. 450.173 and 450.175)
i. Mishap Definition
In the NPRM, the FAA proposed to consolidate the definitions of
``Mishap,'' ``Launch Accident,'' ``Launch Incident,'' ``Reentry
Accident,'' ``Reentry Incident,'' ``Human Spaceflight Incident,'' and
``Launch Site Accident'' under the definition of ``Mishap'' in Sec.
401.5. The FAA proposed four mishap categories, from most severe (Class
1) to least severe (Class 4).
In the final rule, the FAA does not adopt the proposed
classification system. Instead, the FAA combines the substantive
criteria of Mishap Classes 1 through 4 under the definition of
``mishap'' in Sec. 401.7. The revised definition describes events that
constitute a mishap in a straightforward manner that better corresponds
to regulatory requirements. The FAA incorporates additional changes to
the final rule as discussed in the following paragraphs.
Numerous commenters from industry expressed confusion about the
types of activities that would fall under each class. The commenters
questioned the necessity of classifying mishaps based on severity since
the regulatory requirements were largely the same for all mishaps.
The FAA reviewed the regulatory requirements associated with each
of the proposed mishap classes and agrees there were no significant
differences among the regulatory requirements for each class. The
requirements to report, respond to, and investigate mishaps are
incumbent upon an operator regardless of a mishap's severity. Mishap
classes are not needed to achieve the objective of consolidating
mishap-related terms and streamlining the requirements to report,
respond to, and investigate mishaps. Accordingly, the FAA removes the
proposed classification system. Except as discussed later in this
preamble, the criteria proposed under each mishap class have been
consolidated under ``mishap'' in Sec. 401.7.
In the NPRM, the FAA proposed that a Class 1 mishap would include
any event resulting in (1) a fatality or serious injury (as defined in
49 CFR 830.2) resulting from licensed or permitted activity to any
person who is not associated with the licensed or permitted activity,
or (2) a fatality or serious injury to any space flight participant,
crew, or government astronaut. This proposal was consistent with
longstanding definitions of ``launch accident'' and ``reentry
accident'' in Sec. 401.5.
A fatality or serious injury to a person associated with licensed
or permitted activity constitutes a mishap under Sec. 401.5, rather
than a launch or reentry accident. The FAA proposed to incorporate each
of the mishap-related terms found in Sec. 401.5 under the definition
of ``mishap.'' \180\ As such, save for the removal of the $25,000
monetary threshold, all events that meet the current accident,
incident, and mishap definitions would continue to be mishaps under the
consolidated definition.\181\ In combining the mishap-related terms,
the FAA inadvertently excluded from the proposed definition a fatality
or serious injury to persons associated with licensed or permitted
activity, which has been covered by the term ``mishap'' in Sec. 401.5.
The FAA did not intend to depart from current practice by excluding
these serious events from the definition, as evidenced by the NPRM
preamble. In revising the definition of ``mishap,'' the FAA stated its
intent to streamline and clarify existing definitions, eliminate the
monetary threshold, and consolidate the accident and incident
investigation sections of parts 417, 420, 431, 435, 437 into one
section applicable to all licenses, permits, and vehicles.\182\ In
proposing to consolidate existing definitions, the FAA did not propose
to narrow the scope of activities deemed a mishap. In the final rule,
the FAA revises the definition of ``mishap'' to include any fatality or
serious injury resulting from licensed or permitted activity,
irrespective of the person's involvement in the launch activity.
---------------------------------------------------------------------------
\180\ 84 FR 15351 (``The proposed mishap classification system
would streamline and clarify the current accident, incident, and
mishap definitions to create four mishap categories organized by
severity, from most severe (Class 1) to least severe (Class 4).'').
\181\ 84 FR 15352.
\182\ 84 FR 15351.
---------------------------------------------------------------------------
The FAA consolidates under paragraph (1) of the definition those
criteria proposed for Mishap Class 1 and the previous definition of
``mishap'' in Sec. 401.5. This revision is consistent with the mishap
reporting requirements
[[Page 79679]]
under Sec. 450.173(c)(1) for the occurrence of a fatality or serious
injury during FAA-authorized activities. The FAA removes the phrase
``including ground activities at a launch or reentry site'' from the
criterion addressing fatality or serious injury because the phrase
``events associated with a licensed or permitted activity'' adequately
covers such activities.
In the final rule, the FAA re-designates criterion (1) of proposed
Mishap Class 2 as paragraph (2) of the definition, which applied to the
malfunction of an FSS or safety-critical system. The FAA notes that it
removed the term ``flight safety system'' from paragraph (2) because an
FSS is a safety-critical system.
Paragraph (7) of the definition consolidates two criteria proposed
under Class 3 and 4 for permanent loss of a vehicle during licensed and
permitted activity, respectively. Since the FAA is discarding the
mishap classification system, there is no longer a need to
differentiate loss of a launch or reentry vehicle during licensed
versus permitted activity. Nor does the FAA intend to differentiate
loss of a ``vehicle'' from loss of a ``launch or reentry vehicle.''
The FAA proposed to replace the clause, ``failure to complete a
launch or reentry as planned,'' in the previous definition of
``mishap'' in Sec. 401.5, with the clause, ``failure to achieve
mission objectives.'' AIA, Sierra Nevada, and SpaceX objected to this
criterion, arguing that failure to achieve mission objectives related
to mission assurance and exceeded the FAA's authority to ensure public
safety.
Based on industry comments, the FAA reverts to the original phrase,
``failure to complete a launch or reentry as planned,'' but adds a
citation to a regulatory requirement that narrows the scope of this
criterion. Failure to complete a launch or reentry according to the
parameters provided by the operator under the pre-flight reporting
requirements of Sec. 450.213(b) \183\ will constitute a mishap. This
criterion more accurately reflects the scope of activities that the FAA
deems to be a mishap and alleviates the commenters' concerns about
mission assurance.
---------------------------------------------------------------------------
\183\ As discussed later in the preamble, Sec. 450.213(b)(2)
requires a licensee to submit planned mission information, including
the vehicle, launch site, planned flight path, staging and impact
locations, each payload delivery point, intended reentry or landing
sites including any contingency abort location, and the location of
any disposed launch or reentry vehicle stage or component that is
deorbited.
---------------------------------------------------------------------------
The FAA removes from the final rule all references to the proposed
mishap classes. The FAA revises Sec. 450.131(a)(2) to clarify that a
probability of failure analysis must account for data on any mishap and
anomaly. While the NPRM stated that the probability analysis must
account for all partial failures and anomalies, ``including Class 3 and
Class 4 mishaps,'' the language implied that it would also apply to
Class 1 and Class 2 mishaps--the more severe events. The FAA replaces
the mishap classes referenced in Sec. 450.173(a) with the term,
``mishap.'' Finally, the FAA replaces the mishap classes referenced in
Sec. 450.219(b) with a reference to the portion of the mishap
definition that corresponds to the proposed requirement: Events listed
in paragraphs (1) through (5) and (8).
The removal of the mishap classes dispenses with commenters'
requests for clarification or guidance in ACs on applying and
differentiating the proposed mishap classes.
The final rule adds three changes to sections that cross-reference
the mishap-related terms that the FAA proposed to replace with the
revised mishap definition: Sec. Sec. 420.61(b), 437.87(b), and
460.45(d). The FAA replaces the term ``launch or launch site accident''
in Sec. 420.61(b) with a reference to the portions of the mishap
definition that replace these terms: Paragraphs (1), (5), and (8). The
FAA also replaces the word ``shall'' with the word ``must'' in Sec.
420.61 because ``shall'' is no longer used in FAA regulations.
Similarly, in Sec. 437.87(b), the FAA replaces the phrase, ``launch or
reentry accident or incident,'' with a reference to corresponding
portions of the mishap definition in paragraphs (1) through (3), (5),
and (8). As noted in the section of this preamble discussing the
compliance period for legacy licenses (Sec. 450.1(b)), the FAA revises
Sec. 460.45(d) to require part 415, 431, and 435 licensees to apply
the mishap-related definitions in Sec. 401.5, and part 450 licensees
to apply the definitions in Sec. 401.7 when describing the safety
record of the vehicle to space flight participants. Specifically, Sec.
460.45(d)(1) requires that part 450 licensees identify events that meet
paragraphs (1), (4), (5), and (8) of the definition of a mishap in
Sec. 401.7, which occur during and after vehicle verification
performed in accordance with Sec. 460.17.
The FAA also revises Sec. 420.59 to identify the portions of the
mishap definition applicable to launch site operators licensed under
part 420. Not all of the events described under the definition of
``mishap'' apply to part 420 licenses, which do not authorize launch or
reentry activities, though the NPRM did not state this fact expressly.
Nor did the FAA intend the revised definition of ``mishap'' to expand
the scope of the previous ``launch site accident'' definition under
part 420. The FAA therefore revises Sec. 420.59(a) to state that a
licensee must report, respond to, and investigate mishaps that meet
paragraph (1) or (5) of the definition of ``mishap'' in Sec. 401.7.
The FAA specified in the final rule that part 420 licensees must
prepare mishap plans that meet Sec. 450.173(b) through (f), including
allocation of roles and responsibilities between the launch operator
and site operator for reporting, responding to, and investigating any
mishap during ground activities at the site, to specify the scope of
the mishap plan more accurately. The FAA also deletes the word
``response'' in Sec. 420.59(a) since Sec. 450.173 and the rest of
Sec. 420.59 refer to a ``mishap plan,'' not a ``mishap response
plan.''
AIA and Virgin Galactic commented that the term ``failure of a
safety organization'' in the ``mishap'' definition was unclear. The FAA
notes this term previously appeared under ``launch incident'' and
``reentry incident'' in Sec. 401.5. ``Failure of a safety
organization'' occurs when an operator fails to complete an action
expected or required by the safety organization, or when the
organization stops functioning normally, such that it creates a public
safety risk. For example, the FAA would consider an operator's failure
to follow existing safety processes or procedures, thereby placing the
public at risk, a failure of a safety organization. Additional examples
include (1) the failure of operator personnel to communicate a hold
condition upon a violation of launch commit criteria, (2) a safety
official failing to report potential safety matters to the mission
director, or (3) the failure of an organization to recognize and
mitigate a hazard, resulting in a public safety risk. No change was
made to the regulation based on this comment.
SpaceX and Virgin Galactic sought clarification on the meaning of
``high risk'' of causing serious or fatal injury and ``substantial
damage'' to property. SpaceX requested examples of high risk versus
non-high risk events. AIA asked how the FAA would determine whether an
event rises to the level of ``high risk.'' Virgin Galactic recommended
``high risk'' be defined in Sec. 401.5 as an event that would have
caused a casualty had one or more humans been present.
The FAA has used ``high risk'' of causing serious or fatal injury
to define ``human space flight incident'' in Sec. 401.5. As stated in
the FAA's ``Answers to Clarifying Questions
[[Page 79680]]
Received by June 28, 2019,'' \184\ the FAA would consider any off-
nominal event during pre-flight or flight operations that posed a high
probability of fatality or serious injury to spaceflight participants,
crew, government astronauts, or the public, to be ``high risk.'' The
FAA stated in the NPRM that it would determine on a case-by-case basis
whether damage to property not associated with the licensed activity is
``substantial damage,'' based on such factors as direct replacement
cost, repair cost, and the property's intended use and functionality.
When making a substantial damage determination, the FAA will include
damage caused by debris impacts, toxic plumes, and fires ignited by the
vehicle or its debris. The FAA provided, as an example, structural
damage to public property exceeding 50 percent of its market value,
such as a failed launch attempt with debris impacts outside a defined
hazard area resulting in a post-impact fire and loss of a residential
structure. The FAA will evaluate unplanned damage to property
associated with a licensed or permitted activity on the same bases.
Examples might include a major repair or replacement of launch
facilities due to an unsuccessful launch attempt, including processing
facilities, launch pads, or propellant tanks, based on cost of repair
or replacement or loss of use. Similar to the NTSB's definition of
``substantial damage'' (49 CFR 830.2), under paragraph (6) of the
``mishap'' definition in Sec. 401.7, the FAA may deem any damage that
adversely affects the structural strength, performance, or flight
characteristics of a launch or reentry vehicle which normally require
major repair or replacement of the affected component, to be
substantial.
---------------------------------------------------------------------------
\184\ See FAA-2019-0229-0106.
---------------------------------------------------------------------------
The FAA declines Virgin Galactic's suggested definition of ``high
risk'' because the suggested standard is too narrow and would exclude
serious injury short of fatality. As noted above, the FAA would
consider any off-nominal event during pre-flight or flight operations
that pose a high probability of fatality or serious injury to
spaceflight participants, crew, government astronauts, or the public,
to be high risk. The FAA intends ``high risk'' to cover events akin to
a near miss or close-call. This approach is consistent with USAF and
NASA practices. Virgin Galactic's suggestion would prove impracticable,
requiring near certainty that a casualty would have occurred.
Virgin Galactic recommended the FAA prescribe a timeline and
specific process for determining whether ``high risk'' or ``substantial
damage'' occurred. Virgin Galactic suggested the FAA develop such a
process and incorporate it elsewhere in the regulations, not in the
definition of ``mishap.'' Virgin Galactic argued the FAA should have no
more than 14 days to make these determinations in order to minimize
operational impacts.
It would not be appropriate to limit the time frame or implement
procedures to determine whether an event posed a high risk of causing
serious or fatal injury or resulted in substantial damage to property.
Although the FAA will begin to evaluate a mishap upon receiving notice
and details of the event, the rate at which the FAA can make these
determinations will necessarily depend on the attendant circumstances
and information supplied by the licensee. Moreover, the FAA retains the
ability to modify its determination upon receipt of new information
about the mishap.
SpaceX recommended the FAA remove ``government astronauts'' from
the ``mishap'' definition because, unlike the uninvolved public, those
individuals accept risk by virtue of their informed involvement in a
vehicle's flight. Acceptance of risk does not preclude a fatality or
serious injury from being considered a mishap. The FAA removes the
references to space flight participants, government astronauts, and
crew from the ``mishap'' definition to make it clear that the FAA will
deem any fatality or serious injury associated with licensed or
permitted activity a mishap irrespective of whether persons are
involved in the licensed activity.
SpaceX recommended the Class 2 definition be limited to events
``during a licensed or permitted activity,'' rather than events
``associated with'' licensed or permitted activity. The commenter
offered no rationale for temporally limiting the criteria now described
in paragraphs (2) through (5) of the ``mishap'' definition, and the FAA
sees no reason to do so. The FAA would only deem a mishap those events
that are within the scope of the FAA's statutory authority. No change
to the regulation is made based on this comment.
Sierra Nevada commented that treating the impact of a vehicle,
payload, or components thereof ``outside the designated area'' as a
mishap was overly prescriptive and unrealistic. Sierra Nevada commented
that since hazard areas are generated as probability contours, not
contours of total containment, debris could realistically exist outside
the hazard area that would not warrant segregation in the event of a
breakup scenario. Sierra Nevada also recommended removing from proposed
Sec. 450.173(d) the requirement to report vehicle or debris impact
points outside the hazard area to the FAA, which it claimed was
burdensome, cost prohibitive, and unreasonable.
The criterion cited by Sierra Nevada, now captured in paragraph (8)
of the mishap definition, does not require licensees to track every
possible piece of debris in an off-nominal scenario, but rather only
debris that presents a hazard to the public. The proposed criterion
closely followed the definitions of ``launch accident'' and ``reentry
accident'' in Sec. 401.5, but used ``hazard area'' in lieu of ``impact
limit lines'' and ``designated'' landing or reentry site, to be
consistent with the hazard analysis framework set forth in part 450. To
clarify the scope of this mishap criterion, the FAA replaces the term
``vehicle or debris'' in paragraph (8) with the term ``hazardous
debris,'' which is defined in Sec. 401.7. Thus, this criterion applies
to the impact of hazardous debris (i.e., debris capable of causing a
casualty or loss of functionality to a critical asset) outside the
planned landing site or hazard area. The occurrence of debris outside
the hazard area that does not meet the definition of ``hazardous
debris'' in Sec. 401.7 is not a mishap.
The FAA similarly revises Sec. 450.173(c)(3)(iv) to require that
operators identify ``hazardous debris'' impact points as part of a
preliminary mishap report, so that the FAA can assess potential public
safety risks. The FAA makes this change to be consistent with the new
definition of ``hazardous debris,'' and it is consistent with the
intent of the proposed regulation. The FAA also replaces the term
``impact area'' with the term ``designated hazard area'' to be
consistent with the terminology used in the mishap definition. This
revision does not change the scope of the requirement from the NPRM;
the FAA only requires an operator to report the hazardous debris impact
locations, not all debris impact locations. Use of the term ``hazard
area'' is also consistent with requirements for an operator to
establish ``hazard areas'' under part 450 to protect the public from
hazards associated with their operations.
The requirement to track and report hazardous debris is reasonable,
given that operators must employ vehicle tracking for normal flight,
and hazardous debris falling outside the designated area poses a
serious risk to public safety. In the event of a vehicle breakup,
operators should be able to approximate any hazardous debris impacts in
relation to the designated landing site or hazard area based on the
[[Page 79681]]
vehicle's last-known state vector or other tracking resources required
for normal flight.
ii. Mishap Plan (Sec. 450.173)
In the NPRM, the FAA proposed to consolidate mishap planning,
reporting, response, and investigation requirements under proposed
Sec. 450.173. The FAA also proposed to revise Sec. Sec. 420.59 and
437.41 to require an applicant to submit a mishap plan that meets the
requirements of Sec. 450.173. Proposed Sec. 450.173(c) required an
operator to report to and cooperate with FAA and NTSB investigations
and designate one or more points of contact for the FAA and NTSB.
Proposed Sec. 450.173(d) required operators to notify the FAA of
mishaps and submit a preliminary report within certain time frames.
Proposed Sec. 450.173(f) required that, in the event of a mishap, an
operator must investigate the root causes of the mishap and report
investigation results to the FAA.
Virgin Galactic broadly expressed support for the proposed rule.
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended adding
to proposed Sec. 450.173(f) a requirement for licensees to support any
NTSB or government agency-led mishap investigation and to cooperate
with any other government investigative agencies.
The FAA declines to incorporate the suggested addition. Upon review
of the NPRM and comments received, the FAA determines that the
requirement originally proposed in Sec. 450.173(c) regarding NTSB and
FAA cooperation is unnecessary. Section 450.13 (Rights Not Conferred by
a Vehicle Operator License) plainly states that issuance of a license
does not relieve a licensee of its obligation to comply with all
applicable requirements of law or regulation. The duty of operators to
comply with lawful investigations, whether conducted by the FAA or
another entity with investigative authority, exists irrespective of the
language proposed in Sec. 450.173(c). Accordingly, the FAA removes
proposed Sec. 450.173(c) from the final rule. For the same reason, the
FAA also removes paragraph (b)(2) from proposed Sec. 420.59 (Mishap
Plan). Operators remain responsible for reporting investigation results
to the FAA under Sec. 450.173(e).
Sierra Nevada asked whether licensees must coordinate with the FAA
and NTSB for all mishaps. For the reasons stated above, the FAA removed
the requirement proposed in Sec. 450.173(c).
The National Fire Protection Association (NFPA) recommended the FAA
revise proposed Sec. 450.173(e), which contained emergency response
requirements, to require a level of safety based on its spaceport fire
safety and emergency response standards. The FAA supports the
development of industry consensus standards for fire safety and
emergency response, but disagrees that it would be appropriate to
prescribe such a code or standard in this performance-based rule.
In addition to removing proposed Sec. 450.173(c), the FAA replaces
the term ``vehicle and debris impact points, including those outside a
planned landing or impact area'' in proposed Sec. 450.173(d)(3)(iv)
with the term ``hazardous debris impact points, including those outside
a planned landing site or designated hazard area'' in Sec.
450.173(c)(3)(iv).\185\ This change is consistent with changes
previously discussed in the preamble. Lastly, the FAA revises the
emergency response requirements in Sec. 450.173(d)(1) to include the
term ``property'' because, as discussed in this preamble, the FAA
removed the reference to ``property'' from the definition of ``public''
in Sec. 401.7. The FAA adopts the rest of this section of the proposed
rule without change.
---------------------------------------------------------------------------
\185\ The FAA removes proposed Sec. 450.173(c) from the final
rule and re-designates Sec. 450.173(d) through (h) as Sec.
450.173(c) through (g).
---------------------------------------------------------------------------
iii. Test-Induced Damage (Sec. 450.175)
In the NPRM, the FAA proposed to give license applicants and
licensees the option to pre-coordinate testing activities with the FAA.
This pre-coordination would take place during FAA-licensed activities
to prevent the FAA from labeling test failures or associated damage as
mishaps.
In the final rule, the FAA adopts Sec. 450.175 with a
modification. Section 450.175 will only apply to licensees or license
applicants seeking this exception. The FAA will consider test failures
and damage covered by this section, including damage to ground support
equipment, ground support systems, and flight hardware, as test-induced
damage and not a mishap, so long as the failure falls within the pre-
coordinated scope and FAA-approved testing profile. Any mishap
resulting in a serious injury or fatality, damage to property not
associated with the licensed activity, or hazardous debris leaving the
pre-defined hazard area, will be treated as a mishap and not test-
induced damage, and will be subject to the reporting, response, and
investigation requirements of Sec. 450.173.
Several commenters expressed confusion about the effect of proposed
Sec. 450.175 on the part 450 licensing process. Boeing, Leo Aerospace,
Lockheed Martin, Northrop Grumman, and ULA asked how test-induced
damage would impact the licensing process. Boeing also commented that
all planned test operations within the scope of a license should be
assessed for public risk during the application process. Blue Origin
asked what type of test is contemplated by ``test-induced damage,'' and
if it would include tests conducted at a launch site with co-located
test facilities, as opposed to integrated vehicle tests that
traditionally happen at a launch site. Sierra Nevada and Microcosm
commented that testing was outside the FAA's jurisdiction, and the
proposed regulation should only apply to damage induced by a test
performed under a license.
The test-induced damage exception set forth in Sec. 450.175 only
applies to license applicants or licensees seeking a mishap exception
for test activities conducted during licensed activities. The test-
induced damage exception is optional. To clarify that the test-induced
damage exception is optional, the FAA adds paragraph (a)
(Applicability), which states that Sec. 450.175 only applies to
license applicants or licensees who choose to pre-coordinate and apply
for an optional test-induced damage exception. The FAA also replaces
the word ``operator'' with the term ``license applicants or licensees''
to clarify that this provision is only available through the part 450
licensing process. Experimental permittees under part 437, by contrast,
cannot seek to pre-coordinate test-induced damage with the FAA.
The exception does not apply to test activities that are not
associated with FAA-licensed activities, nor to any activities outside
FAA jurisdiction. The information submitted by the applicant will
define the scope and type of test activities considered for test-
induced damage. The FAA confirms that all planned test operations
occurring during the scope of a license will be assessed for public
safety risks. As stated in the FAA's ``Answers to Clarifying Questions
Received by June 28, 2019,'' test-induced damage refers to damage
expected to occur as part of a licensed activity approved by the FAA
prior to the operation. An applicant must identify expected outcomes
and potential risks associated with the proposed test activity. The FAA
expects an applicant to identify potential failure outcomes and their
consequences or risks, and plan for them appropriately. In order to
except damage from becoming a mishap, the applicant needs to identify
that potential damage to the
[[Page 79682]]
FAA. Unanticipated test damage may be excepted if it results from
activities conducted within the scope of the FAA approval, and does not
result in any of the events listed in Sec. 450.175(b)(2).
To seek an exception, an applicant must submit the information
listed in Sec. 450.175(c) to the FAA in advance with sufficient time
to evaluate the proposal. Although the FAA anticipates the amount of
time required to evaluate an applicant's proposal will be minimal, the
scope of review required will vary based on the proposed test
activities and completeness of information provided.
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended
without explanation that the subheading for proposed Sec. 450.175(a)
be changed to, ``Coordination of risk of test-induced damage.'' The FAA
declines to incorporate this recommendation, as it does not accurately
describe the coordination set forth in Sec. 450.175. The possibility
of test-induced damage is assumed under Sec. 450.175. Identification
of potential risks associated with a testing activity is but one of the
items applicants must submit to seek an exception under this section.
The FAA agrees, however, that the proposed text was unclear, as the
heading used the term, ``anticipated,'' which does not appear in Sec.
450.175. Accordingly, the FAA revises the subheading for Sec.
450.175(b) to clarify that operators would be coordinating
``potential,'' rather than ``anticipated,'' test-induced damage.
Boeing, Lockheed Martin, Northrop Grumman, and ULA also
recommended, without explanation, that applicants be required to
coordinate test-induced damage with any affected third parties or
public authorities, in addition to the FAA. The FAA declines to
incorporate this recommendation. Section 450.175 provides a process for
license applicants and licensees to pre-coordinate with the FAA test-
induced damage that would otherwise fall under the FAA's definition of
``mishap.'' The FAA is the only entity with whom coordination will be
needed to seek exception from the FAA's ``mishap'' definition. It
should be noted, however, that pre-coordination of test-induced damage
under this section will not affect the duty of licensees to comply with
all other requirements of their license, and with all other applicable
laws and regulations.
In reference to what is now Sec. 450.175(b)(2), Boeing recommended
the FAA take into consideration insight gleaned from near-misses,
noting that while a test may not have resulted in damage, the same
anomaly could induce significant damage in a similar operational
sequence. The FAA acknowledges the commenter's concern for the net
effect of unreported anomalies but finds it unnecessary to change the
regulatory text. Section 450.175 provides an exception to the
``mishap'' definition. Test-induced damage that exceeds the scope of
FAA-approved activities will be treated as a mishap. It is possible for
an anomaly to occur during pre-coordinated test activities. Any
condition during licensed or permitted activity (including pre-
coordinated test activity) that deviates from what is standard, normal,
or expected during verification or operation of a system, process,
facility, or equipment is an anomaly under Sec. 401.7. Given that
Sec. 450.215 (Post-flight Reporting) requires operators to identify
anomalies and corrective actions taken in response in their post-flight
report, the FAA finds it will have notice of the ``near-miss''
anomalies referenced by the commenter.
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended that
proposed Sec. 450.175(c) be made consistent with ground hazard
analysis requirements in proposed Sec. 450.185 or be deleted
altogether. The FAA disagrees with this comment because the
requirements of Sec. 450.185 apply to the entire launch and reentry
vehicle lifecycle, and are therefore much more comprehensive than the
information requirements for test-induced damage. Imposing ground
hazard analysis requirements would place an undue burden on applicants
seeking a test-induced damage exception. Moreover, the test-induced
paradigm is intended for the testing of a specific system, function, or
component during licensed activities. As stated in the NPRM, the test-
induced damage exception is not available for the operation of an
entire vehicle, but rather the testing of specific components and
systems. Lastly, unlike the ground hazard analysis requirements, the
information requirements of Sec. 450.175(c) only apply to applicants
seeking a mishap exception for damage resulting from specific test
activities taking place within a defined time-period, as coordinated
with and approved by the FAA.
pp. Unique Safety Policies, Requirements and Practices (Sec. 450.177)
In the NPRM, the FAA proposed requirements under Sec. 450.177 for
operators to implement unique policies, requirements, and practices
needed to protect the public health and safety, safety of property, and
the national security and foreign policy interests of the United
States. Proposed Sec. 450.177(a) would require an operator to review
operations, system designs, analysis, and testing, and to identify any
unique launch or reentry hazards not otherwise addressed by proposed
part 450. Proposed Sec. 450.177(b) would provide that the FAA may
identify and impose a unique policy, requirement, or practice, as
needed, to protect the public health and safety, safety of property,
and the national security and foreign policy interests of the United
States.
In the final rule, the FAA adopts Sec. 450.177 (Unique Safety
Policies, Requirements and Practices) with two revisions. For the
reasons discussed below, the FAA removes the references to property
protection and national security and foreign policy interests of the
United States, and adds ``safety'' to the section title.
CSF, Sierra Nevada, and Spaceport Strategies commented that
proposed Sec. 450.177(b) expanded regulatory uncertainty by allowing
the FAA to impose new requirements when needed to protect public health
and safety, safety of property, and national security or U.S. foreign
policy interests. CSF noted that part 417 previously allowed the FAA to
impose new requirements when needed ``to protect the public.'' CSF and
Sierra Nevada commented that proposed Sec. 450.177(b) expanded the
FAA's ability to impose requirements on an operator outside of
regulatory process even if the operator met all other criteria. The
commenters suggested that the ability to impose unknown requirements as
a result of innovation will adversely impact costs and could have a
chilling effect on innovation and investments in U.S. space industries
if the FAA's discretion under proposed Sec. 450.177 was unbounded.
They further contended that the proposed requirement would give the FAA
discretion to impose new requirements ``as-needed'' and result in no
cost savings. CSF also expressed concern that such requirements could
be inequitably imposed on a singular licensee or disparately among
licensees developing similar technologies or operational approaches.
CSF recommended the FAA be required to collaborate with the operator or
with industry before requiring a unique policy, rule, or practice. CSF
and Sierra Nevada recommended the rule be bounded to limit the scope
and timeline for the FAA to impose restrictions, and give applicants
due process.
The FAA agrees that it is unnecessary to include hazards to the
national security and foreign policy interests of the United States
under this section because those considerations are adequately covered
under policy and
[[Page 79683]]
payload reviews in part 450. In the final rule, the FAA removes
``national security and foreign policy interests of the United States''
from Sec. 450.177(b) and (c)(2).
In the final rule, the FAA also removes ``safety of property'' from
Sec. 450.177(b) and (c). As explained in other parts of this preamble,
the FAA is retaining in the final rule only specific requirements for
property protection (e.g. critical assets, property on orbit), which
have specific safety criteria. Operators may be required to mitigate
hazards to property through emergency response requirements in Sec.
450.173(d), but otherwise, the FAA declines to impose a more specific
property protection requirement at this time. Removal of the references
to property protection and national security and foreign policy
interests largely dispenses with the commenters' concerns that Sec.
450.177 would expand the scope of Sec. 417.127. Although the final
rule retains the provision in Sec. 450.177(b) regarding FAA's ability
to impose a unique requirement, policy, or practice needed to protect
public health and safety, the FAA does not foresee a substantive change
for operators from Sec. 417.127, which provides that FAA may impose
such unique requirements as needed to protect the public.
The FAA's authority to impose a unique requirement, policy, or
practice is bounded, as it is in Sec. 417.127, by the FAA's statutory
authority to protect public health and safety. The FAA understands the
concern expressed by Spaceport Strategies and others that the
imposition of unique policies, requirements, or practices deemed
necessary by the FAA to protect public health and safety has the
potential to impose additional costs on the operator. However, given
the rarity of the FAA's invocation of Sec. 417.127, and the prosperity
of today's commercial space industry under part 417, the FAA does not
foresee any additional costs to operators or a chilling of innovation
resulting from Sec. 450.177.
Moreover, as discussed in the NPRM preamble, the necessity for
Sec. 450.177 is the same as that for Sec. 417.127: The FAA expects
that advances in technology and implementation of innovations by launch
and reentry operators will likely introduce new and unforeseen safety
challenges. These advances and innovations can present regulatory
challenges that are unforeseen in existing regulations. In this case,
the FAA must work with operators on a case-by-case basis to identify
and mitigate those unique hazards posed to public health and safety,
which are not addressed by part 450. The FAA expects the need for the
use of this provision to be rare, as has the need to use Sec. 417.127,
due to the comprehensiveness and performance-based nature of part 450.
In the rare instance that it is used, the FAA will work with the
operator to reach a mutually satisfactory solution that allows the
activity while protecting public health and safety, but the FAA
declines to require collaboration in the regulation, as CSF suggests.
qq. Ground Safety (Sec. 450.179 to Sec. 450.189)
i. Ground Safety General (Sec. 450.179)
In the NPRM, the FAA proposed that an operator would be required to
protect the public from the adverse effects of hazardous operations and
systems associated with preparing a launch vehicle for flight,
returning a launch or reentry vehicle to a safe condition after flight,
or after an aborted launch attempt, and returning a site to a safe
condition.
In the final rule, the FAA adopts Sec. 450.179 with
revisions.\186\ This final rule moves proposed subsections (b) and (c)
to Sec. 450.179(a)(1) through (3) and adds new subsections (b) and
(c). These additions are discussed in more detail in the preamble
section addressing Launch and Reentries from a Federal Launch or
Reentry Site.
---------------------------------------------------------------------------
\186\ Proposed Sec. 450.179 required an operator at a U.S.
launch or landing site to protect the public from adverse effects of
hazardous operations and systems. The FAA changed ``protect the
public'' to ``protect the public and property'' in the final rule.
This change is because, as discussed earlier in this preamble,
property was removed from the definition of ``public.'' Thus,
``property'' was added to this section to keep the requirement
equivalent to what was proposed.
---------------------------------------------------------------------------
ii. Coordination With a Licensed Launch or Reentry Site Operator (Sec.
450.181)
In the NPRM, the FAA proposed that an operator would be required to
coordinate with site operators as both entities have public safety
obligations during ground operations. Operators would be required to
coordinate with site operators to ensure that access to public sites is
controlled and prevent unsafe interference of ground hazards. For a
launch or reentry conducted from or to an FAA licensed site, an
operator would be required to coordinate mishap reporting, response,
and investigations with the site operator for any mishap during ground
activities at the site.
In the final rule, the FAA adopts Sec. 450.181 as proposed with
two exceptions. In Sec. 450.181(a)(3), the ground hazard areas must be
coordinated with a site operator during the designation of those ground
hazard areas. In the final rule, the FAA changes the language used to
describe this coordination to ``[t]he designation of any ground hazard
area that affects the operations of a launch or reentry site is
coordinated with the Federal or licensed launch or reentry site
operator.'' This amended language is a minor grammatical change and is
consistent with the intent of the proposed requirement. In addition,
proposed Sec. 450.181(a)(4) required an operator to coordinate with a
site operator to ensure, in part, prompt and effective response in the
event of a mishap that could impact ``public safety.'' In the final
rule, the FAA changes this phrasing to require that a prompt and
effective response ``is undertaken'' in the event of a mishap that
could impact ``the safety of the public and property.'' The FAA changes
``public safety'' to ``the safety of the public and property'' in the
final rule because, as discussed earlier in this preamble, property was
removed from the definition of ``public.'' Thus, the FAA makes this
wording change to keep the requirement equivalent to what was proposed.
The FAA adds ``is undertaken'' as a minor grammatical change that is
consistent with the intent of the proposed requirement.
Sierra Nevada commented that proposed Sec. 450.181 seems to be
duplicative of proposed Sec. 450.147 (Agreements) and thus should be
removed. While agreements made with a Federal or licensed site operator
may satisfy the requirements of Sec. 450.181, the FAA finds the
requirement to coordinate with a site operator specifies what
coordination must be in place to prevent unsafe interference among
users of a site and ensure clear lines of responsibility for related
aspects of public safety. The FAA concurs that an applicant may be able
to show compliance with both requirements by providing an agreement
that shows compliance with the specific criteria in Sec. 450.181.
However, the two requirements are different and intentionally separate.
Specifically, Sec. 450.181 provides additional detail about
coordination that is necessary for public safety because improperly
coordinated neighboring operations that occur on or near the launch
site have the ability to create hazards to the public. In addition, the
agreement required by Sec. 450.147 is not an application deliverable,
whereas Sec. 450.181 requires an application deliverable. Accordingly,
the FAA adopts both Sec. Sec. 450.181 and 450.147.
Denver International Airport commented that, although it supported
the proposed requirements for
[[Page 79684]]
coordination with site operators, these requirements were too narrow to
keep site operators and surrounding communities properly informed.
Denver International Airport also commented that operators should be
required to coordinate on launch and reentry activities and mishaps
with a wider group of interested and affected stakeholders, including
first responders and local governments. Similarly, AAAE proposed that
licensed operators be required to notify contingent landing sites and
nearby airports of safety hazards, including providing them with the
ground safety hazard analysis. AAAE suggested such notifications could
be accomplished as part of the notifications required in proposed Sec.
450.147 or as part of a broader public disclosure.
The FAA notes that the notification requirements in Sec. 420.57
require licensed site operators to notify local officials and adjacent
landowners of flight schedules. In addition, Sec. 450.147 requires
vehicle operators to have agreements with any sites or services that
are necessary to meet the safety requirements for a license. These
requirements serve to notify the necessary entities about licensed
operations. Including notification requirements beyond those in
Sec. Sec. 420.57 and 450.147 is outside the needs of this rulemaking
to protect public health and safety, safety of property, and national
security and foreign policy interests of the United States.
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended the
FAA revise proposed Sec. 450.181(a)(3) to require only that
coordination ensure that any ground hazard areas are identified. The
FAA does not find the commenters' recommendation sufficient to protect
public safety and avoid adverse impacts on neighboring space
operations. The vehicle operator must take an active role in ensuring
the site operator is aware of ground hazard areas and how they may
impact other site operations.
iii. Explosive Site Plan (Sec. 450.183)
In the NPRM, the FAA proposed to require an applicant to include an
explosive site plan as part of its vehicle operator license application
for a launch or reentry from or to a site exclusive to its own use.
This plan would be required to demonstrate compliance with the
explosive siting requirements in part 420.
In the final rule, the FAA adopts Sec. 450.183 (Explosive Site
Plan) as proposed. The FAA received no comments on this section.
iv. Ground Hazard Analysis (Sec. 450.185)
In the NPRM, the FAA proposed an operator would be required to
complete a ground hazard analysis that would include an assessment of
the launch or reentry vehicle, the launch or reentry integrated
systems, ground support equipment, and other site hardware. In its
analysis, an applicant must identify hazards; include a risk
assessment; and identify and describe mitigations, controls, and
provisions for hazard control verification and validation. Although the
analysis might incorporate aspects of employee safety and mission
assurance, an applicant would only be required to identify the hazards
that affect the public and describe how those hazards are mitigated.
In the final rule, the FAA adopts Sec. 450.185 as proposed, with
minor edits to remove the reference to ``public property'' because
``property'' has been removed from the final rule's definition of
``public,'' as discussed in the preamble section for Neighboring
Operations Personnel. Instead, the FAA refers to ``property not
associated with the launch or reentry.''
In response to the proposed requirements, NFPA suggested its own
standards as guidance for complying with proposed Sec. Sec. 450.179,
450.185, and 450.189. Space Florida also commented that the FAA did not
provide clear guidance on what standards would be acceptable and how
the agency would judge the sufficiency of the ground hazard analysis.
Space Florida did not recommend a specific change to proposed Sec.
450.185.
In response to NFPA's comment, the FAA notes that applicants are
free to explore the use of any industry standard to demonstrate
compliance with these sections. If the industry standard has not
already been accepted by the FAA, the FAA would review the proposed
standard as part of an applicant's application. NFPA is also welcome to
submit its standards to the FAA for acceptance at any time.
In response to Space Florida, the FAA recommends that the applicant
identify proposed standards and common practices during pre-application
consultation to reach an agreement with the FAA on their applicability
for proposed operations. For items that may deviate from current
standards and practices, the FAA may seek additional justification or
analysis to determine whether ground hazards pose a risk to public
safety.
Virgin Galactic asked the FAA to retain the ground safety analysis
practices used under part 431 and not to impose proposed Sec. 450.185.
Virgin Galactic also asked that existing launch vehicles be
``grandfathered.'' Finally, Virgin Galactic commented that conducting a
ground hazard analysis would place a cost burden on hybrid vehicle
operators and asked the FAA to outline its reasoning for imposing the
requirement on hybrid operators.
The FAA discusses Virgin Galactic's question regarding cost burden
in the preamble section addressing Responses to Regulatory Impact
Analysis Comments. Part 431 does not have an explicit ground safety
requirement, and as a result it is often difficult for applicants to
ascertain how to meet the safety standard for pre-flight operations.
Concurrently, the ground safety requirements in part 417 are overly
prescriptive and onerous. The ground hazard analysis requirements in
part 450 strike a balance between the two parts, providing additional
guidance to applicants, while at the same time preserving flexibility.
An operation that was licensed prior to the effective date of this
rulemaking will be permitted to continue under its license for five
years from the effective date or when the license expires if the
operator does not seek a renewal. For further discussion, please see
the preamble section on Legacy Licenses. All regulated operators,
including hybrid launch or reentry systems operators, will need to
prepare a ground hazard analysis to ensure public safety is protected.
Hybrid launch or reentry vehicles may still pose a risk to the public;
therefore, the FAA imposes its ground hazard analysis requirements on
hybrid launch vehicles in order to identify and mitigate those risks.
Some launch or reentry systems will have very limited ground hazards,
and thus the ground hazard analysis will be similarly limited. An
operator would not need its ground hazard analysis to include carrier
aircraft activities that do not constitute launch or reentry.\187\
---------------------------------------------------------------------------
\187\ Such activities may include, for example, activities
conducted by a carrier aircraft without a rocket attached when the
carrier aircraft plus rocket constitutes the launch vehicle.
---------------------------------------------------------------------------
Boeing, Lockheed Martin, Northrop, and the ULA recommended the FAA
modify proposed Sec. 450.185(a) by adding that a ground hazard
analysis must identify system and operation hazards posed by the
vehicle ``and any of its components.'' The FAA does not adopt this
change because any requirement levied on the vehicle also necessarily
includes the vehicle's components.
CSF, Sierra Nevada, and Space Florida recommended that the FAA
consider an alternative regulatory approach giving site operators more
[[Page 79685]]
authority over ground safety. Specifically, CSF and Sierra Nevada
recommended that the FAA consider an alternative regulatory approach
that would give the responsibility for assessing and controlling ground
safety and hazards mitigations to the site operator.
Historically, the launch or reentry operator has been responsible
for ground safety and, as reflected in the NPRM, the FAA determined
that this allocation of responsibility was appropriate given that the
operator has the most comprehensive understanding of the parameters of
the licensed activity. The FAA expects that the launch or reentry
operator will work closely with the site operator to ensure all
requirements are met. Accordingly, the FAA retains the proposed
language in the final rule.
v. Ground Safety Prescribed Hazard Controls (Sec. 450.189)
In the NPRM, the FAA proposed that an operator would be required to
implement certain prescribed hazard controls during the ground
operations period of launch or reentry. These prescribed hazard
controls would require that an operator document how it would protect
members of the public who enter areas under the operator's control, and
mitigate hazards created by a countdown abort. They would also require
the operator to establish plans for controlling fires and emergency
procedures. In the final rule, the FAA adopts Sec. 450.189 as
proposed.
AAAE suggested licensed operators be required to notify nearby
airports and contingent landing sites of potential safety hazards and
their controls, including those described under this section and
proposed Sec. 450.185. The notification requirements in Sec. 420.57
require licensed site operators to notify local officials and adjacent
landowners of flight schedules. In addition, Sec. 450.147 requires
vehicle operators to have agreements with any sites or services that
are necessary to meet the safety requirements for a license. These
requirements serve to notify the necessary entities about licensed
operations.
5. Part 450 Subpart D--Terms and Conditions of a Vehicle Operator
License
a. Public Safety Responsibility, Compliance With License, Financial
Responsibility, Human Spaceflight Requirements (Sec. Sec. 450.201 to
450.207)
In the NPRM, the FAA proposed requirements addressing how a
licensee is responsible for ensuring public safety and safety of
property during the conduct of a licensed launch or reentry in proposed
Sec. 450.201, how a licensee would be required to comply with a
license in proposed Sec. 450.203 (Compliance with License), with
financial responsibility requirements of part 440 in proposed Sec.
450.205 (Financial Responsibility Requirements), and with human
spaceflight requirements in part 460 in proposed Sec. 450.207 (Human
Spaceflight Requirements).
In the final rule, the FAA adopts the requirements as proposed. The
FAA received no comments on these proposals.
b. Compliance Monitoring (Sec. 450.209)
In the NPRM, the FAA proposed to combine the compliance monitoring
requirements of Sec. Sec. 417.23 and 431.83 in Sec. 450.209. The FAA
also proposed to allow an operator the option to provide the FAA with
means other than a console for monitoring the communication and
countdown channels. The compliance monitoring requirements of proposed
Sec. 450.209 would apply to all launch and reentry operations.
Finally, proposed Sec. 450.209 codified the FAA practice for
conducting compliance monitoring of part 435 operations. In final rule,
the FAA adopts Sec. 450.209 as proposed.
Virgin Galactic expressed concern regarding proposed Sec.
450.209(b), which stated a licensee must provide the FAA with the
capability to communicate with the mission director. Virgin Galactic
suggested replacement language that gave the operator the
responsibility for assigning a radio communications point-of-contact
for the FAA during operations. The FAA does not adopt this suggestion
because the FAA must have direct contact with the mission director
during licensed operations to ensure any risk to public safety during
ongoing operations is immediately addressed. It will continue to be FAA
practice not to contact the mission director unless there is an
immediate and urgent risk to public safety.
The FAA also deletes Sec. 450.209(c) because it imposed a
requirement only on the FAA and was unnecessary legacy language.
c. Continuing Accuracy of License Application; Application for
Modification of License (Sec. 450.211)
In the NPRM, the FAA proposed to preserve the continuing accuracy
requirements in Sec. Sec. 417.11 and 431.73, and consolidate them in
proposed Sec. 450.211. In addition, the FAA proposed to allow an
applicant to request approval of an alternate method for requesting
license modifications during the application process.
In the final rule, the FAA adopts Sec. 450.211 as proposed with
only a minor revision to split the second requirement in proposed Sec.
450.211(a) into a new Sec. 450.211(b). Accordingly, proposed Sec.
450.211(b) and (c) were renumbered to become Sec. 450.211(c) and (d)
in the final rule, respectively.
CSF and SpaceX suggested that the FAA could update Sec. 413.17(a)
to clarify that it would agree to a modification to an existing license
when the FAA accepts and approves a continuing accuracy submission. CSF
requested that the FAA clarify its use of these terms in an AC.
Virgin Galactic noted that operators may have separate definitions
for continuing accuracy and license modifications. Virgin Galactic
proposed what it believed to be simpler requirements for continuing
accuracy updates and license modifications, which in Virgin Galactic's
experience aligned with how the FAA has processed Virgin Galactic's
license and license application updates over the past three years.
Specifically, Virgin Galactic recommended that proposed Sec.
450.211(a)(1) be rewritten to change the requirement so that after a
license has been issued, a licensee would be required to apply to the
FAA for modification of the license if the licensee proposes to make
changes that affect the license, as issued by the FAA. It also proposed
to add the term ``continuing accuracy updates'' for changes that a
licensee proposes that do not affect the license but do affect the
license application. Virgin Galactic maintained that this approach
would provide schedule assurance for operators, as license modification
usually involves time-intensive coordination between the FAA and an
operator.
Sierra Nevada commented that general edits to the listed documents
should not trigger the requirement of continuing accuracy, as such a
requirement would create an extremely burdensome amount of document
overhead an applicant would be required to maintain that is not
necessary for maintaining public safety.
The FAA does not agree that the suggested changes are necessary;
however, the FAA has split the two requirements in Sec. 450.211(a) so
that the application for modification of license is in Sec. 450.211(b)
for added clarity. The regulation states that a licensee is responsible
for the continuing accuracy of representations contained in its
application. A license modification is
[[Page 79686]]
required only if the licensee proposes to conduct a launch or reentry
in a manner not authorized by the license; or, if any representation
contained in the license application that is material to public health
and safety or the safety of property is no longer accurate and
complete, or does not reflect the licensee's procedures governing the
actual conduct of a launch or reentry. For representations that do not
meet either of these criteria, such as administrative information,
Sec. 450.211(b) continues to require an applicant to inform the FAA of
the change in order to ensure the representations made in the
application are accurate.
The NPRM preamble identified the following as areas that constitute
a material change: Reuse, after an earlier launch or reentry, of
safety-critical systems or components, requiring refurbishment, re-
qualification testing, and re-acceptance testing. Virgin Galactic
believed performing refurbishment and pre-flight testing of reusable
safety-critical systems or components would not constitute a material
change that affects public safety. Both vehicles of a hybrid RLV launch
system are reused, and pre-flight testing and refurbishment are
performed prior to each mission. Virgin Galactic recommended this reuse
language be stricken from the preamble because it is not a material
change to public safety.
The FAA clarifies that normal pre-flight testing and refurbishment
that are evaluated and accepted during a license application are not
considered a material change. The FAA further clarifies that only pre-
flight testing and refurbishment that is not evaluated during a
licensing process will be considered a material change. As discussed
above, a material change is a change that affects public safety that
has not been evaluated and authorized by the FAA during the licensing
process.
Virgin Orbit commented that some of the changes noted in preamble,
such as retesting a valve or changing a safety officer, should not
require a modification to a license. Virgin Orbit recommended that what
constituted a material change should be based on how the change
affected public safety elements contained within the FSA and PSA.
Virgin Orbit further recommended that the FAA allow operators to
determine how the areas that constituted a material change as
identified in the preamble affected the public safety elements.
As noted earlier, a material change is a change that affects public
safety that has not been evaluated and authorized by the FAA during the
licensing process. These changes may go beyond just the FSA and any PSA
\188\ as suggested by Virgin Orbit. All public safety requirements in
part 450 are applicable. The FAA does agree with Virgin Orbit that the
burden lies on the operator to determine what constitutes a material
change. The FAA notes, however, that an operator should consult with
the FAA regarding those changes for which an operator is unsure whether
the change is material or not.
---------------------------------------------------------------------------
\188\ As discussed earlier, the FAA removed the requirement for
a PSA from the final rule.
---------------------------------------------------------------------------
Virgin Orbit requested a definition of a ``minor'' change. It
further requested that minor changes would not require a full 180-day
review period, and that the regulation define a maximum review time for
minor changes. The FAA does not distinguish between major and minor
changes, only those changes that will or will not have a material
impact on public safety. Categorizing all potential changes that have a
material impact on public safety into only two categories is
problematic due to the variety of potential changes. The FAA does
agree, however, that not all requests for modification would require
extensive review. Although the statutory 180-day review period does not
apply to modifications, the FAA makes every effort to act upon all
requests for modifications in a timely manner. The FAA is able to
respond quickly if a change is indeed minor.
d. Pre-Flight Reporting (Sec. 450.213)
In the NPRM, the FAA proposed to require a licensee to provide the
FAA with the following information prior to each launch or reentry:
Mission-specific information, FSA products, FSS test data, data
required by the FAA to conduct a collision avoidance analysis, and a
launch or reentry schedule.
In the final rule, the FAA adopts Sec. 450.213 with four
revisions. First, in Sec. 450.213(d)(2), the FAA replaces the term
``flight information'' with ``planned mission information'' because the
information required includes launch site information, and the term
``planned mission information'' is used in the final Sec.
450.208(d)(6). Second, the FAA revises Sec. 450.213(d) to allow an
operator the flexibility to identify an appropriate time frame in
coordination with the FAA. Third, in Sec. 450.213(e) the FAA removes
the reference to the time frames to submit LCOLA data, which the FAA
has revised in the final rule, so that Sec. 450.213(e) simply requires
operators to submit LCOLA data in accordance with Sec. 450.169(f).
Lastly, the FAA replaces ``operator'' with ``licensee'' throughout the
section to be consistent with the rest of subpart D. The FAA makes
similar changes in Sec. 450.450.215.
Boeing, Lockheed Martin, Northrop Grumman, and ULA commented that
they appreciated the streamlining of pre-flight reporting. CSF
recommended that the FAA allow the submittal of test reports in
accordance with proposed Sec. 450.213(d) less than 30 days before
flight. SpinLaunch also stated that the proposed Sec. 450.213(d)
requirement to submit test reports 30 days prior to launch was too
burdensome.
The FAA agrees that not all test reports for the FSS, such as end-
to-end tests and pre-flight tests, can be delivered 30 days before
flight. The FAA therefore revises Sec. 450.213(d) to allow an operator
the flexibility to identify an appropriate time frame in coordination
with the FAA. The FAA discusses this flexibility in more detail in the
preamble section on Time Frames.
AAAE noted that, under proposed Sec. 450.213(f), launch schedules
would be required to be provided to the FAA in advance. AAAE
recommended that these schedules, including any changes to the
schedule, should also be distributed to nearby airports (within at
least five nautical miles of the launch site or along the vehicle's
trajectory), contingent landing sites, and any emergency responders
supporting the launch operation.
The FAA declines to adopt this recommendation. Section 450.147
requires that an operator establish written agreements with any entity
that provides a service that meets a requirement. The FAA notes that
these written agreements will include any agreements necessary to
ensure the safety of airspace. The FAA has drafted Sec. 450.147 to be
as performance-based as possible; therefore, the specificity
recommended by AAAE is unnecessary. That said, the FAA agrees that such
notifications would usually be required.
CSF noted that proposed Sec. 450.213 would require that the
licensee provide payload details to the FAA 60 days in advance of a
launch or reentry. CSF commented that operators often cannot meet that
time frame due to changes in manifests for passive or minor payloads
that occur inside of 60 days before flight. Proposed Sec. 404.15 would
not allow an operator to request that the time frame for payload
notification be changed unless it knew more than 60 days in advance of
flight that the manifest was going to change. CSF considered the
proposal inflexible and requested that FAA allow proposed Sec. 404.15
be made more flexible. The FAA disagrees with the comment, as Sec.
404.15 currently allows for an
[[Page 79687]]
applicant to request the FAA to relax the 60-day pre-flight reporting
requirement for payload information.
e. Post-Flight Reporting (Sec. 450.215)
In the NPRM, the FAA proposed an operator be required to provide
the actual trajectory flown by the vehicle and, for an unguided
suborbital launch vehicle, the actual impact location of all impacting
stages and impacting components, if requested by the FAA. In the final
rule, the FAA adopts Sec. 450.215 as proposed.
SpaceX generally agreed with the provisions of proposed Sec.
450.215 but suggested that the FAA remove proposed Sec. 450.215(b)(4)
because it contended that post-flight auditing was already an option
for the FAA and that the specific reference to a potential request for
a flown trajectory was redundant and unnecessary. Although the FAA
agrees with SpaceX that the FAA can request these data as part of its
inspection, the FAA finds that the explicit reference in the regulatory
text is necessary to ensure compliance. The FAA included this
requirement in the proposed rule because some operators failed to
provide flown trajectory information when the FAA requested it as part
of an inspection or post-flight review. The FAA will only ask for flown
trajectory data when necessary to verify models and assess vehicle
performance.
f. Registration of Space Objects (Sec. 450.217)
In the NPRM, the FAA consolidated and updated the requirements for
registration of space objects in proposed Sec. 450.217. The FAA
proposed to remove the caveat excluding foreign payloads and to add the
requirement to notify the FAA when removing objects placed in orbit.
The FAA noted that it is the responsibility of the U.S. Government to
register objects and launch operator data is used to make relevant
decisions on what to register. Proposed Sec. 450.217(c) retained Sec.
431.85's requirement that an operator notify the FAA when it removes a
space object.
In the final rule, the FAA adopts Sec. 450.217 as proposed.
NZSA asked if operators would have to report the reentry of an
object due to atmospheric reentry, presumably much later than launch.
NZSA supported the requirement of information on foreign-owned space
objects to determine who would register the objects, which NZSA also
requires. NZSA recommended the FAA clarify whether removal would relate
only to active removal or if it would include passive deorbiting. NZSA
viewed the latter to be in alignment with the terms of the Registration
Convention.\189\
---------------------------------------------------------------------------
\189\ Convention on Registration of Objects Launched into Outer
Space provides that the United Nations maintains a registry of
objects left in space by on data provided by the launching state.
---------------------------------------------------------------------------
The FAA did not intend the requirement to notify the FAA of objects
removed from orbit to cover eventual decays through atmospheric
reentry. NZSA is correct that the Registration Convention requires the
notification of objects removed from space. Yet, the FAA does not
believe there is a need to require launch operators to track the
orbital status of all objects previously launched in perpetuity.
6. Changes to Parts 401, 413, 414, 420, 433, 437, and 440
Part 401--Organization and Definitions
i. Sec. 401.5
In the NPRM, the FAA proposed new and amended definitions to Sec.
401.5 (Definitions). The new proposed definitions in proposed Sec.
401.5 were: ``anomaly,'' ``casualty area,'' ``command control system,''
``control entity,'' ``countdown,'' ``critical asset,'' ``crossrange,''
``data loss flight time,'' ``deorbit,'' ``disposal,'' ``dose-response
relationship,'' ``downrange,'' ``effective casualty area,'' ``expected
casualty,'' ``explosive debris,'' ``flight abort,'' ``flight abort
crew,'' ``flight abort rules,'' ``flight hazard area,'' ``flight safety
limit,'' ``gate,'' ``hazard control,'' ``launch or reentry system,''
``launch window,'' ``liftoff,'' ``limits of a useful mission,''
``mishap, class 1,'' ``mishap, class 2,'' ``mishap, class 3'',
``mishap, class 4,'' ``neighboring operations personnel,'' ``normal
flight,'' ``normal trajectory,'' ``operating environment,'' ``operation
hazard,'' ``orbital insertion,'' ``physical containment,''
``probability of casualty,'' ``public,'' ``reentry window,'' ``service
life,'' ``software function,'' ``sub-vehicle point,'' ``system
hazard,'' ``toxic hazard area,'' ``tracking icon,'' ``uncontrolled
area,'' ``unguided suborbital launch vehicle,'' ``uprange,'' and
``vehicle response modes,'' ``wind weighting safety system,'' and
``window closure.''
The amended definitions in proposed Sec. 401.5 were ``contingency
abort,'' ``flight safety system,'' ``instantaneous impact point,''
``launch,'' ``mishap,'' ``reenter; reentry,'' ``safety critical,'' and
``State and United States''. These new and revised definitions were
necessary additions to accompany the proposed part 450 requirements.
The FAA also proposed to remove a number of definitions from Sec.
401.5 that were no longer used in the regulations: ``emergency abort,''
``human space flight incident,'' ``launch accident,'' ``launch
incident,'' ``public safety,'' ``reentry accident,'' ``reentry
incident,'' and ``vehicle safety operations personnel.''
In the final rule, the FAA does not make any immediate changes to
Sec. 401.5. Instead, Sec. 401.5 will remain in effect for five years
after the effective date of this final rule, and its definitions will
be applied to parts 415, 417, 431, and 435. After five years, Sec.
401.5 will be removed from part 401 and all operators will use the
definitions in the new Sec. 401.7.
ii. Sec. 401.7
In the final rule, existing and proposed definitions from Sec.
401.5 are adopted as new Sec. 401.7 (Definitions) specifically
applicable to part 450 requirements, with the exception of the
following proposed definitions: ``control entity,'' ``data loss flight
time,'' ``dose-response relationship,'' ``flight abort crew,''
``gate,'' ``mishap, class 1,'' ``mishap, class 2,'' ``mishap, class
3'', ``mishap, class 4,'' ``tracking icon,'' and ``vehicle response
modes.'' In addition, Sec. 401.7 does not contain the definitions for
``Federal launch range'' and ``launch site safety assessment'' that
exist in Sec. 401.5. These definitions are not adopted because they
are no longer used in the regulations. Section 401.7 will apply to all
of Chapter III except parts 415, 417, 431, 435, and 440, where Sec.
401.5 will continue to apply until five years after the effective date
of this rule.
The FAA notes that the proposed definition of ``probability of
casualty'' uses the phrase ``serious injury or worse.'' Consistent with
current practice for launch and reentry safety analyses, as well as
other DOT modal administrations, the FAA maintains that the use of the
Abbreviated Injury Scale (AIS) Level 3 or greater (of the Association
for the Advancement of Automotive Medicine) is appropriate for
describing a medical condition sufficiently to allow modeling of
casualties for purposes of determining whether a launch or reentry
satisfies the public risk criteria. For additional information
regarding casualty modeling, the FAA refers the reader to the preamble
of a previous rulemaking.\190\
---------------------------------------------------------------------------
\190\ See 67 FR 49464 (July 30, 2002).
---------------------------------------------------------------------------
The FAA adds new definitions for ``critical payload,'' ``hazardous
debris,'' ``key flight safety event,'' and ``useful mission,'' which
were not proposed in the NPRM. These definitions and the rationale to
remove, adopt, or amend them are discussed in the relevant topic
sections of this preamble.
Sierra Nevada suggested including a specific reference to ground
safety for
[[Page 79688]]
the public in the definition of ``reentry.'' The FAA declines to adopt
this suggestion because public safety is the core of the FAA's
statutory mission, and including additional reference to public safety
for the definition of ``reentry'' is unnecessary.
Part 413--Application Procedures
In the NPRM, to enable incremental application submission and
review, the FAA proposed to modify Sec. 413.1 to clarify the term
``application'' to mean either an application in its entirety, or a
portion of an application for incremental review and determination in
accordance with proposed Sec. 450.33.
In the final rule, the FAA adopts the provision as proposed. This
decision is further discussed in the Incremental Review section of the
preamble. The FAA did not receive any comments on this part.
In the NPRM, the FAA proposed to revise the table in Sec. 413.1 by
replacing parts 415, 417, 431, and 435, with part 450. The FAA adopts
the proposed table with revisions as discussed in the preamble section
for Compliance Period for Legacy Licenses.
In the NPRM, the FAA proposed to amend Sec. 413.7(a)(3) to allow
an applicant the option to submit its application by email as a link to
a secure server and removed the requirement that an application be in a
format that cannot be altered. The FAA adopts Sec. 413.7(a)(3) as
proposed and this decision is further discussed in the Application
Process section of the preamble.
In the NPRM, the FAA proposed to revise Sec. 413.11(a) by removing
the reference to initiate a review ``required to make a decision about
the license or permit.'' This revision would enable incremental
application submission and review. In the final rule, the FAA adopts
the change as proposed.
In the NPRM, the FAA proposed a change to Sec. 413.15 to allow the
FAA to establish a time frame for any incremental review with an
applicant on a case-by-case basis during pre-application consultation.
In the final rule, the FAA adopts this change with a revision. The FAA
revises the explicit time frames in Sec. 413.15 to reference the time
frames specified in 51 U.S.C. 50905(a)(1) and 50906(a) so that a future
rulemaking will not be required if the time frames are modified in the
statute. This decision is further discussed in the Incremental Review
section of the preamble.
In the NPRM, the FAA proposed to correct the section heading of
Sec. 413.21 to reflect the content of the section, and to correct
Sec. 413.21(c) to reference both license and permit applications. The
FAA adopts these changes as proposed.
In the NPRM, the FAA included license and permit renewals in the
flexible time frames table in Appendix A to Part 404. The FAA
inadvertently omitted making the same change in the corresponding
regulatory text in Sec. 413.21. The FAA adopts the change as proposed,
and revises Sec. 413.21 to allow flexible time frames for license and
permit renewals. This decision is further discussed in the Time Frames
section of the preamble.
In the NPRM, the FAA proposed conforming changes in part 413 where
a part 414 safety approval is referenced, to change those references to
``safety element approval.'' The FAA adopts the changes as proposed.
This decision is further discussed in the Safety Element Approval
section of the preamble.
Part 414--Safety Element Approvals
In the NPRM, the FAA proposed to change the part 414 term ``safety
approval'' to ``safety element approval,'' to distinguish it from the
term ``safety approval'' as used in parts 415, 431, and 435, and
proposed part 450. Also, the FAA proposed to modify part 414 to enable
applicants to request a safety element approval in conjunction with a
license application in accordance with proposed part 450.
In the final rule, the FAA adopts the changes as proposed with
minor editorial corrections. The FAA did not receive any comments on
this part.
Part 420--License To Operate a Launch Site
In the NPRM, the FAA proposed multiple changes in part 420.
Specifically, the FAA proposed changes in Sec. Sec. 420.5, 420.15,
420.51, 420.57, 420.59, and 420.61 to align with requirements in part
450.
In Sec. 420.5, the FAA proposed to remove the definitions of
``instantaneous impact point,'' ``launch site accident,'' and
``public'' from Sec. 420.5. The FAA did not receive comments on these
changes and adopts them as proposed.
In Sec. 420.15(b), the FAA proposed to revise the environmental
review requirements under part 420 to match the environmental review
requirements proposed in Sec. 450.47. As discussed in the
Environmental Review section of this preamble, the FAA adopts this
change as proposed, with revisions that affirmatively state the
responsibilities of the FAA and an applicant in accordance with FAA
Order 1050.1.
The FAA proposed a minor edit to Sec. 420.51, and proposed to
allow alternate time frames in Sec. 420.57. The FAA adopts these
changes as proposed.
In Sec. 420.59, the FAA proposed changing the heading from
``Launch Site Accident Investigation Plan'' to ``Mishap Plan,'' and
modifying the requirements for Mishap Plans to match the requirements
for ``mishap plans'' in Sec. 450.173. As discussed in the Mishap
section of this preamble, the FAA revises Sec. 420.59(a) to state that
the requirements of this section only apply in the event of a mishap
that meets paragraph (a)(1) or (a)(5) of the definition of ``mishap''
in Sec. 401.7 and removes the requirement for the licensee to
cooperate with an FAA or NTSB investigations of a mishap for launches
launched from the launch site.
Lastly, in Sec. 420.61(b), the FAA replaces the word ``shall''
with the word ``must,'' and replaces the term ``launch or launch site
accident'' with a reference to the portions of the ``mishap''
definition that replace this term: paragraphs (1), (5), and (8). As
explained in the Mishap section of this preamble, the NPRM
inadvertently omitted these changes necessitated by the revised
definition of ``mishap'' in Sec. 401.7.
Part 433--License To Operate a Reentry Site
In the NPRM, the FAA proposed changes to the environmental
requirements in Sec. 433.7 to align them with the environmental
requirements in proposed Sec. 450.47 and removed and reserved Sec.
433.9.
In the final rule, the FAA adopts the proposed requirements in
Sec. 433.7 with revisions to align with the revisions in Sec. 450.47.
The revisions are discussed in the Environmental Review section of the
preamble. The FAA also adopts the proposal to remove and reserve Sec.
433.9. The FAA did not receive any comments on these proposals.
Part 437--Experimental Permits
In the NPRM, the FAA proposed the following changes to part 437
(Experimental Permits).
First, the FAA proposed to remove the definition of
``anomaly'' from Sec. 437.3 and include a modified version in proposed
Sec. 401.5.
Second, the FAA proposed to modify the environmental
requirements in Sec. 437.21(b)(1) to match the environmental
requirements proposed in Sec. 450.47.
Third, the FAA proposed to change the name of ``safety
approval'' to ``safety element approval'' in Sec. 437.21.
Fourth, the FAA proposed to modify the mishap plan
requirements in Sec. 437.41 to require that they meet the
[[Page 79689]]
requirements of proposed Sec. 450.173 and remove and reserve the
requirements in Sec. 437.75.
Fifth, the FAA proposed to change the requirements in
Sec. 437.65 for collision avoidance to match proposed Sec. 450.169.
Finally, the FAA proposed allowing for alternate time
frames for pre-flight reporting in Sec. 437.89.
In the final rule, the FAA adopts the proposed requirements with
the following exceptions. The FAA revises the environmental
requirements in Sec. 437.21 to align with Sec. 450.47, and replaces
the word ``envelope'' with the word ``scope.'' ``Scope'' more
accurately captures ``envelope, parameter, or situation'' as used in
the definition of ``safety element approval.'' The rationale for this
revision is discussed in the Environmental Review section of the
preamble. The FAA also aligns the recordkeeping requirements in Sec.
437.87(b) for an event that meets paragraph (a)(1) through (a)(3),
(a)(5), or (b)(3) of the definition of ``mishap'' in Sec. 401.7, for
which a permittee must preserve all records related to the mishap
event. The FAA removes the definition of ``anomaly'' from Sec. 437.3
and includes a revised definition of ``anomaly'' in Sec. 401.7 instead
of in Sec. 401.5 as proposed. The FAA also amends the language in
Sec. 437.87(b) to state that records must be retained until completion
of any Federal investigation and the FAA advises the permittee that the
records need no longer be retained. These changes will clarify the
records retention requirements and ensure consistency with part 450.
The changes do not modify the scope of the requirements. The FAA did
not receive any comments on this portion of the proposed rule.
Part 440--Financial Responsibility
In the NPRM, the FAA proposed to modify Sec. 440.15 to allow for
alternate time frames. The FAA also proposed to modify the definition
of ``maximum probable loss'' in Sec. 440.3 to exclude neighboring
operations losses from losses to third parties that are reasonably
expected to result from a licensed or permitted activity and that have
a probability of occurrence of no less than one in ten million (1 x
10-\8\), and to include those losses to neighboring
operations personnel that have a probability of occurrence of no less
than one in one hundred thousand (1 x 10-\5\).
In the final rule, the FAA adopts these changes as proposed. The
FAA did not receive any comments on this proposal.
7. Miscellaneous Comments
i. General Support/Opposition
Several commenters generally supported the proposed rule as a much-
needed effort to consolidate and update the licensing process in a way
that would foster innovation and growth of the space industry.
Individual commenters supported streamlined licensing as a way for
space startups to enter the industry.
The FAA also received comments stating the NPRM fell short in
streamlining rules and procedures, as directed by SPD-2. The FAA
received comments that the proposed rules made obtaining launch
licenses too difficult or expensive for small companies because they
require legal or technical experts for small, low-risk launches. An
individual commenter asserted the FAA should ease restrictions for
space startups. Another individual commenter stated the NPRM added
administrative requirements that the FAA would not be able to manage.
Virgin Galactic requested that the safety, efficiency, and clarity of
the current regulatory regime for suborbital, reusable vehicles be
maintained in any new rulemaking.
Individual commenters asserted the NPRM did not contain adequate
standards to evaluate the adverse effects of licensed activities on
public safety and the environment. The Center for a Sustainable Coast
(Center) stated the FAA should require applicants to analyze risks to
private or public property, including infrastructure and natural
resources. Without such a requirement, the Center and other commenters
argued the proposed rule would make it easier to launch over
residential areas, environmental preserves, or other areas presenting a
high risk of harm to persons, property, and natural resources. The FAA
also received comments raising concerns about Camden Spaceport, citing
the proposed rule's lack of noise limitations, emissions requirements,
and attention to the effects on the environment and residential areas.
The FAA notes that the commenters did not recommend specific
changes to the proposed rule, nor did they provide cost data to
substantiate the economic concern for small companies. As such, the FAA
cannot provide a specific response to these comments but notes its
general disagreement with the claim that the new rule will make it too
difficult or expensive for small companies to secure commercial space
launch and reentry licenses from the FAA. In fact, publicly available
means of compliance will assist small companies in entering the market
by providing multiple options for complying with the regulations.
Similarly, the FAA disagrees that it would be necessary or feasible to
create an exception in the licensing process for ``space startups.''
The FAA disagrees further that the administrative requirements to
be placed on the FAA will prove impracticable to administer. The final
rule upholds the FAA's responsibility to protect public safety and
safety of property. In addition, the final rule makes no change to the
FAA's assessment of environmental impacts. As such, the FAA disagrees
that the final rule will enable operators to secure licenses for
launches or reentries that do not satisfy the FAA's public safety or
environmental review criteria.
Finally, commenters' concerns regarding Camden Spaceport are beyond
the scope of this rulemaking.
ii. Miscellaneous Comments
Starfighters Aerospace asked if all present restrictions on
compensation or hire would be removed for licenses and certificates
developed collaboratively between AVS and AST.
The FAA notes that this rule will not change any current practice
or regulation regarding compensation or hire restrictions under
aviation regulations. Changes to compensation or hire are outside the
scope of this rulemaking.
An individual commenter stated that the FAA should have
incorporated the proposed regulatory text the ARC included at the end
of its report, or, alternatively, the FAA should reconvene the SLR2
ARC. Two individuals commented that the FAA did not provide sufficient
public engagement for this rule. SpaceX and two individuals commented
that the proposed rule did not adequately address stakeholder concerns.
Several commenters, including SpaceX and Virgin Orbit, requested a
public meeting.
As noted in the NPRM, the FAA does not address the ARC's
recommended regulatory text because the recommended text did not
receive broad consensus within the ARC. The FAA also disagrees that
commenters did not have sufficient opportunity to comment on the NPRM.
Although the FAA did not hold a public meeting, as some commenters
requested, the FAA accepted written questions seeking clarification on
the NPRM and, upon publication of the FAA's responses to those
questions, extended the comment period to allow commenters sufficient
time to review the FAA's clarifications. Similarly, while the FAA did
not reconvene the SLR2 ARC, the FAA
[[Page 79690]]
relied heavily upon the recommendations of the ARC, in addition to
industry and other public comments, in promulgating this rule.
Relativity Space commented that the NPRM preamble and proposed rule
diverged from stakeholder expectations and appeared contradictory.
Sierra Nevada requested that the FAA identify in the docket any
contractor support used to develop and draft the NPRM.
The FAA generally disagrees that the preamble contradicted the
proposed regulation, but notes that, as explained herein, the FAA has
revised particular provisions that commenters specifically identified
as unclear or impracticable. The question of contractor support is
irrelevant to this rule or its promulgation by the FAA.
CSF and SpaceX commented that the FAA should revise Sec. 440.15(c)
so that operators would not need to submit proof of insurance, as
required by Sec. 440.9, more than once if the insurance policy covered
multiple licensed activities.
CSF, Rocket Lab, and SpaceX requested the FAA revise Sec.
440.15(c)(1)(iv) through (c)(1)(vi) to allow use of electronic
signatures, in lieu of original signatures, for each party to the
required waiver of claims.
Denver International Airport asked the FAA to broaden the scope of
financial responsibility required by part 440 to include employees,
site operators, neighboring communities, and other stakeholders.
Boeing and Northrop Grumman recommended the FAA add to Sec.
404.5(b) a requirement that petitions for waivers specify the duration
or specific mission for which petitioner seeks relief, noting the FAA
should not assume a waiver applies to the entire license.
The FAA notes that the previous four issues raised by the
commenters are all beyond the scope of this rule because they contained
comments on areas of the commercial space transportation regulations
that were not part of the proposal.
CSF commented that the NPRM was anti-competitive and discouraged
operations from U.S. Government ranges, thereby favoring operators
located elsewhere, including outside the United States.
The FAA notes that CSF does not explain why it thinks the rule will
discourage operations from U.S. Government ranges and favor operators
located elsewhere, including outside the United States. Based on
applications received by the FAA, the locations of operations are
ultimately determined by the scale and complexity of operations,
including the size and type of launch vehicle, resource inputs,
infrastructure requirements, and payload considerations. The net cost
savings provided by this rule do not significantly change the relative
costs of operating from U.S. Government ranges in favor of locations
elsewhere given these considerations of scale and complexity of
operations. In addition, U.S. companies need a license from the FAA for
a commercial space launch regardless of where the launch occurs--this
rule does not change that. Currently, and prior to this rule, U.S.
companies operate at locations outside of U.S. Government ranges in
remote locations and abroad, such as New Zealand.
iii. Advisory Circulars (ACs)
CSF, Sierra Nevada, Space Florida, SpaceX, and two individuals
(including Congressman Steven M. Palazzo) commented that the FAA had
failed to provide sufficient accompanying guidance documents and ACs to
allow industry to provide meaningful input on the proposed regulations.
CSF and SpaceX both commented that the FAA's approach to publish many
ACs with the final rule did not allow industry to consider the proposed
rules and the draft ACs as a complete package. Virgin Galactic
recommended that the FAA release updated ACs and guidelines to coincide
with the new rule's going into effect, or allow a grace period for
applicants and currently licensed operators to be compliant.
The FAA acknowledges the commenters' concerns, but disagrees that
the lack of draft ACs, which are necessarily rooted in the text of
regulations, prevented commenters from substantively commenting on the
proposed rule. The preamble and table of accepted means of compliance
provided sufficient detail to support the proposal. The ACs will be
non-binding guidance documents designed to provide specific examples of
means of compliance and recognized practices without prescribing
regulatory requirements. The public and interested parties will have an
opportunity to provide comment on the ACs.
As noted under the performance-based regulations discussion, CSF
and SpaceX stated that some of the proposed rules may be performance-
based, but it was difficult to make that determination without
reviewing the accompanying ACs. Space Florida commented that there was
an absence of performance criteria and guidance providing acceptable
approaches.
The FAA does not agree that the absence of additional draft ACs
prevented members of the public from understanding the performance-
based requirements as proposed. The proposed requirements, along with
discussions in the preamble, provided ample notice to the public. An AC
would provide one means, but not the only means, of meeting any
particular requirement.
iv. Designated Engineering Representative Model
Blue Origin recommended the Designated Engineering Representative
(DER) model to determine compliance with the FAA's launch and reentry
regulations.
Delegating the agency's authority to make engineering compliance
findings to qualified individuals (DERs) in the context of licensing
commercial space transportation is beyond the scope of this rulemaking.
The FAA may consider such a recommendation in the future.
v. Request for SNPRM
The FAA received a number of comments requesting that the FAA issue
an SNPRM. Denver International Airport commented that the FAA should
wait to issue this rule until Congress adopts the Space Frontier Act,
and then, if required, issue an SNPRM.
One individual commenter asked the FAA to restart the rulemaking
process and work closely with industry and the ARC to produce a final
rule that would meet industry needs and would comply with the
Commercial Space Launch Act and SPD-2.
The FAA disagrees that the final rule is inconsistent with either
the Commercial Space Launch Act or SPD-2. Through this rule, the FAA
streamlines the licensing process for commercial launch and reentry
operations, and replaces many prescriptive requirements with
performance-based criteria, as directed by SPD-2. To forego rulemaking
until Congress passes additional legislation on commercial space
operations, as Denver International Airport suggested, would contravene
the President's policy directive.
The FAA finds no circumstances that would justify a second round of
notice and comment or SNPRM. The FAA provided ample opportunity for
members of the public to submit comments and supporting evidence to the
administrative record, as shown by the large volume of substantive,
diverse comments received. The FAA also provided two sets of written
responses to clarifying questions, and extended the comment period
following publication of those responses. Although the FAA has adjusted
and revised parts of the NPRM in light of the
[[Page 79691]]
comments received and interagency review, the final rule does not
materially differ from the proposed rule such that an SNPRM would have
been warranted. Nor does the FAA view the presence of the circumstances
that might otherwise necessitate publishing an SNPRM (e.g.,
availability of new studies or experiments affecting the agency's
analysis; supervening legal developments that significantly affect the
rulemaking; or any other important change to the agency's analytical
framework in the rulemaking).
vi. Airspace
The FAA received a number of comments on the effect of space
operations on the NAS. A4A, AAAE, ACI, ALPA, AOPA, CAA, NATCA, and RAA
recommended the FAA implement tools to integrate commercial space
activities safely and expeditiously into the NAS and to harmonize the
regulatory regime governing aviation and commercial space. These
commenters argue that greater communication and coordination with NAS
users was needed to reduce delays and obstacles faced by both
industries (e.g., coordinated vehicle surveillance, traffic management,
and hazard mitigation plans).
The same commenters recommended the FAA incorporate into the rule
the recommendations of the ongoing Airspace Access ARC. AOPA stated the
COMSTAC and SLR2 ARC should have included general aviation
representation.
A4A and Southwest Airlines asked that aviation stakeholders be
given an opportunity to identify potential NAS impacts during the
licensing process. A4A, AAAE, ACI, ALPA, CAA, NATCA, and RAA
recommended the FAA require licensees to identify and mitigate negative
operational and financial impacts to NAS users resulting from licensed
activities. A4A added that hazard mitigation plans and the FAA's
accepted means of compliance should be subject to public comment, or
otherwise allow NAS users the opportunity to identify airspace and
ground safety risks.
The FAA did not propose any changes for the protection of aircraft
other than the aircraft risk criteria proposed in Sec. 450.101(a)(3).
As such, these comments are beyond the scope of this rule.
Recommendations from the Airspace Access ARC, which included commercial
space and aviation industry representatives, may inform future actions
addressing aircraft protection.
8. Responses to Regulatory Impact Analysis Comments
i. Compliance Period for Legacy Licenses
CSF commented that if the FAA required holders of licenses issued
under current regulations to seek renewals under part 450, operators
and the FAA would experience significant additional cost and regulatory
burdens because currently licensed operators under parts 431 and 435
would have to come into compliance with certain additional requirements
in part 450. Blue Origin also expressed concern that, without
grandfathering, there would be a cost to transition a license to part
450. Blue Origin pointed out that, according to the NPRM, upon license
renewal, an existing operation would have to comply with part 450. Blue
Origin disagreed with the FAA's conclusion that operators would not
have great difficulty transitioning existing programs to part 450. It
cited, in particular, proposed CEC and associated
requirements in proposed Sec. 450.145.
The FAA notes that any request to renew a current license submitted
after the effective date of the rule will result in a license valid for
no more than five years after the effective date of this rule. However,
upon the effective date, the operator will be required to come into
compliance with COLA and critical asset requirements. The FAA does not
estimate additional costs for those two requirements because the
operator will provide the same information the operator currently
provides, and the U.S. Government will perform the necessary analyses,
as discussed in the preamble sections for Critical Asset and COLA.
After five years from the effective date of the final rule, all
vehicle operators must be in compliance with part 450, but information
previously submitted to the FAA in obtaining a license under parts 417
and 431 may be referenced as means of compliance to meet the
requirements of part 450. Concerns over costs of proposed
CEC and FSS requirements in Sec. 450.145 are discussed in
the remainder of this section. There may be costs to transition
licenses following the 5-year period after the rule's effective date.
However, as mentioned previously, the FAA anticipates few, if any,
additional requirements that could not be fulfilled by referencing
previous submittals.
ii. Sec. 450.47 Environmental Review
Several commenters stated that the proposed requirements would
impose added costs for which the FAA did not account. Space Florida
expressed concern that the FAA may determine that new or supplemental
environmental analyses would be necessary for operators opting for a
single vehicle license with vehicle and site flexibility. The commenter
was concerned that such analyses would be required before the
determination to add multiple vehicle configurations, operational
parameters, or launch site locations to an operator's single license.
Spaceport Strategies also expressed concern that the FAA had not
analyzed the cost to launch operators or to launch site operators for
additional or redundant environmental reviews that the FAA would likely
require of an operator under the new rule in order for an operator to
obtain a single license covering multiple launch or reentry sites or
multiple vehicle configurations and flight operations. Spaceport
Strategies noted that the added costs of repetitive or redundant
environmental reviews would cause unquantified cost impacts on
licensees, including State and local launch site license applicants.
CSF stated that applicants using the licensing option to include
multiple sites under one license may be vulnerable to time and cost
uncertainty resulting from these environmental review requirements.
The FAA does not agree that the final rule will impose additional
costs beyond what is currently required of applicants for environmental
reviews, including applications for a single vehicle license or
licenses that include multiple sites, as the final rule codifies
current practice. NEPA requires that an environmental review be
completed for each site covered by the FAA license. As such, the final
rule makes no change to the existing requirement that applicants submit
information allowing the FAA to fulfill its responsibility under NEPA
to assess the environmental impacts associated with the proposed
activities, at each site where the licensed activities will occur. An
applicant must submit these materials to allow the FAA to conduct site-
specific reviews regardless of whether multiple sites or vehicles are
covered under one license or several licenses. This could be
accomplished by including multiple sites into one NEPA document, or
separating them into individual NEPA documents.
Spaceport Strategies commented that the FAA did not consider the
offsetting costs of environmental reviews for the new vehicles and
launch sites for which cost savings were assessed. The FAA notes it did
not include offsetting costs for new vehicles and launch sites because
the same costs for environmental reviews will be imposed
[[Page 79692]]
under the current regulations. There will be no change in costs.
Spaceport Strategies commented that the FAA's re-write of
environmental review requirements was more than a simple
``consolidation'' as reported in the Preliminary Regulatory Impact
Assessment. The commenter stated that the proposed requirements had
unquantified cost impacts upon licensees, including State and local
launch site license applicants, for the additive costs of repetitive or
redundant environmental reviews.
As discussed in the Environmental Review section of this preamble,
the final rule codifies existing environmental review requirements. The
commenter did not identify the environmental reviews it deems
repetitive or redundant. However, the FAA confirms that in codifying
existing practice, the final rule will not impose additional costs for
environmental review.
Spaceport Strategies commented that licensees would face
significant costs to redo environmental analyses for previously studied
and permitted sites. As an example, the commenter referred to Space
Florida's being required to spend almost $239,000 for another
environmental assessment for its Launch Site Operator License for
horizontal launch at the former Shuttle Landing Facility, when NASA had
completed two previous environmental assessments on the same facility.
The FAA notes this rule will impose no additional environmental
reviews nor require a redo of an environmental assessment if an
operator's operation remains within the scope of the original
assessment. However, consistent with NEPA, an operator will be required
to do additional environmental reviews if the scope of its operation
has changed.
Spaceport Strategies commented that the FAA did not address
environmental review regulations derived from practices and policies
being codified into rules as potential federalism issues with the State
and local jurisdictions that operate the part 420-licensed sites. The
commenter stated that the FAA also did not consider that some, if not
all, of the local and State authorities are small governmental entities
for purposes of the Regulatory Flexibility Act.
The FAA determines that this rule codifies existing requirements in
FAA Order 1050.1 and will not affect the applicability of NEPA or any
other Federal environmental law to non-Federal launch or reentry sites.
Therefore, the FAA finds that the final rule will not have an
additional cost impact on small governmental jurisdictions.
iii. Sec. 450.101(a)(b) Neighboring Operations
Virgin Orbit believed the costs of the additional EC
analysis to use in determination of neighboring operations personnel
would be $10,000. As discussed in the preamble section for Neighboring
Operations Personnel, the FAA acknowledges that this requirement will
require additional analysis; however, the FAA expects that this
analysis will involve minor additional effort because the operator
already has to perform a similar analysis for the public and will only
need to account for the population of neighboring operations personnel,
if any.
Blue Origin expressed concern that the FAA might implement a
requirement for which compliance would be impossible, or would lead to
the creation of a sole source provider for a service necessary to
demonstrate compliance, if the FAA does not explain how the transfer of
neighboring operations personnel population data would take place.
Sierra Nevada expressed concern regarding an applicant's ability to
perform calculations to determine which neighboring operations
personnel could remain on a launch site, because the applicant would
need to get accurate data regarding the populations and locations of
neighboring operations. Sierra Nevada pointed out that, because data
could be on personnel performing operations for competing companies,
the data could be proprietary or sensitive. Sierra Nevada suggested the
FAA could perform this function to guard the proprietary nature of the
data.
In the final rule, the FAA notes that the Federal or licensed site
operator will determine those personnel who are eligible for
neighboring operations personnel status in coordination with the launch
operators, because the site operator is in the best position to
identify which personnel are required to perform safety, security, or
critical tasks at the launch site. Further, as previously discussed,
both the launch or reentry operator and the neighboring site operator
benefit from this treatment of neighboring operations personnel.
Spaceport Strategies faults the FAA for not comparing the estimated
marginal productivity improvement created by allowing certain personnel
of neighboring operators to remain at work during nearby operations
with adverse schedule and competitiveness losses if the FAA did not
adopt the alternative approaches suggested by the ARC and CSF.
The alternative chosen by the FAA provides cost savings compared to
the current regulations, and the FAA believes that this approach is
consistent with the intent of SPD-2. The FAA acknowledges that other
approaches exist, and considered three alternatives that are discussed
in the Regulatory Flexibility Act section of this preamble.
Spaceport Strategies commented that the labor categories used to
calculate neighboring operations personnel savings (engineers and
technicians) did not align with the restricted categories of work
functions allowed to remain (such as personnel required for safety,
security, or critical tasks), indicating that the FAA's savings
estimates may not actually be realized.
The FAA received input from licensed operators on the labor
categories that might be allowed to remain on the launch site and,
based on that input, is confident that these are reasonable labor
categories.
iv. Sec. 450.101(a) Incorporate Waterborne Vessels Into Collective
Risk Criteria
To incorporate waterborne vessels into collective risk assessment,
Virgin Orbit requested the FAA and other regulators work with launch
service providers by providing databases on global marine traffic.
Virgin Orbit also requested guidance on debris size/fragment velocities
that would result in injury to marine traffic, in an appendix or AC.
Virgin Orbit asserted that this requirement is not found in the
existing regulations, and estimated that the additional cost to analyze
and document the effort would be approximately $20,000 per launch,
which would become significant costs for a large number of launches.
The FAA does not agree that there will be additional costs of any
significance from the requirement to incorporate waterborne vessels
into collective risk criteria. The operator can continue its current
practice and demonstrate compliance in accordance with the RCC 321-20
Supplement. The FAA does not find a need to provide databases on global
marine traffic because there are several public sources of data on ship
traffic available through the internet which aggregate near real-time
Automatic Identification System (AIS) \191\ data from satellites and
ground stations. The FAA notes that all vessels over 300 tons on an
international voyage, all domestic vessels over 500 tons, and all
passenger carriers, are
[[Page 79693]]
required to operate ``Class A'' AIS transponders, broadcasting
continually-updated data, such as identity, position, course, speed,
ship characteristics, cargo, and voyage information, to other vessels
and the shore. The United States Coast Guard requires AIS Class A
transponders on all U.S. vessels engaged in commercial service that are
(1) self-propelled and over 65 feet in length, or (2) towing vessels of
26 feet or more in length and more than 600 horsepower. The USCG also
requires AIS Class B transponders on smaller vessels, such as fishing
industry vessels.\192\ Detection of smaller vessels, which tend to
remain close to shore, can be accomplished without AIS by fixed ground-
based and ship-board radar, as well as surveillance aircraft. The FAA
will publish an AC on population exposure analyses that includes
details about available databases that provide valid data on ship
traffic, including near real-time ship traffic useful for EC
analyses. The forthcoming RCC 321 Supplement will also include this
information.
---------------------------------------------------------------------------
\191\ AIS is a standardized maritime navigation safety
communications system that provides vessel information automatically
to appropriately equipped shore stations, other ships, and aircraft.
\192\ USGC regulations regarding AIS are given in 33 CFR 164.46.
---------------------------------------------------------------------------
The ship probability of impact contours (PI) and
individual risk contours are already required and computed based on
current practice to establish ship hazard areas. The FAA Office of
Commercial Space Transportation will facilitate access to the ship
traffic densities so that the EC contribution from ships can
be computed with a spreadsheet.
v. Sec. 450.101(a)(3) Aircraft Risk
Virgin Orbit commented on the proposed requirement for an operator
to establish aircraft hazard areas necessary to ensure the probability
of impact with debris capable of causing a casualty for aircraft does
not exceed 1 x 10-\6\. To incorporate airborne vessels into
the collective risk assessment, Virgin Orbit requested FAA databases on
civil and general aircraft, predicted air traffic, and debris size and
velocities that would result in aircraft casualties in order to comply
with this requirement. Virgin Orbit stated guidance on debris size and
fragment velocities could be added in an appendix or AC. Virgin Orbit
indicated that this is a new requirement relative to the existing
regulations and estimated that the additional cost to analyze and
document the effort would be $20,000 per launch. While not significant
by itself, Virgin Orbit stated that the additional cost for a large
number of launches becomes significant.
The FAA does not agree that this is a new requirement. Current part
431 regulations require an operator to demonstrate that the risk level
to an individual does not exceed 1 x 10-\6\ probability of
casualty per mission. The part 431 requirement is equivalent to the
corresponding part 450 requirement, which requires that the probability
of impact with debris capable of causing a casualty for aircraft does
not exceed 1 x 10-\6\. Because people in aircraft are not
excluded from the part 431 requirement, part 450 is not adding a new
requirement to demonstrate risk level for aircraft. In addition, Sec.
417.107(b)(4) is identical to the requirement in Sec. 450.101(a)(3).
Part 450 does not require a collective risk assessment for aircraft, so
aircraft traffic densities, data on civil and general aircraft, and
predicted air traffic, are not necessary.
vi. Sec. 450.101(a)(4) Critical Assets
Blue Origin commented that because operators on non-Federal launch
or reentry sites would be required to comply with USAF Federal site
requirements, the FAA would need either to confirm it had considered
private and licensed spaceports in its cost assessment and that those
operators would not need to complete any critical asset analyses, or to
confirm they were not included. The commenter also stated that it was
possible the new requirement would impose costs for operators not at
Federal sites.
Spaceport Florida voiced concern about the creation of a new
category of property designated as a ``critical asset,'' which would be
required to be protected against ``loss of functionality'' by
prescribed risk criteria limiting each designated asset's exposure to
launch or reentry hazards. The commenter indicated concerns about
extraordinary analysis requirements, unknown costs, and program risks
asking what limits the types and numbers of assets that may be
designated by multiple parties within proximity to a licensed launch
activity.
Spaceport Strategies commented that the FAA had not conducted
certain analyses. These included analyzing the cost to a licensee to
perform a risk assessment on each FAA-identified critical asset to be
incorporated into a flight safety risk analysis, analyzing the cost to
identify critical assets to be evaluated as a property at risk, and
analyzing operator time to process waivers required for an operator's
own critical assets or for an asset that may be at risk for a
particular critical licensed activity. Spaceport Strategies expressed
concern that the proposed requirements duplicated existing standards
imposed by NASA and the USAF, and noted that there was only brief
mention of this newly proposed requirement in the FAA's Preliminary
Regulatory Impact Analysis, which identified no costs associated with
its implementation. As proposed, this requirement would apply to all
licensed launches and reentries wherever they may occur, at any site in
the United States. The commenter noted that in the Baseline Analysis of
the cost impacts and cost savings of proposed Sec. 450.101, the FAA
claimed no cost impact for a new requirement that clearly would add
cost burden to every licensee, as well as to the FAA itself.
The FAA notes that under the final rule the U.S. Government will
perform the identification and analysis of critical assets. The FAA
expects these costs to be relatively small. The Federal launch or
reentry site will perform the analysis for launch or reentry operations
from Federal sites, and the FAA will perform the analysis for
operations from non-Federal launch or reentry sites. Therefore,
operators should incur no costs for determination of critical assets.
vii. Sec. 450.101(c) High Consequence Event Protection
Spaceport Strategies stated that the proposed requirement to use
the CEC analysis tool would be prohibitively expensive--even
technologically infeasible--to use, and faulted the Preliminary
Regulatory Impact Analysis for not including these costs. The commenter
also criticized the FAA for not including the costs for operators to
learn the skills or contract for the analysis. In addition, they stated
that the FAA did not include its cost to hire in-house personnel or
contractor skills to validate that the operator's analysis justifies
not needing an FSS.
CSF found the CEC to be a new and costly calculation
that may require significant resources, including possible reliance on
contracts for expensive modeling capabilities. The commenter feared
that meeting the CEC may result in substantial increase in
cost to those operators currently able to show compliance. Based on its
understanding of the proposed rule, CSF concluded that the majority, if
not all, of the operators would be captured by proposed Sec.
450.145(a)(1) and would be required to implement an FSS of the highest
reliability. CSF disagreed with the FAA's estimated FSS cost savings
and indicated there would be cost increases.
Virgin Orbit stated that CEC, as a new requirement,
would be burdensome to implement and would require changes to its in-
house algorithm to compute flight corridors with associated
EC. According to Virgin Orbit, this new burden would impact
timelines for future launches and would have
[[Page 79694]]
significant costs to implement. The commenter recommended
CEC be included as one method to determine whether an FSS
was needed and not as a required calculation. The commenter further
noted that CEC, as proposed, would be better suited in an
AC. Blue Origin described the proposed CEC as a complicated
analysis with debatable accuracy. Several commenters disagreed with the
FAA's conclusion that this new ``consequence risk'' methodology aligned
with current practices.
Rocket Lab explained that, because proposed CEC
disregarded demonstrated reliability and experience, it appeared almost
impossible for any orbital launch vehicle to meet the prescribed
CEC thresholds. Preliminary calculations suggested that the
majority of orbital launch vehicle operators would be directed toward a
flight abort system of the highest prescribed reliability.
The FAA does not agree that the cost to use CEC is
prohibitive or that Virgin Orbit will be required to make significant
changes to its in-house algorithm. Additional costs associated with
modifications of analysis tools, adjustments to data development,
additional analysis runtime, and interpretation of the results as
detailed below, should not be significant.
The modification of existing analysis tools is expected to take
only a few hours. As explained earlier, CEC is inherent in
the calculation of total casualty expectation. If the capability to
output the CEC values is not already part of the calculation
tool, adding the output of this value for each scenario should require
no more than a few hours of effort. This estimate is included in the
Regulatory Impact Analysis for those operators who choose to do the
analysis.
Because the CEC metric is more sensitive to the input
data and to numerical sampling approaches than the collective
EC metric, more rigor needs to be applied to the analysis or
more uncertainty accepted in the result. Some data development may need
to be of higher fidelity and more computation samples run to achieve a
statistically meaningful answer. Therefore, the FAA finds there will be
additional cost to perform the analysis. To comply with Sec.
450.101(c), the operator first calculates the CEC, assuming
no FSS is present, to determine whether flight abort with an FSS
meeting the requirements of Sec. 450.108(b) is needed. These
calculations will incur 5 percent of the debris analysis costs.\193\
These estimates are included in the Regulatory Impact Analysis.
---------------------------------------------------------------------------
\193\ Debris cost analysis is estimated to cost $50,000.
---------------------------------------------------------------------------
Applicants using an FSS can use hazard containment or analysis of
CEC as key criteria in the determination of flight safety
limits. The cost to interpret CEC results for flight safety
limit development is expected (after the debris analysis is run) to
reduce the costs nominally compared to existing containment approaches.
Using its CEC tool, ACTA, under contract to the FAA, has
identified several launches in the launch forecast that will not need
an FSS. The Regulatory Impact Analysis includes more information on
these launches, as well as an updated estimate of cost savings
anticipated because these launches will not need an FSS.
The FAA notes that any operator that agrees to have a Sec.
450.145-compliant FSS does not have to do a CEC analysis to
determine the required reliability level of the FSS. However, a
CEC analysis may still be needed to determine the flight
safety limits. As discussed in the High Consequence Event Protection
preamble section, the final rule now has a number of flexibilities in
Sec. 450.101(c). Nevertheless, an operator could opt to use the flight
safety limits approach in current Sec. 417.213 as a means of
compliance with Sec. 450.108(5), and thus avoid any costs associated
with CEC analysis.
viii. System Safety Program, Post-Flight Data Review, Post-Flight
Reporting
CSF disagreed with the FAA's rationale that any added burden of
this section would be minimal because industry practice was to review
post-flight data for reliability and mission success. CSF maintained
that the proposed post-flight data requirement extended beyond industry
practice. The commenter also stated that it was not clear whether the
process for evaluating post-flight data would be subject to FAA review
and approval, which would create an even larger burden. Sierra Nevada
also commented that the proposed requirements extended beyond the
industry practice of reviewing post-flight data for reliability and
mission success, to requiring an operator to develop and employ a
process for evaluating post-flight data to ensure consistency between
the assumptions used for preliminary safety assessment, any flight
hazard or FSA, and associated mitigation and control measures. Rocket
Lab and Sierra Nevada stated the proposed Sec. 450.103(d) would
require the operator to address any anomaly identified and resolve
inconsistencies prior to the next flight of the vehicle. Rocket Lab
pointed out that this was overly burdensome.
The FAA disagrees with the commenters. The FAA is only concerned
with ensuring consistency between the assumptions used for any safety
analysis and associated mitigation and hazard control measures. It is
industry practice to review post-flight data to address vehicle
reliability and mission success.
The FAA further notes that current regulations already require that
any representation contained in the license application that is
material to public health and safety or the safety of property be kept
accurate and complete, therefore any additional burden from Sec.
450.103(d) will be minimal. Currently, operators review the post-flight
data because it provides valuable information on future operations. At
a minimum, in the final rule, Sec. 450.103(d)(1) will require that an
operator employ a process for evaluating post-flight data to ensure
consistency between the assumptions used for the hazard control
strategy determination, any hazard or FSA, and associated mitigation
and hazard control measures. With respect to Sec. 450.103(d), the FAA
will evaluate the post-flight data review process during the
application evaluation. Applicants will not be required to provide
information obtained from the post-flight data review to the FAA unless
specifically requested to do so during the compliance monitoring
process. The FAA finds that it has always been the operator's
responsibility to ensure the accuracy of the relevant safety analyses.
Operators must review flight data in order to ensure that the operation
is conducted as predicted, and to inform necessary safety analysis
changes for future flights.
Section 450.215 will continue to require licensees to submit a
post-flight report no later than 90 days after an operation if there
are any anomalies in the flight environment material to public health
and safety and the safety of property, and if there is a need for
associated corrective actions. This practice is currently required by
Sec. 417.25(c). While RLV operators licensed under part 431 are not
currently required to submit a post-flight report, they are required to
ensure that all assumptions and representations made in their
application that are material to public health and safety or the safety
of property are kept accurate and complete, in accordance with
Sec. Sec. 413.7 and 431.73(b)(2). As such, the FAA expects the added
burden to be minimal because launch and reentry operators regularly
track anomalies and
[[Page 79695]]
implement corrective actions for mission assurance, continuing license
accuracy, and safety purposes. The FAA is normally made aware of any
anomalies and corrective actions that are material to public health and
safety through its inspection program.
ix. Sec. 450.141 (Proposed Sec. 450.111) Computing Systems and
Software Systems
Several commenters expressed concern that the NPRM proposed a
prescriptive approach to the software hazard, which would impose a
significant burden on operators to meet all of the proposed
requirements and structure.
An individual commenter estimated that changing the review process
and structure of software would require a substantial new effort and
add costs of over $40,000 per launch. Blue Origin faulted the FAA for
proposing overly prescriptive regulations governing how the operator
would design and test software. Blue Origin also contended that the
prescriptive proposed requirements did not integrate well with most
industry applications and best practices and failed to address critical
aspects of safety sufficiently for aeronautical databases, complex
distributed software systems, new techniques, and machine learning.
Blue Origin indicated that these would threaten progress being made
towards safer, lower cost and higher quality software approaches. CSF
maintained that the requirements of proposed Sec. 450.111 prescribing
how the operator would design and test software, and providing only one
way to demonstrate that software was safe, failed to allow development
of new technologies that could lead to safer solutions, and would
greatly increase costs. Leo Aerospace stated that the testing
requirements of proposed Sec. 450.111(d)(2) and (f)(1) were so
prescriptive that they would be cost-prohibitive.
In the final rule, the FAA revises Sec. 450.111 to mirror the
typical structure of computing system safety application data
submissions and adds flexibility in the means of compliance for key
aspects of safe computing system development. The FAA notes that these
revisions address the key aspects of commenters' concerns. The final
rule on computing and software systems, now located in Sec. 450.141,
aggregates the requirements in proposed Sec. 450.111 into performance-
based objectives set in the context of the appropriateness of each
element for the system as a whole. This aggregation removes any
prescriptive requirements and replaces them with the performance-based
objectives. The performance-based objectives are the elements of
software development and testing processes that enable an understanding
of the public safety implications of each software component, and the
objectives are structured to mirror typical software safety application
data submissions to minimize or eliminate the need to adapt existing
software safety processes to fit the new regulations. The final
performance-based objectives expand the range of software safety
approaches that could meet the regulation to enable more innovation
while keeping the compliance burden at or below the level proposed in
the NPRM.
x. Proposed Sec. 450.113(a)(5) Flight Safety Analysis Requirements
Virgin Galactic commented that its launch system had an FSS in the
form of its pilot, rendering the need for ``demonstrated reliability''
unnecessary. In addition, unlike the ELVs addressed by part 417, Virgin
Galactic's launch system does not have a large effective casualty area,
which raised the question of whether the risks truly justified the
costs of the proposed requirement, particularly to small businesses.
Under this rule, currently licensed hybrid systems will not have to
do an FSA for phases of flight that have a flight history to
demonstrate reliability based on operational and flight history in lieu
of a traditional risk analysis. This allowance is discussed in greater
detail in the Hybrid Vehicles section of the preamble.
xi. Sec. 450.115 Flight Safety Analysis Methods
CSF commented that prescriptive FSA requirements are inappropriate
for some vehicles and operations. An applicant would have to propose an
alternative method of compliance or submit a waiver request, resulting
in an increase in the amount of work. The lack of tool-availability
might also cause some applicants to incur costs of performing these
analyses themselves. CSF noted these costs had not been included in the
cost analysis. The FAA agrees that prescriptive requirements are not
appropriate and revises the requirements to be more performance-based.
x. Independent Analyses
CSF stated that the NPRM's Flight Safety Analysis sections
(proposed Sec. Sec. 450.119 and 450.135) include multiple references
to an applicant submitting any additional products that allow an
independent analysis as requested by the Administrator. CSF stated that
this behavior of recreating an applicant's analysis was already an
expensive and burdensome aspect of the current rules that should be
ended. A couple of commenters provided estimates of additional hours of
work that might be required to conduct independent analyses.
As mentioned previously, the goal is for the FAA to evaluate, in an
efficient and thorough manner, the validity of the analysis. The FAA
finds that conducting an independent analysis is typically the most
efficient and thorough means to verify compliance with the FSA
requirements for novel launch or reentry operations or operators that
propose to use substantially new FSA methods. Furthermore, the FAA
plans to provide benchmarks for comparison purposes that operators can
reference to as part of the validation and verification of their
analysis methods.
Therefore, the FAA does not anticipate this rule will impose an
additional cost burden for independent analyses because conducting
independent analyses is current practice.
xi. Sec. 450.135 Debris Risk Analysis
An individual commenter indicated that the proposed rule would add
significant work in additional debris risk analysis beyond what the
operator was doing to comply with the current regulations. The
commenter specified that the proposed rule would add requirements on
explosive debris, toxic release effects from the debris, accounting for
sheltering of individual from buildings and vehicles, a casualty mode
that included ricochet fragments, and impacts to critical assets. It
would also add reporting requirements for the top ten impacted
population centers and the need to perform conditional probability
calculations in the FSA.
The FAA notes that an explosive debris or toxic release effects
analysis will not be required if the vehicle does not have explosive
debris and toxics. Explosive debris or toxic release effects analysis
are currently required for ELVs under Sec. 417.107(b)(1) and for RLVs
under Sec. 431.35(b)(1)(ii), so the requirement for those analyses
under part 450 would not impose additional costs. The final rule
requirements allow operators to determine how to conduct their debris
risk analysis. For example, an operator will not need to update the
debris risk analysis to account for sheltering or ricochet if it uses a
conservative estimate of the casualty area for people in the open
pursuant to Sec. 450.101(g). Under the final rule, the FAA or Federal
launch or reentry site will do any critical asset risk assessment. The
cost of the CEC
[[Page 79696]]
assessment is addressed in the High Consequence Event Protection
preamble section. Reporting the top ten population centers is a minimal
amount of additional paperwork.
xii. Sec. 450.143 Safety-Critical System Design, Test, and
Documentation
An individual commenter expressed concern that the proposed rule
would constrain the design by prescribing fault tolerance where an
operational mitigation solution might exist, and stated that this would
result in a large burden.
The FAA finds that industry interpreted this regulation to be
burdensome due to a misunderstanding of the breadth of possible means
of compliance to the ``fault-tolerant'' requirement in Sec.
450.143(b). In the NPRM, the FAA noted that while redundancy was a
currently prescribed requirement for some safety-critical components,
the intent of this requirement was to accept other methods, including
fail safety and damage tolerance for systems like primary structures
that could not be redundant. This flexibility permits operational
restrictions, testing, and inspection to factor into the design to
demonstrate that a system is fault-tolerant. The FAA resolves these
concerns by revising Sec. 450.143(b) to allow for other means of
compliance.
xiii. Sec. 450.145 Flight Safety System
Several commenters took issue with the FAA's assessment of cost
savings associated with the new approach to FSS implementation. CSF
disagreed there would be cost savings and expressed that the majority
of operators would be required to implement an FSS of the highest
reliability. CSF concluded that the result would be significant
increases in cost and oversight burdens to every operator not already
operating at a U.S. Federal site that has not yet implemented a RCC
319-4-compliant FSS. Rocket Lab stated that preliminary calculations
suggested that the majority of orbital launch vehicle operators would
be directed toward a flight abort system of the highest prescribed
reliability. Blue Origin stated that most, if not all, operators
(whether smaller suborbital launch vehicles operating in remote
locations, or larger orbital launch vehicles operating at Federal
sites) would be forced down a path of implementing an FSS that must
comply with an unmodified set of prescriptive USAF requirements.
Spaceport Strategies criticized the FAA's analysis of cost savings from
launches not requiring an FSS as being speculative and not providing
information on whether the vehicles would fly from existing or newly
licensed or private launch sites. It expressed that the uncertainties
made the projected savings an overstatement.
The FAA disagrees that most, if not all, operators will be required
to implement an FSS of the highest reliability. For some launches, no
FSS may be required; for others, an FSS will be required, but not of
the highest reliability. The FAA sponsored an analysis performed by
ACTA \194\ using a CEC model to evaluate selected \195\
prospective launches and determine those which would not need a FSS to
be in compliance with part 450. The FAA then determined which of these
launches identified as not needing an FSS under part 450 would be
required to employ an FSS under part 431 or current practice. Based on
cost input received from industry on FSS costs, the FAA then estimated
cost savings due to the fact that some launches would not need an FSS
under part 450, as determined by the ACTA analysis. The cost savings
calculations are in the Regulatory Impact Analysis.
---------------------------------------------------------------------------
\194\ ACTA, LLC is a risk management company that evaluates
safety hazards and risks from space launch vehicle debris, blast,
fire, and toxic gases. The FAA sponsored ACTA to perform a series of
tasks to investigate the potential conditional risks associated with
past and foreseeable launch operations. The study provided an
independent evaluation of the potential for the CEC
related requirements in the NPRM to necessitate changes to current
practice for more than a dozen missions involving large, medium, and
small launch vehicles from a wide variety sites.
\195\ In selecting which launches to analyze, the FAA analyzed
those launches planned from remote areas, suborbital and launches
with a certain kind of upper stage. This is because orbital launches
that are not from remote areas are going to exceed the risk
threshold of greater than 1 x 10-\3\ conditional expected
casualties for uncontrolled areas.
---------------------------------------------------------------------------
xiv. Sec. 450.161 Control of Hazard Areas
CSF stated that, in cases in which the hazard area locations were
in extremely remote locations or significant distances away from the
launch and reentry site, it was unreasonable for cost and logistics
reasons to expect that a commercial company could provide such
surveillance. The FAA notes that Sec. 450.161 only requires
surveillance to the extent necessary to ensure compliance with Sec.
450.101. Hence, surveillance will be unnecessary in extremely remote
locations.
xv. Sec. 450.167 Tracking
Sierra Nevada expressed that, as written, the proposed rule seemed
to imply that tracking would be required for every possible piece of
debris in off-nominal scenarios. Sierra Nevada noted this would be
burdensome, cost prohibitive, and increase the risk to the public. As
clarified by the FAA in ``Answers to Clarifying Questions Received by
June 28, 2019'' and ``Answers to Clarifying Questions Received by July
29, 2019,'' the term ``all stages and components'' does not imply that
all debris must be tracked to the ground after a vehicle breakup. In
the final rule, the FAA replaces the requirement to ``determine the
actual impact locations'' with the phrase, ``predict the expected
impact locations,'' in Sec. 450.167. Hence, the FAA finds the final
rule requirements are consistent with current practice and thus incur
no additional costs.
xvi. Sec. 450. 173 Mishap Plan--Reporting, Response and Investigating
Requirements
Sierra Nevada recommended removing the mishap plan requirement to
report debris impact points, including those outside a planned landing
or impact area as proposed in Sec. 450.173(d)(3)(iv), this requirement
would be burdensome, cost prohibitive, and not reasonable. Sierra
Nevada stated that this burden would follow because hazard areas are
generated as probability contours and not contours of total
containment. The commenter further stated it was realistic that, in the
event of a breakup scenario, debris would exist outside the hazard area
but not at a high enough probability to warrant segregation.
The FAA notes that the requirement to report hazardous debris
impact points is consistent with the current 5-day reporting
requirements for ELVs. It is not the FAA's intent to require tracking
and surveillance for every possible piece of debris in off-nominal
scenarios. However, based on the vehicle's last-known state vector, an
operator should be able to calculate approximate hazardous debris
impact points, including those points outside a planned landing site or
designated hazard area. The FAA will consider an event that results in
hazardous debris impact points outside a planned landing site or
designated hazard area as a mishap. Considering the potential increased
risk to public safety resulting from hazardous debris impacts outside
planned landing site or designated hazard area, the FAA finds that this
requirement is reasonable and necessary.
In addition to requiring submission of a 5 day report in all mishap
cases, there might be some additional cost associated with submitting
debris impact location data, which is not currently required under part
431. Part 417 requires submission of this data
[[Page 79697]]
only for debris that lands outside the impact limit lines.
The FAA does not agree that this requirement will be costly or
unreasonable for the following reasons. First, the requirement has been
changed to require that only hazardous debris be reported. Second,
operators currently must employ vehicle tracking for normal flight. In
the event of a vehicle breakup, operators should be able to approximate
any hazardous debris impacts in relation to the designated landing site
or hazard area, based on the vehicle's last known state vector or other
tracking resources required for normal flight. In other words, this
requirement will involve only minimal costs because an operator can
leverage vehicle tracking data it already collects in order to submit
the debris impact location data. In addition, the FAA believes the
operator will benefit from reporting this debris.\196\
---------------------------------------------------------------------------
\196\ The debris data reported can be valuable in assessing the
current license representations to allow for adjustments to expand
launch availability or enhance the safety of operations.
---------------------------------------------------------------------------
xvii. Sec. 450.185 Ground Hazard Analysis
Virgin Galactic commented that the ground hazard analysis
requirements proposed in the NPRM would represent new requirements and
a new cost burden, creating new work outside of its existing license.
Virgin Galactic requested that the FAA determine whether a ground
hazard analysis would be necessary for hybrid operators, in accordance
with the Congressional direction that the FAA regulate only to the
extent necessary.
The FAA included estimated costs for ground hazard analyses in the
NPRM. For the final rule, the FAA estimates that 75 percent of
operators will spend no more than 80 hours on the ground hazard and 25
percent of the operators will spend no more than 160 hours (non-
recurring one time per license).
IV. Regulatory Notices and Analyses
A. Regulatory Evaluation
Changes to Federal regulations must undergo several economic
analyses. First, Executive Order 12866 and Executive Order 13563 direct
that each Federal agency shall propose or adopt a regulation only upon
a reasoned determination that the benefits of the intended regulation
justify its costs. In addition, DOT rulemaking procedures in Subpart B
of 49 CFR part 5 instruct DOT agencies to issue a regulation upon a
reasoned determination that benefits exceed costs. Second, the
Regulatory Flexibility Act of 1980 (Pub. L. 96-354) requires agencies
to analyze the economic impact of regulatory changes on small entities.
Third, the Trade Agreements Act (Pub. L. 96-39 as amended) prohibits
agencies from setting standards that create unnecessary obstacles to
the foreign commerce of the United States. In developing U.S.
standards, the Trade Agreements Act requires agencies to consider
international standards and, where appropriate, that they be the basis
of U.S. standards. Fourth, the Unfunded Mandates Reform Act of 1995
(Pub. L. 104-4) requires agencies to prepare a written assessment of
the costs, benefits, and other effects of proposed or final rules that
include a Federal mandate likely to result in the expenditure by State,
local, or tribal governments, in the aggregate, or by the private
sector, of $100 million or more annually (adjusted for inflation with
base year of 1995). The FAA has provided a more detailed Regulatory
Impact Analysis of the benefits and costs of this final rule in the
docket of this rulemaking. This portion of the preamble summarizes the
findings of this analysis.
In conducting these analyses, FAA has determined that this rule
will unleash economic benefits that will outweigh its costs. This rule
is a significant regulatory action, as defined in section 3(f) of
Executive Order 12866, as it raises novel policy issues. This rule is
also significant under DOT's administrative procedure rule on
rulemaking at 49 CFR 5.13 for the same reason. The rule will have a
significant economic impact on a substantial number of small entities.
It will not create unnecessary obstacles to the foreign commerce of the
United States, and will not impose an unfunded mandate on State, local,
or tribal governments, or on the private sector.
Changes to Regulatory Impact Analysis Since the Proposed Rule
The FAA updates its analysis for changes incorporated in the final
rule and additional information and data identified during the comment
period. The following is a summary of these changes (see the Regulatory
Impact Analysis available in the docket for additional discussion and
detail).
Changes period of analysis from 5 to 10 years to capture
the effects of a five-year compliance period and recurring impacts of
the rule.
Provides a range of net impacts from low to high based on
launch forecast that includes base, low, and high scenarios. The FAA
uses the base scenario as the primary estimate of the net impacts of
this rule.
Incorporates additional data to update savings estimates
for changes to an FSS.
Updates data and analysis of neighboring operations
(number of personnel that evacuate) that decreased savings.
Updates wage data and adds/clarifies small costs.
Statement of Need
In 2018, DOT was directed by the National Space Council and SPD-2
to streamline the regulations governing commercial space launch and
reentry licensing. The purpose of the final rule is to streamline and
simplify the licensing of launch and reentry operations by relying on
performance-based regulations rather than prescriptive regulations.
This action consolidates and revises multiple commercial space launch
and reentry regulations addressing licensing into a single regulatory
part that states safety objectives to be achieved for the launch of
suborbital and orbital launch vehicles, and the reentry of reentry
vehicles. This action also enables flexible time frames, removes
unnecessarily burdensome ground safety regulations, redefines when
launch begins to allow specified pre-flight operations prior to license
approval, and allows applicants to seek a license to launch from
multiple sites. This rule is necessary to reduce the need to file and
process waivers, improve clarity of the regulations, and relieve
unnecessary administrative and cost burdens on industry and the FAA.
The intended effect of this action is to make commercial space
transportation regulations more efficient and effective, while
maintaining public safety.
Affected Operators and Launches
At the time of writing based on FAA license data, the FAA estimates
this rule will affect 12 operators that have an active license or
permit to conduct launch or reentry operations. In addition, the FAA
estimates this rule will affect approximately 672 to 800 launches over
the next 10 years, with a base or primary estimate of approximately 737
launches.\197\ The
[[Page 79698]]
FAA anticipates this rule will reduce the costs of current and future
launch operations by removing current prescriptive requirements that
are often burdensome to comply with or require a waiver. The FAA
expects these changes will lead to more efficient launch operations and
have a positive effect on expanding the number of future launch and
reentry operations.
---------------------------------------------------------------------------
\197\ Based on historical launch data from the FAA Office of
Commercial Space Transportation and the 2020 FAA Aerospace Forecast
(https://www.faa.gov/data_research/aviation/aerospace_forecasts/media/FY2020-40_FAA_Aerospace_Forecast.pdf). See the Regulatory
Impact Analysis of this rule in the docket for more information. The
FAA acknowledges that there is uncertainty estimating future
launches over a 10-year period since industry is expanding and
planning for more launches in the future given expected business and
economic conditions. In addition, historical data has shown that
there is uncertainty and variation with the number of planned
launches that result in actual launches on annual basis.
---------------------------------------------------------------------------
Summary of Impacts
The FAA bases the analysis of this rule on a launch forecast that
includes base, low, and high scenarios. Accordingly, this analysis
provides a range of net impacts from low to high based on these
forecast scenarios. The FAA uses the base scenario as the primary
estimate of the net impacts of this rule.
For the primary estimate, over a 10-year period of analysis, the
rule will result in present value net cost savings to industry of about
$53.9 million at a seven percent discount rate with annualized net cost
savings of about $7.7 million. At a three percent discount rate, the
10-year present value net cost savings to industry is about $68.3
million with annualized net cost savings of about $8.0 million. The
rule will also result in net present value savings for the FAA of about
$1.7 million at a seven percent discount rate over the same period of
analysis, with annualized net cost savings of about $0.24 million. At a
three percent discount rate, the net present value savings for the FAA
is about $2.3 million with annualized net cost savings of about $0.27
million.
The largest quantified cost saving for industry will result from
eliminating or modifying requirements for an FSS on some launches:
About $52.6 million in present value savings over 10 years at a seven
percent discount rate or about $66.6 million at a three percent
discount rate. As previously discussed, the FAA will move from
prescriptive FSS requirements to performance-based requirements. The
rule will not require all launch vehicles to have an FSS. Launch
vehicles that have a very low probability of multiple casualties even
if vehicle control fails will not be required to have as robust an FSS.
In addition, vehicles that have moderately low probability of casualty,
even if vehicle control fails, will not be required to have robust
FSS.\198\ These performance-based requirements will reduce costs for
some vehicle operators, especially for small vehicles or those
operating in remote locations.
---------------------------------------------------------------------------
\198\ See discussion in the FSS preamble section.
---------------------------------------------------------------------------
The final rule will also generate another important area of
quantified savings by providing a new definition of ``neighboring
operations personnel'' and establishing new criteria for neighboring
launch site personnel for the purposes of risk and financial
responsibility. The change will allow affected operators to reduce the
number of personnel that must evacuate and will enable operations that
are more concurrent by accepting a small safety risk tradeoff. The FAA
has monetized the value of this small increased safety risk as
summarized in the following tables. The FAA estimates the present value
of these small increased safety risks to be about $0.16 million
discounted at seven percent or about $0.2 million discounted at three
percent over ten years.
The FAA estimates some small costs to industry that will assist
both industry and the FAA in the implementation of this final rule,
such as providing information to the FAA that other agencies frequently
request or performing one-time updates of flight safety limit analyses
and ground hazard analyses that will be used to determine performance-
based means of compliance that provide future savings. In addition,
there may be additional costs for the modification of existing licenses
to benefit from the cost saving provisions of this final rule. The FAA
will also incur small costs for payload review, flight hazard analysis,
ground hazard analysis, and the review of modifications to existing
licenses.
The following tables present a summary of the primary, low, and
high estimates of the quantified savings, costs, and the net impacts of
the rule.
Summary of 10-Year Quantified Savings, Costs and Net Impacts--Base Scenario or Primary Estimate
[Presented in thousands of dollars]
----------------------------------------------------------------------------------------------------------------
Industry Industry
Impact present value present value FAA present FAA present
(7%) (3%) value (7%) value (3%)
----------------------------------------------------------------------------------------------------------------
Cost Savings................................ $54,634.8 $69,193.0 $1,864.2 $2,468.3
Costs....................................... -733.3 -872.2 -162.7 -199.6
-------------------------------------------------------------------
Net Cost Savings........................ 53,901.5 68,320.7 1,701.5 2,268.7
-------------------------------------------------------------------
Annualized Net Cost Savings......... 7,674.4 8,009.3 242.3 266.0
----------------------------------------------------------------------------------------------------------------
Increased Safety Risks...................... -158.5 -197.3 ............... ...............
-------------------------------------------------------------------
Net Cost Savings less Increased Safety 53,743.0 68,123.5 1,701.5 2,268.7
Risks..................................
-------------------------------------------------------------------
Annualized Net Cost Savings less 7,651.8 7,986.1 242.3 266.0
Increased Safety Risks.............
----------------------------------------------------------------------------------------------------------------
Notes: In this and the following tables, the sum of individual items may not equal totals due to rounding.
Negative signs used to indicate costs and increased safety risks. Present value estimates provided at seven
and three percent discount rates per OMB guidance.
Summary of 10-Year Quantified Savings, Costs and Net Impacts--Low Scenario
[Presented in thousands of dollars]
----------------------------------------------------------------------------------------------------------------
Industry Industry
Impact present value present value FAA present FAA present
(7%) (3%) value (7%) value (3%)
----------------------------------------------------------------------------------------------------------------
Cost Savings................................ $44,274.1 $56,404.8 $1,850.3 $2,449.5
[[Page 79699]]
Costs....................................... -695.3 -828.0 -146.8 -180.6
-------------------------------------------------------------------
Net Cost Savings........................ 43,578.8 55,576.7 1,703.5 2,268.9
-------------------------------------------------------------------
Annualized Net Cost Savings......... 6,204.6 6,515.3 242.5 266.0
----------------------------------------------------------------------------------------------------------------
Increased Safety Risks...................... -143.8 -179.6 ............... ...............
-------------------------------------------------------------------
Net Cost Savings less Increased Safety 43,435.0 55,397.2 1,703.5 2,268.9
Risks..................................
-------------------------------------------------------------------
Annualized Net Cost Savings less 6,184.2 6,494.2 242.5 266.0
Increased Safety Risks.............
----------------------------------------------------------------------------------------------------------------
Summary of 10-Year Quantified Savings, Costs and Net Impacts--High Scenario
[Presented in thousands of dollars]
----------------------------------------------------------------------------------------------------------------
Industry Industry
Impact present value present value FAA present FAA present
(7%) (3%) value (7%) value (3%)
----------------------------------------------------------------------------------------------------------------
Cost Savings................................ $64,993.7 $81,979.8 $1,878.4 $2,487.5
Costs....................................... -769.6 -914.8 -179.2 -219.4
-------------------------------------------------------------------
Net Cost Savings........................ 64,224.1 81,065.0 1,699.3 2,268.1
-------------------------------------------------------------------
Annualized Net Cost Savings......... 9,144.1 9,503.3 241.9 265.9
----------------------------------------------------------------------------------------------------------------
Increased Safety Risks...................... -172.5 -214.3 ............... ...............
-------------------------------------------------------------------
Net Cost Savings less Increased Safety 64,051.6 80,850.7 1,699.3 2,268.1
Risks..................................
-------------------------------------------------------------------
Annualized Net Cost Savings less 9,119.5 9,478.2 241.9 265.9
Increased Safety Risks.............
----------------------------------------------------------------------------------------------------------------
The following table summarizes quantified impacts by provision
category for the primary estimate (see the Regulatory Impact Analysis
in the docket for tables presenting low and high estimates of
quantified impacts by provision category).
Summary of 10-Year Quantified Savings, Costs and Net Impacts by Provision Base Scenario--Primary Estimate
[Presented in thousands of dollars]
----------------------------------------------------------------------------------------------------------------
Industry Industry
Provision category/impact present value present value FAA present FAA present
(7%) (3%) value (7%) value (3%)
----------------------------------------------------------------------------------------------------------------
Waiver Avoidance:
--Definition of ``Launch''.............. $23.7 $32.1 $7.5 $10.1
--Waterborne Vessel Hazard Areas........ 47.5 64.2 14.9 20.2
--Waiver for 48 Hour Readiness.......... 29.7 40.1 9.3 12.6
System Safety Program--Safety Official...... 28.4 38.4 33.3 45.0
Duration of a Vehicle License............... 36.6 49.4 76.1 102.8
Readiness--Elimination of pre-launch meeting 860.7 1,169.5 155.9 211.8
15 days prior..............................
Flight Safety System--Not required for all 52,618.2 66,554.4 1,453.9 1,912.7
launches...................................
Flight Safety Analysis no longer required 34.4 46.7 4.4 6.0
for hybrids................................
Neighboring Operations *.................... 873.6 1,087.4 ............... ...............
Ground Hazard Analysis...................... 81.9 110.7 108.8 147.0
-------------------------------------------------------------------
Total Cost Savings...................... 54,634.8 69,193.0 1,864.2 2,468.3
----------------------------------------------------------------------------------------------------------------
Payload Review and Determination............ -52.5 -71.2 -54.0 -73.4
Safety criteria............................. -55.3 -64.1 ............... ...............
Flight Hazard Analysis...................... -56.9 -68.0 -15.9 -19.0
Flight Abort--Flight Safety Limits 58.5 79.0 ............... ...............
Constraint.................................
Flight Safety Limit Analysis................ -114.0 -143.3 ............... ...............
Far-field Overpressure Blast Effects -2.9 -3.9 ............... ...............
Analysis...................................
Safety-Critical System Design............... -19.3 -26.1 ............... ...............
Ground Hazard Analysis...................... -42.4 -57.3 -19.8 -26.8
[[Page 79700]]
Waivers for Neighboring Operations Personnel -171.5 -192.9 -54.0 -60.7
Modification Costs for Existing Licenses.... -160.2 -166.4 -19.0 -19.8
-------------------------------------------------------------------
Total Costs............................. -733.3 -872.2 -162.7 -199.6
-------------------------------------------------------------------
Net Cost Savings........................ 53,901.5 68,320.7 1,701.5 2,268.7
-------------------------------------------------------------------
Annualized Net Cost Savings......... 7,674.4 8,009.3 242.3 266.0
----------------------------------------------------------------------------------------------------------------
Increased Safety Risks: Neighboring -158.5 -197.3 ............... ...............
Operations *...............................
-------------------------------------------------------------------
Net Cost Savings less Increased Safety 53,743.0 68,123.5 1,701.5 2,268.7
Risks..................................
-------------------------------------------------------------------
Annualized Net Cost Savings less 7,651.8 7,986.1 242.3 266.0
Increased Safety Risks.............
----------------------------------------------------------------------------------------------------------------
Table notes: The sum of individual items may not equal totals due to rounding. Negative signs used to indicate
costs and increased safety risks in this table. Present value estimates are provided at seven and three
percent discount rates per OMB guidance.
* Changes to Neighboring Operations requirements result in net savings are less increased safety risks.
The FAA also expects industry will gain additional unquantified
savings and benefits from the final rule, because the rule provides
flexibility and scalability through performance-based requirements that
will reduce the future cost of innovation and improve the efficiency
and productivity of U.S. commercial space transportation.
The following table summarizes some of the changes that will result
in unquantified savings.
Unquantified Savings
------------------------------------------------------------------------
Change Savings
------------------------------------------------------------------------
Time Frames................................... The rule revises time
frames in parts 404,
413, 414, 415, 417,
420, 431, 437, and 440
that may be burdensome
for some operators.
This will increase
flexibility by allowing
an operator the option
to propose alternative
time frames that better
suit its operations.
Eligible time frames
include preflight and
post-flight reporting
among others listed in
Appendix A to Part 404--
Alternative Time
Frames.
Safety Element Approval....................... The rule removes the
requirement in part 414
to publish in the
Federal Register the
criteria upon which
safety element
approvals were based.
The purpose of this
notification
requirement was to make
clear the criteria and
standards the FAA used
to assess a safety
element, particularly
when no clear
regulatory requirement
existed and there could
be other potential
users of the safety
approval. However, the
FAA finds that this
requirement is
unnecessary, and has
potentially discouraged
applications for safety
element approvals due
to concerns that
proprietary data may be
disclosed. The FAA
anticipates that
removing this
requirement will lead
to increased use of
safety element
approvals, reducing
industry burden, and
potentially improving
safety.
Mishaps....................................... The rule provides the
following mishap-
related enhancements,
which will better
tailor mishap
responses.
Replaces
current part 400
mishap related
definitions with a
consolidated mishap
definition
(streamlines and
reduces confusion).
Consolidates
existing part 400
mishap/accident
investigation and
emergency response
plan requirements
into a single part
(streamlines and
reduces confusion).
Exempts pre-
coordinated test-
induced property
damage from being a
mishap (removes need
to consider test-
induced property
damages from mishap
requirements and
likely results in
fewer investigations
of minor mishaps).
Eliminates
the small $25,000
monetary threshold
from the current
mishap and accident
investigation
requirements
potentially reducing
the number of
mishaps investigated
that do not pose a
threat to public
safety. Minor damage
that does not pose a
threat to public
safety can easily
exceed the $25,000
monetary threshold,
triggering
potentially costly
and burdensome
notification,
reporting, and
investigation
requirements.
Clarifies
that a mishap is
triggered by
hazardous debris
falling outside a
planned landing site
or designated hazard
area. As a result,
non-hazardous
debris, no matter
where it falls, will
not be considered a
mishap potentially
avoiding unnecessary
notification,
reporting, and
investigation
requirements.
Toxics........................................ The rule replaces part
417 toxic release
hazard analysis
requirements with
performance-based
regulations that will
provide flexibility for
operators to comply
with the required risk
criteria in varied and
innovative ways for
their ground
operations.
Lightning protection requirement.............. The rule removes
Appendix G to part 417,
Natural and Triggered
Lightning Flight Commit
Criteria, and replaces
it with the performance-
based requirements. The
current requirements
are outdated,
inflexible, overly
conservative, and not
explicitly applicable
to RLVs and reentry
vehicles.
------------------------------------------------------------------------
[[Page 79701]]
The FAA analyzed the impacts of this rule based on the best
available data at the time of writing. The FAA acknowledges that there
are uncertainties with the savings and costs of this rule given the
variety of operators, locations of operations, and the scale and
complexity of operations. In addition, there is uncertainty regarding
how operators holding an active license, or who have an accepted
license application, will choose to operate during the five-year
compliance period after the effective date of the rule (i.e., choose to
operate under part 450 or operate under the legacy parts 415 and 417
for expendable launch vehicles, part 431 for reusable launch vehicles,
and part 435 for reentry vehicles). Lastly, there is uncertainty in the
range and scope of future means of compliance, since this rule replaces
many prescriptive regulations with performance-based rules, giving
industry greater flexibility to develop means of compliance that meet
their unique business objectives while maintaining public safety. All
of these factors may result in variation of savings and costs for
individual operators during and after the five-year compliance period.
As previously discussed, the FAA will continue to work with industry to
identify alternative means of compliance to provide future savings and
efficiencies from this rule as industry continues to evolve.
B. Regulatory Flexibility Act
The Regulatory Flexibility Act of 1980 (Pub. L. 96-354) (RFA)
establishes ``as a principle of regulatory issuance that agencies shall
endeavor, consistent with the objectives of the rule and of applicable
statutes, to fit regulatory and informational requirements to the scale
of the businesses, organizations, and governmental jurisdictions
subject to regulation. To achieve this principle, agencies are required
to solicit and consider flexible regulatory proposals and to explain
the rationale for their actions to assure that such proposals are given
serious consideration.'' The RFA covers a wide-range of small entities,
including small businesses, not-for-profit organizations, and small
governmental jurisdictions.
Agencies must perform a review to determine whether a proposed or
final rule would have a significant economic impact on a substantial
number of small entities. If the determination is that it would, the
agency must prepare a regulatory flexibility analysis as described in
the RFA.
The FAA estimates this final rule will have a significant economic
impact on a substantial number of small entities and therefore has
performed the following Final Regulatory Flexibility Analysis in
accordance with section 604(a)(1)-(a)(6).
(1) A statement of the need for, and objectives of, the rule.
The Department of Transportation was directed by the National Space
Council in February 2018, and SPD-2 to streamline the regulations
governing commercial space launch and reentry licensing. The goal of
the streamlining rule is to create a single licensing regime for
expendable and reusable launch vehicles and reentry vehicles.
The purpose of the final rule is to streamline and simplify the
licensing of launch and reentry operations by relying on performance-
based regulations rather than prescriptive regulations. This action
consolidates and revises multiple commercial space launch and reentry
regulations addressing licensing into a single regulatory part that
states safety objectives to be achieved for the launch of suborbital
and orbital expendable and reusable launch vehicles, and the reentry of
reentry vehicles. This action also enables flexible time frames,
removes unnecessarily burdensome ground safety regulations, redefines
when launch begins to allow specified pre-flight operations prior to
license approval, and allows applicants to seek a license to launch
from multiple sites. This rule is necessary to reduce the need to file
and process waivers, improve clarity of the regulations, and relieve
administrative and cost burdens on industry and the FAA. The intended
effect of this action is to make commercial space transportation
regulations more efficient and effective, while maintaining public
safety.
(2) A statement of the significant issues raised by the public
comments in response to the initial regulatory flexibility analysis, a
statement of the assessment of the agency of such issues, and a
statement of any changes made in the proposed rule as a result of such
comments.
Commenters indicated that the FAA only identified two small
entities that will be affected by the rule and left out numerous small
entities that will be affected. The FAA has reevaluated and identified
at least five small entities that will be affected by the rule and
indicates this fact in the description of small entities section in
this Final Regulatory Flexibility Analysis.
An individual commenter also noted that beyond the small entities
not addressed in the analysis as noted above, the FAA's proposal would
also impact small companies that are subcontractors, suppliers, or
service providers to licensed launch or reentry operators, both in
regard to a particular event and in the activities of neighboring
operations not involved in a particular licensed or permitted event.
The FAA finds these subcontractors, suppliers, or service providers
to licensed launch and reentry operators are not directly impacted by
the rule. The RFA requires an agency to perform a regulatory
flexibility analysis of small entity impacts only when a rule directly
regulates small entities. A commenter indicated that small State or
local governmental jurisdictions might be affected by the rule and
these were not mentioned by the FAA in the RFA. The commenter appeared
to be referring to potential costs from environmental review practices
and policies now being codified into rules. The FAA addresses concerns
related to potential costs from this codification in the comment
section of this preamble and finds that the potential costs are
negligible.
An individual commenter claimed several proposed new flight safety
requirements would impose complex and costly risk analyses on small
entities, including the ``consequence protection'' requirement, the
``critical assets'' risk assessment requirement, and flight software
requirements. Also, the commenter pointed out the duplicative or
conflicting rules among overlapping Federal jurisdictions as creating a
barrier for small startups.
The FAA finds the costs of these critical asset and consequence
protection requirements will be small or nonexistent. Operators in
remote locations will likely be able to avoid the higher costs of a
highly reliable FSS by demonstrating through a CEC analysis
that the launch in question will not exceed a certain risk threshold.
The initial CEC analysis under Sec. 450.101 that is
estimated to cost $2,500 may relieve some operators from the expense of
any FSS. If a determination is made that an FSS is necessary, further
analysis under Sec. 450.108 will be performed to determine the flight
safety limits needed for the FSS. The FAA estimated the cost of the
additional analysis to account for CEC in the flight safety
limit is $10,000. Of course, an operator could avoid these analysis
costs simply by choosing to use a highly reliable FSS, but the FAA
assumes that an operator would not perform these analyses if it
expected that it would still need the most highly reliable FSS. The
worst case would be that the operator would incur $12,500 in costs but
still need an FSS, just not a highly reliable FSS. The final rule also
allows an applicant to propose an alternative to CEC that
would measure
[[Page 79702]]
or mitigate the potential for a high consequence event by use of other
safeguards.
The identification of critical assets and the analysis to determine
how to protect the critical assets will be performed by the ranges for
launches from Federal sites and by the FAA for launches from non-
Federal sites. Therefore, small entities will not bear these costs.
(3) The response of the agency to any comments filed by the Chief
Counsel for Advocacy of the Small Business Administration in response
to the proposed rule, and a detailed statement of any change made to
the proposed rule in the final rule as a result of the comments.
The Chief Counsel for Advocacy of the Small Business Administration
did not file comments in response to the proposed rule.
(4) A description of and an estimate of the number of small
entities to which the rule will apply or an explanation of why no such
estimate is available.
The FAA identifies at least five licensees that would qualify as
small businesses. The rule will have a large effect in terms of cost
savings on some of these small businesses. In addition to the five
operators, there are two licensees that will be affected by the rule
that may fall under the small business threshold in terms of number of
employees, but they are subsidiaries of large parent companies and
therefore are not considered small businesses.
(5) A description of the projected reporting, recordkeeping, and
other compliance requirements of the rule, including an estimate of the
classes of small entities that will be subject to the requirement and
the type of professional skills necessary for preparation of the report
or record.
The rule will result in a reduction in reporting requirements
because there will be fewer requests for waivers to certain provisions,
fewer requests to modify licenses when a safety officer changes, and
fewer licenses having to be issued because there will be extension of
RLV licenses up to five years. The documentation accompanying a ground
hazard analysis for ELV operators will be reduced due to change in
launch scope.
Some new requirements will result in additional reporting. This
reporting includes the following:
(1) Paperwork associated with payload review and determination,
and safety criteria analyses;
(2) Paperwork resulting from the flight safety limits analysis
and the far-field overpressure blast effects analysis;
(3) Paperwork submitted by legacy license who would like to
waive the higher conditional expected casualty level for neighboring
operations under the current regulations, or the new ground safety
requirements for RLV operators; and
(4) Paperwork costs for those operators who modify their
licenses in the first five years to comply with the new regulations.
The paperwork costs are discussed in more detail in the Paperwork
Reduction Analysis section of this preamble.
(6) A description of the steps the agency has taken to minimize the
significant economic impact on small entities consistent with the
stated objectives of applicable statutes, including a statement of the
factual, policy, and legal reasons for selecting the alternative
adopted in the final rule and why each one of the other significant
alternatives to the rule considered by the agency which affect the
impact on small entities was rejected.
a. Factual, Policy, and Legal Reasons for Selecting the Adopted
Alternative
The Commercial Space Launch Act of 1984, as amended and re-codified
at 51 U.S.C. 50901-50923 (the Act), authorizes the Department of
Transportation, and the FAA through delegation, to oversee, license,
and regulate commercial launch and reentry activities, and the
operation of launch and reentry sites as carried out by U.S. citizens
or within the United States. Section 50905 directs the FAA to exercise
this responsibility consistent with public health and safety, safety of
property, and the national security and foreign policy interests of the
United States. The FAA is authorized to regulate only to the extent
necessary to protect the public health and safety, safety of property,
and national security and foreign policy interests of the United
States. In addition, section 50903 requires that the FAA encourage,
facilitate, and promote commercial space launches and reentries by the
private sector.
This rulemaking streamlines and increases flexibility in the FAA's
commercial space regulations. This action consolidates and revises
multiple regulatory parts to apply a single set of licensing and safety
regulations across several types of operations and vehicles. It also
replaces many prescriptive regulations with performance-based rules,
giving industry greater flexibility to develop means of compliance that
maximize their business objectives while maintaining an equivalent
level of safety to the agency's current regulations. Because this
rulemaking amends the FAA's launch and reentry requirements, it falls
under the authority delegated by the Act.
b. Alternatives Considered
The FAA considered three alternatives to the proposed rule. The FAA
restates these alternatives below. The FAA did not receive comment
convincing it that any of these alternatives would be better than the
rule it proposed and is now finalizing.
i. No Change to Current Regulations
This alternative was not chosen because the current regulations are
outdated, prescriptive, and do not adequately reflect industry current
practices or technology development. The inefficiency of the licensing
process due to current regulations risks stifling innovation and growth
of the industry, especially for small operators.
ii. Propose a More Process-Based Regulatory Approach
With this alternative, the FAA would have proposed less detailed
regulations that would have relied primarily on the outcome of an
operator's system safety process to protect public safety. The FAA did
not chose this alternative because it would have lacked regulatory
clarity and hazard control flexibility. System safety process is one
method to derive hazard controls; however, there are other hazard
control strategies that are more appropriate for some operations.
Specifically, physical containment, wind weighting, and, most
importantly, flight abort are often sufficient. Part 450 incorporates
the flexibility of part 431, but acknowledges the acceptability of
other hazard control strategies. Part 450 also builds on the precedent
set by part 431's limits on the foreseeable consequences of a failure
in terms of conditional expected casualties and establishes a less
stringent threshold.With this final rule, the FAA declines to adopt
this alternative.
iii. Propose a Defined Modular Application Process
With this alternative, the FAA would have proposed similar safety
requirements but would have added a more defined incremental or modular
application process. The final rule enables an incremental application
process, but does not define one with explicit modules and time frames.
This alternative was not chosen because the FAA has no experience with
an incremental or modular application process with which to base a
rule. In addition, a more defined incremental or modular application
process may be less flexible and scalable and therefore more burdensome
to small operators.
[[Page 79703]]
The FAA expects this final rule will provide regulatory relief to
small entities from current prescriptive requirements and result in net
savings. Accordingly, the FAA declines to adopt this alternative.
c. Cost Savings to Small Entities
The following sections identifies key provisions of the rule that
minimize impacts to and expand flexibilities for small entities.
i. Readiness--Elimination of Pre-Launch Meeting 15 Days Prior (Sec.
450.155)
ELV operators might save $4,683 per avoided launch readiness
meeting; however, this assumes the average number of people at each
meeting would be 25 and this might not apply to a small business.
ii. Flight Safety System--Not Required for All Launches (Sec. 450.145)
For launches for which an FSS would not be required under the
proposal, ELV operators might save $100,000 to $680,000 per launch and
RLV operators might save $20,000 per launch vehicle.
ELV operators might save between $479,000 and $1.4 million in non-
recurring costs and RLV operators might save approximately $375,000 for
new FSS designs by not having to incur all the research, design,
testing, materials, and installation costs for an FSS. This is likely
to benefit small operators launching from remote sites.
iii. Ground Hazard Analysis (Sec. 450.185)
An ELV operator might save approximately $28,026 per application by
not having to do a ground hazard analysis under this final rule.
d. Costs to Small Entities
The following sections identify provisions of the rule that might
result in additional costs for small entities. However, the rule
provides a compliance period of five years for holders of current
licenses at the effective date of the final rule and those who have an
accepted application within 90 days of the effective date of the final
rule. This will provide small operators more time to comply with the
final rule and will reduce costs.
i. Payload Review and Determination (Sec. 450.43)
The final rule could cause small operators to incur about $206 more
per launch than due to additional payload review and determination
costs.
ii. Flight Hazard Analysis (Sec. 450.107)
Operators who do not need FSS, and choose to operate without one,
will have to perform a flight hazard analysis. RLV operators currently
do flight hazard analyses, while ELV operators do not. To save the
costs of an FSS, an ELV operator will have to use another hazard
control strategy which will likely be a flight hazard analysis. In the
regulatory impact analysis, two small businesses have to perform a
flight hazard analysis. However, the cost savings of not having to have
an FSS will far exceed the costs of the flight hazard analysis.
iii. Flight Abort (Sec. 450.108(d)) Flight Safety Limits Constraint
Some operators will choose to do a CEC analysis
voluntarily as part of the flight safety limits analysis so they can
expand the area their flights can pass through. These operators would
only do this additional analysis if they expected the benefit to exceed
the cost. The estimated voluntary cost of $10,000 per license could be
incurred by small businesses.
iv. Far-Field Overpressure Blast Effects Analysis (Sec. 450.137)
Additional costs are $330 per application.
v. Safety-Critical System Design (Sec. 450.143)
Additional documentation costs are $1,649 per application.
vi. Ground Hazard Analysis (Sec. 450.185)
RLV applicants might incur about $7,254 more per application due to
having to perform ground hazard analyses under the final rule.
As previously discussed, the FAA provides a compliance period of
five years in the final rule for holders of current licenses at the
effective date of the final rule and those who have an accepted
application within 90 days of the effective date of the final rule.
This will give all businesses, including the small operators, more time
to comply with the final rule. This will reduce the burden on small
entities.
C. International Trade Impact Assessment
The Trade Agreements Act of 1979 (Pub. L. 96-39), as amended by the
Uruguay Round Agreements Act (Pub. L. 103-465), prohibits Federal
agencies from establishing standards or engaging in related activities
that create unnecessary obstacles to the foreign commerce of the United
States. Pursuant to these Acts, the establishment of standards is not
considered an unnecessary obstacle to the foreign commerce of the
United States, if the standard has a legitimate domestic objective,
such as the protection of safety, and does not operate in a manner that
excludes imports that meet this objective. The statute also requires
consideration of international standards and, where appropriate, that
they serve as the basis for U.S. standards. The FAA has assessed the
potential effect of this final rule and determined that it will not
create unnecessary obstacles to the foreign commerce of the United
States.
D. Unfunded Mandates Assessment
Title II of the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-
4) requires each Federal agency to prepare a written statement
assessing the effects of any Federal mandate in a proposed or final
agency rule that may result in an expenditure of $100 million or more
(in 1995 dollars) in any one year by State, local, and tribal
governments, in the aggregate, or by the private sector; such a mandate
is deemed to be a ``significant regulatory action.'' The threshold
after adjustment for inflation is $150 million using the most current
annual (2017) Implicit Price Deflator for Gross Domestic Product from
the U.S. Bureau of Economic Analysis. This final rule does not contain
such a mandate; therefore, the requirements of Title II of the Act do
not apply.
E. Paperwork Reduction Act
The Paperwork Reduction Act of 1995 (44 U.S.C. 3507(d)) requires
that the FAA consider the impact of paperwork and other information
collection burdens imposed on the public. According to the 1995
amendments to the Paperwork Reduction Act (5 CFR 1320.8(b)(2)(vi)), an
agency may not collect or sponsor the collection of information, nor
may it impose an information collection requirement, unless it displays
a currently valid Office of Management and Budget (OMB) control number.
This action contains the following proposed consolidation of two
existing information collection requirements, previously approved under
OMB Control Numbers 2120-0608 and 2120-0643, under a new OMB control
number. As required by the Paperwork Reduction Act of 1995 (44 U.S.C.
3507(d)), the FAA will submit the proposed information collection
requirements to OMB for its review. In addition, the FAA has published
a separate notice of the proposed requirements for public comment, and
has included the notice in the docket for this rulemaking. The notice
includes instructions on how to submit comments specifically to the
proposed information collection requirements. Additional details on
assumptions and
[[Page 79704]]
calculations used in this section are presented in the Preliminary
Regulatory Impact Analysis available in the docket of this rulemaking.
The following estimates are included in the total savings and costs
summarized in the Regulatory Evaluation section and considered in the
Regulatory Flexibility Determination section of this proposed rule.
Because the FAA is allowing a five year compliance period for
existing operators holding a license under parts 417, 431, or 435, OMB
Control Numbers 2120-0608 and 2120-0643 will continue to be renewed for
five years. After five years, all operators are expected to comply with
part 450 and the new OMB number for collections.
Summary: The FAA proposes to consolidate under a new part 450, the
requirements currently contained in parts 415 and 417 for the launch of
an ELV, in part 431 for the launch and reentry of an RLV, and in part
435 for the reentry of a reentry vehicle other than an RLV. The result
of this effort will be streamlined regulations designed to be more
flexible and scalable, with reduced timelines and minimal duplicative
jurisdiction. The net result will be reduced paperwork for operators,
although for some provisions paperwork would increase.
Use: The information would be used by FAA to evaluate the launch
and reentry operators' applications and to ensure safety.
Paperwork Impact to Industry
Respondents: The information collection will potentially affect 12
operators based on available data at the time of writing.
Annual Burden Estimate: Most changes in part 450 will result in a
reduction in paperwork burden. The paperwork associated with industry
requesting waivers to certain provisions will be alleviated. Paperwork
associated with industry requesting license modifications would also be
reduced because an operator will not have to modify a license if the
specific safety official were to change. In addition, with the
extension of RLV licenses to up to five years, it is likely that fewer
licenses will be issued, resulting in less paperwork. Due to the change
in launch scope, the documentation accompanying a ground hazard
analysis for ELV operators would be reduced.
Industry Cost Savings
The following table indicates the frequency of responses, the
estimated time per response, the burdened wage rate, annual hours, and
the cost for each cost saving provision. Response frequency is provided
for the estimated number of waivers avoided (Sec. 450.3), estimated
reduction in annual number of licenses modified (Sec. 450.103),
estimated reduction in annual license renewals, and estimated annual
number of launches for which there would be a reduction in ground
hazard analysis paperwork (Sec. 450.185). An estimated time for each
response is also indicated below, as are burdened hourly wage rates for
the specific personnel associated with each provision and annual hours
and total cost savings.
Industry Paperwork Cost Savings
----------------------------------------------------------------------------------------------------------------
Estimated time
Description Response per response Industry wage Annual hours Cost savings
frequency (hours) rate
----------------------------------------------------------------------------------------------------------------
Waiver Avoidance (Sec. 450.3). 17 20 $101.52 340 $34,518
System Safety Program--Safety 5.6 24 72.40 134.4 9,731
Official (Sec. 450.103)......
Duration of a Vehicle License 1.2 126.5 82.43 151.8 12,513
(Sec. 450.7).................
Ground Hazard Analysis (Sec. 1 340 82.43 340 28,026
450.185).......................
-------------------------------------------------------------------------------
Total Annual Savings........ 24.8 .............. .............. 966 84,788
----------------------------------------------------------------------------------------------------------------
Cost savings includes paperwork related to waivers avoided due to
the definition of ``launch,'' waterborne vessel protection, and removal
of the 48-hour readiness requirement.
Industry Paperwork Burden
Other changes will result in an increase in paperwork burden. The
Payload Review and Determination section (Sec. 450.43) adds
requirements for applicants to provide explosive potential of payload
materials, alone and in combination with other materials on the payload
for launches, as well as the appropriate transit time to final orbit
for payloads with significant transit time after release from the
vehicle. The FAA is adding requirements for ground hazard analysis
(Sec. 450.185) for RLV launches. The provisions that will lead to
additional paperwork burdens are listed in the table below. The final
rule requires RLVs to submit information to the FAA.
The table below indicates the frequency of responses, estimated
time per response, burdened hourly wage rate, annual hours, and the
cost for each provision that would add burden. An estimated time per
response is also indicated below, as are burdened hourly wage rates for
the specific personnel associated with each provision and annual hours
and total cost savings.
Industry Paperwork Burden
----------------------------------------------------------------------------------------------------------------
Estimated time
Description Response per response Industry wage Annual hours Cost
frequency (hours) rate
----------------------------------------------------------------------------------------------------------------
Explosive Potential (Sec. 82 2 $82.43 164 $13,519
450.43)........................
Transit time (Sec. 450.43).... 82 0.5 82.43 41.0 3,380
Ground Hazard Analysis (Sec. 2 88 82.43 176 14,508
450.185).......................
Safety criteria (Sec. 4 60.66 82.43 80.88 6,667
450.101(c))....................
Flight Hazard Analysis (Sec. 2 53 82.43 106.67 8,793
450.107).......................
Flight Abort (Sec. 450.108(d)) 2 121 82.43 242.63 20,000
Flight Safety Limits Constraint
Flight Safety Limit Analysis 12 58 82.43 692 57,042
(Sec. 450.123)...............
Far-field Overpressure Blast 3 4 82.43 12 989
Effects Analysis (Sec.
450.137).......................
[[Page 79705]]
Safety-Critical System Design... 4 20 82.43 80 6,594
Waivers for Neighboring 18.9 20 101.52 378 38,375
Operations Personnel...........
Modification Costs for Existing 3 693 82.43 693 57,124
Licenses.......................
Records set up, record, archive. 82 4 89.72 328 29,429
Records retrieve and present.... 1 8 74.15 8 593
-------------------------------------------------------------------------------
Total Cost Burden........... 298 .............. .............. 3,002 257,012
----------------------------------------------------------------------------------------------------------------
The following table summarizes the industry total annual paperwork
savings, total annual paperwork burden and the net annual paperwork
savings.
Industry Net Paperwork Savings
------------------------------------------------------------------------
Description Annual hours Cost savings
------------------------------------------------------------------------
Total Annual Savings.................... 966 $84,787
Total Annual Burden..................... 3,002 257,012
-------------------------------
Net Annual Burden................... 2,036 172,225
------------------------------------------------------------------------
Paperwork Burden to the Federal Government
The following tables summarizes FAA paperwork savings and burden.
Similar to industry burden savings, the FAA receives burden relief from
waivers avoided due to the definition of ``launch,'' waterborne vessel
protection, and removal of the 48-hour readiness requirement. Other
provisions the FAA receives relief from and provisions that will impose
additional paperwork burden to the FAA are detailed in the tables
below. See the Regulatory Impact Analysis available in the docket for
more details on these estimates and calculations.
----------------------------------------------------------------------------------------------------------------
Estimated time
Description per response FAA wage rate Annual hours Cost savings
(hours)
----------------------------------------------------------------------------------------------------------------
FAA Paperwork Cost Savings
----------------------------------------------------------------------------------------------------------------
Waiver Avoidance (Sec. 450.3)................. 7.5 $85.17 127.5 $10,859
System Safety Program--Safety Official (Sec. 24 84.79 134.4 11,396
450.103).......................................
Duration of a Vehicle License (Sec. 450.7).... 253.5 85.54 304.2 26,021
Ground Safety (Sec. 450.185).................. 439 84.79 439 37,223
---------------------------------------------------------------
Total Annual Savings........................ .............. .............. 1,005 85,499
----------------------------------------------------------------------------------------------------------------
FAA Paperwork Burden
----------------------------------------------------------------------------------------------------------------
Explosive Potential (Sec. 450.43)............. 2.0 84.79 164 13,906
Transit time (Sec. 450.43).................... 0.5 84.79 41 3,476
Ground Safety (Sec. 450.185).................. 40 84.79 80 6,783
Flight Hazard Analysis (Sec. 450.107)......... 47 78.27 31 2,452
Waivers for Neighboring Operations Personnel.... 8 85.17 142 12,094
Modification Costs for Existing Licenses........ 80 84.79 80 6,783
Records retrieve and present.................... 20 84.79 20 1,696
---------------------------------------------------------------
Total Annual Burden......................... .............. .............. 558 47,191
----------------------------------------------------------------------------------------------------------------
FAA Net Paperwork Savings
------------------------------------------------------------------------
Description Annual hours Cost savings
------------------------------------------------------------------------
Total Annual Savings.................... 1,005 $85,499
Total Annual Burden..................... 558 47,191
-------------------------------
Net Annual Savings.................. 447 38,308
------------------------------------------------------------------------
[[Page 79706]]
Individuals and organizations may send comments on the information
collection requirement to the address listed in the ADDRESSES section
at the beginning of this preamble by March 10, 2021. Comments also
should be submitted to the Office of Management and Budget, Office of
Information and Regulatory Affairs, Attention: Desk Officer for FAA,
New Executive Building, Room 10202, 725 17th Street NW, Washington, DC
20053.
F. International Compatibility
In keeping with U.S. obligations under the Convention on
International Civil Aviation, it is FAA policy to conform to
International Civil Aviation Organization (ICAO) Standards and
Recommended Practices to the maximum extent practicable. The FAA has
determined that there are no ICAO Standards and Recommended Practices
that correspond to these proposed regulations.
G. Environmental Analysis
FAA Order 1050.1 identifies FAA actions that are categorically
excluded from preparation of an environmental assessment or
environmental impact statement under the National Environmental Policy
Act in the absence of extraordinary circumstances. The FAA has
determined this rulemaking action qualifies for the categorical
exclusion identified in FAA Order 1050.1 paragraph 5-6.6 and involves
no extraordinary circumstances.
V. Executive Order Determinations
A. Executive Order 13771, Reducing Regulation and Controlling
Regulatory Costs
This final rule is considered an E.O. 13771 deregulatory action.
Details on the estimated cost savings of this final rule can be found
in the rule's economic analysis.
B. Executive Order 13132, Federalism
The FAA has analyzed this final rule under the principles and
criteria of Executive Order 13132, ``Federalism.'' The agency
determined that this action will not have a substantial direct effect
on the States, or the relationship between the Federal Government and
the States, or on the distribution of power and responsibilities among
the various levels of government, and, therefore, does not have
federalism implications.
C. Executive Order 13211, Regulations That Significantly Affect Energy
Supply, Distribution, or Use
The FAA analyzed this final rule under Executive Order 13211,
``Actions Concerning Regulations that Significantly Affect Energy
Supply, Distribution, or Use'' (May 18, 2001). The agency has
determined that it is not a ``significant energy action'' under the
executive order and it is not likely to have a significant adverse
effect on the supply, distribution, or use of energy.
D. Executive Order 13609, International Cooperation
Executive Order 13609, ``Promoting International Regulatory
Cooperation,'' promotes international regulatory cooperation to meet
shared challenges involving health, safety, labor, security,
environmental, and other issues and to reduce, eliminate, or prevent
unnecessary differences in regulatory requirements. The FAA has
analyzed this action under the policies and agency responsibilities of
Executive Order 13609, and has determined that this action will not
affect international regulatory cooperation.
VI. How To Obtain Additional Information
Rulemaking Documents
An electronic copy of a rulemaking document may be obtained by
using the internet--
1. Search the Federal eRulemaking Portal at http://www.regulations.gov;
2. Visit the FAA's Regulations and Policies web page at http://www.faa.gov/regulations_policies/; or
3. Access the Government Printing Office's web page at http://www.gpo.gov/fdsys/.
Copies may also be obtained by sending a request (identified by
notice, amendment, or docket number of this rulemaking) to the Federal
Aviation Administration, Office of Rulemaking, ARM-1, 800 Independence
Avenue SW, Washington, DC 20591, or by calling (202) 267-9677.
Comments Submitted to the Docket
Comments received may be viewed by going to http://www.regulations.gov and following the online instructions to search the
docket number for this action. Anyone may search the electronic form of
all comments received into any of the FAA's dockets by the name of the
individual submitting the comment (or signing the comment, if submitted
on behalf of an association, business, labor union, etc.).
Small Business Regulatory Enforcement Fairness Act
The Small Business Regulatory Enforcement Fairness Act (SBREFA) of
1996 requires FAA to comply with small entity requests for information
or advice about compliance with statutes and regulations within its
jurisdiction. A small entity with questions regarding this document,
may contact its local FAA official, or the person listed under the FOR
FURTHER INFORMATION CONTACT heading at the beginning of the preamble.
To find out more about SBREFA on the internet, visit http://www.faa.gov/regulations_policies/rulemaking/sbre_act/.
List of Subjects
14 CFR Part 401
Organization and functions (Government agencies), Space
Transportation and exploration.
14 CFR Part 404
Administrative practice and procedure, Space transportation and
exploration.
14 CFR Part 413
Confidential business information, Space transportation and
exploration.
14 CFR Part 414
Airspace, Aviation safety, Space transportation and exploration.
14 CFR Part 415
Aviation safety, Environmental protection, Space transportation and
exploration.
14 CFR Part 417
Aircraft, Aviation safety, Reporting and recordkeeping
requirements, Space transportation and exploration.
14 CFR Part 420
Environmental protection, Reporting and recordkeeping requirements,
Space transportation and exploration.
14 CFR Part 431
Aviation safety, Environmental protection, Investigations,
Reporting and recordkeeping requirements, Space transportation and
exploration.
14 CFR Part 435
Aviation safety, Environmental protection, Investigations,
Reporting and recordkeeping requirements, Space transportation and
exploration.
14 CFR Part 437
Aircraft, Aviation safety, Reporting and recording keeping
requirements, Space transportation and exploration.
[[Page 79707]]
14 CFR Part 440
Indemnity payments, Insurance, Reporting and recordkeeping
requirements, Space transportation and exploration.
14 CFR Part 450
Aircraft, Aviation safety, Environmental protection,
Investigations, Reporting and recordkeeping requirements, Space
transportation and exploration.
In consideration of the foregoing, the Federal Aviation
Administration amends chapter III for commercial space transportation
rules of title 14, Code of Federal Regulations as follows:
PART 401--ORGANIZATION AND DEFINITIONS
0
1. The authority citation for part 401 continues to read as follows:
Authority: 51 U.S.C. 50101-50923.
0
2. Amend Sec. 401.5 by revising the introductory text to read as
follows:
Sec. 401.5 Definitions.
For the purposes of parts 415, 417, 431, 435, 440, and 460 of this
chapter, the following definitions apply:
* * * * *
Sec. 401.5 [Removed and Reserved]
0
3. Effective March 10, 2026, remove and reserve Sec. 401.5.
0
4. Add Sec. 401.7 to read as follows:
Sec. 401.7 Definitions.
For the purposes of this chapter unless otherwise excepted, the
following definitions apply:
Act means 51 U.S.C Subtitle V, Programs Targeting Commercial
Opportunities, chapter 509--Commercial Space Launch Activities, 51
U.S.C. 50901-50923.
Anomaly means any condition during licensed or permitted activity
that deviates from what is standard, normal, or expected, during the
verification or operation of a system, subsystem, process, facility, or
support equipment.
Associate Administrator means the Associate Administrator for
Commercial Space Transportation, Federal Aviation Administration, or
any person designated by the Associate Administrator to exercise the
authority or discharge the responsibilities of the Associate
Administrator.
Casualty means serious injury or death.
Casualty area means the area surrounding each potential debris or
vehicle impact point where serious injuries, or worse, can occur.
Command control system means the portion of a flight safety system
that includes all components needed to send a flight abort control
signal to the on-board portion of a flight safety system.
Contingency abort means a flight abort with a landing at a planned
location that has been designated in advance of vehicle flight.
Countdown means the timed sequence of events that must take place
to initiate flight of a launch vehicle or reentry of a reentry vehicle.
Crew means any employee or independent contractor of a licensee,
transferee, or permittee, or of a contractor or subcontractor of a
licensee, transferee, or permittee, who performs activities in the
course of that employment or contract directly relating to the launch,
reentry, or other operation of or in a launch vehicle or reentry
vehicle that carries human beings. A crew consists of flight crew and
any remote operator.
Critical asset means an asset that is essential to the national
interests of the United States. Critical assets include property,
facilities, or infrastructure necessary for national security purposes,
high priority civil space purposes, or assured access to space for
national priority missions.
Critical payload means a payload and essential infrastructure
directly supporting such a payload that is a critical asset that:
(1) Is so costly or unique that it cannot be readily replaced; or
(2) The time frame for its replacement would adversely affect the
national interests of the United States.
Crossrange means the distance measured along a line whose direction
is either 90 degrees clockwise (right crossrange) or counter-clockwise
(left crossrange) to the projection of a vehicle's planned nominal
velocity vector azimuth onto a horizontal plane tangent to the
ellipsoidal Earth model at the vehicle's sub-vehicle point. The terms
right crossrange and left crossrange may also be used to indicate
direction.
Deorbit means the flight of a vehicle that begins with the final
command to commit to a perigee below 70 nautical miles (approximately
130 kilometers), and ends when all vehicle components come to rest on
the Earth.
Disposal means the return or attempt to return, purposefully, a
launch vehicle stage or component, not including a reentry vehicle,
from Earth orbit to Earth, in a controlled manner.
Downrange means the distance measured along a line whose direction
is parallel to the projection of a vehicle's planned nominal velocity
vector azimuth into a horizontal plane tangent to the ellipsoidal Earth
model at the vehicle sub-vehicle point. The term downrange may also be
used to indicate direction.
Effective casualty area means the aggregate casualty area of each
piece of debris created by a vehicle failure at a particular point on
its trajectory. The effective casualty area for each piece of debris is
a modeling construct in which the area within which 100 percent of the
population are assumed to be a casualty, and outside of which 100
percent of the population are assumed not to be a casualty.
Equivalent level of safety means an approximately equal level of
safety as determined by qualitative or quantitative means.
Expected casualty means the mean number of casualties predicted to
occur per flight operation if the operation were repeated many times.
Expendable launch vehicle means a launch vehicle whose propulsive
stages are flown only once.
Experimental permit or permit means an authorization by the FAA to
a person to launch or reenter a reusable suborbital rocket.
Explosive debris means solid propellant fragments or other pieces
of a vehicle or payload that result from breakup of the vehicle during
flight and that explode upon impact with the Earth's surface and cause
overpressure.
Federal launch or reentry site means a launch or reentry site, from
which launches routinely take place, that is owned and operated by the
government of the United States.
Flight abort means the process to limit or restrict the hazards to
public safety, and the safety of property, presented by a launch
vehicle or reentry vehicle, including any payload, while in flight by
initiating and accomplishing a controlled ending to vehicle flight.
Flight abort rules means the conditions under which a flight safety
system must abort the flight to ensure compliance with the safety
criteria in Sec. 450.101.
Flight crew means crew that is on board a vehicle during a launch
or reentry.
Flight hazard area means any region of land, sea, or air that must
be surveyed, publicized, controlled, or evacuated to ensure compliance
with the safety criteria in Sec. 450.101.
Flight safety limit means criteria to ensure that public safety and
critical assets are protected from the flight of a vehicle when a
flight safety system functions properly.
Flight safety system means a system used to implement flight abort.
A flight safety system includes any flight safety system located on
board a launch or
[[Page 79708]]
reentry vehicle; any ground based command control system; any support
system, including telemetry subsystems and tracking subsystems,
necessary to support a flight abort decision; and the functions of any
personnel who operate the flight safety system hardware or software.
Hazard control means a preventative measure or mitigation put in
place for systems or operations to reduce the severity of a hazard or
the likelihood of the hazard occurring.
Hazardous debris means any object or substance capable of causing a
casualty or loss of functionality to a critical asset. Hazardous debris
includes inert debris and explosive debris such as an intact vehicle,
vehicle fragments, any detached vehicle component whether intact or in
fragments, payload, and any planned jettison bodies.
Hazardous materials means hazardous materials as defined in 49 CFR
172.101.
Instantaneous impact point means a predicted impact point,
following thrust termination of a vehicle.
Key flight safety event means a flight activity that has an
increased likelihood of causing a failure compared with other portions
of flight.
Launch means to place or try to place a launch vehicle or reentry
vehicle and any payload or human being from Earth in a suborbital
trajectory, in Earth orbit in outer space, or otherwise in outer space,
including activities involved in the preparation of a launch vehicle or
payload for launch, when those activities take place at a launch site
in the United States.
Launch operator means a person who conducts or who will conduct the
launch of a launch vehicle and any payload.
Launch or reentry system means the integrated set of subsystems,
personnel, products, and processes that, when combined, carries out a
launch or reentry.
Launch site means the location on Earth from which a launch takes
place (as defined in a license the Secretary issues or transfers under
this chapter) and necessary facilities at that location.
Launch vehicle means a vehicle built to operate in, or place a
payload in, outer space or a suborbital rocket.
Launch window means an approved period of time during which the
flight of a launch vehicle may be initiated.
Liftoff means any motion of the launch vehicle with intention to
initiate flight.
Limits of a useful mission means the trajectory data or other
parameters that bound the performance of a useful mission, including
flight azimuth limits.
Mishap means any event, or series of events associated with a
licensed or permitted activity resulting in any of the following:
(1) A fatality or serious injury (as defined in 49 CFR 830.2);
(2) A malfunction of a safety-critical system;
(3) A failure of the licensee's or permittee's safety organization,
safety operations, safety procedures;
(4) High risk, as determined by the FAA, of causing a serious or
fatal injury to any space flight participant, crew, government
astronaut, or member of the public;
(5) Substantial damage, as determined by the FAA, to property not
associated with licensed or permitted activity;
(6) Unplanned substantial damage, as determined by the FAA, to
property associated with licensed or permitted activity;
(7) Unplanned permanent loss of a launch or reentry vehicle during
licensed activity or permitted activity;
(8) The impact of hazardous debris outside the planned landing site
or designated hazard area; or
(9) Failure to complete a launch or reentry as planned as reported
in Sec. 450.213(b).
Neighboring operations personnel means those members of the public
located within a launch or reentry site, or an adjacent launch or
reentry site, who are not associated with a specific hazardous licensed
or permitted operation currently being conducted, but are required to
perform safety, security, or critical tasks at the site and are
notified of the operation.
Nominal means, in reference to launch vehicle performance,
trajectory, or stage impact point, a launch vehicle flight where all
vehicle aerodynamic parameters are as expected, all vehicle internal
and external systems perform exactly as planned, and there are no
external perturbing influences other than atmospheric drag and gravity.
Normal flight means the flight of a properly performing vehicle
whose real-time vacuum instantaneous impact point does not deviate from
the nominal vacuum instantaneous impact point by more than the sum of
the wind effects and the three-sigma guidance and performance
deviations in the uprange, downrange, left-crossrange, or right-
crossrange directions.
Normal trajectory means a trajectory that describes normal flight.
Operating environment means an environment that a launch or reentry
vehicle component will experience during its lifecycle. Operating
environments include shock, vibration, thermal cycle, acceleration,
humidity, thermal vacuum, or other environments relevant to system or
material degradation.
Operation hazard means a hazard created by an operating environment
or by an unsafe act.
Operation of a launch site means the conduct of approved safety
operations at a permanent site to support the launching of vehicles and
payloads.
Operation of a reentry site means the conduct of safety operations
at a permanent site on Earth at which a reentry vehicle and its
payload, if any, is intended to land.
Operator means a holder of a license or permit under 51 U.S.C.
Subtitle V, chapter 509.
Orbital insertion means the point at which a vehicle achieves a
minimum 70-nautical mile perigee based on a computation that accounts
for drag.
Payload means an object that a person undertakes to place in outer
space by means of a launch vehicle, including components of the vehicle
specifically designed or adapted for that object.
Person means an individual or an entity organized or existing under
the laws of a State or country.
Physical containment means a launch vehicle does not have
sufficient energy for any hazards associated with its flight to reach
the public or critical assets.
Physical electronic storage means a physical device that can store
electronic documents and files including but not limited to an optical
disc, a memory card, a USB flash drive, or an external hard drive.
Pilot means a flight crew member who has the ability to control, in
real time, a launch or reentry vehicle's flight path.
Populated area means--
(1) An outdoor location, structure, or cluster of structures that
may be occupied by people;
(2) Sections of roadways and waterways that are frequented by
automobile and boat traffic; or
(3) Agricultural lands, if routinely occupied by field workers.
Probability of casualty means the likelihood that a person will
suffer a serious injury or worse, including a fatal injury, due to all
hazards from an operation at a specific location.
Public means, for a particular licensed or permitted launch or
reentry, people that are not involved in supporting the launch or
reentry and includes those people who may be located within the launch
or reentry site, such as visitors, individuals providing goods or
services not related to launch or reentry processing or flight, and any
other operator and its personnel.
Reenter; reentry means to return or attempt to return,
purposefully, a
[[Page 79709]]
reentry vehicle and its payload or human being, if any, from Earth
orbit or from outer space to Earth.
Reentry operator means a person responsible for conducting the
reentry of a reentry vehicle as specified in a license issued by the
FAA.
Reentry site means the location on Earth where a reentry vehicle is
intended to return. It includes the area within three standard
deviations of the intended landing point (the predicted three-sigma
footprint).
Reentry vehicle means a vehicle designed to return from Earth orbit
or outer space to Earth substantially intact. A reusable launch vehicle
that is designed to return from Earth orbit or outer space to Earth
substantially intact is a reentry vehicle.
Reentry window means an approved period of time during which the
reentry of a reentry vehicle may be initiated.
Remote operator means a crew member who--
(1) Has the ability to control, in real time, a launch or reentry
vehicle's flight path; and
(2) Is not on board the controlled vehicle.
Reusable launch vehicle (RLV) means a launch vehicle that is
designed to return to Earth substantially intact and therefore may be
launched more than one time or that contains vehicle stages that may be
recovered by a launch operator for future use in the operation of a
substantially similar launch vehicle.
Risk means a measure that accounts for both the probability of
occurrence of a hazardous event and the consequence of that event to
persons or property.
Safety critical means essential to safe performance or operation. A
safety-critical system, subsystem, component, condition, event,
operation, process, or item, is one whose proper recognition, control,
performance, or tolerance, is essential to ensuring public safety and
the safety of property.
Service life means, for a safety-critical system component, the sum
total of the component's storage life and operating life.
Sigma means a single standard deviation from a fixed value, such as
a mean.
Software function means a collection of computer code that
implements a requirement or performs an action. This includes firmware
and operating systems.
Space flight participant means an individual, who is not crew,
carried aboard a launch vehicle or reentry vehicle.
State and United States means, when used in a geographical sense,
the several States, the District of Columbia, the Commonwealth of
Puerto Rico, American Samoa, the United States Virgin Islands, Guam,
and any other commonwealth, territory, or possession of the United
States.
Suborbital rocket means a vehicle, rocket-propelled in whole or in
part, intended for flight on a suborbital trajectory, and the thrust of
which is greater than its lift for the majority of the rocket-powered
portion of its ascent.
Suborbital trajectory means the intentional flight path of a launch
vehicle, reentry vehicle, or any portion thereof, whose vacuum
instantaneous impact point does not leave the surface of the Earth.
Sub-vehicle point means the location on an ellipsoidal Earth model
where the normal to the ellipsoid passes through the vehicle's center
of gravity.
System hazard means a hazard associated with a system and generally
exists even when no operation is occurring.
Tether system means a device that contains launch vehicle hazards
by physically constraining a launch vehicle in flight to a specified
range from its launch point. A tether system includes all components,
from the tether's point of attachment to the vehicle to a solid base,
that experience load during a tethered launch.
Toxic hazard area means a region on the Earth's surface where toxic
concentrations and durations may be greater than accepted toxic
thresholds for acute casualty, in the event of a worst case release or
maximum credible release scenario during launch or reentry.
Uncontrolled area is an area of land not controlled by a launch or
reentry operator, a launch or reentry site operator, an adjacent site
operator, or other entity by agreement.
Unguided suborbital launch vehicle means a suborbital rocket that
does not contain active guidance or a directional control system.
United States citizen means:
(1) Any individual who is a citizen of the United States;
(2) Any corporation, partnership, joint venture, association, or
other entity organized or existing under the laws of the United States
or any State; and
(3) Any corporation, partnership, joint venture, association, or
other entity which is organized or exists under the laws of a foreign
nation, if the controlling interest in such entity is held by an
individual or entity described in paragraph (1) or (2) of this
definition. Controlling interest means ownership of an amount of equity
in such entity sufficient to direct management of the entity or to void
transactions entered into by management. Ownership of at least fifty-
one percent of the equity in an entity by persons described in
paragraph (1) or (2) of this definition creates a rebuttable
presumption that such interest is controlling.
Uprange means the distance measured along a line that is 180
degrees to the downrange direction.
Useful mission means a mission that can attain one or more
objectives.
Validation means an evaluation to determine that each safety
measure derived from a system safety process is correct, complete,
consistent, unambiguous, verifiable, and technically feasible.
Validation ensures that the right safety measure is implemented, and
that the safety measure is well understood.
Verification means an evaluation to determine that safety measures
derived from a system safety process are effective and have been
properly implemented. Verification provides measurable evidence that a
safety measure reduces risk to acceptable levels.
Wind weighting safety system means equipment, procedures, analysis
and personnel functions used to determine the launcher elevation and
azimuth settings that correct for wind effects that an unguided
suborbital launch vehicle will experience during flight.
Window closure means a period of time when launch or reentry is not
permitted in order to avoid a collision with an object in orbit. A
window closure may occur within a launch or reentry window, may delay
the start of a window, or terminate a window early.
PART 404--REGULATIONS AND LICENSING REQUIREMENTS
0
5. The authority citation for part 404 continues to read as follows:
Authority: 51 U.S.C. 50901-50923.
0
6. Revise Sec. 404.5 to read as follows:
Sec. 404.5 Filing a petition for waiver.
(a) A petition for waiver must be submitted at least 60 days before
the proposed effective date of the waiver, unless the Administrator
agrees to a different time frame in accordance with Sec. 404.15.
(b) The petition for waiver must include:
(1) The specific section or sections of 14 CFR chapter III from
which the petitioner seeks relief;
(2) The extent of the relief sought and the reason the relief is
being sought;
(3) The reason why granting the request for relief is in the public
interest and will not jeopardize the public
[[Page 79710]]
health and safety, safety of property, and national security and
foreign policy interests of the United States; and
(4) Any additional facts, views, and data available to the
petitioner to support the waiver request.
0
7. Add Sec. 404.15 to read as follows:
Sec. 404.15 Alternative Time Frames.
(a) General. Unless otherwise approved by the Administrator, an
applicant, a licensee, a permittee, or a safety element approval holder
must meet the time frames set forth in this chapter.
(b) Request to change a time frame. An applicant, a licensee, a
permittee, or a safety element approval holder may file a written
request to the FAA to propose an alternative time frame to any of the
time frames included in the chapter III sections listed in Appendix A
to part 404. The request must be--
(1) Emailed to [email protected] in accordance with Sec.
413.7; or
(2) Mailed to the Federal Aviation Administration, Associate
Administrator for Commercial Space Transportation, Room 331, 800
Independence Avenue SW, Washington, DC 20591. Attention: Alternative
Time Frame Request.
(c) Administrator review. The Administrator will review and make a
decision or grant a request for an alternative time frame as follows:
(1) The FAA will conduct its review on a case-by-case basis, taking
into account the complexity of the request, the timeliness of the
request, and whether the requested alternative allows sufficient time
for the FAA to conduct its review and make the requisite public health
and safety, safety of property, and national security and foreign
policy findings;
(2) The FAA will provide its decision in writing; and
(3) The FAA may grant the request, deny the request, or grant an
alternative time frame that differs from what was requested.
0
8. Add appendix A to part 404 the read as follows:
Appendix A to Part 404--Alternative Time Frames
A404.1 General
Alternative time frames. This appendix lists the sections and
corresponding paragraphs in this chapter that provide the eligible
time frames for an applicant, licensee, permittee, or safety element
approval holder, as applicable, to request an alternative time
frame.
Table A404.1--Eligible Time Frames
------------------------------------------------------------------------
Sections Paragraphs
------------------------------------------------------------------------
Sec. 404.5--Filing a petition for waiver...... (a).
Sec. 413.23--License or permit renewal........ (a).
Sec. 414.31--Safety element approval renewal.. (a).
Sec. 420.57--Notifications.................... (d).
Sec. 437.89--Pre-flight reporting............. (a), (b).
Sec. 440.15--Demonstration of compliance...... (a)(1), (a)(2),
(a)(3), (a)(4).
Sec. 450.169--Launch and Reentry Collision (f)(1).
Avoidance Analysis Requirements.
Sec. 450.213--Pre-flight reporting............ (b), (c), (d), (e).
Sec. 450.215--Post-flight reporting........... (a)
------------------------------------------------------------------------
PART 413--APPLICATION PROCEDURES
0
9. The authority citation for part 413 continues to read as follows:
Authority: 51 U.S.C. 50901-50923.
0
10. Revise Sec. 413.1 to read as follows:
Sec. 413.1 Scope of this part.
(a) This part explains how to apply for a license or experimental
permit. These procedures apply to all applications for obtaining a
license or permit, transferring a license, and renewing a license or
permit. In this part, the term application means either an application
in its entirety, or a portion of an application for incremental review
and determination in accordance with Sec. 450.33 of this chapter.
(b) Use paragraphs (b)(1) through (7) in the following table to
locate specific requirements:
------------------------------------------------------------------------
Subject Part
------------------------------------------------------------------------
(1) Obtaining a Launch License (only applications 415
accepted before June 8, 2021)..........................
(2) License to Operate a Launch Site.................... 420
(3) Launch and Reentry of a Reusable Launch Vehicle 431
(RLV) (only applications accepted before June 8, 2021).
(4) License to Operate a Reentry Site................... 433
(5) Reentry of a Reentry Vehicle other than a Reusable 435
Launch Vehicle (RLV) (only applications accepted before
June 8, 2021)..........................................
(6) Experimental Permits................................ 437
(7) Launch and Reentry License Requirements............. 450
------------------------------------------------------------------------
0
11. Effective March 10, 2026, futher amend Sec. 413.1 by revising
paragraphs (b)(1) through (4) and removing paragraphs (b)(5) through
(7).
The revisions read read as follows:
Sec. 413.1 Scope of this part.
* * * * *
(b) * * *
------------------------------------------------------------------------
Subject Part
------------------------------------------------------------------------
(1) License to Operate a Launch Site.................... 420
(2) License to Operate a Reentry Site................... 433
(3) Experimental Permits................................ 437
(4) Launch and Reentry License Requirements............. 450
------------------------------------------------------------------------
[[Page 79711]]
0
12. Amend Sec. 413.7 by revising the section heading and paragraph
(a)(3) to read as follows:
Sec. 413.7 Application submission.
(a) * * *
(3) For an application submitted by email, an applicant must send
the application as an email attachment, or as a link to a secure
server, to [email protected]. The application and the email to
which the application is attached or linked must also satisfy the
following criteria:
(i) The email to which the application is attached or linked must
be sent from an email address controlled by the person who signed the
application or by an authorized representative of the applicant;
(ii) The email must identify each document that is included as an
attachment or that is stored on a secure server; and
(iii) The electronic files must be date-stamped and have version
control documentation.
* * * * *
0
13. Amend Sec. 413.11 by revising paragraph (a) to read as follows:
Sec. 413.11 Acceptance of an application.
* * * * *
(a) The FAA accepts the application and will initiate review; or
* * * * *
0
14. Revise Sec. 413.15 to read as follows:
Sec. 413.15 Review period.
(a) Review period duration. Unless otherwise specified in this
chapter, the FAA reviews and makes a license or permit determination on
an accepted application in accordance with the time frame specified in
51 U.S.C. 50905(a)(1). The FAA will establish the time frame for any
incremental review and determination with an applicant on a case-by-
case basis during pre-application consultation.
(b) Review period tolled. If an accepted application does not
provide sufficient information to continue or complete the reviews or
evaluations required by this chapter for a license, permit, or
incremental determination, or an issue exists that would affect a
determination, the FAA notifies the applicant, in writing, and informs
the applicant of any information required to complete the application.
If the FAA cannot review an accepted application because of lack of
information or for any other reason, the FAA will toll the review
period until the FAA receives the information it needs or the applicant
resolves the issue.
(c) Notice. Except for applications under incremental review and
determination in accordance with Sec. 450.33, if the FAA does not make
a decision in accordance with the time frame specified in 51 U.S.C.
50905(a)(1) for an accepted license application or 51 U.S.C. 50906(a)
for an accepted permit application, the FAA informs the applicant, in
writing, of any outstanding information needed to complete the review,
or of any issues that would affect the decision.
0
15. Amend Sec. 413.21 by revising pargraphs (b) and (c) to read as
follows:
Sec. 413.21 Denial of a license or permit application.
* * * * *
(b) If the FAA has denied an application in its entirety, the
applicant may either--
(1) Attempt to correct any deficiencies identified and ask the FAA
to reconsider the revised application, in which case the FAA has 60
days or the number of days remaining in the review period, whichever is
greater, within which to reconsider the decision; or
(2) Request a hearing in accordance with part 406 of this chapter,
for the purpose of showing why the application should not be denied.
(c) An applicant whose application is denied after reconsideration
under paragraph (b)(1) of this section may request a hearing in
accordance with paragraph (b)(2) of this section.
0
16. Amend Sec. 413.23 by revising paragraphs (a) and (d) to read as
follows:
Sec. 413.23 License or permit renewal.
* * * * *
(a) Eligibility. (1) A licensee or permittee may apply to renew its
license or permit by submitting to the FAA a written application for
renewal at least 90 days before the license expires or at least 60 days
before the permit expires, unless the Administrator agrees to a
different time frame in accordance with Sec. 404.15.
(2) A request to renew a licensed under parts 415, 431, and 435 may
be granted with a non-standard duration so as not to exceed March 10,
2026.
* * * * *
(d) Renewal of license or permit. After the FAA finishes its
reviews, the FAA issues an order modifying the expiration date of the
license or permit. The FAA may impose additional or revised terms and
conditions necessary to protect public health and safety and the safety
of property and to protect U.S. national security and foreign policy
interests. The renewal period for a license issued under parts 415,
431, or 435 of this chapter cannot extend beyond March 10, 2026.
* * * * *
0
17. Effective March 10, 2026, Sec. 413.23 is further amended by
revising paragraphs (a) and (d) to read as follows:
Sec. 413.23 License or permit renewal.
* * * * *
(a) Eligibility. A licensee or permittee may apply to renew its
license or permit by submitting to the FAA a written application for
renewal at least 90 days before the license expires or at least 60 days
before the permit expires, unless the Administrator agrees to a
different time frame in accordance with Sec. 404.15.
* * * * *
(d) Renewal of license or permit. After the FAA finishes its
reviews, the FAA issues an order modifying the expiration date of the
license or permit. The FAA may impose additional or revised terms and
conditions necessary to protect public health and safety and the safety
of property and to protect U.S. national security and foreign policy
interests.
* * * * *
0
18. Revise part 414 to read as follows:
PART 414--SAFETY ELEMENT APPROVALS
Sec.
Subpart A--General
414.1 Scope
414.3 Definitions.
414.5 Applicability.
414.7 Eligibility.
Subpart B--Application Procedures
414.9 Pre-application consultation.
414.11 Application.
414.13 Application separate from a vehicle operator license
application.
414.15 Application concurrent with vehicle operator license
application.
414.17 Confidentiality.
414.19 Processing the initial application.
414.21 Maintaining the continued accuracy of the initial
application.
Subpart C--Safety Element Approval Review and Issuance
414.23 Technical criteria for reviewing a safety element approval
application.
414.25 Terms and conditions for issuing a safety element approval;
duration of a safety element approval.
414.27 Maintaining the continued accuracy of the safety element
approval application.
414.29 Safety element approval records.
414.31 Safety element approval renewal.
414.33 Safety element approval transfer.
414.35 Monitoring compliance with the terms and conditions of a
safety element approval.
414.37 Modification, suspension, or revocation of a safety element
approval.
Subpart D--Appeal Procedures
414.41 Hearings in safety element approval actions.
414.43 Submissions; oral presentations in safety element approval
actions.
[[Page 79712]]
414.45 Administrative law judge's recommended decision in safety
element approval actions.
Authority: 51 U.S.C. 50901-50923.
Subpart A--General
Sec. 414.1 Scope.
This part establishes procedures for obtaining a safety element
approval and renewing and transferring an existing safety element
approval. Safety element approvals issued under this part may be used
to support the application review for one or more vehicle operator
license requests under other parts of this chapter.
Sec. 414.3 Definitions.
Safety element. For purposes of this part, a safety element is any
one of the items or persons (personnel) listed in paragraphs (1) and
(2) of the definition of ``safety element approval'' in this section.
Safety element approval. For purposes of this part, a safety
element approval is an FAA document containing the FAA determination
that one or more of the safety elements listed in paragraphs (1) and
(2) of this definition, when used or employed within a defined
envelope, parameter, or situation, will not jeopardize public health
and safety or safety of property. A safety element approval may be
issued independent of a license, and does not confer any authority to
conduct activities for which a license is required under 14 CFR chapter
III. A safety element approval does not relieve its holder of the duty
to comply with all applicable requirements of law or regulation that
may apply to the holder's activities.
(1) Launch vehicle, reentry vehicle, safety system, process,
service, or any identified component thereof; or
(2) Qualified and trained personnel, performing a process or
function related to licensed activities or vehicles.
Sec. 414.5 Applicability.
This part applies to an applicant that wants to obtain a safety
element approval for any of the safety elements defined under this part
and to persons granted a safety element approval under this part. Any
person eligible under this part may apply to become the holder of a
safety element approval.
Sec. 414.7 Eligibility.
(a) There is no citizenship requirement to obtain a safety element
approval.
(b) You may be eligible for a safety element approval if you are--
(1) A designer, manufacturer, or operator of a launch or reentry
vehicle or component thereof;
(2) The designer or developer of a safety system or process; or
(3) Personnel who perform safety-critical functions in conducting a
licensed launch or reentry.
(c) A safety element approval applicant must have sufficient
knowledge and expertise to show that the design and operation of the
safety element for which safety element approval is sought qualify for
a safety element approval.
(d) Only the safety elements defined under this part are eligible
for a safety element approval.
Subpart B--Application Procedures
Sec. 414.9 Pre-application consultation.
The applicant must consult with the FAA before submitting an
application. Unless the applicant or the FAA requests another form of
consultation, consultation is oral discussion with the FAA about the
application process and the potential issues relevant to the FAA's
safety element approval decision.
Sec. 414.11 Application.
An applicant may submit an application for a safety element
approval in one of two ways:
(a) Separate from a vehicle operator license application in
accordance with Sec. 414.13; or
(b) Concurrent with a vehicle operator license application in
accordance with Sec. 414.15.
Sec. 414.13 Application separate from a vehicle operator license
application.
(a) An applicant must make an application in writing and in
English. The applicant must file the application with the Federal
Aviation Administration either by paper, by use of physical electronic
storage, or by email in the following manner:
(1) For an application submitted on paper, an applicant must send
two copies of the application to the Federal Aviation Administration,
Associate Administrator for Commercial Space Transportation, Room 331,
800 Independence Avenue SW, Washington, DC 20591. Attention:
Application Review.
(2) For an application submitted by use of physical electronic
storage, the applicant must either mail the application to the address
specified in paragraph (a)(1) of this section or hand-deliver the
application to an authorized FAA representative. The application and
the physical electronic storage containing the application must also
satisfy all of the following criteria:
(i) The application must include a cover letter that is printed on
paper and signed by the person who signed the application or by an
authorized representative of the applicant;
(ii) The cover letter must identify each document that is included
on the physical electronic storage; and
(iii) The physical electronic storage must be in a format such that
its contents cannot be altered.
(3) For an application submitted by email, an applicant must send
the application as an email attachment, or as a link to a secure
server, to [email protected]. The application and the email to
which the application is attached must also satisfy the following
criteria:
(i) The email to which the application is attached must be sent
from an email address controlled by the person who signed the
application or by an authorized representative of the applicant; and
(ii) The email must identify each document that is included as an
attachment or that is stored on a secure server; and
(iii) The electronic files must be date-stamped and have version
control documentation.
(b) The application must identify the following basic information:
(1) Name and address of the applicant.
(2) Name, address, and telephone number of any person to whom
inquiries and correspondence should be directed.
(3) Safety element as defined under this part for which the
applicant seeks a safety element approval.
(c) The application must contain the following technical
information:
(1) A Statement of Conformance letter, describing the specific
criteria the applicant used to show the adequacy of the safety element
for which a safety element approval is sought, and showing how the
safety element complies with the specific criteria.
(2) The specific operating limits for which the safety element
approval is sought.
(3) The following as applicable:
(i) Information and analyses required under this chapter that may
be applicable to demonstrating safe performance of the safety element
for which the safety element approval is sought.
(ii) Engineering design and analyses that show the adequacy of the
proposed safety element for its intended use, such that the use in a
licensed launch or reentry will not jeopardize public health or safety
or the safety of property.
(iii) Relevant manufacturing processes.
[[Page 79713]]
(iv) Test and evaluation procedures.
(v) Test results.
(vi) Maintenance procedures.
(vii) Personnel qualifications and training procedures.
(d) The application must be legibly signed, dated, and certified as
true, complete, and accurate by one of the following:
(1) For a corporation, an officer or other individual authorized to
act for the corporation in licensing or safety element approval
matters.
(2) For a partnership or a sole proprietorship, a general partner
or proprietor, respectively.
(3) For a joint venture, association, or other entity, an officer
or other individual duly authorized to act for the joint venture,
association, or other entity in licensing matters.
(e) Failure to comply with any of the requirements set forth in
this section is sufficient basis for denial of a safety element
approval application.
Sec. 414.15 Application concurrent with vehicle operator license
application.
(a) An applicant for a vehicle operator license may also identify
one or more sections of its application for which it seeks to obtain a
safety element approval concurrently with a license. An applicant
applying for a safety element approval concurrently with a license
must--
(1) Meet the applicable requirements of part 450;
(2) Provide the information required in Sec. 414.13(b)(3) and
(c)(2) and (3); and
(3) Specify the sections of the license application that support
the application for a safety element approval.
(b) The scope of the safety element approval will be limited to
what the application supports. The technical criteria for reviewing a
safety element submitted as part of a vehicle operator license
application are limited to the applicable requirements of part 450.
Sec. 414.17 Confidentiality.
(a) To ensure confidentiality of data or information in the
application, the applicant must--
(1) Send a written request with the application that trade secrets
or proprietary commercial or financial data be treated as confidential,
and include in the request the specific time frame confidential
treatment is required.
(2) Mark data or information that require confidentiality with an
identifying legend, such as ``Proprietary Information,'' ``Proprietary
Commercial Information,'' ``Trade Secret,'' or ``Confidential Treatment
Requested.'' Where this marking proves impracticable, attach a cover
sheet that contains the identifying legend to the data or information
for which confidential treatment is sought.
(b) If the applicant requests confidential treatment for previously
submitted data or information, the FAA will honor that request to the
extent practicable in case of any prior distribution of the data or
information.
(c) Data or information for which confidential treatment is
requested or data or information that qualifies for exemption under
section 552(b)(4) of title 5, U.S.C., will not be disclosed to the
public unless the Associate Administrator determines that withholding
the data or information is contrary to the public or national interest.
Sec. 414.19 Processing the initial application.
(a) The FAA will initially screen an application to determine if
the application is complete enough for the FAA to start the review.
(b) After completing the initial screening, the FAA will inform the
applicant in writing of one of the following:
(1) The FAA accepts the application and will begin the reviews or
evaluations required for a safety element approval determination under
this part.
(2) The FAA rejects the application because it is incomplete or
indefinite, making initiation of the reviews or evaluations required
for a safety element approval determination under this part
inappropriate.
(c) The written notice will state the reason(s) for rejection and
corrective actions necessary for the application to be accepted. The
FAA may return a rejected application to the applicant or may hold it
until the applicant provides more information.
(d) The applicant may withdraw, amend, or supplement an application
any time before the FAA makes a final determination on the safety
element approval application by making a written request to the
Associate Administrator. If the applicant amends or supplements the
initial application, the revised application must meet all the
applicable requirements under this part.
Sec. 414.21 Maintaining the continued accuracy of the initial
application.
The applicant is responsible for the continuing accuracy and
completeness of information provided to the FAA as part of the safety
element approval application. If at any time after submitting the
application, circumstances occur that cause the information to no
longer be accurate and complete in any material respect, the applicant
must submit a written statement to the Associate Administrator
explaining the circumstances and providing the new or corrected
information. The revised application must meet all requirements under
Sec. 414.13 or Sec. 414.15.
Subpart C--Safety Element Approval Review and Issuance
Sec. 414.23 Technical criteria for reviewing a safety element
approval application.
The FAA will determine whether a safety element is eligible for and
may be issued a safety element approval. The FAA will base its
determination on performance-based criteria, against which it may
assess the effect on public health and safety and on safety of
property, in the following hierarchy:
(a) FAA or other appropriate Federal regulations.
(b) Government-developed or adopted standards.
(c) Industry consensus performance-based criteria or standard.
(d) Applicant-developed criteria. Applicant-developed criteria are
performance standards customized by the manufacturer that intends to
produce the system, system component, or part. The applicant-developed
criteria must define--
(1) Design and minimum performance;
(2) Quality assurance system requirements;
(3) Production acceptance test specifications; and
(4) Continued operational safety monitoring system characteristics.
Sec. 414.25 Terms and conditions for issuing a safety element
approval; duration of a safety element approval.
(a) The FAA will issue a safety element approval to an applicant
that meets all the requirements under this part.
(b) The scope of the safety element approval will be limited by the
scope of the safety demonstration contained in the application on which
the FAA based the decision to grant the safety element approval.
(c) The FAA will determine specific terms and conditions of a
safety element approval individually, limiting the safety element
approval to the scope for which it was approved. The terms and
conditions will include reporting requirements tailored to the
individual safety element approval.
(d) A safety element approval is valid for five years and may be
renewed.
[[Page 79714]]
Sec. 414.27 Maintaining the continued accuracy of the safety element
approval application.
(a) The holder of a safety element approval must ensure the
continued accuracy and completeness of representations contained in the
safety element approval application, on which the approval was issued,
for the entire term of the safety element approval.
(b) If any representation contained in the application that is
material to public health and safety or safety of property ceases to be
accurate and complete, the safety element approval holder must prepare
and submit a revised application according to Sec. 414.13 or Sec.
414.15 under this part. The safety element approval holder must point
out any part of the safety element approval or the associated
application that would be changed or affected by a proposed
modification. The FAA will review and make a determination on the
revised application under the terms of this part.
Sec. 414.29 Safety element approval records.
The holder of a safety element approval must maintain all records
necessary to verify that the holder's activities are consistent with
the representations contained in the application for which the approval
was issued for the duration of the safety element approval plus one
year.
Sec. 414.31 Safety element approval renewal.
(a) Eligibility. A holder of a safety element approval may apply to
renew it by sending the FAA a written application at least 90 days
before the expiration date of the approval, unless the Administrator
agrees to a different time frame in accordance with Sec. 404.15.
(b) Application. (1) A safety element approval renewal application
must meet all the requirements under Sec. 414.13 or Sec. 414.15.
(2) The application may incorporate by reference information
provided as part of the application for the expiring safety element
approval or any modification to that approval.
(3) Any proposed changes in the conduct of a safety element for
which the FAA has issued a safety element approval must be described
and must include any added information necessary to support the fitness
of the proposed changes to meet the criteria upon which the FAA
evaluated the safety element approval application.
(c) Review of application. The FAA conducts the reviews required
under this part to determine whether the safety element approval may be
renewed. We may incorporate by reference any findings that are part of
the record for the expiring safety element approval.
(d) Grant of safety element approval renewal. If the FAA makes a
favorable safety element approval determination, the FAA issues an
order that amends the expiration date of the safety element approval or
issues a new safety element approval. The FAA may impose added or
revised terms and conditions necessary to protect public health and
safety and the safety of property.
(e) Written notice. The FAA will provide written notice to the
applicant of its determination on the safety element approval renewal
request.
(f) Denial of a safety element approval renewal. If the FAA denies
the renewal application, the applicant may correct any deficiency the
FAA identified and request a reconsideration of the revised
application. The applicant also has the right to appeal a denial as set
forth in subpart D of this part.
Sec. 414.33 Safety element approval transfer.
(a) Only the FAA may approve a transfer of a safety element
approval.
(b) Either the holder of a safety element approval or the
prospective transferee may request a safety element approval transfer.
(c) Both the holder and prospective transferee must agree to the
transfer.
(d) The person requesting the transfer must submit a safety element
approval application according to Sec. 414.13 or Sec. 414.15, must
meet the applicable requirements of this part, and may incorporate by
reference relevant portions of the initial application.
(e) The FAA will approve a transfer of a safety element approval
only after all the approvals and determinations required under this
chapter for a safety element approval have been met. In conducting
reviews and issuing approvals and determinations, the FAA may
incorporate by reference any findings made part of the record to
support the initial safety element approval determination. The FAA may
modify the terms and conditions of a safety element approval to reflect
any changes necessary because of a safety element approval transfer.
(f) The FAA will provide written notice to the person requesting
the safety element approval transfer of our determination.
Sec. 414.35 Monitoring compliance with the terms and conditions of a
safety element approval.
Each holder of a safety element approval must allow access by, and
cooperate with, Federal officers or employees or other individuals
authorized by the Associate Administrator to inspect manufacturing,
production, testing, or assembly performed by a holder of a safety
element approval or its contractor. The FAA may also inspect a safety
element approval process or service, including training programs and
personnel qualifications.
Sec. 414.37 Modification, suspension, or revocation of a safety
element approval.
(a) The safety element approval holder. The safety element approval
holder may submit an application to the FAA to modify the terms and
conditions of the holder's safety element approval. The application
must meet all the applicable requirements under this part. The FAA will
review and make a determination on the application using the same
procedures under this part applicable to an initial safety element
approval application. If the FAA denies the request to modify a safety
element approval, the holder may correct any deficiency the FAA
identified and request reconsideration. The holder also has the right
to appeal a denial as set forth in subpart D of this part.
(b) The FAA. If the FAA finds it is in the interest of public
health and safety, safety of property, or if the safety element
approval holder fails to comply with any applicable requirements of
this part, any terms and conditions of the safety element approval, or
any other applicable requirement, the FAA may--
(1) Modify the terms and conditions of the safety element approval;
or
(2) Suspend or revoke the safety element approval.
(c) Effective date. Unless otherwise stated by the FAA, any
modification, suspension, or revocation of a safety element approval
under paragraph (b)--
(1) Takes effect immediately; and
(2) Continues in effect during any reconsideration or appeal of
such action under this part.
(d) Notification and right to appeal. If the FAA determines it is
necessary to modify, suspend, or revoke a safety element approval, we
will notify the safety element approval holder in writing. If the
holder disagrees with the FAA's determination, the holder may correct
any deficiency the FAA identified and request a reconsideration of the
determination. The applicant also has the right to appeal the
determination as set forth in subpart D of this part.
Subpart D--Appeal Procedures
Sec. 414.41 Hearings in safety element approval actions.
(a) The FAA will give the safety element approval applicant or
holder, as appropriate, written notice stating the reason for issuing a
denial or for
[[Page 79715]]
modifying, suspending, or revoking a safety element approval under this
part.
(b) A safety element approval applicant or holder is entitled to a
determination on the record after an opportunity for a hearing.
Sec. 414.43 Submissions; oral presentations in safety element
approval actions.
(a) Determinations in safety element approval actions under this
part will be made on the basis of written submissions unless the
administrative law judge, on petition or on their own initiative,
determines that an oral presentation is required.
(b) Submissions must include a detailed exposition of the evidence
or arguments supporting the petition.
(c) Petitions must be filed as soon as practicable, but in no event
more than 30 days after issuance of decision or finding under Sec.
414.37.
Sec. 414.45 Administrative law judge's recommended decision in safety
element approval actions.
(a) The Associate Administrator, who will make the final decision
on the matter at issue, will review the recommended decision of the
administrative law judge. The Associate Administrator will make such
final decision within 30 days of issuance of the recommended decision.
(b) The authority and responsibility to review and decide rests
solely with the Associate Administrator and may not be delegated.
PART 415--LAUNCH LICENSE
0
19. The authority citation for part 415 continues to read as follows:
Authority: 51 U.S.C. 50901-50923.
PART 415--[REMOVED AND RESERVED]
0
20. Effective March 10, 2026, remove and reserve part 415.
0
21. Revise Sec. 415.1 to read as follows:
Sec. 415.1 Applicability and scope.
(a) Applicability. This part applies to the following:
(1) Licenses issued under this part before June 8, 2021; and
(2) Licenses issued on or after June 8, 2021, if the FAA accepted
the application under Sec. 413.11 of this chapter before that date.
(b) Scope. This part prescribes requirements for obtaining a
license to launch an expendable launch vehicle and post-licensing
requirements with which a licensee must comply to remain licensed.
Requirements for preparing a license application are in part 413 of
this subchapter.
0
22. Add Sec. 415.2 to read as follows:
Sec. 415.2 Licenses issued under this part.
(a) Definitions. For the purposes of this part, the definitions of
Sec. 401.5 of this chapter apply.
(b) Compliance with part 450 of this chapter. Operations under this
part must comply with launch and reentry collision avoidance
requirements in Sec. 450.169 of this chapter and critical asset
protection requirements in Sec. Sec. 450.101(a)(4) and (b)(4) of this
chapter.
0
23. Amend Sec. 415.3 by adding paragraph (c) to read as follows:
Sec. 415.3 Types of launch licenses.
* * * * *
(c) Notwithstanding the duration for a license established in
paragraphs (a) and (b) of this section, no license issued under this
part will be valid after March 10, 2026.
0
24. Amend Sec. 415.35 by revising paragraph (d) to read as follows:
Sec. 415.35 Acceptable flight risk.
* * * * *
(d) Operation. A launch vehicle must be operated in a manner that
ensures that flight risks meet the criteria of paragraph (a) of this
section and in accordance with collision avoidance requirements in
Sec. 450.169 and critical asset protection requirements in Sec.
450.101(a)(4) and (b)(4). An applicant must identify all launch
operations and procedures that must be performed to ensure acceptable
flight risk.
Appendix A to Part 415--[Removed and Reserved]
0
25. Remove and reserve appendix A to part 415.
PART 417--LAUNCH SAFETY
0
26. The authority citation for part 417 continues to read as follows:
Authority: 51 U.S.C. 50901-50923.
PART 417--[REMOVED AND RESERVED]
0
27. Effective March 10, 2026, remove and reserve part 417.
0
28. Revise Sec. 417.1 to read as follows:
Sec. 417.1 General information.
(a) Scope. This part sets forth--
(1) The responsibilities of a launch operator conducting a licensed
launch of an expendable launch vehicle pursuant to a license issued
under part 415 of this chapter; and
(2) The requirements for maintaining a launch license obtained
under part 415 of this chapter. Parts 413 and 415 of this chapter
contain requirements for preparing a license application to conduct a
launch, including information reviewed by the FAA to conduct a policy,
safety, payload, and environmental review, and a payload determination
(b) Applicability. (1) The administrative requirements for filing
material with the FAA in subpart A of this part apply to all licensed
launches from a Federal launch range or a non-Federal launch site,
except where noted.
(2) The safety requirements of subparts B through E of this part
apply to all licensed launches of expendable launch vehicles. See
paragraph (d) of this section for exceptions to this provision.
(c) ``Meets intent'' certification. For a licensed launch from a
Federal launch range, a launch operator need not demonstrate to the FAA
that an alternative means of satisfying a requirement of this part
provides an equivalent level of safety for a launch if written evidence
demonstrates that a Federal launch range has, by the effective date of
this part, granted a ``meets intent certification,'' including through
``tailoring,'' that applies to the requirement and that launch. See
paragraph (e) of this section for exceptions to this provision. Written
evidence includes:
(1) Range flight plan approval,
(2) Missile system pre-launch safety package,
(3) Preliminary and final flight data packages,
(4) A tailored version of EWR 127-1,
(5) Range email to the FAA stating that the MIC was approved, or
(6) Operation approval.
(d) Waiver. For a licensed launch from a Federal launch range, a
requirement of this part does not apply to a launch if written evidence
demonstrates that a Federal launch range has, by the effective date of
this part, granted a waiver that allows noncompliance with the
requirement for that launch. See paragraph (e) of this section for
exceptions to this provision. Written evidence includes:
(1) Range flight plan approval,
(2) Missile system pre-launch safety package,
(3) Preliminary and final flight data packages,
(4) A tailored version of EWR 127-1,
(5) Range email to the FAA stating that the waiver was approved, or
(6) Operation approval.
(e) Exceptions to Federal launch range meets intent certifications
and waivers. Even if a licensed launch from a Federal launch range
satisfies paragraph (c) or (d) of this section for a
[[Page 79716]]
requirement of this part, the requirement applies and a launch operator
must satisfy the requirement, obtain FAA approval of any alternative,
or obtain FAA approval for any further noncompliance if--
(1) The launch operator modifies the launch vehicle's operation or
safety characteristics;
(2) The launch operator uses the launch vehicle, component, system,
or subsystem in a new application;
(3) The FAA or the launch operator determines that a previously
unforeseen or newly discovered safety hazard exists that is a source of
significant risk to public safety; or
(4) The Federal launch range previously accepted a component,
system, or subsystem, but did not then identify a noncompliance to a
Federal launch range requirement.
(f) Equivalent level of safety. The requirements of this part apply
to a launch operator and the launch operator's launch unless the launch
operator clearly and convincingly demonstrates that an alternative
approach provides an equivalent level of safety.
Sec. 417.3 [Amended]
0
29. Amend Sec. 417.3 by removing the definitions for ``conjunction on
launch'' and ``launch wait''.
0
30. Amend Sec. 417.11 by adding paragraph (f) to read as follows:
Sec. 417.11 Continuing accuracy of license application; application
for modification of license.
* * * * *
(f) The Administrator may determine that a modification to a
license issued under this part must comply with the requirements in
part 450 of this chapter. The Administrator will base the determination
on the extent and complexity of the modification, whether the applicant
proposes to modify multiple parts of the application, or if the
application requires significant evaluation.
0
31. Amend Sec. 417.107 by adding paragraph (b)(5), and removing and
reserving paragraph (e).
The addition reads as follows:
Sec. 417.107 Flight safety.
* * * * *
(b) * * *
(5) A launch operator may initiate flight of a launch vehicle only
if all of the risks to the public satisfy the criteria in the critical
asset protection requirements in Sec. 450.101(a)(4) and (b)(4).
* * * * *
0
32. Amend Sec. 417.113 by revising paragraphs (c)(1) introductory text
and (c)(1)(iii) to read as follows:
Sec. 417.113 Launch safety rules.
* * * * *
(c) * * *
(1) The flight-commit criteria must implement the flight safety
analysis of subpart C of this part and collision avoidance requirements
in Sec. 450.169 and critical asset protection requirements in Sec.
450.101(a)(4) and (b)(4). These must include criteria for:
* * * * *
(iii) Implementation of any launch wait in the launch window for
the purpose of collision avoidance in accordance with collision
avoidance requirements in Sec. 450.169.
* * * * *
Sec. 417.121 [Amended]
0
32. Amend Sec. 417.121 by removing and reserving paragraph (c).
Sec. 417.231 [Removed and Reserved.]
0
33. Remove and reserve Sec. 417.231.
Appendix A to Part 417--[Amended]
0
34. Amend appendix A to part 417 by removing and reserving section
A417.31.
0
35. Amend appendix C to part 417 by revising paragraph (a) in section
C417.1 and removing section C417.11.
The revision reads as follows:
Appendix C to Part 417--Flight Safety Analysis Methodologies and
Products for an Unguided Suborbital Launch Vehicle Flown With a Wind
Weighting Safety System
* * * * *
C417.1 General
(a) This appendix contains methodologies for performing the
flight safety analysis required for the launch of an unguided
suborbital launch vehicle flown with a wind weighting safety system,
except for the hazard area analysis required by Sec. 417.107, which
is covered in appendix B of this part. This appendix includes
methodologies for a trajectory analysis, wind weighting analysis,
debris analysis, and debris risk analysis.
* * * * *
PART 420--LICENSE TO OPERATE A LAUNCH SITE
0
36. The authority citation for part 420 continues to read as follows:
Authority: 51 U.S.C. 50901-50923.
Sec. 420.5 [Amended]
0
37. Amend Sec. 420.5 by removing the definitions of ``Instantaneous
impact point'', ``Launch site accident'', and ``Public''.
0
38. Amend Sec. 420.15 by revising paragraph (b) to read as follows:
Sec. 420.15 Information requirements.
* * * * *
(b) Environmental. The FAA is responsible for complying with the
procedures and policies of the National Environmental Policy Act (NEPA)
and other applicable environmental laws, regulations, and Executive
Orders prior to issuing a launch site license. An applicant must
provide the FAA with information needed to comply with such
requirements. The FAA will consider and document the potential
environmental effects associated with issuing a launch site license.
(1) Environmental impact statement or environmental assessment.
When directed by the FAA, an applicant must--
(i) Prepare an Environmental Assessment with FAA oversight;
(ii) Assume financial responsibility for preparation of an
Environmental Impact Statement by an FAA-selected and -managed
consultant contractor; or
(iii) Submit information to support a written re-evaluation of a
previously submitted Environmental Assessment or Environmental Impact
Statement when requested by the FAA.
(2) Categorical exclusion. The FAA may determine that a categorical
exclusion is appropriate upon receipt of supporting information from an
applicant.
(3) Environmental information. An application must include an
approved FAA Environmental Assessment, Environmental Impact Statement,
categorical exclusion determination, or written re-evaluation covering
all planned licensed activities in compliance with NEPA and the Council
on Environmental Quality Regulations for Implementing the Procedural
Provisions of NEPA.
* * * * *
0
39. Revise Sec. 420.51 to read as follows:
Sec. 420.51 Responsibilities--general.
A licensee must operate its launch site in accordance with the
representations in its application.
0
40. Amend Sec. 420.57 by revising paragraph (d) to read as follows:
Sec. 420.57 Notifications.
* * * * *
(d) At least 2 days prior to flight of a launch vehicle, unless the
Administrator agrees to a different time frame in accordance with Sec.
404.15, the licensee must notify local officials and all owners of land
adjacent to the launch site of the flight schedule.
0
41. Revise Sec. 420.59 to read as follows:
[[Page 79717]]
Sec. 420.59 Mishap plan.
(a) General. A licensee must report, respond to, and investigate
any event that meets either paragraph (1) or (5) of the definition of
``mishap'' in Sec. 401.7 of this chapter. A licensee must submit a
mishap plan that meets the requirements of Sec. 450.173(b) through
(f).
(b) Launch mishaps. A launch site operator's mishap plan must also
contain procedures for participating in an investigation of a launch
mishap for launches launched from the launch site.
(c) Other agency procedures. Emergency response and investigation
procedures developed in accordance with 29 CFR 1910.119 and 40 CFR part
68 will satisfy the requirements of Sec. 450.173(d) and (e) to the
extent that they include the elements required by Sec. 450.173(d) and
(e).
0
42. Amend Sec. 420.61 by revising paragraph (b) to read as follows:
Sec. 420.61 Records.
* * * * *
(b) For any event that meets any of paragraph (1), (5), or (8) of
the definition of ``mishap'' in Sec. 401.7 of this chapter, a licensee
must preserve all records related to the event. Records must be
retained until completion of any Federal investigation and the FAA
advises the licensee that the records need not be retained.
* * * * *
PART 431--LAUNCH AND REENTRY OF A REUSABLE LAUNCH VEHICLE (RLV)
0
43. The authority citation for part 431 continue to read as follows:
Authority: 51 U.S.C. 50901-50923.
PART 431--[REMOVED AND RESERVED]
0
44. Effective March 10, 2026, remove and reserve part 431.
0
45. Revise Sec. 431.1 to read as follows:
Sec. 431.1 General.
(a) Applicability. This part applies to the following--
(1) Licenses issued under this part before June 8, 2021; and
(2) Licenses issued on or after June 8, 2021, if the FAA accepted
the application under Sec. 413.11 of this chapter before that date.
(b) Scope. This part prescribes requirements for obtaining a
reusable launch vehicle (RLV) mission license and post-licensing
requirements with which a licensee must comply to remain licensed.
Requirements for preparing a license application are contained in part
413 of this subchapter.
(c) Equivalent level of safety. Each requirement of this part
applies unless the applicant or licensee clearly and convincingly
demonstrates that an alternative approach provides an equivalent level
of safety to the requirement of this part.
0
46. Add Sec. 431.2 to read as follows:
Sec. 431.2 Licenses issued under this part.
(a) Definitions. For the purposes of this subpart, the definitions
of Sec. 401.5 of this chapter apply.
(b) Compliance with part 450 of this chapter. Operations under this
part must comply with launch and reentry collision avoidance
requirements in Sec. 450.169 of this chapter and critical asset
protection requirements in Sec. 450.101(a)(4) and (b)(4) of this
chapter.
0
47. Amend Sec. 431.3 by adding paragraph (c) to read as follows:
Sec. 431.3 Types of reusable launch vehicle mission licenses.
* * * * *
(c) Duration of license. Notwithstanding the duration for a license
established in paragraphs (a) and (b) of this section, no license
issued under this part will be valid after March 10, 2026.
0
48. Amend Sec. 431.43 by revising paragraph (a)(1) and removing and
reserving paragraph (c)(1).
The revision reads as follows:
Sec. 431.43 Reusable launch vehicle mission operational requirements
and restrictions.
(a) * * *
(1) That ensure RLV mission risks do not exceed the criteria set
forth in Sec. Sec. 431.35, 450.169, and in Sec. 450.101(a)(4) and
(b)(4) for nominal and non-nominal operations;
* * * * *
0
49. Amend Sec. 431.73 by adding paragraph (f) to read as follows:
Sec. 431.73 Continuing accuracy of license application; application
for modification of license.
* * * * *
(f) The Administrator may determine that a modification to a
license issued under this part must comply with the requirements in
part 450 of this chapter. The Administrator will base the determination
on the extent and complexity of the modification, whether the applicant
proposes to modify multiple parts of the application, or if the
application requires significant evaluation.
PART 433--LICENSE TO OPERATE A REENTRY SITE
0
50. The authority citation for part 433 will continue to read as
follows:
Authority: 51 U.S.C. 50901-50923.
0
51. Revise Sec. 433.7 to read as follows:
Sec. 433.7 Environmental.
(a) General. The FAA is responsible for complying with the
procedures and policies of the National Environmental Policy Act (NEPA)
and other applicable environmental laws, regulations, and Executive
Orders prior to issuing a reentry site license. An applicant must
provide the FAA with information needed to comply with such
requirements. The FAA will consider and document the potential
environmental effects associated with issuing a license for a reentry
site.
(b) Environmental impact statement or environmental assessment.
When directed by the FAA, an applicant must--
(1) Prepare an Environmental Assessment with FAA oversight;
(2) Assume financial responsibility for preparation of an
Environmental Impact Statement by an FAA-selected and -managed
consultant contractor; or
(3) Submit information to support a written re-evaluation of a
previously submitted Environmental Assessment or Environmental Impact
Statement.
(c) Categorical exclusion. The FAA may determine that a categorical
exclusion is appropriate upon receipt of supporting information from an
applicant.
(d) Environmental information. An application must include an
approved FAA Environmental Assessment, Environmental Impact Statement,
categorical exclusion determination, or written re-evaluation covering
all planned licensed activities in compliance with NEPA and the Council
on Environmental Quality Regulations for Implementing the Procedural
Provisions of NEPA.
Sec. 433.9 [Removed]
0
52. Remove Sec. 433.9.
PART 435--REENTRY OF A REENTRY VEHICLE OTHER THAN A REUSABLE LAUNCH
VEHICLE (RLV)
0
53. The authority citation for part 435 continues to read as follows:
Authority: 51 U.S.C. 50901-50923.
PART 435--[REMOVED AND RESERVED]
0
54. Effective March 10, 2026, remove and reserve part 435.
0
55. Revise Sec. 435.1 to read as follows:
Sec. 435.1 General.
(a) Applicability. This part applies to the following--
[[Page 79718]]
(1) Licenses issued under this part before June 8, 2021; and
(2) Licenses issued on or after June 8, 2021, if the FAA accepted
the application under Sec. 413.11 of this chapter before that date.
(b) Scope. This part prescribes requirements for obtaining a
license to reenter a reentry vehicle other than a reusable launch
vehicle (RLV), and post-licensing requirements with which a licensee
must comply to remain licensed. Requirements for preparing a license
application are contained in part 413 of this subchapter.
(c) Equivalent level of safety. Each requirement of this part
applies unless the applicant or licensee clearly and convincingly
demonstrates that an alternative approach provides an equivalent level
of safety to the requirement of this part.
0
56. Add Sec. 435.2 to read as follows:
Sec. 435.2 Licenses.
(a) Definitions. For the purposes of this subpart, the definitions
of Sec. 401.5 of this chapter apply.
(b) Compliance with part 450 of this chapter. Operations under this
part must comply with launch and reentry collision avoidance
requirements in Sec. 450.169 and critical asset protection
requirements in Sec. 450.101(a)(4) and (b)(4).
0
57. Amend Sec. 435.3 by adding paragraph (c) to read as follows:
Sec. 435.3 Types of reentry licenses.
* * * * *
(c) Duration of license. Notwithstanding the duration for a license
established in paragraphs (a) and (b) of this section, no license
issued under this part will be valid after March 10, 2026.
PART 437--EXPERIMENTAL PERMITS
0
58. The authority citation for part 437 continues to read as follows:
Authority: 51 U.S.C. 50901-50923.
Sec. 437.3 [Amended]
0
59. Amend Sec. 437.3 by removing the definitions for ``anomaly'' and
``key flight-safety event''.
0
60. Amend Sec. 437.21 by revising paragraphs (b) and (c) to read as
follows:
Sec. 437.21 General.
* * * * *
(b) Other regulations--(1) Environmental--(i) General. The FAA is
responsible for complying with the procedures and policies of the
National Environmental Policy Act (NEPA) and other applicable
environmental laws, regulations, and Executive Orders to consider and
document the potential environmental effects associated with proposed
reusable suborbital rocket launches or reentries. An applicant must
provide the FAA with information needed to comply with such
requirements. The FAA will consider and document the potential
environmental effects associated with proposed reusable suborbital
rocket launches or reentries.
(ii) Environmental Impact Statement or Environmental Assessment.
When directed by the FAA, an applicant must--
(A) Prepare an Environmental Assessment with FAA oversight;
(B) Assume financial responsibility for preparation of an
Environmental Impact Statement by an FAA-selected and -managed
consultant contractor; or
(C) Submit information to support a written re-evaluation of a
previously submitted Environmental Assessment or Environmental Impact
Statement.
(iii) Categorical exclusion. The FAA may determine that a
categorical exclusion determination is appropriate upon receipt of
supporting information from an applicant.
(iv) Information requirements. An application must include an
approved FAA Environmental Assessment, Environmental Impact Statement,
categorical exclusion determination, or written re-evaluation covering
all planned licensed activities in compliance with NEPA and the Council
on Environmental Quality Regulations for Implementing the Procedural
Provisions of NEPA.
(2) Financial responsibility. An applicant must provide the
information required by part 3 of appendix A of part 440 for the FAA to
conduct a maximum probable loss analysis.
(3) Human space flight. An applicant proposing launch or reentry
with flight crew or a space flight participant on board a reusable
suborbital rocket must demonstrate compliance with Sec. Sec. 460.5,
460.7, 460.11, 460.13, 460.15, 460.17, 460.51, and 460.53 of this
subchapter.
(c) Use of a safety element approval. If an applicant proposes to
use any reusable suborbital rocket, safety system, process, service, or
personnel for which the FAA has issued a safety element approval under
part 414 of this chapter, the FAA will not reevaluate that safety
element to the extent its use is within its approved scope. As part of
the application process, the FAA will evaluate the integration of that
safety element into vehicle systems or operations.
* * * * *
0
61. Revise Sec. 437.41 to read as follows:
Sec. 437.41 Mishap plan.
An applicant must submit a mishap plan that meets the requirements
of Sec. 450.173 of this chapter.
0
62. Revise Sec. 437.65 to read as follows:
Sec. 437.65 Collision avoidance analysis.
For a permitted flight with a planned maximum altitude greater than
150 kilometers, a permittee must obtain a collision avoidance analysis
in accordance with Sec. 450.169 of this chapter.
Sec. 437.75 [Removed and Reserved]
0
63. Remove and reserve Sec. 437.75.
0
64. Amend Sec. 437.87 by revising paragraph (b) to read as follows:
Sec. 437.87 Records.
* * * * *
(b) For any event that meets any of paragraphs (1) through (3),
(5), or (8) of the definition of ``mishap'' in Sec. 401.7 of this
chapter, a permittee must preserve all records related to the event.
Records shall be retained until any Federal investigation is complete
and the FAA advises the permittee that the records need not be
retained.
* * * * *
0
65. Amend Sec. 437.89 by revising paragraphs (a) introductory text and
(b) to read as follows:
Sec. 437.89 Pre-flight reporting.
(a) Not later than 30 days before each flight or series of flights
conducted under an experimental permit, unless the Administrator agrees
to a different time frame in accordance with Sec. 404.15, a permittee
must provide the FAA with the following information:
* * * * *
(b) Not later than 15 days before each permitted flight planned to
reach greater than 150 km altitude, unless the Administrator agrees to
a different time frame in accordance with Sec. 404.15, a permittee
must provide the FAA its planned trajectory for a collision avoidance
analysis.
PART 440--FINANCIAL RESPONSIBILITY
0
66. The authority citation for part 440 continues to read as follows:
Authority: 51 U.S.C. 50901-50923.
0
67. Amend Sec. 440.3 by revising the introductory text and the
definition for ``maximum probable loss (MPL)'' to read as follows:
Sec. 440.3 Definitions.
Except as otherwise provided in this section, any term used in this
part and defined in 51 U.S.C. 50901-50923, or in
[[Page 79719]]
Sec. 401.5 or Sec. 401.7 of this chapter shall have the meaning
contained therein.
* * * * *
Maximum probable loss (MPL) means the greatest dollar amount of
loss for bodily injury or property damage that is reasonably expected
to result from a licensed or permitted activity;
(1) Losses to third parties, excluding Government personnel and
other launch or reentry participants' employees involved in licensed or
permitted activities and neighboring operations personnel, that are
reasonably expected to result from a licensed or permitted activity are
those that have a probability of occurrence of no less than one in ten
million.
(2) Losses to Government property and Government personnel involved
in licensed or permitted activities and neighboring operations
personnel that are reasonably expected to result from licensed or
permitted activities are those that have a probability of occurrence of
no less than one in one hundred thousand.
* * * * *
Sec. 440.3 [Amended]
0
68. Effective March 10, 2026, further amend Sec. 440.3 in the
introductory text by removing `` in Sec. Sec. 401.5 or 401.7'' and
add, in its place, ``in Sec. 401.7''.
0
69. Amend Sec. 440.15 by revising paragraphs (a)(1) through (4) to
read as follows:
Sec. 440.15 Demonstration of compliance.
(a) * * *
(1) All reciprocal waiver of claims agreements required under Sec.
440.17(c) must be submitted at least 30 days before the start of any
licensed or permitted activity involving a customer, crew member, or
space flight participant; unless the Administrator agrees to a
different time frame in accordance with Sec. 404.15;
(2) Evidence of insurance must be submitted at least 30 days before
commencement of any licensed launch or permitted activity, and for
licensed reentry no less than 30 days before commencement of launch
activities involving the reentry licensee, unless the Administrator
agrees to a different time frame in accordance with Sec. 404.15;
(3) Evidence of financial responsibility in a form other than
insurance, as provided under Sec. 440.9(f) must be submitted at least
60 days before commencement of a licensed or permitted activity, unless
the Administrator agrees to a different time frame in accordance with
Sec. 404.15; and
(4) Evidence of renewal of insurance or other form of financial
responsibility must be submitted at least 30 days in advance of its
expiration date, unless the Administrator agrees to a different time
frame in accordance with Sec. 404.15.
* * * * *
0
70. Add part 450 to read as follows:
PART 450--LAUNCH AND REENTRY LICENSE REQUIREMENTS
Sec.
Subpart A--General Information
450.1 Applicability.
450.3 Scope of a vehicle operator license.
450.5 Issuance of a vehicle operator license.
450.7 Duration of a vehicle operator license.
450.9 Additional license terms and conditions.
450.11 Transfer of a vehicle operator license.
450.13 Rights not conferred by a vehicle operator license.
Subpart B--Requirements to Obtain a Vehicle Operator License
450.31 General.
450.33 Incremental review and determinations.
450.35 Means of compliance.
450.37 Equivalent level of safety.
450.39 Use of safety element approval.
450.41 Policy review and approval.
450.43 Payload review and determination.
450.45 Safety review and approval.
450.47 Environmental review.
Subpart C--Safety Requirements
Safety Criteria
450.101 Safety criteria.
System Safety Program
450.103 System safety program.
Hazard Control Strategies
450.107 Hazard control strategies.
450.108 Flight abort.
450.109 Flight hazard analysis.
450.110 Physical containment.
450.111 Wind weighting.
Flight Safety Analyses
450.113 Flight safety analysis requirements--scope.
450.115 Flight safety analysis methods.
450.117 Trajectory analysis for normal flight.
450.119 Trajectory analysis for malfunction flight.
450.121 Debris analysis.
450.123 Population exposure analysis.
450.131 Probability of failure analysis.
450.133 Flight hazard area analysis.
450.135 Debris risk analysis.
450.137 Far-field overpressure blast effects analysis.
450.139 Toxic hazards for flight.
Prescribed Hazard Controls for Safety-Critical Hardware and Computing
Systems
450.141 Computing systems.
450.143 Safety-critical system design, test, and documentation.
450.145 Highly reliable flight safety system.
Other Prescribed Hazard Controls
450.147 Agreements.
450.149 Safety-critical personnel qualifications.
450.151 Work shift and rest requirements.
450.153 Radio frequency management.
450.155 Readiness.
450.157 Communications.
450.159 Pre-flight procedures.
450.161 Control of hazard areas.
450.163 Lightning hazard mitigation.
450.165 Flight commit criteria.
450.167 Tracking.
450.169 Launch and reentry collision avoidance analysis
requirements.
450.171 Safety at end of launch.
450.173 Mishap plan--reporting, response, and investigation
requirements.
450.175 Test-induced damage.
450.177 Unique safety policies, requirements, and practices.
Ground Safety
450.179 Ground safety--general.
450.181 Coordination with a site operator.
450.183 Explosive site plan.
450.185 Ground hazard analysis.
450.187 Toxic hazards mitigation for ground operations.
450.189 Ground safety prescribed hazard controls.
Subpart D--Terms and Conditions of a Vehicle Operator License
450.201 Responsibility for public safety and safety of property.
450.203 Compliance.
450.205 Financial responsibility requirements.
450.207 Human spaceflight requirements.
450.209 Compliance monitoring.
450.211 Continuing accuracy of license application; application for
modification of license.
450.213 Pre-flight reporting.
450.215 Post-flight reporting.
450.217 Registration of space objects.
450.219 Records.
Appendix A to Part 450--Collision Analysis Worksheet
Authority: 51 U.S.C. 50901-50923.
Subpart A--General Information
Sec. 450.1 Applicability.
This part prescribes requirements for obtaining and maintaining a
license to launch, reenter, or both launch and reenter, a launch or
reentry vehicle.
Sec. 450.3 Scope of a vehicle operator license.
(a) General. A vehicle operator license authorizes a licensee to
conduct one or more launches or reentries using the same vehicle or
family of vehicles. A vehicle operator license identifies the scope of
authorization as defined in paragraphs (b) and (c) of this section or
as agreed to by the Administrator.
(b) Scope of launch. A vehicle operator license authorizes launch,
which includes the flight of a launch
[[Page 79720]]
vehicle and pre- and post-flight ground operations as follows:
(1) Launch begins when hazardous pre-flight operations commence at
a U.S. launch site that may pose a threat to the public. Hazardous pre-
flight operations that may pose a threat to the public include
pressurizing or loading of propellants into the vehicle, operations
involving a fueled launch vehicle, the transfer of energy necessary to
initiate flight, or any hazardous activity preparing the vehicle for
flight. Hazardous pre-flight operations do not include the period
between the end of the previous launch and launch vehicle reuse, when
the vehicle is in a safe and dormant state.
(2) At a non-U.S. launch site, launch begins at ignition or at the
first movement that initiates flight, whichever occurs earlier.
(3) Launch ends when any of the following events occur:
(i) For an orbital launch of a vehicle without a reentry of the
vehicle, launch ends after the licensee's last exercise of control over
its vehicle on orbit, after vehicle component impact or landing on
Earth, after activities necessary to return the vehicle or component to
a safe condition on the ground after impact or landing, or after
activities necessary to return the site to a safe condition, whichever
occurs latest;
(ii) For an orbital launch of a vehicle with a reentry of the
vehicle, launch ends after deployment of all payloads, upon completion
of the vehicle's first steady-state orbit if there is no payload
deployment, after vehicle component impact or landing on Earth, after
activities necessary to return the vehicle or component to a safe
condition on the ground after impact or landing, or after activities
necessary to return the site to a safe condition, whichever occurs
latest;
(iii) For a suborbital launch that includes a reentry, launch ends
after reaching apogee;
(iv) For a suborbital launch that does not include a reentry,
launch ends after vehicle or vehicle component impact or landing on
Earth, after activities necessary to return the vehicle or vehicle
component to a safe condition on the ground after impact or landing, or
after activities necessary to return the site to a safe condition,
whichever occurs latest.
(c) Scope of reentry. A vehicle operator license authorizes
reentry. Reentry includes activities conducted in Earth orbit or outer
space to determine reentry readiness and that are critical to ensuring
public health and safety and the safety of property during reentry
flight. Reentry also includes activities necessary to return the
reentry vehicle, or vehicle component, to a safe condition on the
ground after impact or landing.
(d) Application requirements. An applicant must identify pre- and
post-flight ground operations at a U.S. launch site sufficient for the
Administrator to determine the scope of activities authorized under the
license.
Sec. 450.5 Issuance of a vehicle operator license.
(a) The FAA issues a vehicle operator license to an applicant who
has obtained all approvals and determinations required under this part
for a license.
(b) A vehicle operator license authorizes a licensee to conduct
launches or reentries, in accordance with the representations contained
in the licensee's application, with subparts C and D of this part, and
subject to the licensee's compliance with terms and conditions
contained in license orders accompanying the license, including
financial responsibility requirements.
Sec. 450.7 Duration of a vehicle operator license.
A vehicle operator license is valid for the period of time
determined by the Administrator as necessary to conduct the licensed
activity but may not exceed 5 years from the issuance date.
Sec. 450.9 Additional license terms and conditions.
The FAA may modify a vehicle operator license at any time by
modifying or adding license terms and conditions to ensure compliance
with the Act and regulations.
Sec. 450.11 Transfer of a vehicle operator license.
(a) Only the FAA may transfer a vehicle operator license.
(b) Either the holder of a vehicle operator license or the
prospective transferee may request a vehicle operator license transfer.
(c) Both the holder and prospective transferee must agree to the
transfer.
(d) An applicant for transfer of a vehicle operator license must
submit a license application in accordance with part 413 of this
chapter and must meet the requirements of part 450 of this chapter.
(e) The FAA will transfer a license to an applicant that has
obtained all of the approvals and determinations required under this
part for a license. In conducting its reviews and issuing approvals and
determinations, the FAA may incorporate by reference any findings made
part of the record to support the initial licensing determination. The
FAA may modify a license to reflect any changes necessary as a result
of a license transfer.
(f) The FAA will provide written notice of its determination to the
person requesting the vehicle operator license transfer.
Sec. 450.13 Rights not conferred by a vehicle operator license.
Issuance of a vehicle operator license does not relieve a licensee
of its obligation to comply with all applicable requirements of law or
regulation that may apply to its activities, nor does issuance confer
any proprietary, property, or exclusive right in the use of any Federal
launch or reentry site or related facilities, airspace, or outer space.
Subpart B--Requirements to Obtain a Vehicle Operator License
Sec. 450.31 General.
(a) To obtain a vehicle operator license, an applicant must--
(1) Submit a license application in accordance with the procedures
in part 413 of this chapter;
(2) Obtain a policy approval from the Administrator in accordance
with Sec. 450.41;
(3) Obtain a favorable payload determination from the Administrator
in accordance with Sec. 450.43, if applicable;
(4) Obtain a safety approval from the Administrator in accordance
with Sec. 450.45;
(5) Satisfy the environmental review requirements of Sec. 450.47;
and
(6) Provide the information required by appendix A of part 440 for
the Administrator to conduct a maximum probable loss analysis for the
applicable licensed operation.
(b) An applicant may apply for the approvals and determinations in
paragraphs (a)(2) through (6) of this section separately or all
together in one complete application, using the application procedures
contained in part 413 of this chapter.
(c) An applicant may also apply for a safety approval in an
incremental manner, in accordance with Sec. 450.33.
(d) An applicant may reference materials previously provided as
part of a license application in order to meet the application
requirements of this part.
Sec. 450.33 Incremental review and determinations.
An applicant may submit its application for a safety review in
modules using an incremental approach approved by the Administrator.
(a) An applicant must identify to the Administrator, prior to
submitting an
[[Page 79721]]
application, whether it will submit a modular application for any
approval or determination.
(b) An applicant using an incremental approach must have the
approach approved by the Administrator prior to submitting an
application. In reviewing a proposed approach, the Administrator will
consider the following:
(1) Whether the modules can be reviewed independently; and
(2) Whether the modules will be submitted in a workable
chronological order.
(c) The Administrator may make incremental determinations as part
of this review process.
Sec. 450.35 Means of compliance.
(a) Prior to application acceptance, a means of compliance must be
accepted by the Administrator for the following:
(1) Section 450.115(b)(1) regarding flight safety analyses;
(2) Section 450.139(e)(1) regarding toxic hazards for flight;
(3) Section 450.145(b) regarding highly-reliable flight safety
system;
(4) Section 450.163(a)(1) regarding lightning hazard mitigation;
and
(5) Section 450.187(e)(1) regarding toxic hazards mitigation for
ground operations.
(b) A person requesting acceptance of a proposed means of
compliance outside a license application must submit the proposed means
of compliance to the FAA in a form and manner acceptable to the
Administrator.
Sec. 450.37 Equivalent level of safety.
(a) An applicant must demonstrate compliance with each requirement
of this part, unless the applicant clearly and convincingly
demonstrates that an alternative approach provides an equivalent level
of safety to the requirement of this part.
(b) Paragraph (a) of this section does not apply to Sec.
450.101(a), (b), (c)(1) and (3), (d), (e)(1), and (g).
Sec. 450.39 Use of safety element approval.
If an applicant proposes to use any vehicle, safety system,
process, service, or personnel for which the FAA has issued a safety
element approval under part 414 of this chapter, the FAA will not
reevaluate that safety element during a license application evaluation
to the extent its use is within its approved scope.
Sec. 450.41 Policy review and approval.
(a) General. The FAA issues a policy approval to an applicant
unless the FAA determines that a proposed launch or reentry would
jeopardize U.S. national security or foreign policy interests, or
international obligations of the United States.
(b) Interagency consultation. (1) The FAA consults with the
Department of Defense to determine whether a license application
presents any issues affecting U.S. national security.
(2) The FAA consults with the Department of State to determine
whether a license application presents any issues affecting U.S.
foreign policy interests or international obligations.
(3) The FAA consults with other Federal agencies, including the
National Aeronautics and Space Administration, authorized to address
issues identified under paragraph (a) of this section, associated with
an applicant's proposal.
(c) Issues during policy review. The FAA will advise an applicant,
in writing, of any issue raised during a policy review that would
impede issuance of a policy approval. The applicant may respond, in
writing, or amend its license application as required by Sec. 413.17
of this chapter.
(d) Denial of policy approval. The FAA notifies an applicant, in
writing, if it has denied policy approval for a license application.
The notice states the reasons for the FAA's determination. The
applicant may seek further review of the determination in accordance
with Sec. 413.21 of this chapter.
(e) Application requirements for policy review. In its license
application, an applicant must--
(1) Identify the model, type, and configuration of any vehicle
proposed for launch or reentry by the applicant;
(2) Describe the vehicle by characteristics that include individual
stages, their dimensions, type and amounts of all propellants, and
maximum thrust;
(3) Identify foreign ownership of the applicant as follows:
(i) For a sole proprietorship or partnership, identify all foreign
ownership;
(ii) For a corporation, identify any foreign ownership interests of
10 percent or more; and
(iii) For a joint venture, association, or other entity, identify
any participating foreign entities; and
(4) Identify the proposed vehicle flight profile, including:
(i) Launch or reentry site, including any contingency abort
locations;
(ii) Flight azimuths, trajectories, and associated ground tracks
and instantaneous impact points for the duration of the licensed
activity, including any contingency abort profiles;
(iii) Sequence of planned events or maneuvers during flight;
(iv) Normal impact or landing areas for all mission hardware; and
(v) For each orbital mission, the range of intermediate and final
orbits of each vehicle upper stage and their estimated orbital
lifetimes.
Sec. 450.43 Payload review and determination.
(a) General. If applicable, the FAA issues a favorable payload
determination for a launch or reentry to a license applicant or payload
owner or operator if--
(1) The applicant, payload owner, or payload operator has obtained
all required licenses, authorizations, and permits; and
(2) Its launch or reentry would not jeopardize public health and
safety, safety of property, U.S. national security or foreign policy
interests, or international obligations of the United States.
(b) Relationship to other executive agencies. The FAA does not make
a determination under paragraph (a)(2) of this section for--
(1) Those aspects of payloads that are subject to regulation by the
Federal Communications Commission or the Department of Commerce; or
(2) Payloads owned or operated by the U.S. Government.
(c) Classes of payloads. The FAA may review and issue findings
regarding a proposed class of payload, including communications, remote
sensing, or navigation. However, prior to a launch or reentry, each
payload is subject to verification by the FAA that its launch or
reentry would not jeopardize public health and safety, safety of
property, U.S. national security or foreign policy interests, or
international obligations of the United States.
(d) Payload owner or payload operator may apply. In addition to a
launch or reentry operator, a payload owner or payload operator may
request a payload review and determination.
(e) Interagency consultation. The FAA consults with other agencies
as follows:
(1) The Department of Defense to determine whether launch or
reentry of a proposed payload or payload class would present any issues
affecting U.S. national security;
(2) The Department of State to determine whether launch or reentry
of a proposed payload or payload class would present any issues
affecting U.S. foreign policy interests or international obligations;
or
(3) Other Federal agencies, including the National Aeronautics and
Space Administration, authorized to address issues of public health and
safety, safety of property, U.S. national security or foreign policy
interests, or international obligations of the United States,
[[Page 79722]]
associated with the launch or reentry of a proposed payload or payload
class.
(f) Issues during payload review. The FAA will advise a person
requesting a payload determination, in writing, of any issue raised
during a payload review that would impede issuance of a license to
launch or reenter that payload or payload class. The person requesting
payload review may respond, in writing, or amend its application as
required by Sec. 413.17 of this chapter.
(g) Denial of a payload determination. The FAA notifies an
applicant, in writing, if it has denied a favorable payload
determination. The notice states the reasons for the FAA's
determination. The applicant may seek further review of the
determination in accordance with Sec. 413.21 of this chapter.
(h) Incorporation of payload determination in license application.
A favorable payload determination issued for a payload or class of
payload may be included by a license applicant as part of its
application. However, any change in information provided under
paragraph (i) of this section must be reported in accordance with Sec.
413.17 of this chapter. The FAA determines whether a favorable payload
determination remains valid in light of reported changes and may
conduct an additional payload review.
(i) Application requirements. A person requesting review of a
particular payload or payload class must identify the following:
(1) For launch of a payload:
(i) Payload name or class of payload, and function;
(ii) Description, including physical dimensions, weight,
composition, and any hosted payloads;
(iii) Payload owner and payload operator, if different from the
person requesting payload review and determination;
(iv) Any foreign ownership of the payload or payload operator, as
specified in Sec. 450.41(e)(3);
(v) Hazardous materials as defined in Sec. 401.7 of this chapter,
radioactive materials, and the amounts of each;
(vi) Explosive potential of payload materials, alone and in
combination with other materials found on the payload;
(vii) For orbital launches, parameters for parking, transfer and
final orbits, and approximate transit times to final orbit;
(viii) Delivery point in flight at which the payload will no longer
be under the licensee's control;
(ix) Intended operations during the lifetime of the payload,
including anticipated life span and any planned disposal;
(x) Any encryption associated with data storage on the payload and
transmissions to or from the payload; and
(xi) Any other information necessary to make a determination based
on public health and safety, safety of property, U.S. national security
or foreign policy interests, or international obligations of the United
States.
(2) For reentry of a payload:
(i) Payload name or class of payload, and function;
(ii) Physical characteristics, dimensions, and weight of the
payload;
(iii) Payload owner and payload operator, if different from the
person requesting the payload review and determination;
(iv) Type, amount, and container of hazardous materials and
radioactive materials in the payload;
(v) Explosive potential of payload materials, alone and in
combination with other materials found on the payload or reentry
vehicle during reentry; and
(vi) Designated reentry site.
Sec. 450.45 Safety review and approval.
(a) General. The FAA issues a safety approval to an applicant if it
determines that an applicant can conduct launch or reentry without
jeopardizing public health and safety and safety of property. A license
applicant must satisfy the application requirements in this section and
subpart C of this part.
(b) Services or property provided by a Federal launch or reentry
site. The FAA will accept any safety-related launch or reentry service
or property provided by a Federal launch or reentry site or other
Federal entity by contract, as long as the FAA determines that the
launch or reentry services or property provided satisfy this part.
(c) Issues during safety review. The FAA will advise an applicant,
in writing, of any issues raised during a safety review that would
impede issuance of a safety approval. The applicant may respond, in
writing, or amend its license application as required by Sec. 413.17
of this chapter.
(d) Denial of a safety approval. The FAA notifies an applicant, in
writing, if it has denied a safety approval for a license application.
The notice states the reasons for the FAA's determination. The
applicant may seek further review of the determination in accordance
with Sec. 413.21 of this chapter.
(e) Application requirements. An applicant must submit the
information required in the ``Application requirements'' paragraphs in
individual sections in subpart C of this part, as well as the
following:
(1) General. An application must--
(i) Contain a glossary of unique terms and acronyms used in
alphabetical order;
(ii) Contain a listing of all referenced material;
(iii) Use equations and mathematical relationships derived from or
referenced to a recognized standard or text, and define all algebraic
parameters;
(iv) Include the units of all numerical values provided; and
(v) Include a legend or key that identifies all symbols used for
any schematic diagrams.
(2) Site description. An applicant must identify the proposed
launch or reentry site, including contingency abort locations, and
submit the following:
(i) Boundaries of the site;
(ii) Launch or landing point locations, including latitude and
longitude;
(iii) Identity of any site operator; and
(iv) Identity of any facilities at the site that will be used for
pre- or post-flight ground operations.
(3) Vehicle description. An applicant must submit the following:
(i) A written description of the vehicle or family of vehicles,
including structural, thermal, pneumatic, propulsion, electrical, and
avionics and guidance systems used in each vehicle, and all
propellants. The description must include a table specifying the type
and quantities of all hazardous materials on each vehicle and must
include propellants, explosives, and toxic materials; and
(ii) A drawing of each vehicle that identifies:
(A) Each stage, including strap-on motors;
(B) Physical dimensions and weight;
(C) Location of all safety-critical systems;
(D) Location of all major vehicle control systems, propulsion
systems, pressure vessels, and any other hardware that contains
potential hazardous energy or hazardous material; and
(E) For an unguided suborbital launch vehicle, the location of the
rocket's center of pressure in relation to its center of gravity for
the entire flight profile.
(4) Mission schedule. An applicant must submit a generic launch or
reentry processing schedule that identifies any readiness activities,
such as reviews and rehearsals, and each safety-critical pre-flight
operation to be conducted. The mission schedule must also identify day
of flight activities.
(5) Human space flight. For a proposed launch or reentry with a
human being on board a vehicle, an applicant must demonstrate
compliance
[[Page 79723]]
with Sec. Sec. 460.5, 460.7, 460.11, 460.13, 460.15, 460.17, 460.51,
and 460.53 of this chapter.
(6) Radionuclides. The FAA will evaluate the launch or reentry of
any radionuclide on a case-by-case basis, and issue an approval if the
FAA finds that the launch or reentry is consistent with public health
and safety, safety of property, and national security and foreign
policy interests of the United States. For any radionuclide on a launch
or reentry vehicle, an applicant must--
(i) Identify the type and quantity;
(ii) Include a reference list of all documentation addressing the
safety of its intended use; and
(iii) Describe all approvals by the Nuclear Regulatory Commission
for pre-flight ground operations.
(7) Additional material. The FAA may also request--
(i) Any information incorporated by reference in the license
application; and
(ii) Additional products that allow the FAA to conduct an
independent safety analysis.
Sec. 450.47 Environmental review.
(a) General. The FAA is responsible for complying with the
procedures and policies of the National Environmental Policy Act (NEPA)
and other applicable environmental laws, regulations, and Executive
Orders prior to issuing a launch or reentry license. An applicant must
provide the FAA with information needed to comply with such
requirements. The FAA will consider and document the potential
environmental effects associated with issuing a launch or reentry
license consistent with paragraph (b) of this section.
(b) Environmental Impact Statement or Environmental Assessment.
When directed by the FAA, an applicant must--
(1) Prepare an Environmental Assessment with FAA oversight;
(2) Assume financial responsibility for preparation of an
Environmental Impact Statement by an FAA-selected and -managed
consultant contractor; or
(3) Submit information to support a written re-evaluation of a
previously submitted Environmental Assessment or Environmental Impact
Statement.
(c) Categorical exclusion. The FAA may determine that a categorical
exclusion is appropriate upon receipt of supporting information from an
applicant.
(d) Application requirements. An application must include an
approved FAA Environmental Assessment, Environmental Impact Statement,
categorical exclusion determination, or written re-evaluation, which
should address compliance with any other applicable environmental laws,
regulations, and Executive Orders covering all planned licensed
activities in compliance with NEPA and the Council on Environmental
Quality Regulations for Implementing the Procedural Provisions of NEPA.
Subpart C--Safety Requirements
Safety Criteria
Sec. 450.101 Safety criteria.
(a) Launch risk criteria. For any launch, an operator may initiate
the flight of a launch vehicle only if all risks to the public satisfy
the criteria in this paragraph (a). For an orbital launch, the criteria
in this paragraph apply from liftoff through orbital insertion. For a
suborbital launch, or a suborbital launch and reentry, the criteria in
this paragraph apply from liftoff through final impact or landing.
(1) Collective risk. The collective risk, measured as expected
number of casualties (EC), consists of risk posed by
impacting inert and explosive debris, toxic release, and far field
blast overpressure. Public risk due to any other hazard associated with
the proposed flight of a launch vehicle will be determined by the
Administrator on a case-by-case basis.
(i) The risk to all members of the public, excluding persons in
aircraft and neighboring operations personnel, must not exceed an
expected number of 1 x 10-\4\ casualties.
(ii) The risk to all neighboring operations personnel must not
exceed an expected number of 2 x 10-\4\ casualties.
(2) Individual risk. The individual risk, measured as probability
of casualty (PC), consists of risk posed by impacting inert
and explosive debris, toxic release, and far field blast overpressure.
The FAA will determine whether to approve public risk due to any other
hazard associated with the proposed flight of a launch vehicle on a
case-by-case basis.
(i) The risk to any individual member of the public, excluding
neighboring operations personnel, must not exceed a probability of
casualty of 1 x 10-\6\ per launch.
(ii) The risk to any individual neighboring operations personnel
must not exceed a probability of casualty of 1 x 10-\5\ per
launch.
(3) Aircraft risk. A launch operator must establish any aircraft
hazard areas necessary to ensure the probability of impact with debris
capable of causing a casualty for aircraft does not exceed 1 x
10-\6\.
(4) Risk to critical assets. (i) The risk to critical assets,
measured as the probability of loss of functionality, must not exceed
the following probabilities:
(A) For each critical asset, except for a critical payload, 1 x
10-\3\ ; and
(B) For each critical payload, 1 x 10-\4\.
(ii) The Administrator will consult with relevant Federal agencies,
and each agency will identify, for purposes of this part, any critical
assets that the agency owns or otherwise depends on. For purposes of
this part, the Administrator will accept any identification by the
Secretary of Defense that an asset is critical to national security.
(iii) The Administrator or Federal site operator will notify the
licensee of any risk to critical assets above the risk criteria in
paragraph (a)(4)(i) of this section.
(iv) The Administrator may determine, in consultation with relevant
Federal agencies, that a more stringent probability is necessary to
protect the national interests of the United States.
(v) The risk criteria in paragraph (a)(4)(i) of this section do not
apply to property, facilities, or infrastructure supporting the launch
that are within the public area distance, as defined in part 420,
appendix E, tables E1 and E2 or associated formulae, of the vehicle's
launch point.
(b) Reentry risk criteria. For any reentry, an operator may
initiate the deorbit of a vehicle only if all risks to the public
satisfy the criteria in this paragraph (b). The following criteria
apply to each reentry, other than a suborbital reentry, from the final
health check prior to initiating deorbit through final impact or
landing:
(1) Collective risk. The collective risk, measured as expected
number of casualties (EC), consists of risk posed by
impacting inert and explosive debris, toxic release, and far field
blast overpressure. Public risk due to any other hazard associated with
the proposed deorbit of a reentry vehicle will be determined by the
Administrator on a case-by-case basis.
(i) The risk to all members of the public, excluding persons in
aircraft and neighboring operations personnel, must not exceed an
expected number of 1 x 10-\4\ casualties.
(ii) The risk to all neighboring operations personnel must not
exceed an expected number of 2 x 10-\4\ casualties.
(2) Individual risk. The individual risk, measured as probability
of casualty (PC), consists of risk posed by impacting inert
and explosive debris, toxic release, and far field blast overpressure.
Public risk due to any other hazard associated with the proposed flight
of a launch
[[Page 79724]]
vehicle will be determined on a case-by-case basis.
(i) The risk to any individual member of the public, excluding
neighboring operations personnel, must not exceed a probability of
casualty of 1 x 10-\6\ per reentry.
(ii) The risk to any individual neighboring operations personnel
must not exceed a probability of casualty of 1 x 10-\5\ per
reentry.
(3) Aircraft risk. A reentry operator must establish any aircraft
hazard areas necessary to ensure the probability of impact with debris
capable of causing a casualty for aircraft does not exceed 1 x
10-\6\.
(4) Risk to critical assets. (i) The risk to critical assets,
measured as the probability of loss of functionality, must not exceed
the following probabilities:
(A) For each critical asset, except for a critical payload, 1 x
10-\3\ ; and
(B) For each critical payload, 1 x 10-\4\.
(ii) The Administrator will consult with relevant Federal agencies,
and each agency will identify, for purposes of this part, any critical
assets that the agency owns or otherwise depends on. For purposes of
this part, the Administrator will accept any identification by the
Secretary of Defense that an asset is critical to national security.
(iii) The Administrator or Federal site operator will notify the
licensee of any risk to critical assets above the risk criteria in
paragraph (b)(4)(i) of this section.
(iv) The Administrator may determine, in consultation with relevant
Federal agencies, that a more stringent probability is necessary to
protect the national interests of the United States.
(c) High consequence event protection. An operator must protect
against a high consequence event in uncontrolled areas for each phase
of flight by:
(1) Using flight abort as a hazard control strategy in accordance
with the requirements of Sec. 450.108;
(2) Ensuring the consequence of any reasonably foreseeable failure
mode, in any significant period of flight, is no greater than 1 x
10-\3\ conditional expected casualties; or
(3) Establishing the launch or reentry vehicle has sufficient
demonstrated reliability as agreed to by the Administrator based on
conditional expected casualties criteria during that phase of flight.
(d) Disposal safety criteria. A launch operator must ensure that
any disposal meets the criteria of paragraphs (b)(1) through (3) of
this section, or targets a broad ocean area.
(e) Protection of people and property on orbit. (1) A launch or
reentry operator must prevent the collision between a launch or reentry
vehicle stage or component and people or property on orbit, in
accordance with the requirements in Sec. 450.169(a).
(2) For any launch vehicle stage or component that reaches Earth
orbit, a launch operator must prevent the creation of debris through
the conversion of energy sources into energy that fragments the stage
or component, in accordance with the requirements in Sec. 450.171.
(f) Notification of planned impacts. For any launch, reentry, or
disposal, an operator must notify the public of any region of land,
sea, or air that contains, with 97 percent probability of containment,
all debris resulting from normal flight events capable of causing a
casualty.
(g) Validity of the analysis. For any analysis used to demonstrate
compliance with this section, an operator must use accurate data and
scientific principles and the analysis must be statistically valid. The
method must produce results consistent with or more conservative than
the results available from previous mishaps, tests, or other valid
benchmarks, such as higher-fidelity methods.
System Safety Program
Sec. 450.103 System safety program.
An operator must implement and document a system safety program
throughout the lifecycle of a launch or reentry system that includes
the following:
(a) Safety organization. An operator must maintain a safety
organization that has clearly defined lines of communication and
approval authority for all public safety decisions. At a minimum, the
safety organization must have the following positions:
(1) Mission director. For each launch or reentry, an operator must
designate a position responsible for the safe conduct of all licensed
activities and authorized to provide final approval to proceed with
licensed activities. This position is referred to as the mission
director in this part.
(2) Safety official. For each launch or reentry, an operator must
designate a position with direct access to the mission director who
is--
(i) Responsible for communicating potential safety and
noncompliance issues to the mission director; and
(ii) Authorized to examine all aspects of the operator's ground and
flight safety operations, and to independently monitor compliance with
the operator's safety policies, safety procedures, and licensing
requirements.
(3) Addressing safety official concerns. The mission director must
ensure that all of the safety official's concerns are addressed.
(b) Hazard management. For hazard management:
(1) An operator must implement methods to assess the system to
ensure the validity of the hazard control strategy determination and
any flight hazard or flight safety analysis throughout the lifecycle of
the launch or reentry system;
(2) An operator must implement methods for communicating and
implementing any updates throughout the organization; and
(3) Additionally, an operator required to conduct a flight hazard
analysis must implement a process for tracking hazards, risks,
mitigation measures, and verification activities.
(c) Configuration management and control. An operator must--
(1) Employ a process that tracks configurations of all safety-
critical systems and documentation related to the operation;
(2) Ensure the use of correct and appropriate versions of systems
and documentation tracked in paragraph (c)(1) of this section; and
(3) Document the configurations and versions identified in
paragraph (c)(2) of this section for each licensed activity.
(d) Post-flight data review. An operator must employ a process for
evaluating post-flight data to--
(1) Ensure consistency between the assumptions used for the hazard
control strategy determination, any flight hazard or flight safety
analyses, and associated mitigation and hazard control measures;
(2) Resolve any inconsistencies identified in paragraph (d)(1) of
this section prior to the next flight of the vehicle;
(3) Identify any anomaly that may impact any flight hazard
analysis, flight safety analysis, or safety-critical system, or is
otherwise material to public safety; and
(4) Address any anomaly identified in paragraph (d)(3) of this
section prior to the next flight as necessary to ensure public safety,
including updates to any flight hazard analysis, flight safety
analysis, or safety-critical system.
(e) Application requirements. An applicant must submit in its
application the following:
(1) A description of the applicant's safety organization as
required by paragraph (a) of this section, identifying the applicant's
lines of communication and approval authority, both internally and
externally, for all public safety
[[Page 79725]]
decisions and the provision of public safety services; and
(2) A summary of the processes and products identified in the
system safety program requirements in paragraphs (b), (c), and (d) of
this section.
Hazard Control Strategies
Sec. 450.107 Hazard control strategies.
(a) General. To meet the safety criteria of Sec. 450.101(a), (b),
or (c) for the flight, or any phase of flight, of a launch or reentry
vehicle, an operator must use one or more of the hazard control
strategies identified in Sec. 450.108 through Sec. 450.111.
(b) Hazard control strategy determination. For each phase of flight
during a launch or reentry, an operator must use a functional hazard
analysis to determine a hazard control strategy or strategies that
account for--
(1) All functional failures associated with reasonably foreseeable
hazardous events that have the capability to create a hazard to the
public;
(2) Safety-critical systems; and
(3) A timeline of all safety-critical events.
(c) Flight hazard analysis. An operator must conduct a flight
hazard analysis in accordance with Sec. 450.109 of this part for the
flight, or phase of flight, of a launch or reentry vehicle if the
public safety hazards cannot be mitigated adequately to meet the public
risk criteria of Sec. 450.101(a), (b), and (c) using physical
containment, wind weighting, or flight abort.
(d) Application requirements. An applicant must submit in its
application--
(1) The results of the hazard control strategy determination,
including--
(i) All functional failures identified under paragraph (b)(1) of
this section;
(ii) The identification of all safety-critical systems; and
(iii) A timeline of all safety-critical events.
(2) A description of its hazard control strategy or strategies for
each phase of flight.
Sec. 450.108 Flight abort.
(a) Applicability. This section applies to the use of flight abort
as a hazard control strategy for the flight, or phase of flight, of a
launch or reentry vehicle to meet the safety criteria of Sec. 450.101.
(b) Flight safety system. An operator must use a flight safety
system that:
(1) Meets the requirements of Sec. 450.145 if the consequence of
any reasonably foreseeable failure mode in any significant period of
flight is greater than 1 x 10-\2\ conditional expected
casualties in uncontrolled areas; or
(2) Meets the requirements of Sec. 450.143 if the consequence of
any reasonably foreseeable failure mode in any significant period of
flight is between 1 x 10-\2\ and 1 x 10-\3\
conditional expected casualties for uncontrolled areas.
(c) Flight safety limits objectives. An operator must determine and
use flight safety limits that define when an operator must initiate
flight abort for each of the following--
(1) To ensure compliance with the safety criteria of Sec.
450.101(a) and (b);
(2) To prevent continued flight from increasing risk in
uncontrolled areas if the vehicle is unable to achieve a useful
mission;
(3) To prevent the vehicle from entering a period of materially
increased public exposure in uncontrolled areas, including before
orbital insertion, if a critical vehicle parameter is outside its pre-
established expected range or indicates an inability to complete flight
within the limits of a useful mission;
(4) To prevent conditional expected casualties greater than 1 x
10-\2\ in uncontrolled areas due to flight abort or due to
flight outside the limits of a useful mission from any reasonably
foreseeable off-trajectory failure mode in any significant period of
flight; and
(5) To prevent the vehicle state from reaching identified
conditions that are anticipated to compromise the capability of the
flight safety system if further flight has the potential to violate a
flight safety limit.
(6) In lieu of paragraphs (c)(2) and (4) of this section, to
prevent debris capable of causing a casualty due to any hazard from
affecting uncontrolled areas using a flight safety system that complies
with Sec. 450.145.
(d) Flight safety limits constraints. An operator must determine
flight safety limits that--
(1) Account for temporal and geometric extents on the Earth's
surface of any reasonably foreseeable vehicle hazards under all
reasonably foreseeable conditions during normal and malfunctioning
flight;
(2) Account for physics of hazard generation and transport
including uncertainty;
(3) Account for the potential to lose valid data necessary to
evaluate the flight abort rules;
(4) Account for the time delay, including uncertainties, between
the violation of a flight abort rule and the time when the flight
safety system is expected to activate;
(5) Account in individual, collective, and conditional risk
evaluations both for proper functioning of the flight safety system and
failure of the flight safety system;
(6) Are designed to avoid flight abort that results in increased
collective risk to the public in uncontrolled areas, compared to
continued flight; and
(7) Ensure that any trajectory within the limits of a useful
mission that is permitted to fly without abort would meet the
collective risk criteria of Sec. 450.101(a)(1) or (b)(1) when analyzed
as if it were the planned mission in accordance with Sec.
450.213(b)(2).
(e) End of flight abort. A flight does not need to be aborted to
protect against high consequence events in uncontrolled areas beginning
immediately after critical vehicle parameters are validated, if the
vehicle is able to achieve a useful mission and the following
conditions are met for the remainder of flight:
(1) Flight abort would not materially decrease the risk from a high
consequence event; and
(2) There are no key flight safety events.
(f) Flight abort rules. For each launch or reentry, an operator
must establish and observe flight abort rules that govern the conduct
of the launch or reentry as follows.
(1) Vehicle data required to evaluate flight abort rules must be
available to the flight safety system under all reasonably foreseeable
conditions during normal and malfunctioning flight.
(2) The flight safety system must abort flight:
(i) When valid, real-time data indicate the vehicle has violated
any flight safety limit developed in accordance with this section;
(ii) When the vehicle state approaches identified conditions that
are anticipated to compromise the capability of the flight safety
system and further flight has the potential to violate a flight safety
limit; and
(iii) In accordance with methods used to satisfy (d)(3) of this
section, if tracking data is invalid and further flight has the
potential to violate a flight safety limit.
(g) Application requirements. An applicant must submit in its
application the following:
(1) A description of the methods used to demonstrate compliance
with paragraph (c) of this section, including descriptions of how each
analysis constraint in paragraph (d) of this section is satisfied in
accordance with Sec. 450.115.
(2) A description of how each flight safety limit and flight abort
rule is evaluated and implemented during vehicle flight, including the
quantitative
[[Page 79726]]
criteria that will be used, a description of any critical parameters,
and how the values required in paragraphs (c)(3) and (e) of this
section are identified;
(3) A graphic depiction or series of depictions of flight safety
limits for a representative mission together with the launch or landing
point, all uncontrolled area boundaries, the nominal trajectory,
extents of normal flight, and limits of a useful mission trajectories,
with all trajectories in the same projection as each of the flight
safety limits; and
(4) A description of the vehicle data that will be available to
evaluate flight abort rules under all reasonably foreseeable conditions
during normal and malfunctioning flight.
Sec. 450.109 Flight hazard analysis.
(a) Applicability. This section applies to the use of a flight
hazard analysis as a hazard control strategy to derive hazard controls
for the flight, or phase of flight, of a launch or reentry vehicle.
Hazards associated with computing systems and software are further
addressed in Sec. 450.141.
(b) Analysis. A flight hazard analysis must identify, describe, and
analyze all reasonably foreseeable hazards to public safety resulting
from the flight of a launch or reentry vehicle. Each flight hazard
analysis must--
(1) Identify all reasonably foreseeable hazards, and the
corresponding failure mode for each hazard, associated with the launch
or reentry system relevant to public safety, including those resulting
from:
(i) Vehicle operation, including staging and release;
(ii) System, subsystem, and component failures or faults;
(iii) Software operations;
(iv) Environmental conditions;
(v) Human factors;
(vi) Design inadequacies;
(vii) Procedure deficiencies;
(viii) Functional and physical interfaces between subsystems,
including any vehicle payload;
(ix) Reuse of components or systems; and
(x) Interactions of any of the above.
(2) Assess each hazard's likelihood and severity.
(3) Ensure that the likelihood of any hazardous condition that may
cause death or serious injury to the public is extremely remote.
(4) Identify and describe the risk elimination and mitigation
measures required to satisfy paragraph (b)(3) of this section.
(5) Document that the risk elimination and mitigation measures
achieve the risk level of paragraph (b)(3) of this section through
validation and verification. Verification includes:
(i) Analysis;
(ii) Test;
(iii) Demonstration; or
(iv) Inspection.
(c) New Hazards. An operator must establish and document the
criteria and techniques for identifying new hazards throughout the
lifecycle of the launch or reentry system.
(d) Completeness Prior to Flight. For every launch or reentry, the
flight hazard analysis must be complete and all hazards must be
mitigated to an acceptable level in accordance with paragraph (b)(3) of
this section.
(e) Updates. An operator must continually update the flight hazard
analysis throughout the lifecycle of the launch or reentry system.
(f) Application requirements. An applicant must submit in its
application the following:
(1) Flight hazard analysis products of paragraphs (b)(1) through
(5) of this section, including data that verifies the risk elimination
and mitigation measures resulting from the applicant's flight hazard
analyses required by paragraph (b)(5) of this section; and
(2) The criteria and techniques for identifying new hazards
throughout the lifecycle of the launch or reentry system as required by
paragraph (c) of this section.
Sec. 450.110 Physical containment.
(a) Applicability. This section applies to the use of physical
containment as a hazard control strategy for the flight, or phase of
flight, of a launch or reentry vehicle to meet the safety criteria of
Sec. 450.101(a), (b), and (c).
(b) Containment. To use physical containment as a hazard control
strategy, an operator must--
(1) Develop the flight hazard area in accordance with Sec.
450.133;
(2) Ensure that the launch vehicle does not have sufficient energy
for any hazards associated with its flight to reach outside the flight
hazard area;
(3) Ensure the hazard area is clear of the public and critical
assets; and
(4) Apply other mitigation measures necessary to ensure no public
or critical asset exposure to hazards, such as control of public access
or wind placards.
(c) Application requirements. An applicant must submit in its
application the following:
(1) A demonstration that the launch vehicle does not have
sufficient energy for any hazards associated with its flight to reach
outside the flight hazard area developed in accordance with Sec.
450.133; and
(2) A description of the methods used to ensure that flight hazard
areas are cleared of the public and critical assets.
Sec. 450.111 Wind weighting.
(a) Applicability. This section applies to the use of wind
weighting as a hazard control strategy for the flight of an unguided
suborbital launch vehicle to meet the safety criteria of Sec.
450.101(a), (b), and (c).
(b) Wind weighting safety system. The flight of an unguided
suborbital launch vehicle that uses a wind weighting safety system must
meet the following:
(1) The launcher azimuth and elevation settings must be wind
weighted to correct for the effects of wind conditions at the time of
flight to provide impact locations that will ensure compliance with the
safety criteria in Sec. 450.101; and
(2) An operator must use launcher azimuth and elevation angle
settings that ensures the rocket will not fly in an unintended
direction accounting for uncertainties in vehicle and launcher design
and manufacturing, and atmospheric uncertainties.
(c) Analysis. An operator must--
(1) Establish flight commit criteria and other flight safety rules
that control the risk to the public from potential adverse effects
resulting from normal and malfunctioning flight;
(2) Establish any wind constraints under which flight may occur;
and
(3) Conduct a wind weighting analysis that establishes the launcher
azimuth and elevation settings that correct for the windcocking and
wind-drift effects on the unguided suborbital launch vehicle.
(d) Stability. An unguided suborbital launch vehicle, in all
configurations, must be stable throughout each stage of powered flight.
(e) Application requirements. An applicant must submit in its
application the following:
(1) A description of its wind weighting analysis methods, including
its method and schedule of determining wind speed and wind direction
for each altitude layer;
(2) A description of its wind weighting safety system including all
equipment used to perform the wind weighting analysis; and
(3) A representative wind weighting analysis using actual or
statistical winds for the launch area and samples of the output.
Flight Safety Analyses
Sec. 450.113 Flight safety analysis requirements--scope.
(a) An operator must perform and document a flight safety analysis
for all
[[Page 79727]]
phases of flight, except as specified in paragraph (b) of this section,
as follows--
(1) For orbital launch, from liftoff through orbital insertion, and
through all component impacts or landings;
(2) For suborbital launch, from liftoff through all component
impacts or landings;
(3) For disposal, from the initiation of the deorbit through final
impact; and
(4) For reentry, from the initiation of the deorbit through all
component impacts or landing.
(b) An operator is not required to perform and document a flight
safety analysis for a phase of flight if agreed to by the Administrator
based on demonstrated reliability. An operator demonstrates reliability
by using operational and flight history to show compliance with the
risk criteria in Sec. 450.101(a) and (b).
Sec. 450.115 Flight safety analysis methods.
(a) Scope of the analysis. An operator's flight safety analysis
method must account for all reasonably foreseeable events and failures
of safety-critical systems during nominal and non-nominal launch or
reentry that could jeopardize public safety.
(b) Level of fidelity of the analysis. An operator's flight safety
analysis method must have a level of fidelity sufficient to--
(1) Demonstrate that any risk to the public satisfies the safety
criteria of Sec. 450.101, including the use of mitigations, accounting
for all known sources of uncertainty, using a means of compliance
accepted by the Administrator; and
(2) Identify the dominant source of each type of public risk with a
criterion in Sec. 450.101(a) or (b) in terms of phase of flight,
source of hazard (such as toxic exposure, inert, or explosive debris),
and failure mode.
(c) Application requirements. An applicant must submit a
description of the flight safety analysis methodology, including
identification of:
(1) The scientific principles and statistical methods used;
(2) All assumptions and their justifications;
(3) The rationale for the level of fidelity;
(4) The evidence for validation and verification required by Sec.
450.101(g);
(5) The extent to which the benchmark conditions are comparable to
the foreseeable conditions of the intended operations; and
(6) The extent to which risk mitigations were accounted for in the
analyses.
Sec. 450.117 Trajectory analysis for normal flight.
(a) General. A flight safety analysis must include a trajectory
analysis that establishes, for any phase of flight within the scope as
provided by Sec. 450.113(a), the limits of a launch or reentry
vehicle's normal flight as defined by the nominal trajectory, and the
following sets of trajectories sufficient to characterize variability
and uncertainty during normal flight:
(1) A set of trajectories to characterize variability. This set
must describe how the intended trajectory could vary due to conditions
known prior to initiation of flight; and
(2) A set of trajectories to characterize uncertainty. This set
must describe how the actual trajectory could differ from the intended
trajectory due to random uncertainties in all parameters with a
significant influence on the vehicle's behavior throughout normal
flight.
(b) Trajectory model. A final trajectory analysis must use a six-
degree of freedom trajectory model to satisfy the requirements of
paragraph (a) of this section.
(c) Atmospheric effects. A trajectory analysis must account for
atmospheric conditions that have an effect on the trajectory, including
atmospheric profiles that are no less severe than the worst conditions
under which flight might be attempted, and for uncertainty in the
atmospheric conditions.
(d) Application requirements. An applicant must submit the
following:
(1) A description of the methods used to characterize the vehicle's
flight behavior throughout normal flight, in accordance with Sec.
450.115(c).
(2) The quantitative input data, including uncertainties, used to
model the vehicle's normal flight in six degrees of freedom.
(3) The worst atmospheric conditions under which flight might be
attempted, and a description of how the operator will evaluate the
atmospheric conditions and uncertainty in the atmospheric conditions
prior to initiating the operation;
(4) Representative normal flight trajectory analysis outputs,
including the position velocity, and orientation for each second of
flight for--
(i) The nominal trajectory;
(ii) A set of trajectories that characterize variability in the
intended trajectory based on conditions known prior to initiation of
flight; and
(iii) A set of trajectories that characterize how the actual
trajectory could differ from the intended trajectory due to random
uncertainties.
Sec. 450.119 Trajectory analysis for malfunction flight.
(a) General. A flight safety analysis must include a trajectory
analysis that establishes--
(1) The vehicle's deviation capability in the event of a
malfunction during flight,
(2) The trajectory dispersion resulting from reasonably foreseeable
malfunctions, and
(3) For vehicles using flight abort as a hazard control strategy
under Sec. 450.108, trajectory data or parameters that describe the
limits of a useful mission. The FAA does not consider the collection of
data related to a failure to be a useful mission.
(b) Analysis constraints. A malfunction trajectory analysis must
account for each cause of a malfunction flight, including software and
hardware failures, for every period of normal flight. The analysis for
each type of malfunction must have sufficient temporal and spatial
resolution to establish flight safety limits, if any, and individual
risk contours that are smooth and continuous. The analysis must account
for--
(1) The relative probability of occurrence of each malfunction;
(2) The probability distribution of position and velocity of the
vehicle when each malfunction trajectory will terminate due to vehicle
breakup, ground impact, or orbital insertion along with the cause of
termination and the state of the vehicle;
(3) The parameters with a significant influence on a vehicle's
flight behavior from the time a malfunction begins to cause a flight
deviation until the time each malfunction trajectory will terminate due
to vehicle breakup, ground impact, or orbital insertion; and
(4) The potential for failure of the flight safety system, if any.
(c) Application requirements. An applicant must submit--
(1) A description of the methodology used to characterize the
vehicle's flight behavior throughout malfunction flight, in accordance
with Sec. 450.115(c).
(2) A description of the methodology used to determine the limits
of a useful mission, in accordance with Sec. 450.115(c).
(3) A description of the input data used to characterize the
vehicle's malfunction flight behavior, including:
(i) A list of each cause of malfunction flight considered;
(ii) A list of each type of malfunction flight for which
malfunction flight behavior was characterized; and
(iii) A quantitative description of the parameters, including
uncertainties, with a significant influence on the
[[Page 79728]]
vehicle's malfunction behavior for each type of malfunction flight
characterized.
(4) Representative malfunction flight trajectory analysis outputs,
including the position and velocity as a function of flight time for--
(i) Each set of trajectories that characterizes a type of
malfunction flight;
(ii) The probability of each set of trajectories that characterizes
a type of malfunction flight; and
(iii) A set of trajectories that characterizes the limits of a
useful mission as described in paragraph (a)(3) of this section.
Sec. 450.121 Debris analysis.
(a) General. A flight safety analysis must include an analysis
characterizing the hazardous debris generated from normal and
malfunctioning vehicle flight as a function of vehicle flight sequence.
(b) Vehicle impact and breakup analysis. A debris analysis must
account for:
(1) Each reasonably foreseeable cause of vehicle breakup and intact
impact,
(2) Vehicle structural characteristics and materials, and
(3) Energetic effects during break-up or at impact.
(c) Propagation of debris. A debris analysis must compute
statistically valid debris impact probability distributions. The
propagation of debris from each predicted breakup location to impact
must account for--
(1) All foreseeable forces that can influence any debris impact
location; and
(2) All foreseeable sources of impact dispersion, including, at a
minimum:
(i) The uncertainties in atmospheric conditions;
(ii) Debris aerodynamic parameters, including uncertainties;
(iii) Pre-breakup position and velocity, including uncertainties;
and
(iv) Breakup-imparted velocities, including uncertainties.
(d) Application requirements. An applicant must submit:
(1) A description of all scenarios that can lead to hazardous
debris;
(2) A description of the methods used to perform the vehicle impact
and breakup analysis, in accordance with Sec. 450.115(c);
(3) A description of the methods used to compute debris impact
distributions, in accordance with Sec. 450.115(c);
(4) A description of the atmospheric data used as input to the
debris analysis; and
(5) A quantitative description of the physical, aerodynamic, and
harmful characteristics of hazardous debris.
Sec. 450.123 Population exposure analysis.
(a) General. A flight safety analysis must account for the
distribution of people for the entire region where there is a
significant probability of impact of hazardous debris.
(b) Constraints. The exposure analysis must--
(1) Characterize the distribution of people both geographically and
temporally;
(2) Account for the distribution of people among structures and
vehicle types;
(3) Use reliable, accurate, and timely source data; and
(4) Account for vulnerability of people to hazardous debris
effects.
(c) Application requirements. An applicant must submit:
(1) A description of the methods used to develop the exposure input
data in accordance with Sec. 450.115(c), and
(2) Complete population exposure data, in tabular form.
Sec. 450.131 Probability of failure analysis.
(a) General. For each hazard and phase of flight, a flight safety
analysis for a launch or reentry must account for vehicle failure
probability. The probability of failure must be consistent for all
hazards and phases of flight.
(1) For a vehicle or vehicle stage with fewer than two flights, the
failure probability estimate must account for the outcome of all
previous flights of vehicles developed and launched or reentered in
similar circumstances.
(2) For a vehicle or vehicle stage with two or more flights,
vehicle failure probability estimates must account for the outcomes of
all previous flights of the vehicle or vehicle stage in a statistically
valid manner. The outcomes of all previous flights of the vehicle or
vehicle stage must account for data on any mishap and anomaly.
(b) Failure. For flight safety analysis purposes, a failure occurs
when a vehicle does not complete any phase of normal flight or when any
anomalous condition exhibits the potential for a stage or its debris to
impact the Earth or reenter the atmosphere outside the normal
trajectory envelope during the mission or any future mission of similar
vehicle capability.
(c) Previous flight. For flight safety analysis purposes--
(1) The flight of a launch vehicle begins at a time in which a
launch vehicle lifts off from the surface of the Earth; and
(2) The flight of a reentry vehicle or deorbiting upper stage
begins at a time in which a vehicle attempts to initiate a reentry.
(d) Allocation. The vehicle failure probability estimate must be
distributed across flight phases and failure modes. The distribution
must be consistent with--
(1) The data available from all previous flights of vehicles
developed and launched or reentered in similar circumstances; and
(2) Data from previous flights of vehicles, stages, or components
developed and launched, reentered, flown, or tested by the subject
vehicle developer or operator. Such data may include previous
experience involving similar--
(i) Vehicle, stage, or component design characteristics;
(ii) Development and integration processes, including the extent of
integrated system testing; and
(iii) Level of experience of the vehicle operation and development
team members.
(e) Observed vs. conditional failure rate. Probability of failure
allocation must account for significant differences in the observed
failure rate and the conditional failure rate. A probability of failure
analysis must use a constant conditional failure rate for each phase of
flight, unless there is clear and convincing evidence of a different
conditional failure rate for a particular vehicle, stage, or phase of
flight.
(f) Application requirements. An applicant must submit:
(1) A description of the methods used in probability of failure
analysis, in accordance with Sec. 450.115(c); and
(2) A representative set of tabular data and graphs of the
predicted failure rate and cumulative failure probability for each
foreseeable failure mode.
Sec. 450.133 Flight hazard area analysis.
(a) General. A flight safety analysis must include a flight hazard
area analysis that identifies any region of land, sea, or air that must
be surveyed, publicized, controlled, or evacuated in order to control
the risk to the public. The analysis must account for, at a minimum--
(1) The regions of land, sea, and air potentially exposed to
hazardous debris generated during normal flight events and all
reasonably foreseeable failure modes;
(2) Any hazard controls implemented to control risk from any
hazard;
(3) The limits of a launch or reentry vehicle's normal flight,
including--
(i) Atmospheric conditions that are no less severe than the worst
atmospheric conditions under which flight might be attempted; and
(ii) Uncertainty in the atmospheric conditions;
(4) All hazardous debris;
(5) Sources of debris dispersion in accordance with Sec.
450.121(c); and
[[Page 79729]]
(6) A probability of one for any planned debris hazards or planned
impacts.
(b) Waterborne vessel hazard areas. The flight hazard area analysis
for waterborne vessels must determine the areas and durations for
regions of water--
(1) That are necessary to contain, with 97 percent probability of
containment, all debris resulting from normal flight events capable of
causing a casualty to persons on waterborne vessels;
(2) That are necessary to contain either where the probability of
debris capable of causing a casualty impacting on or near a vessel
would exceed 1 x 10-\5\, accounting for all relevant
hazards, or where the individual probability of casualty for any person
on board a vessel would exceed the individual risk criteria in Sec.
450.101(a)(2) or (b)(2); and
(3) Where reduced vessel traffic is necessary to meet the
collective risk criteria in Sec. 450.101(a)(1) or (b)(1).
(c) Land hazard areas. The flight hazard area analysis for land
must determine the durations and areas regions of land--
(1) That are necessary to contain, with 97 percent probability of
containment, all debris resulting from normal flight events capable of
causing a casualty to any person on land;
(2) Where the individual probability of casualty for any person on
land would exceed the individual risk criteria in Sec. 450.101(a)(2)
or (b)(2); and
(3) Where reduced population is necessary to meet the collective
risk criteria in Sec. 450.101(a)(1) or (b)(1).
(d) Airspace hazard volumes. The flight hazard area analysis for
airspace must determine the durations and volumes for regions of air to
be submitted to the FAA for approval--
(1) That are necessary to contain, with 97 percent probability of
containment, all debris resulting from normal flight events capable of
causing a casualty to persons on an aircraft; and
(2) Where the probability of impact on an aircraft would exceed the
aircraft risk criterion in Sec. 450.101(a)(3) or (b)(3).
(e) Application requirements. An applicant must submit:
(1) A description of the methodology to be used in the flight
hazard area analysis in accordance with Sec. 450.115(c), including:
(i) Classes of waterborne vessel and vulnerability criteria
employed; and
(ii) Classes of aircraft and vulnerability criteria employed.
(2) Tabular data and graphs of the results of the flight hazard
area analysis, including:
(i) Geographical coordinates of all hazard areas that are
representative of those to be published, in accordance with Sec.
450.161, prior to any proposed operation;
(ii) Representative 97 percent probability of containment contours
for all debris resulting from normal flight events capable of causing a
casualty for all locations specified in paragraph (a) of this section;
(iii) Representative individual probability of casualty contours
for all locations specified in paragraph (a) of this section, including
tabular data and graphs showing the hypothetical location of any member
of the public that could be exposed to a probability of casualty of 1 x
10-\5\ or greater for neighboring operations personnel, and
1 x 10-\6\ or greater for other members of the public, given
all foreseeable conditions within the flight commit criteria;
(iv) If applicable, representative 1 x 10-\5\ and 1 x
10-\6\ probability of impact contours for all debris capable
of causing a casualty to persons on a waterborne vessel regardless of
location; and
(v) Representative 1 x 10-\6\ and 1 x 10-\7\
probability of impact contours for all debris capable of causing a
casualty to persons on an aircraft regardless of location.
Sec. 450.135 Debris risk analysis.
(a) General. A flight safety analysis must include a debris risk
analysis that demonstrates compliance with safety criteria in Sec.
450.101, either--
(1) Prior to the day of the operation, accounting for all
foreseeable conditions within the flight commit criteria; or
(2) During the countdown using the best available input data,
including flight commit criteria and flight abort rules.
(b) Casualty area and consequence analysis. A debris risk analysis
must model the casualty area, and compute the predicted consequences of
each reasonably foreseeable failure mode in any significant period of
flight in terms of conditional expected casualties. The casualty area
and consequence analysis must account for--
(1) All relevant debris fragment characteristics and the
characteristics of a representative person exposed to any potential
debris hazard;
(2) Statistically-valid debris impact probability distributions;
(3) Any impact or effects of hazardous debris; and
(4) The vulnerability of people to debris impact or effects,
including:
(i) Effects of buildings, ground vehicles, waterborne vessel, and
aircraft upon the vulnerability of any occupants;
(ii) Effect of atmospheric conditions on debris impact and effects;
(iii) Impact speed and angle, accounting for motion of impacted
vehicles;
(iv) Uncertainty in input data, such as fragment impact parameters;
and
(v) Uncertainty in modeling methodology.
(c) Application requirements. An applicant must submit:
(1) A description of the methods used to demonstrate compliance
with the safety criteria in Sec. 450.101, in accordance with Sec.
450.115(c), including a description of how the operator will account
for the conditions immediately prior to enabling the flight of a launch
vehicle or the reentry of a reentry vehicle, such as the final
trajectory, atmospheric conditions, and the exposure of people;
(2) A description of the atmospheric data used as input to the
debris risk analysis;
(3) The effective unsheltered casualty area for all fragment
classes, assuming a representative impact vector;
(4) The effective casualty area for all fragment classes for a
representative type of building, ground vehicle, waterborne vessel, and
aircraft, assuming a representative impact vector;
(5) Collective and individual debris risk analysis outputs under
representative conditions and the worst foreseeable conditions,
including:
(i) Total collective casualty expectation for the proposed
operation;
(ii) A list of the collective risk contribution for at least the
top ten population centers and all centers with collective risk
exceeding 1 percent of the collective risk criteria in Sec.
450.101(a)(1) or (b)(1);
(iii) A list of the maximum individual probability of casualty for
the top ten population centers and all centers that exceed 10 percent
of the individual risk criteria in Sec. 450.101(a)(2) or (b)(2); and
(iv) A list of the conditional collective casualty expectation for
each failure mode for each significant period of flight under
representative conditions and the worst foreseeable conditions.
Sec. 450.137 Far-field overpressure blast effects analysis.
(a) General. A flight safety analysis must include a far-field
overpressure blast effect analysis that demonstrates compliance with
safety criteria in Sec. 450.101, either--
(1) Prior to the day of the operation, accounting for all
foreseeable conditions within the flight commit criteria; or
(2) During the countdown using the best available input data,
including flight commit criteria and flight abort rules.
[[Page 79730]]
(b) Analysis constraints. The analysis must account for--
(1) The explosive capability of the vehicle and hazardous debris at
impact and at altitude;
(2) The potential influence of meteorological conditions and
terrain characteristics; and
(3) The potential for broken windows due to peak incident
overpressures below 1.0 psi and related casualties based on the
characteristics of exposed windows and the population's susceptibility
to injury, with considerations including, at a minimum, shelter types,
window types, and the time of day of the proposed operation.
(c) Application requirements. An applicant must submit a
description of the far-field overpressure analysis, including all
assumptions and justifications for the assumptions, analysis methods,
input data, and results. At a minimum, the application must include:
(1) A description of the population centers, terrain, building
types, and window characteristics used as input to the far-field
overpressure analysis;
(2) A description of the methods used to compute the foreseeable
explosive yield probability pairs, and the complete set of yield-
probability pairs, used as input to the far-field overpressure
analysis;
(3) A description of the methods used to compute peak incident
overpressures as a function of distance from the explosion and
prevailing meteorological conditions, including sample calculations for
a representative range of the foreseeable meteorological conditions,
yields, and population center locations;
(4) A description of the methods used to compute the probability of
window breakage, including tabular data and graphs for the probability
of breakage as a function of the peak incident overpressure for a
representative range of window types, building types, and yields
accounted for;
(5) A description of the methods used to compute the probability of
casualty for a representative individual, including tabular data and
graphs for the probability of casualty, as a function of location
relative to the window and the peak incident overpressure for a
representative range of window types, building types, and yields
accounted for;
(6) Tabular data and graphs showing the hypothetical location of
any member of the public that could be exposed to a probability of
casualty of 1 x 10-\5\ or greater for neighboring operations
personnel, and 1 x 10-\6\ or greater for other members of
the public, given foreseeable conditions;
(7) The maximum expected casualties that could result from far-
field overpressure hazards given foreseeable conditions; and
(8) A description of the meteorological measurements used as input
to any real-time far-field overpressure analysis.
Sec. 450.139 Toxic hazards for flight.
(a) Applicability. (1) Except as specified in paragraph (a)(2),
this section applies to any launch or reentry vehicle, including all
vehicle components and payloads, that use toxic propellants or other
toxic chemicals.
(2) No toxic release hazard analysis is required for kerosene-based
fuels, unless the Administrator determines that an analysis is required
to protect public safety.
(b) General. An operator must--
(1) Conduct a toxic release hazard analysis in accordance with
paragraph (c) of this section;
(2) Manage the risk of casualties that could arise from the
exposure to toxic release through one of the following means:
(i) Contain hazards caused by toxic release in accordance with
paragraph (d) of this section; or
(ii) Perform a toxic risk assessment, in accordance with paragraph
(e) of this section, that protects the public in compliance with the
safety criteria of Sec. 450.101, including toxic release hazards.
(3) Establish flight commit criteria based on the results of its
toxic release hazard analysis and toxic containment or toxic risk
assessment for any necessary evacuation of the public from any toxic
hazard area.
(c) Toxic release hazard analysis. A toxic release hazard analysis
must--
(1) Account for any toxic release that could occur during nominal
or non-nominal flight;
(2) Include a worst-case release scenario analysis or a maximum-
credible release scenario analysis for each process that involves a
toxic propellant or other chemical;
(3) Determine if toxic release can occur based on an evaluation of
the chemical compositions and quantities of propellants, other
chemicals, vehicle materials, and projected combustion products, and
the possible toxic release scenarios;
(4) Account for both normal combustion products and any unreacted
propellants and phase change or chemical derivatives of released
substances; and
(5) Account for any operational constraints and emergency
procedures that provide protection from toxic release.
(d) Toxic containment. An operator using toxic containment must
manage the risk of any casualty from the exposure to toxic release
either by--
(1) Evacuating, or being prepared to evacuate, the public from any
toxic hazard area in the event of a worst-case release or maximum-
credible release scenario; or
(2) Employing meteorological constraints to limit an operation to
times during which prevailing winds and other conditions ensure that
any member of the public would not be exposed to toxic concentrations
and durations greater than accepted toxic thresholds for acute casualty
in the event of a worst-case release or maximum-credible release
scenario.
(e) Toxic risk assessment. An operator using toxic risk assessment
must establish flight commit criteria that demonstrate compliance with
the safety criteria of Sec. 450.101. A toxic risk assessment must--
(1) Account for airborne concentration and duration thresholds of
toxic propellants or other chemicals. For any toxic propellant, other
chemicals, or combustion product, an operator must use airborne toxic
concentration and duration thresholds identified in a means of
compliance accepted by the Administrator;
(2) Account for physical phenomena expected to influence any toxic
concentration and duration in the area surrounding the potential
release site;
(3) Determine a toxic hazard area for the launch or reentry,
surrounding the potential release site for each toxic propellant or
other chemical based on the amount and toxicity of the propellant or
other chemical, the exposure duration, and the meteorological
conditions involved;
(4) Account for all members of the public who may be exposed to the
toxic release, including all members of the public on land and on any
waterborne vessels, populated offshore structures, and aircraft that
are not operated in direct support of the launch or reentry; and
(5) Account for any risk mitigation measures applied in the risk
assessment.
(f) Application requirements. An applicant must submit:
(1) The identity of toxic propellant, chemical, or combustion
products or derivatives in the possible toxic release;
(2) The applicant's selected airborne toxic concentration and
duration thresholds;
[[Page 79731]]
(3) The meteorological conditions for the atmospheric transport and
buoyant cloud rise of any toxic release from its source to downwind
receptor locations;
(4) Characterization of the terrain, as input for modeling the
atmospheric transport of a toxic release from its source to downwind
receptor locations;
(5) The identity of the toxic dispersion model used, and any other
input data;
(6) Representative results of an applicant's toxic dispersion
modeling to predict concentrations and durations at selected downwind
receptor locations, to determine the toxic hazard area for a released
quantity of the toxic substance;
(7) A toxic release hazard analysis in accordance with paragraph
(c) of this section:
(i) A description of the failure modes and associated relative
probabilities for potential toxic release scenarios used in the risk
evaluation; and
(ii) The methodology and representative results of an applicant's
determination of the worst-case or maximum-credible quantity of any
toxic release that might occur during the flight of a vehicle;
(8) In accordance with Sec. 450.139(b)(2),
(i) A toxic containment in accordance with paragraph (d) of this
section, identify the evacuation plans or meteorological constraints
and associated launch commit criteria needed to ensure that the public
will not be within a toxic hazard area in the event of a worst-case
release or maximum-credible release scenario; or
(ii) A toxic risk assessment in accordance with paragraph (e) of
this section:
(A) A demonstration that the safety criteria in Sec. 450.101 will
be met;
(B) The population characteristics in receptor locations that are
identified by toxic dispersion modeling as toxic hazard areas;
(C) A description of any risk mitigations applied in the toxic risk
assessment; and
(D) A description of the population exposure input data used in
accordance with Sec. 450.123.
Prescribed Hazard Controls for Safety-Critical Hardware and Computing
Systems
Sec. 450.141 Computing systems.
(a) Identification of computing system safety items. An operator
must identify:
(1) Any software or data that implements a capability that, by
intended operation, unintended operation, or non-operation, can present
a hazard to the public; and
(2) The level of criticality of each computing system safety item
identified in paragraph (a)(1) of this section, commensurate with its
degree of control over hazards to the public and the severity of those
hazards.
(b) Safety requirements. An operator must develop safety
requirements for each computing system safety item. In doing so, the
operator must:
(1) Identify and evaluate safety requirements for each computing
system safety item;
(2) Ensure the safety requirements are complete and correct;
(3) Implement each safety requirement; and
(4) Verify and validate the implementation of each safety
requirement by using a method appropriate for the level of criticality
of the computing system safety item. For each computing system safety
item that is safety critical under Sec. 401.7, verification and
validation must include testing by a test team independent of the
development division or organization.
(c) Development process. An operator must implement and document a
development process for computing system safety items appropriate for
the level of criticality of the computing system safety item. A
development process must define:
(1) Responsibilities for each task associated with a computing
system safety item;
(2) Processes for internal review and approval--including review
that evaluates the implementation of all safety requirements--such that
no person approves that person's own work;
(3) Processes to ensure development personnel are trained,
qualified, and capable of performing their role;
(4) Processes that trace requirements to verification and
validation evidence;
(5) Processes for configuration management that specify the content
of each released version of a computing system safety item;
(6) Processes for testing that verify and validate all safety
requirements to the extent required by paragraph (b)(4) of this
section;
(7) Reuse policies that verify and validate the safety requirements
for reused computing system safety items; and
(8) Third-party product use policies that verify and validate the
safety requirements for any third-party product.
(d) Application requirements. An applicant must:
(1) Identify and describe all computing system safety items
involved in the proposed operations;
(2) Provide the safety requirements for each computing system
safety item;
(3) Provide documentation of the development processes that meets
paragraph (c) of this section;
(4) Provide evidence of the execution of the appropriate
development process for each computing system safety item; and
(5) Provide evidence of the implementation of each safety
requirement.
Sec. 450.143 Safety-critical system design, test, and documentation.
(a) Applicability. This section applies to all safety-critical
systems, except for--
(1) Highly reliable flight safety systems covered under Sec.
450.145; or
(2) Safety-critical systems for which an operator demonstrates
through its flight hazard analysis that the likelihood of any hazardous
condition specifically associated with the system that may cause death
or serious injury to the public is extremely remote, pursuant to Sec.
450.109(b)(3).
(b) Design. An operator must design safety-critical systems such
that no credible fault can lead to increased risk to the public beyond
nominal safety-critical system operation.
(c) Qualification testing of design. An operator must functionally
demonstrate the design of the vehicle's safety-critical systems at
conditions beyond its predicted operating environments. The operator
must select environmental test levels that ensure the design is
sufficiently stressed to demonstrate that system performance is not
degraded due to design tolerances, manufacturing variances, or
uncertainties in the environment.
(d) Acceptance of hardware. An operator must--
(1) Functionally demonstrate any safety-critical system, while
exposed to its predicted operating environments with margin, is free of
defects, free of integration and workmanship errors, and ready for
operational use; or
(2) Combine in-process controls and a quality assurance process to
ensure functional capability of any safety-critical system during its
service life.
(e) Lifecycle of safety-critical systems. (1) The predicted
operating environments must be based on conditions predicted to be
encountered in all phases of flight, recovery, and transportation.
(2) An operator must monitor the flight environments experienced by
safety-critical system components to the extent necessary to--
(i) Validate the predicted operating environments; and
(ii) Assess the actual component life remaining or adjust any
inspection period.
[[Page 79732]]
(f) Application requirements. An applicant must submit to the FAA
the following as part of its application:
(1) A list and description of each safety-critical system;
(2) Drawings and schematics for each safety-critical system;
(3) A summary of the analysis to determine the predicted operating
environments and duration to be applied to qualification and acceptance
testing covering the service life of any safety-critical system;
(4) A description of any method used to validate the predicted
operating environments;
(5) A description of any instrumentation or inspection processes to
monitor aging of any safety-critical system;
(6) The criteria and procedures for disposal or refurbishment for
service life extension of safety-critical system components; and
(7) A description of the standards used in all phases of the
lifecycle of each safety-critical system.
Sec. 450.145 Highly reliable flight safety system.
(a) General. For each phase of flight for which an operator must
implement flight abort to meet the requirement of Sec. 450.108(b)(1),
the operator must use a highly reliable flight safety system on the
launch or reentry vehicle, vehicle component, or payload with a design
reliability in accordance with this section.
(b) Reliability. A highly reliable flight safety system must, using
a means of compliance accepted by the Administrator--
(1) Have a design reliability of 0.999 at 95 percent confidence and
commensurate design, analysis, and testing for the portion of the
flight safety system onboard the vehicle; and
(2) Have a design reliability of 0.999 at 95 percent confidence and
commensurate design, analysis, and testing for the portion of the
flight safety system not onboard the vehicle, if used.
(c) Monitoring. An operator must monitor the flight environments
experienced by any flight safety system component to the extent
necessary to--
(1) Validate the predicted operating environment; and
(2) Assess the actual component life remaining or adjust any
inspection period.
(d) Application requirements. An applicant must submit the
information identified below, for any highly reliable flight safety
system:
(1) Flight safety system description. An applicant must describe
the flight safety system and its operation in detail, including all
components, component functions, and possible operational scenarios.
(2) Flight safety system diagram. An applicant must submit a
diagram that identifies all flight safety system subsystems and shows
the interconnection of all the elements of the flight safety system.
The diagram must include any subsystems used to implement flight abort
both on and off the vehicle, including any subsystems used to make the
decision to abort flight.
(3) Flight safety system analyses. An applicant must submit any
analyses and detailed analysis reports of all flight safety system
subsystems necessary to calculate the reliability and confidence levels
required by paragraph (a) of this section.
(4) Tracking validation procedures. An applicant must document and
submit the procedures for validating the accuracy of any vehicle
tracking data utilized by the flight safety system to make the decision
to abort flight.
(5) Flight safety system test plans. An applicant must submit
acceptance, qualification, and preflight test plans of any flight
safety system, subsystems, and components. The test plans must include
test procedures and test environments.
(6) Monitoring plan. An applicant must submit a description of any
method used to validate the predicted operating environments.
Other Prescribed Hazard Controls
Sec. 450.147 Agreements.
(a) General. An operator must establish a written agreement with
any entity that provides a service or property that meets a requirement
in this part, including:
(1) Launch and reentry site use agreements. A Federal launch or
reentry site operator, a licensed launch or reentry site operator, or
any other person that provides services or access to or use of property
required to support the safe launch or reentry under this part;
(2) Agreements for notices to mariners. Unless otherwise addressed
in agreements with the site operator, for overflight of navigable
water, the U.S. Coast Guard or other applicable maritime authority to
establish procedures for the issuance of a Notice to Mariners prior to
a launch or reentry and other measures necessary to protect public
health and safety;
(3) Agreements for notices to airmen. Unless otherwise addressed in
agreements with the site operator, the FAA Air Traffic Organization or
other applicable air navigation authority to establish procedures for
the issuance of a Notice to Airmen prior to a launch or reentry, for
closing of air routes during the respective launch and reentry windows,
and for other measures necessary to protect public health and safety;
and
(4) Mishap response. Emergency response providers, including local
government authorities, to satisfy the requirements of Sec. 450.173.
(b) Roles and responsibilities. The agreements required in this
section must clearly delineate the roles and responsibilities of each
party to support the safe launch or reentry under this part.
(c) Effective date. The agreements required in this section must be
in effect before a license can be issued, unless otherwise agreed to by
the Administrator.
(d) Application requirements. An applicant must--
(1) Describe each agreement in this section; and
(2) Provide a copy of any agreement, or portion thereof, to the FAA
upon request.
Sec. 450.149 Safety-critical personnel qualifications.
(a) General. An operator must ensure safety-critical personnel are
trained, qualified, and capable of performing their safety-critical
tasks, and that their training is current.
(b) Application requirements. An applicant must--
(1) Identify safety-critical tasks that require qualified
personnel;
(2) Provide internal training and currency requirements, completion
standards, or any other means of demonstrating compliance with the
requirements of this section; and
(3) Describe the process for tracking training currency.
Sec. 450.151 Work shift and rest requirements.
(a) General. For any launch or reentry, an operator must document
and implement rest requirements that ensure safety-critical personnel
are physically and mentally capable of performing all assigned tasks.
(b) Work shifts and deviation approval process. An operator's rest
requirements must address the following:
(1) Duration of each work shift and the process for extending this
shift, including the maximum allowable length of any extension;
(2) Number of consecutive work shift days allowed before rest is
required;
(3) Minimum rest period required--
[[Page 79733]]
(i) Between each work shift, including the period of rest required
immediately before the flight countdown work shift; and
(ii) After the maximum number of work shift days allowed; and
(4) Approval process for any deviation from the rest requirements.
(c) Application requirement. An applicant must submit rest rules
that demonstrate compliance with the requirements of this section.
Sec. 450.153 Radio frequency management.
(a) General. For any radio frequency used, an operator must--
(1) Ensure radio frequency interference does not adversely affect
performance of any flight safety system or safety-critical system; and
(2) Coordinate use of radio frequencies with any site operator and
any local and Federal authorities.
(b) Application requirements. An applicant must submit procedures
or other means to demonstrate compliance with the radio frequency
requirements of this section.
Sec. 450.155 Readiness.
(a) General. An operator must document and implement procedures to
assess readiness to proceed with the flight of a launch or reentry
vehicle. These procedures must address, at a minimum, the following:
(1) Readiness of vehicle and launch, reentry, or landing site,
including any contingency abort location;
(2) Readiness of safety-critical personnel, systems, software,
procedures, equipment, property, and services; and
(3) Readiness to implement the mishap plan required by Sec.
450.173.
(b) Application requirements. An applicant must--
(1) Demonstrate compliance with the requirements of paragraph (a)
of this section through procedures that may include a readiness meeting
close in time to flight; and
(2) Describe the criteria for establishing readiness to proceed
with the flight of a launch or reentry vehicle so that public safety is
maintained.
Sec. 450.157 Communications.
(a) An operator must implement communication procedures during the
countdown and flight of a launch or reentry vehicle that--
(1) Define the authority of personnel, by individual or position
title, to issue ``hold/resume,'' ``go/no go,'' and abort commands;
(2) Assign communication networks so that personnel identified in
paragraph (a)(1) of this section have direct access to real-time,
safety-critical information required to issue ``hold/resume,'' ``go/no
go,'' and any abort commands; and
(3) Implement a protocol for using defined radio telephone
communications terminology.
(b) An operator must ensure the currency of the communication
procedures, and that all personnel are working with the approved
version of the communication procedures.
(c) An operator must record all safety-critical communications
network channels that are used for voice, video, or data transmissions
that support safety-critical systems during each countdown.
Sec. 450.159 Pre-flight procedures.
(a) An operator must implement pre-flight procedures that--
(1) Verify that each flight commit criterion is satisfied before
flight is initiated; and
(2) Ensure the operator can return the vehicle to a safe state
after a countdown abort or delay.
(b) An operator must ensure the currency of the pre-flight
procedures, and that all personnel are working with the approved
version of the pre-flight procedures.
Sec. 450.161 Control of hazard areas.
(a) General. The operator must publicize, survey, control, or
evacuate each flight hazard area identified in accordance with Sec.
450.133 prior to initiating flight of a launch vehicle or the reentry
of a reentry vehicle to the extent necessary to ensure compliance with
Sec. 450.101.
(b) Verification. The launch or reentry operator must perform
surveillance sufficient to verify or update the assumptions, input
data, and results of the flight safety analyses.
(c) Publication. An operator must publicize warnings for each
flight hazard area, except for regions of land, sea, or air under the
control of the vehicle operator, site operator, or other controlling
authority with which the operator has an agreement. If the operator
relies on another entity to publicize these warnings, it must:
(1) Determine whether the warnings have been issued; and
(2) Notify the FAA if the warnings have not been issued so that the
FAA can determine if the launch or reentry can be conducted in a manner
that sufficiently protects the public. This notification must provide
sufficient information to enable FAA to issue warnings to U.S.
aircraft.
(d) Application requirements. An applicant must submit--
(1) A description of how the applicant will provide for day-of-
flight surveillance and control of flight hazard areas, if necessary,
to ensure that the presence of any member of the public in or near a
flight hazard area is consistent with flight commit criteria developed
for each launch or reentry as required by Sec. 450.165(b);
(2) A description of how the applicant will provide for any
publication of flight hazard areas necessary to meet the requirements
of this section; and
(3) A description of how the applicant will establish flight commit
criteria based on the results of its toxic release hazard analysis,
toxic containment, or toxic risk assessment for any necessary
evacuation of the public from any toxic hazard area.
Sec. 450.163 Lightning hazard mitigation.
(a) Lightning hazard mitigation. An operator must--
(1) Establish flight commit criteria that mitigate the potential
for a launch or reentry vehicle intercepting or initiating a direct
lightning strike, or encountering a nearby discharge, using a means of
compliance accepted by the Administrator; or
(2) Use a vehicle designed to protect safety-critical systems in
the event of a direct lightning strike or nearby discharge.
(b) Application requirements. (1) An applicant electing to comply
with paragraph (a)(1) of this section must submit flight commit
criteria that mitigate the potential for a launch or reentry vehicle
intercepting or initiating a direct lightning strike, or encountering a
nearby lightning discharge.
(2) An applicant electing to comply with paragraph (a)(2) of this
section must submit documentation providing evidence that the vehicle
is designed to protect safety-critical systems against the effects of a
direct lightning strike or nearby discharge.
Sec. 450.165 Flight commit criteria.
(a) General. For each launch or reentry, an operator must establish
and observe flight commit criteria that identify each condition
necessary prior to flight to satisfy the requirements of Sec. 450.101,
and must include:
(1) Surveillance of any region of land, sea, or air in accordance
with Sec. 450.161;
(2) Monitoring of any meteorological condition necessary to--
(i) Be consistent with any safety analysis required by this part;
and
(ii) If necessary in accordance with Sec. 450.163, mitigate the
potential for a launch or reentry vehicle intercepting a lightning
strike, or encountering a nearby discharge;
[[Page 79734]]
(3) Implementation of any launch or reentry window closure in the
launch or reentry window for the purpose of collision avoidance in
accordance with Sec. 450.169;
(4) Confirmation that any safety-critical system is ready for
flight;
(5) Confirmation from the FAA that the risk to critical assets
satisfies the requirements of Sec. 450.101(a)(4) or (b)(4);
(6) For any reentry vehicle, except a suborbital vehicle,
monitoring by the operator or an onboard system that the status of
safety-critical systems is healthy before enabling reentry flight, to
assure the vehicle can reenter safely to Earth; and
(7) Any other hazard controls derived from any safety analysis
required by this part.
(b) Application requirements. An applicant must submit a list of
all flight commit criteria.
Sec. 450.167 Tracking.
(a) General. During the flight of a launch or reentry vehicle, an
operator must measure and record in real time the position and velocity
of the vehicle. The system used to track the vehicle must provide data
to predict the expected impact locations of all stages and components,
and to obtain vehicle performance data for comparison with the pre-
flight performance predictions.
(b) Application requirements. An applicant must identify and
describe each method or system used to meet the tracking requirements
of paragraph (a) of this section.
Sec. 450.169 Launch and reentry collision avoidance analysis
requirements.
(a) Criteria. Except as provided in paragraph (d) of this section,
for an orbital or suborbital launch or reentry, an operator must
establish window closures needed to ensure that the launch or reentry
vehicle, any jettisoned components, or payloads meet the following
requirements with respect to orbiting objects, not including any object
being launched or reentered.
(1) For inhabitable objects, one of three criteria below must be
met:
(i) The probability of collision between the launching or
reentering objects and any inhabitable object must not exceed 1 x
10-\6\;
(ii) The launching or reentering objects must maintain an
ellipsoidal separation distance of 200 km in-track and 50 km cross-
track and radially from the inhabitable object; or
(iii) The launching or reentering objects must maintain a spherical
separation distance of 200 km from the inhabitable object.
(2) For objects that are neither orbital debris nor inhabitable,
one of the two criteria below must be met:
(i) The probability of collision between the launching or
reentering objects and any object must not exceed 1 x
10-\5\; or
(ii) The launching or reentering objects must maintain a spherical
separation distance of 25 km from the object.
(3) For all other known orbital debris identified by the FAA or
other Federal Government entity as large objects with radar cross
section greater than 1 m\2\ and medium objects with radar cross section
0.1 m\2\ to 1 m\2\:
(i) The probability of collision between the launching or
reentering objects and any known orbital debris must not exceed 1 x
10-\5\; or
(ii) The launching or reentering objects must maintain a spherical
separation distance of 2.5 km.
(b) Screening time. A launch or reentry operator must ensure the
requirements of paragraph (a) of this section are met as follows:
(1) Through the entire segment of flight of a suborbital launch
vehicle above 150 km;
(2) For an orbital launch, during ascent from a minimum of 150 km
to initial orbital insertion and for a minimum of 3 hours from liftoff;
(3) For reentry, during descent from initial reentry burn to 150 km
altitude; and
(4) For disposal, during descent from initial disposal burn to 150
km altitude.
(c) Rendezvous. Planned rendezvous operations that occur within the
screening time frame are not considered a violation of collision
avoidance if the involved operators have pre-coordinated the rendezvous
or close approach.
(d) Exception. A launch collision avoidance analysis is not
required for any launched object if the maximum planned altitude by
that object is less than 150 km.
(e) Analysis. Collision avoidance analysis must be obtained for
each launch or reentry from a Federal entity identified by the FAA, or
another entity agreed to by the Administrator.
(1) An operator must use the results of the collision avoidance
analysis to establish flight commit criteria for collision avoidance;
and
(2) The collision avoidance analysis must account for uncertainties
associated with launch or reentry vehicle performance and timing, and
ensure that each window closure incorporates all additional time
periods associated with such uncertainties.
(f) Timing and information required. An operator must prepare a
collision avoidance analysis worksheet for each launch or reentry using
a standardized format that contains the input data required by appendix
A to this part, as follows:
(1) Except as specified in paragraphs (f)(1)(i) and (ii) of this
section, an operator must file the input data with an entity identified
in paragraph (e) of this section and the FAA at least 7 days before the
first attempt at the flight of a launch vehicle or the reentry of a
reentry vehicle.
(i) Operators that have never received a launch or reentry
conjunction assessment from the entity identified in paragraph (e) of
this section, must file the input data at least 15 days in advance.
(ii) The Administrator may agree to an alternative time frame in
accordance with Sec. 404.15;
(2) An operator must obtain a collision avoidance analysis
performed by an entity identified in paragraph (e) of this section, no
later than 3 hours before the beginning of a launch or reentry window;
and
(3) If an operator needs an updated collision avoidance analysis
due to a launch or reentry delay, the operator must file the request
with the entity identified in paragraph (e) of this section and the FAA
at least 12 hours prior to the beginning of the new launch or reentry
window.
Sec. 450.171 Safety at end of launch.
(a) Orbital debris mitigation. An operator must ensure for any
proposed launch that for all vehicle stages or components that reach
Earth orbit--
(1) There is no unplanned physical contact between the vehicle or
any of its components and the payload after payload separation;
(2) Debris generation does not result from the conversion of energy
sources into energy that fragments the vehicle or its components.
Energy sources include chemical, pressure, and kinetic energy; and
(3) For all vehicle stages or components that are left in orbit,
stored energy is removed by depleting residual fuel and leaving all
fuel line valves open, venting any pressurized system, leaving all
batteries in a permanent discharge state, and removing any remaining
source of stored energy.
(b) Application requirement. An applicant must demonstrate
compliance with the requirements in paragraph (a) of this section.
Sec. 450.173 Mishap plan--reporting, response, and investigation
requirements.
(a) General. An operator must report, respond to, and investigate
mishaps, as
[[Page 79735]]
defined in Sec. 401.7 of this chapter, in accordance with paragraphs
(b) through (g) of this section using a plan or other written means.
(b) Responsibilities. An operator must document--
(1) Responsibilities for personnel assigned to implement the
requirements of this section;
(2) Reporting responsibilities for personnel assigned to conduct
investigations and for anyone retained by the operator to conduct or
participate in investigations; and
(3) Allocation of roles and responsibilities between the launch
operator and any site operator for reporting, responding to, and
investigating any mishap during ground activities at the site.
(c) Mishap reporting requirements. An operator must--
(1) Immediately notify the FAA Washington Operations Center in case
of a mishap that involves a fatality or serious injury (as defined in
49 CFR 830.2);
(2) Notify within 24 hours the FAA Washington Operations Center in
the case of a mishap that does not involve a fatality or serious injury
(as defined in 49 CFR 830.2); and
(3) Submit a written preliminary report to the FAA Office of
Commercial Space Transportation within five days of any mishap. The
preliminary report must include the following information, as
applicable:
(i) Date and time of the mishap;
(ii) Description of the mishap and sequence of events leading to
the mishap, to the extent known;
(iii) Intended and actual location of the launch or reentry or
other landing on Earth;
(iv) Hazardous debris impact points, including those outside a
planned landing site or designated hazard area;
(v) Identification of the vehicle;
(vi) Identification of any payload;
(vii) Number and general description of any fatalities or injuries;
(viii) Description and estimated costs of any property damage;
(ix) Identification of hazardous materials, as defined in Sec.
401.7 of this chapter, involved in the event, whether on the vehicle,
any payload, or on the ground;
(x) Action taken by any person to contain the consequences of the
event;
(xi) Weather conditions at the time of the event; and
(xii) Potential consequences for other similar vehicles, systems,
or operations.
(d) Emergency response requirements. An operator must--
(1) Activate emergency response services to protect the public and
property following a mishap as necessary including, but not limited to:
(i) Evacuating and rescuing members of the public, taking into
account debris dispersion and toxic plumes; and
(ii) Extinguishing fires;
(2) Maintain existing hazard area surveillance and clearance as
necessary to protect public safety;
(3) Contain and minimize the consequences of a mishap, including:
(i) Securing impact areas to ensure that no members of the public
enter;
(ii) Safely disposing of hazardous materials; and
(iii) Controlling hazards at the site or impact areas.
(4) Preserve data and physical evidence; and
(5) Implement agreements with government authorities and emergency
response services, as necessary, to satisfy the requirements of this
section.
(e) Mishap investigation requirements. In the event of a mishap, an
operator must--
(1) Investigate the root causes of the mishap; and
(2) Report investigation results to the FAA.
(f) Preventative measures. An operator must identify and implement
preventive measures for avoiding recurrence of the mishap prior to the
next flight, unless otherwise approved by the Administrator.
(g) Mishap records. An operator must maintain records associated
with the mishap in accordance with Sec. 450.219(b).
(h) Application requirements. An applicant must submit the plan or
other written means required by this section.
Sec. 450.175 Test-induced damage.
(a) Applicability. This section applies to license applicants or
operators seeking an optional test-induced damage exception.
(b) Coordination of potential test-induced damage. Test-induced
damage is not a mishap if all of the following are true:
(1) A license applicant or operator coordinates potential test-
induced damage with the FAA before the planned activity, and with
sufficient time for the FAA to evaluate the operator's proposal during
the application process or as a license modification;
(2) The test-induced damage did not result in any of the following:
(i) Serious injury or fatality (as defined in 49 CFR 830.2);
(ii) Damage to property not associated with the licensed activity;
or
(iii) Hazardous debris leaving the pre-defined hazard area; and
(3) The test-induced damage falls within the scope of activities
coordinated with the FAA in paragraph (b)(1) of this section.
(c) Application requirements. An applicant must submit the
following information--
(1) Test objectives;
(2) Test limits;
(3) Expected outcomes;
(4) Potential risks, including the applicant's best understanding
of the uncertainties in environments, test limits, or system
performance;
(5) Applicable procedures;
(6) Expected time and duration of the test; and
(7) Additional information as required by the FAA to ensure
protection of public health and safety, safety of property, and the
national security and foreign policy interests of the United States.
Sec. 450.177 Unique safety policies, requirements, and practices.
(a) Unique hazards. An operator must review operations, system
designs, analysis, and testing, and identify any unique hazards not
otherwise addressed by this part. An operator must implement any unique
safety policy, requirement, or practice needed to protect the public
from the unique hazard.
(b) Unique requirements. The FAA may identify and impose a unique
policy, requirement, or practice as needed to protect the public health
and safety.
(c) Application requirements. An applicant must--
(1) Identify any unique safety policy, requirement, or practice
necessary in accordance with paragraph (a) of this section, and
demonstrate that each unique safety policy, requirement, or practice
protects public health and safety.
(2) Demonstrate compliance with each unique safety policy,
requirement, or practice imposed by the FAA in accordance with
paragraph (b) of this section.
Ground Safety
Sec. 450.179 Ground safety--general.
(a) At a U.S. launch or reentry site, an operator must protect the
public and property from adverse effects of hazardous operations and
systems associated with--
(1) Preparing a launch vehicle for flight;
(2) Returning a launch or reentry vehicle to a safe condition after
landing, or after an aborted launch attempt; and
(3) Returning a site to a safe condition.
(b) An operator is not required to comply with Sec. Sec. 450.181
through 450.189 of this part if:
[[Page 79736]]
(1) The launch or reentry is being conducted from a Federal launch
or reentry site;
(2) The operator has a written agreement with the Federal launch or
reentry site for the provision of ground safety services and oversight;
and
(3) The Administrator has determined that the Federal launch or
reentry site's ground safety processes, requirements, and oversight are
not inconsistent with the Secretary's statutory authority over
commercial space activities.
(c) In making the determination required by paragraph (b)(3) of
this section, the Administrator will consider the nature and frequency
of launch and reentry activities conducted from the Federal launch or
reentry site, coordination between the FAA and the Federal launch or
reentry site safety personnel, and the Administrator's knowledge of the
Federal launch or reentry site's requirements.
Sec. 450.181 Coordination with a site operator.
(a) General. For a launch or reentry conducted from or to a Federal
launch or reentry site or a site licensed under part 420 or 433 of this
chapter, an operator must coordinate with the site operator to--
(1) Ensure public access is controlled where and when necessary to
protect public safety;
(2) Ensure launch or reentry operations are coordinated with other
launch and reentry operators and other affected parties to prevent
unsafe interference;
(3) Designate any ground hazard area that affects the operations of
a launch or reentry site; and
(4) Ensure a prompt and effective response is undertaken in the
event of a mishap that could impact the safety of the public and
property.
(b) Licensed site operator. For a launch or reentry conducted from
or to a site licensed under part 420 or 433 of this chapter, an
operator must also coordinate with the site operator to establish roles
and responsibilities for reporting, responding to, and investigating
any mishap during ground activities at the site.
(c) Application requirement. An applicant must describe how it is
coordinating with a Federal or licensed launch or reentry site operator
in compliance with this section.
Sec. 450.183 Explosive site plan.
(a) Explosive siting requirements. For a launch or reentry
conducted from or to a site exclusive to its own use, an operator must
comply with the explosive siting requirements of Sec. Sec. 420.63,
420.65, 420.66, 420.67, 420.69, and 420.70 of this chapter.
(b) Application requirement. An applicant must submit an explosive
site plan in accordance with paragraph (a) of this section.
Sec. 450.185 Ground hazard analysis.
An operator must perform and document a ground hazard analysis, and
continue to maintain it throughout the lifecycle of the launch or
reentry system. The analysis must--
(a) Hazard identification. Identify system and operation hazards
posed by the vehicle and ground hardware, including site and ground
support equipment. Hazards identified must include the following:
(1) System hazards, including:
(i) Vehicle over-pressurization;
(ii) Sudden energy release, including ordnance actuation;
(iii) Ionizing and non-ionizing radiation;
(iv) Fire or deflagration;
(v) Radioactive materials;
(vi) Toxic release;
(vii) Cryogens;
(viii) Electrical discharge; and
(ix) Structural failure.
(2) Operation hazards, including:
(i) Propellant handling and loading;
(ii) Transporting of vehicle or vehicle components;
(iii) Vehicle testing; and
(iv) Vehicle or system activation.
(b) Hazard assessment. Assess each hazard's likelihood and
severity.
(c) Risk acceptability criteria. Ensure that the risk associated
with each hazard meets the following criteria:
(1) The likelihood of any hazardous condition that may cause death
or serious injury to the public must be extremely remote; and
(2) The likelihood of any hazardous condition that may cause major
damage to property not associated with the launch or reentry must be
remote.
(d) Risk mitigation. Identify and describe the risk elimination and
mitigation measures required to satisfy paragraph (c) of this section.
(e) Validation and verification. Document that the risk elimination
and mitigation measures achieve the risk levels of paragraph (c) of
this section through validation and verification. Verification
includes:
(1) Analysis;
(2) Test;
(3) Demonstration; or
(4) Inspection.
(f) Application requirements. An applicant must submit--
(1) A description of the methodology used to perform the ground
hazard analysis;
(2) A list of all systems and operations that may cause a hazard
involving the vehicle or any payload; and
(3) The ground hazard analysis products of paragraphs (a) through
(e) of this section, including data that verifies the risk elimination
and mitigation measures.
Sec. 450.187 Toxic hazards mitigation for ground operations.
(a) Applicability. (1) Except as specified in paragraph (a)(2),
this section applies to any launch or reentry vehicle, including all
vehicle components and payloads, that use toxic propellants or other
toxic chemicals.
(2) No toxic release hazard analysis is required for kerosene-based
fuels, unless the Administrator determines that an analysis is required
to protect public safety.
(b) General. An operator must--
(1) Conduct a toxic release hazard analysis in accordance with
paragraph (c) of this section;
(2) Manage the risk of casualties that could arise from the
exposure to toxic release through one of the following means:
(i) Contain hazards caused by toxic release in accordance with
paragraph (d) of this section; or
(ii) Perform a toxic risk assessment, in accordance with paragraph
(e) of this section, that demonstrates compliance with the risk
criteria of Sec. 450.185(c).
(3) Establish ground hazard controls based on the results of its
toxic release hazard analysis and toxic containment or toxic risk
assessment for any necessary evacuation of the public from any toxic
hazard area.
(c) Toxic release hazard analysis. A toxic release hazard analysis
must--
(1) Account for any toxic release that could occur during nominal
or non-nominal launch or reentry ground operations;
(2) Include a worst-case release scenario analysis or a maximum-
credible release scenario analysis for each process that involves a
toxic propellant or other chemical;
(3) Determine if toxic release can occur based on an evaluation of
the chemical compositions and quantities of propellants, other
chemicals, vehicle materials, and projected combustion products, and
the possible toxic release scenarios;
(4) Account for both normal combustion products and any unreacted
propellants and phase change or chemical derivatives of released
substances; and
(5) Account for any operational constraints and emergency
procedures
[[Page 79737]]
that provide protection from toxic release.
(d) Toxic containment. An operator using toxic containment must
manage the risk of casualty from the exposure to toxic release either
by--
(1) Evacuating, or being prepared to evacuate, the public from any
toxic hazard area in the event of a worst-case release or maximum
credible release scenario; or
(2) Employing meteorological constraints to limit a ground
operation to times during which prevailing winds and other conditions
ensure that the public would not be exposed to toxic concentrations and
durations greater than accepted toxic thresholds for acute casualty in
the event of a worst-case release or maximum credible release scenario.
(e) Toxic risk assessment. An operator using toxic risk assessment
must manage the risk from any toxic release hazard and demonstrate
compliance with the criteria in Sec. 450.185(c). A toxic risk
assessment must--
(1) Account for airborne concentration and duration thresholds of
toxic propellants or other chemicals. For any toxic propellant, other
chemicals, or combustion product, an operator must use airborne toxic
concentration and duration thresholds identified in a means of
compliance accepted by the Administrator;
(2) Account for physical phenomena expected to influence any toxic
concentration and duration in the area surrounding the potential
release site;
(3) Determine a toxic hazard area for each process surrounding the
potential release site for each toxic propellant or other chemical
based on the amount and toxicity of the propellant or other chemical,
the exposure duration, and the meteorological conditions involved;
(4) Account for all members of the public that may be exposed to
the toxic release; and
(5) Account for any risk mitigation measures applied in the risk
assessment.
(f) Application requirements. An applicant must submit:
(1) The identity of the toxic propellant, chemical, or combustion
products or derivatives in the possible toxic release;
(2) The applicant's selected airborne toxic concentration and
duration thresholds;
(3) The meteorological conditions for the atmospheric transport and
buoyant cloud rise of any toxic release from its source to downwind
receptor locations;
(4) Characterization of the terrain, as input for modeling the
atmospheric transport of a toxic release from its source to downwind
receptor locations;
(5) The identity of the toxic dispersion model used, and any other
input data;
(6) Representative results of an applicant's toxic dispersion
modeling to predict concentrations and durations at selected downwind
receptor locations, to determine the toxic hazard area for a released
quantity of the toxic substance;
(7) For toxic release hazard analysis in accordance with paragraph
(c) of this section:
(i) A description of the failure modes and associated relative
probabilities for potential toxic release scenarios used in the risk
evaluation; and
(ii) The methodology and representative results of an applicant's
determination of the worst-case or maximum-credible quantity of any
toxic release that might occur during ground operations;
(8) For toxic containment in accordance with paragraph (d) of this
section, identify the evacuation plans or meteorological constraints
and associated ground hazard controls needed to ensure that the public
will not be within any toxic hazard area in the event of a worst-case
release or maximum credible release scenario.
(9) For toxic risk assessment in accordance with paragraph (e) of
this section:
(i) A demonstration that the risk criteria in Sec. 450.185(c) will
be met;
(ii) The population characteristics in receptor locations that are
identified by toxic dispersion modeling as toxic hazard areas;
(iii) A description of any risk mitigation measures applied in the
toxic risk assessment; and
(iv) A description of the population exposure input data used in
accordance with Sec. 450.123.
Sec. 450.189 Ground safety prescribed hazard controls.
(a) General. In addition to the hazard controls derived from an
operator's ground hazard analysis and toxic hazard analysis, an
operator must comply with paragraphs (b) through (e) of this section.
(b) Protection of public on the site. An operator must document a
process for protecting members of the public who enter any area under
the control of a launch or reentry operator, including:
(1) Procedures for identifying and tracking the public while on the
site; and
(2) Methods the operator uses to protect the public from hazards in
accordance with the ground hazard analysis and toxic hazard analysis.
(c) Countdown abort. Following a countdown abort or recycle
operation, an operator must establish, maintain, and perform procedures
for controlling hazards related to the vehicle and returning the
vehicle, stages, or other flight hardware and site facilities to a safe
condition. When a launch vehicle does not liftoff after a command to
initiate flight was sent, an operator must--
(1) Ensure that the vehicle and any payload are in a safe
configuration;
(2) Prohibit entry of the public into any identified hazard areas
until the site is returned to a safe condition; and
(3) Maintain and verify that any flight safety system remains
operational until verification that the launch vehicle does not
represent a risk of inadvertent flight.
(d) Fire suppression. An operator must have reasonable precautions
in place to report and control any fire caused by licensed activities.
(e) Emergency procedures. An operator must have general emergency
procedures that apply to any emergencies not covered by the mishap plan
of Sec. 450.173 that may create a hazard to the public.
(f) Application requirement. An applicant must submit the process
for protecting members of the public who enter any area under the
control of a launch or reentry operator in accordance with paragraph
(b) of this section.
Subpart D--Terms and Conditions of a Vehicle Operator License
Sec. 450.201 Responsibility for public safety and safety of property.
A licensee is responsible for ensuring public safety and safety of
property during the conduct of a licensed launch or reentry.
Sec. 450.203 Compliance.
A licensee must conduct a licensed launch or reentry in accordance
with representations made in its license application, the requirements
of subparts C and D of this part, and the terms and conditions
contained in the license. A licensee's failure to act in accordance
with the representations made in the license application, the
requirements of subparts C and D of this part, and the terms and
conditions contained in the license, is sufficient basis for the
revocation of a license or other appropriate enforcement action.
Sec. 450.205 Financial responsibility requirements.
A licensee must comply with financial responsibility requirements
of part 440 of this chapter and as specified in a license or license
order.
[[Page 79738]]
Sec. 450.207 Human spaceflight requirements.
A licensee conducting a launch or reentry with a human being on
board the vehicle must comply with human spaceflight requirements of
part 460 of this chapter as specified in a license or license order.
Sec. 450.209 Compliance monitoring.
(a) A licensee must allow access by, and cooperate with, Federal
officers or employees or other individuals authorized by the FAA to
observe any of its activities, or any of its contractors' or
subcontractors' activities, associated with the conduct of a licensed
launch or reentry.
(b) For each licensed launch or reentry, a licensee must provide
the FAA with a console for monitoring the progress of the countdown and
communication on all channels of the countdown communications network,
unless the licensee has another acceptable means. A licensee must also
provide the FAA with the capability to communicate with the mission
director designated by Sec. 450.103(a)(1).
Sec. 450.211 Continuing accuracy of license application; application
for modification of license.
(a) A licensee is responsible for the continuing accuracy of
representations contained in its application for the entire term of the
license.
(b) After a license has been issued, a licensee must apply to the
FAA for modification of the license if--
(1) The licensee proposes to conduct a launch or reentry in a
manner not authorized by the license; or
(2) Any representation contained in the license application that is
material to public health and safety or the safety of property is no
longer accurate and complete or does not reflect the licensee's
procedures governing the actual conduct of a launch or reentry. A
change is material to public health and safety or the safety of
property if it alters or affects--
(i) The class of payload;
(ii) The type of launch or reentry vehicle;
(iii) The type or quantity of hazardous material;
(iv) The flight trajectory;
(v) The launch site or reentry site or other landing site; or
(vi) Any system, policy, procedure, requirement, criteria, or
standard that is safety critical.
(c) An application to modify a license must be prepared and
submitted in accordance with part 413 of this chapter. If requested
during the application process, the FAA may approve an alternate method
for requesting license modifications. The licensee must indicate any
part of its license or license application that would be changed or
affected by a proposed modification.
(d) Upon approval of a modification, the FAA issues either a
written approval to the licensee or a license order amending the
license if a stated term or condition of the license is changed, added,
or deleted. An approval has the full force and effect of a license
order and is part of the licensing record.
Sec. 450.213 Pre-flight reporting.
(a) Reporting method. A licensee must send the information in this
section as an email attachment to [email protected], or other
method as agreed to by the Administrator in the license.
(b) Mission information. A licensee must submit to the FAA the
following mission-specific information no less than 60 days before each
mission conducted under the license, unless the Administrator agrees to
a different time frame in accordance with Sec. 404.15 in the license,
except when the information was provided in the license application:
(1) Payload information in accordance with Sec. 450.43(i); and
(2) Planned mission information, including the vehicle, launch
site, planned flight path, staging and impact locations, each payload
delivery point, intended reentry or landing sites including any
contingency abort location, and the location of any disposed launch or
reentry vehicle stage or component that is deorbited.
(c) Flight abort and flight safety analysis products. A licensee
must submit to the FAA updated flight abort and flight safety analysis
products, using methodologies previously approved by the FAA, for each
mission no less than 30 days before flight, unless the Administrator
agrees to a different time frame in accordance with Sec. 404.15 in the
license.
(1) A licensee is not required to submit the flight abort and
flight safety analysis products if--
(i) The analysis submitted in the license application satisfies all
the requirements of this section; or
(ii) The licensee demonstrated during the application process that
the analysis does not need to be updated to account for mission-
specific factors.
(2) If a licensee is required to submit the flight abort and flight
safety analysis products, the licensee--
(i) Must account for vehicle- and mission-specific input data;
(ii) Must account for potential variations in input data that may
affect any analysis product within the final 30 days before flight;
(iii) Must submit the analysis products using the same format and
organization used in its license application; and
(iv) May not change an analysis product within the final 30 days
before flight unless the licensee has a process, approved in the
license, for making a change in that period as part of the licensee's
flight safety analysis process.
(d) Flight safety system test data. Any licensee that is required
by Sec. 450.101(c) to use a flight safety system to protect public
safety must submit to the FAA, or provide the FAA access to, any test
reports, in accordance with approved flight safety system test plans,
no less than 30 days before flight, unless the Administrator agrees to
a different time frame in accordance with Sec. 404.15 in the license.
These reports must include:
(1) A summary of the system, subsystem, and component-level test
results, including all test failures and corrective actions
implemented;
(2) A summary of test results demonstrating sufficient margin to
predicted operating environments;
(3) A comparison matrix of the actual qualification and acceptance
test levels used for each component in each test compared against the
predicted flight levels for each environment, including any test
tolerances allowed for each test; and
(4) A clear identification of any components qualified by
similarity analysis or a combination of analysis and test.
(e) Collision avoidance analysis. A licensee must submit to a
Federal entity identified by the FAA and to the FAA the collision
avoidance information in appendix A to part 450 in accordance with
Sec. 450.169(f).
(f) Launch or reentry schedule. A licensee must file a launch or
reentry schedule that identifies each review, rehearsal, and safety-
critical operation. The schedule must be filed and updated in time to
allow FAA personnel to participate in the reviews, rehearsals, and
safety-critical operations.
Sec. 450.215 Post-flight reporting.
(a) A licensee must submit to the FAA the information in paragraph
(b) of this section no later than 90 days after a launch or reentry,
unless the Administrator agrees to a different time frame in accordance
with Sec. 404.15 of this chapter.
(b) A licensee must send the following information as an email
attachment to [email protected], or other method as agreed to by
the Administrator in the license:
[[Page 79739]]
(1) Any anomaly that occurred during countdown or flight that is
material to public health and safety and the safety of property;
(2) Any corrective action implemented or to be implemented after
the flight due to an anomaly or mishap;
(3) The number of humans on board the vehicle;
(4) The actual trajectory flown by the vehicle, if requested by the
FAA; and
(5) For an unguided suborbital launch vehicle, the actual impact
location of all impacting stages and impacting components, if requested
by the FAA.
Sec. 450.217 Registration of space objects.
(a) To assist the U.S. Government in implementing Article IV of the
1975 Convention on Registration of Objects Launched into Outer Space,
each licensee must submit to the FAA the information required by
paragraph (b) of this section for all objects placed in space by a
licensed launch, including a launch vehicle and any components, except
any object owned and registered by the U.S. Government.
(b) For each object that must be registered in accordance with this
section, no later than 30 days following the conduct of a licensed
launch, a licensee must file the following information:
(1) The international designator of the space object;
(2) Date and location of launch;
(3) General function of the space object;
(4) Final orbital parameters, including:
(i) Nodal period;
(ii) Inclination;
(iii) Apogee;
(iv) Perigee; and
(5) Ownership, and country of ownership, of the space object.
(c) A licensee must notify the FAA when it removes an object that
it has previously placed in space.
Sec. 450.219 Records.
(a) Except as specified in paragraph (b) of this section, a
licensee must maintain for 3 years all records, data, and other
material necessary to verify that a launch or reentry is conducted in
accordance with representations contained in the licensee's
application, the requirements of subparts C and D of this part, and the
terms and conditions contained in the license.
(b) For an event that meets any of paragraph (1) through (5) or
paragraph (8) of the definition of ``mishap'' in Sec. 401.7 of this
chapter, a licensee must preserve all records related to the event.
Records must be retained until completion of any Federal investigation
and the FAA advises the licensee that the records need not be retained.
The licensee must make all records required to be maintained under the
regulations available to Federal officials for inspection and copying.
Appendix A to Part 450--Collision Analysis Worksheet
(a) Launch or reentry information. An operator must file the
following information:
(1) Mission name. A mnemonic given to the launch vehicle/payload
combination identifying the launch mission distinctly from all
others;
(2) Launch location. Launch site location in latitude and
longitude;
(3) Launch or reentry window. The launch or reentry window
opening and closing times in Greenwich Mean Time (referred to as
ZULU time) and the Julian dates for each scheduled launch or reentry
attempts including primary and secondary launch or reentry dates;
(4) Epoch. The epoch time, in Greenwich Mean Time (GMT), of the
expected launch vehicle liftoff time;
(5) Segment number. A segment is defined as a launch vehicle
stage or payload after the thrusting portion of its flight has
ended. This includes the jettison or deployment of any stage or
payload. For each segment, an operator must determine the orbital
parameters;
(6) Orbital parameters. An operator must identify the orbital
parameters for all objects achieving orbit including the parameters
for each segment after thrust ends;
(7) Orbiting objects to evaluate. An operator must identify all
orbiting object descriptions including object name, length, width,
depth, diameter, and mass;
(8) Time of powered flight and sequence of events. The elapsed
time in hours, minutes, and seconds, from liftoff to passivation or
disposal. The input data must include the time of powered flight for
each stage or jettisoned component measured from liftoff; and
(9) Point of contact. The person or office within an operator's
organization that collects, analyzes, and distributes collision
avoidance analysis results.
(b) Collision avoidance analysis results transmission medium. An
operator must identify the transmission medium, such as voice or
email, for receiving results.
(c) Deliverable schedule/need dates. An operator must identify
the times before flight, referred to as ``L-times,'' for which the
operator requests a collision avoidance analysis. The final
collision avoidance analysis must be used to establish flight commit
criteria for a launch.
(d) Trajectory files. Individual position and velocity
trajectory files, including:
(1) The position coordinates in the Earth-Fixed Greenwich (EFG)
coordinates system measured in kilometers and the EFG velocity
components measured in kilometers per second, of each launch vehicle
stage or payload starting below 150 km through screening time frame;
(2) Radar cross section values for each individual file;
(3) Position Covariance, if probability of impact analysis
option is desired; and
(4) Separate trajectory files identified by valid window time
frames, if launch or reentry trajectory changes during launch or
reentry window.
(e) Screening. An operator must select spherical, ellipsoidal,
or collision probability screening as defined in this paragraph for
determining any conjunction:
(1) Spherical screening. Spherical screening centers a sphere on
each orbiting object's center-of-mass to determine any conjunction;
(2) Ellipsoidal screening. Ellipsoidal screening utilizes an
impact exclusion ellipsoid of revolution centered on the orbiting
object's center-of-mass to determine any conjunction. An operator
must provide input in the UVW coordinate system in kilometers. The
operator must provide delta-U measured in the radial-track
direction, delta-V measured in the in-track direction, and delta-W
measured in the cross-track direction; or
(3) Probability of Collision. Collision probability is
calculated using position and velocity information with covariance
in position.
PART 460--HUMAN SPACE FLIGHT REQUIREMENTS
0
71. The authority citation for part 460 continues to read as follows:
Authority: 51 U.S.C. 50901-50923.
0
72. Amend Sec. 460.45 by revising paragraph (d) to read as follows:
Sec. 460.45 Operator informing space flight participant of risk.
* * * * *
(d) An operator must describe the safety record of its vehicle to
each space flight participant as follows:
(1) For licenses issued under part 450 of this chapter, the
operator's safety record must cover any event that meets any of
paragraph (1), (4), (5), or (8) of the definition of ``mishap'' in
Sec. 401.7 that occurred during and after vehicle verification
performed in accordance with Sec. 460.17, and include:
(i) The number of vehicle flights;
(ii) The number of events that meet any of paragraph (1), (4), (5),
or (8) of the definition of ``mishap'' in Sec. 401.7 of this chapter;
and
(iii) Whether any corrective actions were taken to resolve these
mishaps.
(2) For licenses issued under part 415, 431, or 435 of this
chapter, the operator's safety record must cover launch and reentry
accidents and human space flight incidents as defined by Sec. 401.5,
that occurred during and after vehicle verification performed in
accordance with Sec. 460.17, and include:
(i) The number of vehicle flights;
(ii) The number of accidents and human space flight incidents as
defined by Sec. 401.5; and
[[Page 79740]]
(iii) Whether any corrective actions were taken to resolve these
accidents and human spaceflight incidents.
* * * * *
0
73. Effective March 10, 2026, further amend Sec. 460.45 by revising
paragraph (d) to read as follows:
Sec. 460.45 Operator informing space flight participant of risk.
* * * * *
(d) An operator must describe the safety record of its vehicle to
each space flight participant. The operator's safety record must cover
any event that meets any of paragraph (1), (4), (5), or (8) of the
definition of ``mishap'' in Sec. 401.7 that occurred during and after
vehicle verification performed in accordance with Sec. 460.17, and
include:
(1) The number of vehicle flights;
(2) The number of events that meet any of paragraph (1), (4), (5),
or (8) of the definition of ``mishap'' in section Sec. 401.7; and
(3) Whether any corrective actions were taken to resolve these
mishaps.
* * * * *
Issued under authority provided by 49 U.S.C. 106(f) and 51
U.S.C. Chapter 509 in Washington, DC, on September 30, 2020.
Steve Dickson,
Administrator.
[FR Doc. 2020-22042 Filed 12-2-20; 4:15 pm]
BILLING CODE 4910-13-P