Title 14—Aeronautics and Space--Volume 1
PART 417—LAUNCH SAFETY
§ 417.1   General information.
(a) Scope. This part sets forth—
(1) The responsibilities of a launch operator conducting a licensed launch of an expendable launch vehicle pursuant to a license issued under part 415 of this chapter; and
(2) The requirements for maintaining a launch license obtained under part 415 of this chapter. Parts 413 and 415 of this chapter contain requirements for preparing a license application to conduct a launch, including information reviewed by the FAA to conduct a policy, safety, payload, and environmental review, and a payload determination
(b) Applicability. (1) The administrative requirements for filing material with the FAA in subpart A of this part apply to all licensed launches from a Federal launch range or a non-Federal launch site, except where noted.
(2) The safety requirements of subparts B through E of this part apply to all licensed launches of expendable launch vehicles. See paragraph (d) of this section for exceptions to this provision.
(c) “Meets intent” certification. For a licensed launch from a Federal launch range, a launch operator need not demonstrate to the FAA that an alternative means of satisfying a requirement of this part provides an equivalent level of safety for a launch if written evidence demonstrates that a Federal launch range has, by the effective date of this part, granted a “meets intent certification,” including through “tailoring,” that applies to the requirement and that launch. See paragraph (e) of this section for exceptions to this provision. Written evidence includes:
(1) Range flight plan approval,
(2) Missile system pre-launch safety package,
(3) Preliminary and final flight data packages,
(4) A tailored version of EWR 127-1,
(5) Range email to the FAA stating that the MIC was approved, or
(6) Operation approval.
(d) Waiver. For a licensed launch from a Federal launch range, a requirement of this part does not apply to a launch if written evidence demonstrates that a Federal launch range has, by the effective date of this part, granted a waiver that allows noncompliance with the requirement for that launch. See paragraph (e) of this section for exceptions to this provision. Written evidence includes:
(1) Range flight plan approval,
(2) Missile system pre-launch safety package,
(3) Preliminary and final flight data packages,
(4) A tailored version of EWR 127-1,
(5) Range email to the FAA stating that the waiver was approved, or
(6) Operation approval.
(e) Exceptions to Federal launch range meets intent certifications and waivers. Even if a licensed launch from a Federal launch range satisfies paragraph (c) or (d) of this section for a requirement of this part, the requirement applies and a launch operator must satisfy the requirement, obtain FAA approval of any alternative, or obtain FAA approval for any further noncompliance if—
(1) The launch operator modifies the launch vehicle's operation or safety characteristics;
(2) The launch operator uses the launch vehicle, component, system, or subsystem in a new application;
(3) The FAA or the launch operator determines that a previously unforeseen or newly discovered safety hazard exists that is a source of significant risk to public safety; or
(4) The Federal launch range previously accepted a component, system, or subsystem, but did not then identify a noncompliance to a Federal launch range requirement.
(f) Equivalent level of safety. The requirements of this part apply to a launch operator and the launch operator's launch unless the launch operator clearly and convincingly demonstrates that an alternative approach provides an equivalent level of safety.
§ 417.3   Definitions and acronyms.
For the purpose of this part,
Command control system means the portion of a flight safety system that includes all components needed to send a flight termination control signal to an onboard vehicle flight termination system. A command control system starts with any flight termination activation switch at a flight safety crew console and ends at each command-transmitting antenna. It includes all intermediate equipment, linkages, and software and any auxiliary transmitter stations that ensure a command signal will reach the onboard vehicle flight termination system from liftoff until the launch vehicle achieves orbit or can no longer reach a populated or other protected area.
Command destruct system means a portion of a flight termination system that includes all components on board a launch vehicle that receive a flight termination control signal and achieve destruction of the launch vehicle. A command destruct system includes all receiving antennas, receiver decoders, explosive initiating and transmission devices, safe and arm devices and ordnance necessary to achieving destruction of the launch vehicle upon receipt of a destruct command.
Countdown means the timed sequence of events that must take place to initiate flight of a launch vehicle.
Crossrange means the distance measured along a line whose direction is either 90 degrees clockwise (right crossrange) or counter-clockwise (left crossrange) to the projection of a launch vehicle's planned nominal velocity vector azimuth onto a horizontal plane tangent to the ellipsoidal Earth model at the launch vehicle's sub-vehicle point. The terms right crossrange and left crossrange may also be used to indicate direction.
Data loss flight time means the shortest elapsed thrusting time during which a launch vehicle flown with a flight safety system can move from its normal trajectory to a condition where it is possible for the launch vehicle to endanger the public.
Destruct means the act of terminating the flight of a launch vehicle flown with a flight safety system in a way that destroys the launch vehicle and disperses or expends all remaining propellant and renders remaining energy sources non-propulsive before the launch vehicle or any launch vehicle component or payload impacts the Earth's surface.
Downrange means the distance measured along a line whose direction is parallel to the projection of a launch vehicle's planned nominal velocity vector azimuth into a horizontal plane tangent to the ellipsoidal Earth model at the launch vehicle sub-vehicle point. The term downrange may also be used to indicate direction.
Drag impact point means a launch vehicle instantaneous impact point corrected for atmospheric drag.
Dwell time means—
(1) The period during which a launch vehicle instantaneous impact point is over a populated or other protected area; or
(2) The period during which an object is subjected to a test condition.
Explosive debris means solid propellant fragments or other pieces of a launch vehicle or payload that result from break up of the launch vehicle during flight and that explode upon impact with the Earth's surface and cause overpressure.
Fail-over means a method of ensuring continuous or near continuous operation of a command transmitter system by automatically switching from a primary transmitter to a secondary transmitter when a condition exists that indicates potential failure of the primary transmitter.
Family performance data means—
(1) Results of launch vehicle component and system tests that represent similar characteristics for a launch vehicle component or system; and
(2) Data that is continuously updated as additional samples of a given component or system are tested.
Flight safety limit means criteria to ensure a set of impact limit lines established for the flight of a launch vehicle flown with a flight safety system bound the area where debris with a ballistic coefficient of three or more is allowed to impact when a flight safety system functions.
Flight safety system means the system that provides a means of control during flight for preventing a hazard from a launch vehicle, including any payload hazard, from reaching any populated or other protected area in the event of a launch vehicle failure. A flight safety system includes:
(1) All hardware and software used to protect the public in the event of a launch vehicle failure; and
(2) The functions of any flight safety crew.
Flight safety crew means the personnel, designated by a launch operator, who operate flight safety system hardware and software to monitor the flight of a launch vehicle and make a flight termination decision.
Flight termination system means all components, onboard a launch vehicle, that provide the ability to end a launch vehicle's flight in a controlled manner. A flight termination system consists of all command destruct systems, inadvertent separation destruct systems, or other systems or components that are onboard a launch vehicle and used to terminate flight.
Gate means the portion of a flight safety limit boundary through which the tracking icon of a launch vehicle flown with a flight safety system may pass without flight termination.
In-family means a launch vehicle component or system test result that indicates that the component or system's performance conforms to the family performance data that was established by previous test results.
Inadvertent separation destruct system means an automatic destruct system that uses mechanical means to trigger the destruction of a launch vehicle stage.
Launch azimuth means the horizontal angular direction initially taken by a launch vehicle at liftoff, measured clockwise in degrees from true north.
Launch crew means all personnel who control the countdown and flight of a launch vehicle or who make irrevocable operational decisions that have the potential for impacting public safety. A launch crew includes members of the flight safety crew.
Launch processing means all preflight preparation of a launch vehicle at a launch site, including buildup of the launch vehicle, integration of the payload, and fueling.
Launch window means a period of time during which the flight of a launch vehicle may be initiated.
“Meets intent” certification means a decision by a Federal launch range to accept a substitute means of satisfying a safety requirement where the substitute provides an equivalent level of safety to that of the original requirement.
Normal flight means the flight of a properly performing launch vehicle whose real-time instantaneous impact point does not deviate from the nominal instantaneous impact point by more than the sum of the wind effects and the three-sigma guidance and performance deviations in the uprange, downrange, left-crossrange, or right-crossrange directions.
Normal trajectory means a trajectory that describes normal flight.
Non-operating environment means an environment that a launch vehicle component experiences before flight and when not otherwise being subjected to acceptance tests. Non-operating environments include, but need not be limited to, storage, transportation, and installation.
Operating environment means an environment that a launch vehicle component will experience during acceptance testing, launch countdown, and flight. Operating environments include shock, vibration, thermal cycle, acceleration, humidity, and thermal vacuum.
Operating life means, for a flight safety system component, the period of time beginning with activation of the component or installation of the component on a launch vehicle, whichever is earlier, for which the component is capable of satisfying all its performance specifications through the end of flight.
Operation hazard means a hazard derived from an unsafe condition created by a system or operating environment or by an unsafe act.
Out-of-family means a component or system test result where the component or system's performance does not conform to the family performance data that was established by previous test results and is an indication of a potential problem with the component or system requiring further investigation and possible corrective action.
Passive component means a flight termination system component that does not contain active electronic piece parts.
Performance specification means a statement prescribing the particulars of how a component or part is expected to perform in relation to the system that contains the component or part. A performance specification includes specific values for the range of operation, input, output, or other parameters that define the component's or part's expected performance.
Protected area means an area of land not controlled by a launch operator that:
(1) Is a populated area;
(2) Is environmentally sensitive; or
(3) Contains a vital national asset.
Safety-critical computer system function means any computer system function that, if not performed, if performed out of sequence, or if performed incorrectly, may directly or indirectly cause a public safety hazard.
Service life means, for a flight termination system component, the sum total of the component's storage life and operating life.
Storage life means, for a flight termination system component, the period of time after manufacturing of the component is complete until the component is activated or installed on a launch vehicle, whichever is earlier, during which the component may be subjected to storage environments and must remain capable of satisfying all its performance specifications.
Sub-vehicle point means the location on an ellipsoidal Earth model where the normal to the ellipsoid passes through the launch vehicle's center of gravity. The term is the same as the weapon system term “sub-missile point.”
System hazard means a hazard associated with a system and generally exists even when no operation is occurring.
Tracking icon means the representation of a launch vehicle's instantaneous impact point, debris footprint, or other vehicle performance metric that is displayed to a flight safety crew during real-time tracking of the launch vehicle's flight.
Uprange means the distance measured along a line that is 180 degrees to the downrange direction. The term uprange may also be used to indicate direction.
Waiver means a decision that allows a launch operator to continue with a launch despite not satisfying a specific safety requirement and where the launch operator is not able to demonstrate an equivalent level of safety.
§ 417.5   [Reserved]
§ 417.7   Public safety responsibility.
A launch operator is responsible for ensuring the safe conduct of a licensed launch and for ensuring public safety and safety of property at all times during the conduct of a licensed launch.
§ 417.9   Launch site responsibility.
(a) A launch operator must ensure that launch processing at a launch site in the United States satisfies the requirements of this part. Launch processing at a launch site outside the United States may be subject to the requirements of the governing jurisdiction.
(b) For a launch from a launch site licensed under part 420 of this chapter, a launch operator must—
(1) Conduct its operations as required by any agreements that the launch site operator has with any Federal and local authorities under part 420 of this chapter; and
(2) Coordinate with the launch site operator and provide any information on its activities and potential hazards necessary for the launch site operator to determine how to protect any other launch operator, person, or property at the launch site as required by the launch site operator's obligations under § 420.55 of this chapter.
(c) For a launch from an exclusive-use site, where there is no licensed launch site operator, a launch operator must satisfy the requirements of this part and the public safety requirements of part 420 of this chapter. This subpart does not apply to licensed launches occurring from Federal launch ranges.
§ 417.11   Continuing accuracy of license application; application for modification of license.
(a) A launch operator must ensure the representations contained in its application are accurate for the entire term of the license. A launch operator must conduct a licensed launch and carry out launch safety procedures in accordance with its application.
(b) After the FAA issues a launch license, a launch operator must apply to the FAA for modification of a launch license if—
(1) A launch operator proposes to conduct a launch or carry out a launch safety procedure or operation in a manner that is not authorized by the license; or
(2) Any representation contained in the license application that is material to public health and safety or safety of property would no longer be accurate and complete or would not reflect the launch operator's procedures governing the actual conduct of a launch. A representation is material to public health and safety or safety of property if it alters or affects the launch operator's launch plans or procedures, class of payload, orbital destination, type of launch vehicle, flight path, launch site, launch point, or any safety system, policy, procedure, requirement, criteria or standard.
(c) A launch operator must prepare and file an application to modify a launch license under part 413 of this chapter. The launch operator must identify any part of its license or license application that a proposed modification would change or affect.
(d) The FAA reviews all approvals and determinations required by this chapter to determine whether they remain valid in light of a proposed modification. The FAA approves a modification that satisfies the requirements of this part.
(e) Upon approval of a modification, the FAA issues to a launch operator either a written approval or a license order modifying the license if a stated term or condition of the license is changed, added or deleted. A written approval has the full force and effect of a license order and is part of the licensing record.
(f) The Administrator may determine that a modification to a license issued under this part must comply with the requirements in part 450 of this chapter. The Administrator will base the determination on the extent and complexity of the modification, whether the applicant proposes to modify multiple parts of the application, or if the application requires significant evaluation.
§ 417.13   Agreement with Federal launch range.
Before conducting a licensed launch from a Federal launch range, a launch operator must—
(a) Enter into an agreement with a Federal launch range to provide access to and use of U.S. Government property and services required to support a licensed launch from the facility and for public safety related operations and support. The agreement must be in effect for the conduct of any licensed launch; and
(b) Comply with any requirements of the agreement with the Federal launch range that may affect public safety and safety of property during the conduct of a licensed launch, including flight safety procedures and requirements.
§ 417.15   Records.
(a) A launch operator must maintain all records necessary to verify that it conducts licensed launches according to representations contained in the licensee's application. A launch operator must retain records for three years after completion of all launches conducted under the license.
(b) If a launch accident or launch incident occurs, as defined by § 401.5 of this chapter, a launch operator must preserve all records related to the event until completion of any Federal investigation and the FAA advises the licensee not to retain the records. The launch operator must make available to Federal officials for inspection and copying all records that these regulations require the launch operator to maintain.
§ 417.17   Launch reporting requirements and launch specific updates.
(a) General. A launch operator must satisfy the launch reporting requirements and launch specific updates required by this section and by the terms of the launch operator's license. A launch operator must file any change to the information in the license application, not identified by this section, with the FAA as a request for license modification as required by § 417.11.
(b) Launch reporting requirements for a launch from a Federal launch range or a non-Federal launch site. (1) Launch schedule and point of contact. For each launch, a launch operator must file a launch schedule that identifies each review, rehearsal, and safety critical launch processing. A launch operator must file a point of contact for the schedule. The launch schedule must be filed and updated in time to allow FAA personnel to participate in the reviews, rehearsals, and safety critical launch processing.
(2) Sixty-day report. Not later than 60 days before each flight conducted under a launch operator license, a launch operator must provide the FAA the following launch-specific information:
(i) Payload information required by § 415.59 of this chapter; and
(ii) Flight information, including the launch vehicle, planned flight path, staging and impact locations, and any on-orbit activity of the launch vehicle, including each payload delivery point.
(3) U.S. Space Command Launch Notification. Not later than noon, EST, 15 days before each licensed flight, a launch operator must file a completed Federal Aviation Administration/U.S. Space Command (FAA/USSPACECOM) Launch Notification Form (OMB No. 2120-0608) with the FAA.
(c) Launch specific updates for a launch from a non-Federal launch site. A launch operator must file a launch specific update, required by this part, and any required by the terms of the launch license, for every substantive change to the information outlined in this part. For each launch, a launch operator must file the following launch specific updates:
(1) Flight safety system test schedule. For each launch of a launch vehicle flown with a flight safety system, a launch operator must file an updated flight safety system test schedule and points of contact no later than six months before flight. A launch operator must immediately file any later change to ensure that the FAA has the most current data.
(2) Launch plans. A launch operator must file any changes or additions to its launch plans required by § 417.111 to the FAA no later than 15 days before the associated activity is to take place. A launch operator must file the countdown plan with the FAA no later than 15 days before the countdown is to take place. If a change involves the addition of a new public hazard or the elimination of any control for a previously identified public hazard, a launch operator must request a license modification under § 417.11.
(3) Thirty-day flight safety analysis update. A launch operator must file updated flight safety analysis products, using previously approved methodologies, for each launch no later than 30 days before flight.
(i) The launch operator:
(A) Must account for vehicle and mission specific input data;
(B) May reference previously approved analysis products and data that are applicable to the launch or data that is applicable to a series of launches;
(C) Must account for potential variations in input data that may affect any analysis product within the final 30 days before flight;
(D) Must file the analysis products using the same format and organization used in its license application; and
(E) May not change an analysis product within the final 30 days before flight unless the launch operator identified a process for making a change in that period as part of the launch operator's flight safety analysis process and the FAA approved the process by grant of a license to the launch operator.
(ii) A launch operator need not file the 30-day analysis if the launch operator:
(A) Demonstrates that the analysis filed during the license application process satisfies all the requirements of this subpart; and
(B) Demonstrates the analysis does not need to be updated to account for launch specific factors.
(4) Flight termination system qualification test reports. For the launch of a launch vehicle flown with a flight safety system, a launch operator must file all flight termination system qualification test reports, or test report summaries, as required by section E417.1(i) of appendix E of this part, with the FAA no later than six months before the first flight attempt . The summary must identify when and where the tests were performed and provide the results. Complete qualification test reports must be made available to the FAA upon request.
(5) Flight termination system acceptance and age surveillance test report summaries. For the launch of a launch vehicle flown with a flight safety system, a launch operator must file a summary of the results of each flight termination system acceptance and age surveillance test, or the complete test report, as required by section E417.1(i) of appendix E of this part, no later than 30 days before the first flight attempt for each launch . The summary must identify when and where the tests were performed and provide the results. Complete acceptance and age surveillance test reports must be made available to the FAA upon request.
(6) Command control system acceptance test reports. For the launch of a launch vehicle flown with a flight safety system, a launch operator must file all command control system acceptance test reports, or test report summaries, as required by § 417.305(d), with the FAA no later than 30 days before the first flight attempt. The summary must identify when and where the tests were performed and provide the results. Complete acceptance test reports must be made available to the FAA upon request.
(7) Ground safety analysis report updates. A launch operator must file ground safety analysis report updates with the FAA as soon as the need for the change is identified and at least 30 days before the associated activity takes place. A launch operator must file a license modification request with the FAA for each change that involves the addition of a hazard that can affect public safety or the elimination of a previously identified hazard control for a hazard that still exists.
§ 417.19   Registration of space objects.
(a) To assist the U.S. Government in implementing Article IV of the 1975 Convention on Registration of Objects Launched into Outer Space, each launch operator must provide to the FAA the information required by paragraph (b) of this section for all objects placed in space by a licensed launch, including a launch vehicle and any components, except:
(1) Any object owned and registered by the U.S. Government; and
(2) Any object owned by a foreign entity.
(b) For each object that must be registered in accordance with this section, not later than 30 days following the conduct of a licensed launch, an operator must file the following information:
(1) The international designator of the space object(s);
(2) Date and location of launch;
(3) General function of the space object; and
(4) Final orbital parameters, including:
(i) Nodal period;
(ii) Inclination;
(iii) Apogee; and
(iv) Perigee.
§ 417.21   Financial responsibility requirements.
A launch operator must comply with financial responsibility requirements as required by part 440 of this chapter and as specified in a license or license order.
§ 417.23   Compliance monitoring.
(a) A launch operator must allow access by, and cooperate with, Federal officers or employees or other individuals authorized by the FAA to observe any of its activities, or of its contractors or subcontractors, associated with the conduct of a licensed launch.
(b) For each licensed launch, a launch operator must provide the FAA with a console for monitoring the progress of the countdown and communication on all channels of the countdown communications network. A launch operator must also provide the FAA with the capability to communicate with the person designated by § 417.103(b)(1).
§ 417.25   Post launch report.
(a) For a launch operator launching from a Federal launch range, a launch operator must file a post launch report with the FAA no later than 90 days after the launch, unless an FAA launch site safety assessment shows that the Federal launch range creates a post launch report that contains the information required by this section.
(b) For a launch operator launching from a non-Federal launch site, a launch operator must file a post launch report with the FAA no later than 90 days after the launch.
(c) The post launch report must:
(1) Identify any discrepancy or anomaly that occurred during the launch countdown and flight;
(2) Identify any deviation from any term of the license or any event otherwise material to public safety, and each corrective action to be implemented before any future flight;
(3) For the launch of launch vehicle flown with a flight safety system, identify any flight environment not consistent with the maximum predicted environment as required by D 417.7(b) and any measured wind profiles not consistent with the predictions used for the launch, as required by § 417.7(g)(3); and
(4) For the launch of an unguided suborbital launch vehicle, identify the actual impact location of all impacting stages and any impacting components, and provide a comparison of actual and predicted nominal performance.
§§ 417.26-417.100   [Reserved]
§ 417.101   Scope.
This subpart contains public safety requirements that apply to the launch of an orbital or suborbital expendable launch vehicle from a Federal launch range or other launch site. If the FAA has assessed the Federal launch range, through its launch site safety assessment, and found that an applicable range safety-related launch service or property satisfies the requirements of this subpart, then the FAA will treat the Federal launch range's launch service or property as that of a launch operator without need for further demonstration of compliance to the FAA if:
(a) A launch operator has contracted with a Federal launch range for the provision of the safety-related launch service or property; and
(b) The FAA has assessed the Federal launch range, through its launch site safety assessment, and found that the Federal launch range's safety-related launch service or property satisfy the requirements of this subpart. In this case, the FAA will treat the Federal launch range's process as that of a launch operator.
§ 417.103   Safety organization.
(a) A launch operator must maintain and document a safety organization. A launch operator must identify lines of communication and approval authority for all public safety decisions, including those regarding design, operations, and analysis. A launch operator must describe its lines of communication, both within the launch operator's organization and between the launch operator and any federal launch range or other launch site operator providing launch services, in writing. Documented approval authority shall also be employed by the launch operator throughout the life of the launch system to ensure public safety and compliance with this part.
(b) A launch operator's safety organization must include, but need not be limited to, the following launch management positions:
(1) An employee of the launch operator who has the launch operator's final approval authority for launch. This employee, referred to as the launch director in this part, must ensure compliance with this part.
(2) An employee of the launch operator who is authorized to examine all aspects of the launch operator's launch safety operations and to monitor independently personnel compliance with the launch operator's safety policies and procedures. This employee, referred to as the safety official in this part, shall have direct access to the launch director, who shall ensure that all of the safety official's concerns are addressed prior to launch.
§ 417.105   Launch personnel qualifications and certification.
(a) General. A launch operator must employ a personnel certification program that documents the qualifications, including education, experience, and training, for each member of the launch crew.
(b) Personnel certification program. A launch operator's personnel certification program must:
(1) Conduct an annual personnel qualifications review and issue individual certifications to perform safety related tasks.
(2) Revoke individual certifications for negligence or failure to satisfy certification requirements.
§ 417.107   Flight safety.
(a) Flight safety system. For each launch vehicle, vehicle component, and payload, a launch operator must use a flight safety system that satisfies subpart D of this part as follows, unless § 417.125 applies.
(1) In the vicinity of the launch site. For each launch vehicle, vehicle component, and payload, a launch operator must use a flight safety system in the vicinity of the launch site if the following exist:
(i) Any hazard from a launch vehicle, vehicle component, or payload can reach any protected area at any time during flight; or
(ii) A failure of the launch vehicle would have a high consequence to the public.
(2) In the downrange area. For each launch vehicle, vehicle component, and payload, a launch operator must provide a flight safety system downrange if the absence of a flight safety system would significantly increase the accumulated risk from debris impacts.
(b) Public risk criteria. A launch operator may initiate the flight of a launch vehicle only if flight safety analysis performed under paragraph (f) of this section demonstrates that any risk to the public satisfies the following public risk criteria:
(1) A launch operator may initiate the flight of a launch vehicle only if the total risk associated with the launch to all members of the public, excluding persons in water-borne vessels and aircraft, does not exceed an expected number of 1 × 10 −4 casualties. The total risk consists of risk posed by impacting inert and explosive debris, toxic release, and far field blast overpressure. The FAA will determine whether to approve public risk due to any other hazard associated with the proposed flight of a launch vehicle on a case-by-case basis. The E c criterion applies to each launch from lift-off through orbital insertion for an orbital launch, and through final impact for a suborbital launch.
(2) A launch operator may initiate flight only if the risk to any individual member of the public does not exceed a casualty expectation of 1 × 10 −6 per launch for each hazard.
(3) A launch operator must establish any water borne vessel hazard areas necessary to ensure the probability of impact (P i ) with debris capable of causing a casualty for water borne vessels does not exceed 1 × 10 −5 .
(4) A launch operator must establish any aircraft hazard areas necessary to ensure the probability of impact (P i ) with debris capable of causing a casualty for aircraft does not exceed 1 × 10 −6 .
(5) A launch operator may initiate flight of a launch vehicle only if all of the risks to the public satisfy the criteria in the critical asset protection requirements in § 450.101(a)(4) and (b)(4).
(c) Debris thresholds. A launch operator's flight safety analysis, performed as required by paragraph (f) of this section, must account for any inert debris impact with a mean expected kinetic energy at impact greater than or equal to 11 ft-lbs and, except for the far field blast overpressure effects analysis of § 417.229, a peak incident overpressure greater than or equal to 1.0 psi due to any explosive debris impact.
(1) When using the 11 ft-lbs threshold to determine potential casualties due to blunt trauma from inert debris impacts, the analysis must:
(i) Incorporate a probabilistic model that accounts for the probability of casualty due to any debris expected to impact with kinetic energy of 11 ft-lbs or greater and satisfy paragraph (d) of this section; or
(ii) Count each expected impact with kinetic energy of 11 ft-lbs or greater to a person as a casualty.
(2) When applying the 1.0 psi threshold to determine potential casualties due to blast overpressure effects, the analysis must:
(i) Incorporate a probabilistic model that accounts for the probability of casualty due to any blast overpressures of 1.0 psi or greater and satisfy paragraph (d) of this section; or
(ii) Count each person within the 1.0 psi overpressure radius of the source explosion as a casualty. When using this approach, the analysis must compute the peak incident overpressure using the Kingery-Bulmash relationship and may not take into account sheltering, reflections, or atmospheric effects. For persons located in buildings, the analysis must compute the peak incident overpressure for the shortest distance between the building and the blast source. The analysis must count each person located anywhere in a building subjected to peak incident overpressure equal to or greater than 1.0 psi as a casualty.
(d) Casualty modeling. A probabilistic casualty model must be based on accurate data and scientific principles and must be statistically valid. A launch operator must obtain FAA approval of any probabilistic casualty model that is used in the flight safety analysis. If the launch takes place from a Federal launch range, the analysis may employ any probabilistic casualty model that the FAA accepts as part of the FAA's launch site safety assessment of the Federal launch range's safety process.
(e) [Reserved]
(f) Flight safety analysis. A launch operator must perform and document a flight safety analysis as required by subpart C of this part. A launch operator must not initiate flight unless the flight safety analysis demonstrates that any risk to the public satisfies the public risk criteria of paragraph (b) of this section. For a licensed launch that involves a Federal launch range, the FAA will treat an analysis performed and documented by the Federal range, and which has an FAA approved launch site safety assessment, as that of the launch operator as provided in § 417.203(d) of subpart C of this part. A launch operator must use the flight safety analysis products to develop flight safety rules that govern a launch. Section 417.113 contains the requirements for flight safety rules.
§ 417.109   Ground safety.
(a) Ground safety requirements apply to launch processing and post-launch operations at a launch site in the United States.
(b) A launch operator must protect the public from adverse effects of hazardous operations and systems associated with preparing a launch vehicle for flight at a launch site.
(c) §§ 417.111(c), 417.113(b), and 417.115(c), and subpart E of this part provide launch operator ground safety requirements.
§ 417.111   Launch plans.
(a) General. A launch operator must implement written launch plans that define how launch processing and flight of a launch vehicle will be conducted without adversely affecting public safety and how to respond to a launch mishap. A launch operator's launch plans must include those required by this section. A launch operator's launch plans do not have to be separate documents, and may be part of other applicant documentation. A launch operator must incorporate each launch safety rule established under § 417.113 into a related launch safety plan. The launch operator must follow each launch plan.
(b) Flight Safety Plan. A launch operator must implement a plan that includes the following:
(1) Flight safety personnel. Identification of personnel by position who:
(i) Approve and implement each part of the flight safety plan and any modifications to the plan; and
(ii) Perform the flight safety analysis and ensure that the results, including the flight safety rules and establishment of flight hazard areas, are incorporated into the flight safety plan.
(2) Flight safety rules. All flight safety rules required by § 417.113.
(3) Flight safety system. A description of any flight safety system and its operation, including any preflight safety tests that a launch operator will perform.
(4) Trajectory and debris dispersion data. A description of the launch trajectory. For an orbital expendable launch vehicle, the description must include each planned orbital parameter, stage burnout time and state vector, and all planned stage impact times, locations, and downrange and crossrange dispersions. For a guided or unguided suborbital launch vehicle, the description must include each planned stage impact time, location, and downrange and crossrange dispersion.
(5) Flight hazard areas. Identification and location of each flight hazard area established for each launch as required by § 417.223, and identification of procedures for surveillance and clearance of these areas and zones as required by paragraph (j) of this section.
(6) Support systems and services. Identification of any support systems and services that are part of ensuring flight safety, including any aircraft or ship that a launch operator will use during flight.
(7) Flight safety operations. A description of the flight safety related tests, reviews, rehearsals, and other flight safety operations that a launch operator will conduct under §§ 417.115 through 417.121. A flight safety plan must contain or incorporate by reference written procedures for accomplishing all flight safety operations.
(8) Unguided suborbital launch vehicles. A launch operator's flight safety plan for the launch of an unguided suborbital rocket must meet the requirements of paragraph (b) of this section and provide the following data:
(i) Launch angle limits, as required by § 417.125(c)(3); and
(ii) All procedures for measurement of launch day winds and for performing wind weighting as required by §§ 417.125 and 417.233.
(c) Ground safety plan. A launch operator must implement a ground safety plan that describes implementation of the hazard controls identified by a launch operator's ground safety analysis and implementation of the ground safety requirements of subpart E of this part. A ground safety plan must address all public safety related issues and may include other ground safety issues if a launch operator intends it to have a broader scope. A ground safety plan must include the following:
(1) A description of the launch vehicle and any payload, or class of payload, identifying each hazard, including explosives, propellants, toxics and other hazardous materials, radiation sources, and pressurized systems. A ground safety plan must include figures that show the location of each hazard on the launch vehicle, and indicate where at the launch site a launch operator performs hazardous operations during launch processing.
(2) Propellant and explosive information including:
(i) Total net explosive weight of each of the launch operator's liquid and solid propellants and other explosives for each explosive hazard facility as defined by part 420 of this chapter.
(ii) For each toxic propellant, any hazard controls and process constraints determined under the launch operator's toxic release hazard analysis for launch processing performed as required by § 417.229 and appendix I of this part.
(iii) The explosive and occupancy limits for each explosive hazard facility.
(iv) Individual explosive item information, including configuration (such as, solid motor, motor segment, or liquid propellant container), explosive material, net explosive weight, storage hazard classification and compatibility group as defined by part 420 of this chapter.
(3) A graphic depiction of the layout of a launch operator's launch complex and other launch processing facilities at the launch site. The depiction must show separation distances and any intervening barriers between explosive items that affect the total net explosive weight that each facility is sited to accommodate. A launch operator must identify any proposed facility modifications or operational changes that may affect a launch site operator's explosive site plan.
(4) A description of the process for ensuring that the person designated under § 417.103(b)(2) reviews and approves any procedures and procedure changes for safety implications.
(5) Procedures that launch personnel will follow when reporting a hazard or mishap to a launch operator's safety organization.
(6) Procedures for ensuring that personnel have the qualifications and certifications needed to perform a task involving a hazard that could affect public safety.
(7) A flow chart of launch processing activities, including a list of all major tasks. The flow chart must include all hazardous tasks and identify where and when, with respect to liftoff, each hazardous task will take place.
(8) Identification of each safety clear zone and hazard area established as required by §§ 417.411 and 417.413, respectively.
(9) A summary of the means for announcing when any hazardous operation is taking place, the means for making emergency announcements and alarms, and identification of the recipients of each type of announcement.
(10) A summary of the means of prohibiting access to each safety clear zone, and implementing access control to each hazard area, including any procedures for prohibiting or allowing public access to such areas.
(11) A description of the process for ensuring that all safety precautions and verifications are in place before, during, and after hazardous operations. This includes the process for verification that an area can be returned to a non-hazardous work status.
(12) Description of each hazard control required by the ground safety analysis for each task that creates a public or launch location hazard. The hazard control must satisfy § 417.407(b).
(13) A procedure for the use of any safety equipment that protects the public, for each task that creates a public hazard or a launch location hazard.
(14) The requirement and procedure for coordinating with any launch site operator and local authorities, for each task creating a public or launch location hazard.
(15) Generic emergency procedures that apply to all emergencies and the emergency procedures that apply to each specific task that may create a public hazard, including any task that involves hazardous material, as required by § 417.407.
(16) A listing of the ground safety plan references, by title and date, such as the ground safety analysis report, explosive quantity-distance site plan and other ground safety related documentation.
(d) Launch support equipment and instrumentation plan. A launch operator must implement a plan that ensures the reliability of the equipment and instrumentation involved in protecting public safety during launch processing and flight. A launch support equipment and instrumentation plan must:
(1) List and describe support equipment and instrumentation;
(2) Identify all certified personnel, by position, as required by § 417.105, who operate and maintain the support equipment and instrumentation;
(3) Contain, or incorporate by reference, written procedures for support equipment and instrumentation operation, test, and maintenance that will be implemented for each launch;
(4) Identify equipment and instrumentation reliability; and
(5) Identify any contingencies that protect the public in the event of a malfunction.
(e) Configuration management and control plan. A launch operator must implement a plan that:
(1) Defines the launch operator's process for managing and controlling any change to a safety critical system to ensure its reliability;
(2) Identifies, for each system, each person by position who has authority to approve design changes and the personnel, by position, who maintain documentation of the most current approved design; and
(3) Contains, or incorporates by reference, all configuration management and control procedures that apply to the launch vehicle and each support system.
(f) Frequency management plan. A launch operator must implement a plan that:
(1) Identifies each frequency, all allowable frequency tolerances, and each frequency's intended use, operating power, and source;
(2) Provides for the monitoring of frequency usage and enforcement of frequency allocations; and
(3) Identifies agreements and procedures for coordinating use of radio frequencies with any launch site operator and any local and Federal authorities, including the Federal Communications Commission.
(g) Flight termination system electronic piece parts program plan. A launch operator must implement a plan that describes the launch operator's program for selecting and testing all electronic piece parts used in any flight termination system to ensure their reliability. This plan must—
(1) Demonstrate compliance with the requirements of § 417.309(b)(2);
(2) Describe the program for selecting piece parts for use in a flight termination system;
(3) Identify performance of any derating, qualification, screening, lot acceptance testing, and lot destructive physical analysis for electronic piece parts;
(4) Identify all personnel, by position, who conduct the piece part tests;
(5) Identify the pass/fail criteria for each test for each piece part;
(6) Identify the levels to which each piece part specification will be derated; and
(7) Contain, or incorporate by reference, test procedures for each piece part.
(h) Accident investigation plan (AIP). A launch operator must implement a plan containing the launch operator's procedures for reporting and responding to launch accidents, launch incidents, or other mishaps, as defined by § 401.5 of this chapter. An individual, authorized to sign and certify the application as required by § 413.7(c) of this chapter, and the person designated under § 417.103(b)(2) must sign the AIP.
(1) Reporting requirements. An AIP must provide for—
(i) Immediate notification to the Federal Aviation Administration (FAA) Washington Operations Center in case of a launch accident, a launch incident or a mishap that involves a fatality or serious injury (as defined by 49 CFR 830.2).
(ii) Notification within 24 hours to the Associate Administrator for Commercial Space Transportation or the Federal Aviation Administration (FAA) Washington Operations Center in the event of a mishap, other than those in § 415.41 (b) (1) of this chapter, that does not involve a fatality or serious injury (as defined in 49 CFR 830.2).
(iii) Submission of a written preliminary report to the FAA, Associate Administrator for Commercial Space Transportation, in the event of a launch accident or launch incident, as defined by § 401.5 of this chapter, within five days of the event. The report must identify the event as either a launch accident or launch incident, and must include the following information:
(A) Date and time of occurrence;
(B) Description of event;
(C) Location of launch;
(D) Launch vehicle;
(E) Any payload;
(F) Vehicle impact points outside designated impact lines, if applicable;
(G) Number and general description of any injuries;
(H) Property damage, if any, and an estimate of its value;
(I) Identification of hazardous materials, as defined by § 401.5 of this chapter, involved in the event, whether on the launch vehicle, payload, or on the ground;
(J) Action taken by any person to contain the consequences of the event; and
(K) Weather conditions at the time of the event.
(2) Response plan. An AIP must—
(i) Contain procedures that ensure the containment and minimization of the consequences of a launch accident, launch incident or other mishap;
(ii) Contain procedures that ensure the preservation of the data and physical evidence;
(3) Investigation plan. An AIP must contain—
(i) Procedures for investigating the cause of a launch accident, launch incident or other mishap;
(ii) Procedures for reporting investigation results to the FAA; and
(iii) Delineated responsibilities, including reporting responsibilities for personnel assigned to conduct investigations and for any one retained by the licensee to conduct or participate in investigations.
(4) Cooperation with FAA and NTSB. An AIP must contain procedures that require the licensee to report to and cooperate with FAA and National Transportation Safety Board (NTSB) investigations and designate one or more points of contact for the FAA and NTSB.
(5) Preventive measure. An AIP must contain procedures that require the licensee to identify and adopt preventive measures for avoiding recurrence of the event.
(i) Local agreements and public coordination plans. (1) Where there is a licensed launch site operator, a launch operator must implement and satisfy the launch site operator's local agreements and plans with local authorities at or near a launch site whose support is needed to ensure public safety during all launch processing and flight, as required by part 420 of this chapter.
(2) For a launch from an exclusive-use site, where there is no licensed launch site operator, a launch operator must develop and implement any agreements and plans with local authorities at or near the launch site whose support is needed to ensure public safety during all launch processing and flight, as required by part 420 of this chapter.
(3) A launch operator must implement a schedule and procedures for the release of launch information before flight, after flight, and in the event of an mishap.
(4) A launch operator must develop and implement procedures for public access to any launch viewing areas that are under a launch operator's control.
(5) A launch operator must describe its procedures for and accomplish the following for each launch—
(i) Inform local authorities of each designated hazard areas near the launch site associated with a launch vehicle's planned trajectory and any planned impacts of launch vehicle components and debris as defined by the flight safety analysis required by subpart C of this part;
(ii) Provide any hazard area information prepared as required by § 417.225 or § 417.235 to the local United States Coast Guard or equivalent local authority for issuance of the notices to mariners;
(iii) Provide hazard area information prepared as required by § 417.223 or § 417.233 for each aircraft hazard area within a flight corridor to the FAA Air Traffic Control (ATC) office or equivalent local authority having jurisdiction over the airspace through which the launch will take place for the issuance of notices to airmen;
(iv) Communicate with the local Coast Guard and the FAA ATC office or equivalent local authorities, either directly or through any launch site operator, to ensure that notices to airmen and mariners are issued and in effect at the time of flight; and
(v) Coordinate with any other local agency that supports the launch, such as local law enforcement agencies, emergency response agencies, fire departments, National Park Service, and Mineral Management Service.
(j) Hazard area surveillance and clearance plan. A launch operator must implement a plan that defines the process for ensuring that any unauthorized persons, ships, trains, aircraft or other vehicles are not within any hazard areas identified by the flight safety analysis or the ground safety analysis. In the plan, the launch operator must—
(1) List each hazard area that requires surveillance under §§ 417.107 and 417.223;
(2) Describe how the launch operator will provide for day-of-flight surveillance of the flight hazard area to ensure that the presence of any member of the public in or near a flight hazard area is consistent with flight commit criteria developed for each launch as required by § 417.113;
(3) Verify the accuracy of any radar or other equipment used for hazard area surveillance and account for any inaccuracies in the surveillance system when enforcing the flight commit criteria;
(4) Identify the number of security and surveillance personnel employed for each launch and the qualifications and training each must have;
(5) Identify the location of roadblocks and other security checkpoints, the times that each station must be manned, and any surveillance equipment used; and
(6) Contain, or incorporate by reference, all procedures for launch personnel control, handling of intruders, communications and coordination with launch personnel and other launch support entities, and implementation of any agreements with local authorities and any launch site operator.
(k) Communications plan. A launch operator must implement a plan providing licensee personnel and Federal launch range personnel, if applicable, communications procedures during countdown and flight. Effective issuance and communication of safety-critical information during countdown must include hold/resume, go/no go, and abort commands by licensee personnel and any Federal launch range personnel, during countdown. For all launches from Federal launch ranges, the Federal launch range must concur with the communications plan. The communications plan must:
(1) Describe the authority of licensee personnel and any Federal launch range personnel by individual or position title, to issue these commands;
(2) Ensure the assignment of communication networks, so that personnel identified under this paragraph have direct access to real-time safety-critical information required for issuing hold/resume, go/no go, and abort decisions and commands;
(3) Ensure personnel, identified under this paragraph, monitor each common intercom channel during countdown and flight; and
(4) Ensure the implementation of a protocol for using defined radio telephone communications terminology.
(l) Countdown plan. A launch operator must develop and implement a countdown plan that verifies that each launch safety rule and launch commit criterion is satisfied, verifies that personnel can communicate during the countdown and that the communication is available after the flight; and verifies that a launch operator will be able to recover from a launch abort or delay. A countdown plan must:
(1) Cover the period of time when any launch support personnel are to be at their designated stations through initiation of flight.
(2) Include procedures for handling anomalies that occur during a countdown and events and conditions that may result in a constraint to initiation of flight.
(3) Include procedures for delaying or holding a launch when necessary to allow for corrective actions, to await improved conditions, or to accommodate a launch wait.
(4) Describe a process for resolving issues that arise during a countdown and identify each person, by position, who approves corrective actions.
(5) Include a written countdown checklist that provides a formal decision process leading to flight initiation. A countdown checklist must include the flight day preflight tests of a flight safety system required by subpart D of this part and must contain:
(i) Identification of operations and specific actions completed, verification that there are no constraints to flight, and verification that a launch operator satisfied all launch safety rules and launch commit criteria;
(ii) Time of each event;
(iii) Identification of personnel, by position, who perform each operation or specific action, including reporting to the person designated under § 417.103(b)(3);
(iv) Identification of each communication channel that a launch operator uses for reporting each event;
(v) Identification of all communication and event reporting protocols;
(vi) Polling of personnel, by position, who oversee all safety critical systems and operations, to verify that the systems and the operations are ready to proceed with the launch; and
(vii) Record of all critical communications network channels that are used for voice, video, or data transmission that support the flight safety system, during each countdown.
(6) In case of a launch abort or delay:
(i) Identify each condition that must exist in order to make another launch attempt;
(ii) Include a schedule depicting the flow of tasks and events in relation to when the abort or delay occurred and the new planned launch time; and
(iii) Identify each interface and supporting entity needed to support recovery operations.
§ 417.113   Launch safety rules.
(a) General. For each launch, a launch operator must satisfy written launch safety rules that govern the conduct of the launch.
(1) The launch safety rules must identify the meteorological conditions and the status of the launch vehicle, launch support equipment, and personnel under which launch processing and flight may be conducted without adversely affecting public safety.
(2) The launch safety rules must satisfy the requirements of this section.
(3) A launch operator must follow all the launch safety rules.
(b) Ground safety rules. The launch safety rules must include ground safety rules that govern each preflight ground operation at a launch site that has the potential to adversely affect public safety. The ground safety rules must implement the ground safety analysis of subpart E of this part.
(c) Flight-commit criteria. The launch safety rules must include flight-commit criteria that identify each condition that must be met in order to initiate flight.
(1) The flight-commit criteria must implement the flight safety analysis of subpart C of this part and collision avoidance requirements in § 450.169 and critical asset protection requirements in § 450.101(a)(4) and (b)(4). These must include criteria for:
(i) Surveillance of any region of land, sea, or air necessary to ensure the number and location of members of the public are consistent with the inputs used for the flight safety analysis of subpart C of this part;
(ii) Monitoring of any meteorological condition and implementing any flight constraint developed using appendix G of this part. The launch operator must have clear and convincing evidence that the lightning flight commit criteria of appendix G, which apply to the conditions present at the time of lift-off, are not violated. If any other hazardous conditions exist, other than those identified by appendix G, the launch weather team will report the hazardous condition to the official designated under § 417.103(b)(1), who will determine whether initiating flight would expose the launch vehicle to a lightning hazard and not initiate flight in the presence of the hazard; and
(iii) Implementation of any launch wait in the launch window for the purpose of collision avoidance in accordance with collision avoidance requirements in § 450.169.
(2) For a launch that uses a flight safety system, the flight-commit criteria must ensure that the flight safety system is ready for flight. This must include criteria for ensuring that:
(i) The flight safety system is operating to ensure the launch vehicle will launch within all flight safety limits;
(ii) Any command transmitter system required by section D417.9 has sufficient coverage from lift-off to the point in flight where the flight safety system is no longer required by § 417.107(a);
(iii) The launch vehicle tracking system has no less than two tracking sources prior to lift-off. The launch vehicle tracking system has no less than one verified tracking source at all times from lift-off to orbit insertion for an orbital launch, to the end of powered flight for a suborbital launch; and
(iv) The launch operator will employ its flight safety system as designed in accordance with this part.
(3) For each launch, a launch operator must document the actual conditions used for the flight-commit criteria at the time of lift-off and verify whether the flight-commit criteria are satisfied.
(d) Flight termination rules. For a launch that uses a flight safety system, the launch safety rules must identify the conditions under which the flight safety system, including the functions of the flight safety system crew, must terminate flight to ensure public safety. These flight termination rules must implement the flight safety analysis of subpart C of this part and include each of the following:
(1) The flight safety system must terminate flight when valid, real-time data indicate the launch vehicle has violated any flight safety limit of § 417.213;
(2) The flight safety system must terminate flight at the straight-up-time required by § 417.215 if the launch vehicle continues to fly a straight up trajectory and, therefore, does not turn downrange when it should;
(3) The flight safety system must terminate flight when all of the following conditions exist:
(i) Real-time data indicate that the performance of the launch vehicle is erratic;
(ii) The potential exists for the loss of flight safety system control of the launch vehicle and further flight has the potential to endanger the public.
(4) The flight termination rules must incorporate the data-loss flight times and planned safe flight state of § 417.219, including each of the following:
(i) The flight safety system must terminate flight no later than the first data-loss flight time if, by that time, tracking of the launch vehicle is not established and vehicle position and status is unknown; and
(ii) Once launch vehicle tracking is established and there is a subsequent loss of verified tracking data before the planned safe flight state and verified tracking data is not received again, the flight safety system must terminate flight no later than the expiration of the data-loss flight time for the point in flight that the data was lost.
(5) For any gate established under § 417.217, both of the following apply:
(i) The flight safety system must terminate flight if the launch vehicle is performing erratically immediately prior to entering the gate.
(ii) The flight termination rules may permit the instantaneous impact point or other tracking icon to cross the gate only if there is no indication that the launch vehicle's performance has become erratic and the launch vehicle is either flying parallel to the nominal trajectory or converging to the nominal trajectory.
(6) For any hold-and-resume gate established under § 417.218;
(i) The flight safety system must terminate flight if the launch vehicle is performing erratically immediately prior to entering a hold gate.
(ii) The flight termination rules may permit the instantaneous impact point or other tracking icon to cross a hold gate only if there is no indication that the launch vehicle's performance has become erratic and the vehicle is either flying parallel to the nominal trajectory or converging to the nominal trajectory.
(iii) The flight termination rules of paragraphs (d)(1), (d)(3), and (d)(4) of this section apply after the instantaneous impact point or other tracking icon exits a resume gate.
(e) Flight safety system safing. For a launch that uses a flight safety system, the launch safety rules must ensure that any safing of the flight safety system occurs on or after the point in flight where the flight safety system is no longer required by § 417.107(b).
(f) Launch crew work shift and rest rules. For any operation with the potential to have an adverse effect on public safety, the launch safety rules must ensure the launch crew is physically and mentally capable of performing all assigned tasks. These rules must govern the length, number, and frequency of work shifts, including the rest afforded the launch crew between shifts.
§ 417.115   Tests.
(a) General. All flight, communication, and ground systems and equipment that a launch operator uses to protect the public from any adverse effects of a launch, must undergo testing as required by this part, and any corrective action and re-testing necessary to ensure reliable operation. A launch operator must—
(1) Coordinate test plans and all associated test procedures with any launch site operator or local authorities, as required by local agreements, associated with the operation; and
(2) Make test results, test failure reports, information on any corrective actions implemented and the results of re-test available to the FAA upon request.
(b) Flight safety system testing. A launch operator must only use a flight safety system and all flight safety system components, including any onboard launch vehicle flight termination system, command control system, and support system that satisfy the test requirements of subpart D of this part.
(c) Ground system testing. A launch operator must only use a system or equipment used to support hazardous ground operations identified by the ground safety analysis required by § 417.405 that satisfies the test requirements of paragraph (a) of this section.
§ 417.117   Reviews.
(a) General. A launch operator must—
(1) Review the status of operations, systems, equipment, and personnel required by part 417;
(2) Maintain and implement documented criteria for successful completion of each review;
(3) Track to completion and document any corrective actions or issues identified during a review; and
(4) Ensure that launch operator personnel who oversee a review attest to successful completion of the review's criteria in writing.
(b) A launch operator must conduct the following reviews:
(1) Hazardous operations safety readiness reviews. A launch operator must conduct a review before performing any hazardous operation with the potential to adversely affect public safety. The review must determine a launch operator's readiness to perform the operation and ensure that safety provisions are in place. The review must determine the readiness status of safety systems and equipment and verify that the personnel involved satisfy certification and training requirements.
(2) Launch safety review. For each launch, a launch operator must conduct a launch safety review no later than 15 days before the planned day of flight, or as agreed to by the FAA during the application process. This review must determine the readiness of ground and flight safety systems, safety equipment, and safety personnel to support a flight attempt. Successful completion of a launch safety review must ensure satisfaction of the following criteria:
(i) A launch operator must verify that all safety requirements have been or will be satisfied before flight. The launch operator must resolve all safety related action items.
(ii) A launch operator must assign and certify flight safety personnel as required by § 417.105.
(iii) The flight safety rules and flight safety plan must incorporate a final flight safety analysis as required by subpart C of this part.
(iv) A launch operator must verify, at the time of the review, that the ground safety systems and personnel satisfy or will satisfy all requirements of the ground safety plan for support of flight.
(v) A launch operator must accomplish the safety related coordination with any launch site operator or local authorities as required by local agreements.
(vi) A launch operator must verify the filing of all safety related information for a specific launch with the FAA, as required by FAA regulations and any special terms of a license. A launch operator must verify that information filed with the FAA reflects the current status of safety-related systems and processes for each specific launch.
(3) Launch readiness review for flight. A launch operator must conduct a launch readiness review for flight as required by this section within 48 hours of flight. A person, identified as required by § 417.103(b)(1), must review all preflight testing and launch processing conducted up to the time of the review; and review the status of systems and support personnel to determine readiness to proceed with launch processing and the launch countdown. A decision to proceed must be in writing and signed by the person identified as required by § 417.103(b)(1), and any launch site operator or Federal launch range. A launch operator, during the launch readiness review, must poll the FAA to verify that the FAA has identified no issues related to the launch operator's license. During a launch readiness review, the launch operator must account for the following information:
(i) Readiness of launch vehicle and payload.
(ii) Readiness of any flight safety system and personnel and the results of flight safety system testing.
(iii) Readiness of safety-related launch property and services to be provided by a Federal launch range.
(iv) Readiness of all other safety-related equipment and services.
(v) Readiness of launch safety rules and launch constraints.
(vi) Status of launch weather forecasts.
(vii) Readiness of abort, hold and recycle procedures.
(viii) Results of rehearsals conducted as required by § 417.119.
(ix) Unresolved safety issues as of the time of the launch readiness review and plans for their resolution.
(x) Additional safety information that may be required to assess readiness for flight.
(xi) To review launch failure initial response actions and investigation roles and responsibilities.
§ 417.119   Rehearsals.
(a) General. A launch operator must rehearse its launch crew and systems to identify corrective actions needed to ensure public safety. The launch operator must conduct all rehearsals as follows:
(1) A launch operator must assess any anomalies identified by a rehearsal, and must incorporate any changes to launch processing and flight needed to correct any anomaly that is material to public safety.
(2) A launch operator must inform the FAA of any public safety related anomalies and related changes in operations performed during launch processing or flight resulting from a rehearsal.
(3) For each launch, each person with a public safety critical role who will participate in the launch processing or flight of a launch vehicle must participate in at least one related rehearsal that exercises his or her role during nominal and non-nominal conditions so that the launch vehicle will not harm the public.
(4) A launch operator must conduct the rehearsals identified in this section for each launch.
(5) At least one rehearsal must simulate normal and abnormal preflight and flight conditions to exercise the launch operator's launch plans.
(6) A launch operator may conduct rehearsals at the same time if joint rehearsals do not create hazardous conditions, such as changing a hardware configuration that affects public safety, during the rehearsal.
(b) Countdown rehearsal. A launch operator must conduct a rehearsal using the countdown plan, procedures, and checklist required by § 417.111(l). A countdown rehearsal must familiarize launch personnel with all countdown activities, demonstrate that the planned sequence of events is correct, and demonstrate that there is adequate time allotted for each event. A launch operator must hold a countdown rehearsal after the assembly of the launch vehicle and any launch support systems into their final configuration for flight and before the launch readiness review required by § 417.117.
(c) Emergency response rehearsal. A launch operator must conduct a rehearsal of the emergency response section of the accident investigation plan required by § 417.111(h)(2). A launch operator must conduct an emergency response rehearsal for a first launch of a new vehicle, for any additional launch that involves a new safety hazard, or for any launch where more than a year has passed since the last rehearsal.
(d) Communications rehearsal. A launch operator must rehearse each part of the communications plan required by § 417.111(k), either as part of another rehearsal or during a communications rehearsal.
§ 417.121   Safety critical preflight operations.
(a) General. A launch operator must perform safety critical preflight operations that protect the public from the adverse effects of hazards associated with launch processing and flight of a launch vehicle. The launch operator must identify all safety critical preflight operations in the launch schedule required by § 417.17(b)(1). Safety critical preflight operations must include those defined in this section.
(b) Countdown. A launch operator must implement its countdown plan, of § 417.111(l), for each launch. A launch operator must disseminate a countdown plan to all personnel responsible for the countdown and flight of a launch vehicle, and each person must follow that plan.
(c) [Reserved]
(d) Meteorological data. A launch operator must conduct operations and coordinate with weather organizations, as needed, to obtain accurate meteorological data to support the flight safety analysis required by subpart C of this part and to ensure compliance with the flight commit criteria required by § 417.113.
(e) Local notification. A launch operator must implement its local agreements and public coordination plan of § 417.111(i).
(f) Hazard area surveillance. A launch operator must implement its hazard area surveillance and clearance plan, of § 417.111(j), to meet the public safety criteria of § 417.107(b) for each launch.
(g) Flight safety system preflight tests. A launch operator must conduct preflight tests of any flight safety system as required by section E417.41 of appendix E of this part.
(h) Launch vehicle tracking data verification. For each launch, a launch operator must implement written procedures for verifying the accuracy of any launch vehicle tracking data provided. For a launch vehicle flown with a flight safety system, any source of tracking data must satisfy the requirements of § 417.307(b).
(i) Unguided suborbital rocket preflight operations. For the launch of an unguided suborbital rocket, in addition to meeting the other requirements of this section, a launch operator must perform the preflight wind weighting and other preflight safety operations required by §§ 417.125, 417.233, and appendix C of this part.
§ 417.123   Computing systems and software.
(a) A launch operator must document a system safety process that identifies the hazards and assesses the risks to public health and safety and the safety of property related to computing systems and software.
(b) A launch operator must identify all safety-critical functions associated with its computing systems and software. Safety-critical computing system and software functions must include the following:
(1) Software used to control or monitor safety-critical systems.
(2) Software that transmits safety-critical data, including time-critical data and data about hazardous conditions.
(3) Software used for fault detection in safety-critical computer hardware or software.
(4) Software that responds to the detection of a safety-critical fault.
(5) Software used in a flight safety system.
(6) Processor-interrupt software associated with previously designated safety-critical computer system functions.
(7) Software that computes safety-critical data.
(8) Software that accesses safety-critical data.
(9) Software used for wind weighting.
(c) A launch operator must conduct computing system and software hazard analyses for the integrated system.
(d) A launch operator must develop and implement computing system and software validation and verification plans.
(e) A launch operator must develop and implement software development plans, including descriptions of the following:
(1) Coding standards used;
(2) Configuration control;
(3) Programmable logic controllers;
(4) Policy on use of any commercial-off-the-shelf software; and
(5) Policy on software reuse.
§ 417.125   Launch of an unguided suborbital launch vehicle.
(a) Applicability. This section applies only to a launch operator conducting a launch of an unguided suborbital launch vehicle.
(b) Need for flight safety system. A launch operator must launch an unguided suborbital launch vehicle with a flight safety system in accordance with § 417.107 (a) and subpart D of this part unless one of the following exceptions applies:
(1) The unguided suborbital launch vehicle, including any component or payload, does not have sufficient energy to reach any populated area in any direction from the launch point; or
(2) A launch operator demonstrates through the licensing process that the launch will be conducted using a wind weighting safety system that meets the requirements of paragraph (c) of this section.
(c) Wind weighting safety system. A launch operator's wind weighting safety system must consist of equipment, procedures, analysis and personnel functions used to determine the launcher elevation and azimuth settings that correct for the windcocking and wind drift that an unguided suborbital launch vehicle will experience during flight due to wind effects. The launch of an unguided suborbital launch vehicle that uses a wind weighting safety system must meet the following requirements:
(1) The unguided suborbital launch vehicle must not contain a guidance or directional control system.
(2) The launcher azimuth and elevation settings must be wind weighted to correct for the effects of wind conditions at the time of flight to provide a safe impact location. A launch operator must conduct the launch in accordance with the wind weighting analysis requirements and methods of § 417.233 and appendix C of this part.
(3) A launch operator must use a launcher elevation angle setting that ensures the rocket will not fly uprange. A launch operator must set the launcher elevation angle in accordance with the following:
(i) The nominal launcher elevation angle must not exceed 85°. The wind corrected launcher elevation setting must not exceed 86°.
(ii) For an unproven unguided suborbital launch vehicle, the nominal launcher elevation angle must not exceed 80°. The wind corrected launcher elevation setting must not exceed 84°. A proven unguided suborbital launch vehicle is one that has demonstrated, by two or more launches, that flight performance errors are within all the three-sigma dispersion parameters modeled in the wind weighting safety system.
(d) Public risk criteria. A launch operator must conduct the launch of an unguided suborbital launch vehicle in accordance with the public risk criteria of § 417.107(b). The risk to the public determined prior to the day of flight must satisfy the public risk criteria for the area defined by the range of nominal launch azimuths. A launch operator must not initiate flight until a launch operator has verified that the wind drifted impacts of all planned impacts and their five-sigma dispersion areas satisfy the public risk criteria after wind weighting on the day of flight.
(e) Stability. An unguided suborbital launch vehicle, in all configurations, must be stable in flexible body to 1.5 calibers and rigid body to 2.0 calibers throughout each stage of powered flight. A caliber, for a rocket configuration, is defined as the distance between the center of pressure and the center of gravity divided by the largest frontal diameter of the rocket configuration.
(f) Tracking. A launch operator must track the flight of an unguided suborbital launch vehicle. The tracking system must provide data to determine the actual impact locations of all stages and components, to verify the effectiveness of a launch operator's wind weighting safety system, and to obtain rocket performance data for comparison with the preflight performance predictions.
(g) Post-launch review. A launch operator must ensure that the post-launch report required by § 417.25 includes:
(1) Actual impact location of all impacting stages and each impacting component.
(2) A comparison of actual and predicted nominal performance.
(3) Investigation results of any launch anomaly. If flight performance deviates by more than a three-sigma dispersion from the nominal trajectory, a launch operator must conduct an investigation to determine the cause of the rocket's deviation from normal flight and take corrective action before the next launch. A launch operator must file any corrective actions with the FAA as a request for license modification before the next launch in accordance with § 417.11.
§ 417.127   Unique safety policies, requirements and practices.
For each launch, a launch operator must review operations, system designs, analysis, and testing, and identify any unique hazards not otherwise addressed by this part. A launch operator must implement any unique safety policy, requirement, or practice needed to protect the public from the unique hazard. A launch operator must demonstrate through the licensing process that any unique safety policy, requirement, or practice ensures the safety of the public. For any change to a unique safety policy, requirement, or practice, with the exception of a launch specific update, the launch operator must file a request for license modification as required by § 417.11. The FAA may identify and impose a unique safety policy, requirement, or practice as needed to protect the public.
§ 417.129   Safety at end of launch.
A launch operator must ensure for any proposed launch that for all launch vehicle stages or components that reach Earth orbit—
(a) There is no unplanned physical contact between the vehicle or any of its components and the payload after payload separation;
(b) Debris generation does not result from the conversion of energy sources into energy that fragments the vehicle or its components. Energy sources include chemical, pressure, and kinetic energy; and
(c) Stored energy is removed by depleting residual fuel and leaving all fuel line valves open, venting any pressurized system, leaving all batteries in a permanent discharge state, and removing any remaining source of stored energy.
§§ 417.130-417.200   [Reserved]
§ 417.201   Scope and applicability.
(a) This subpart contains requirements for performing the flight safety analysis required by § 417.107(f).
(b) The flight safety analysis requirements of this subpart apply to the flight of any launch vehicle that must use a flight safety system as required by § 417.107(a), except as permitted by paragraph (d) of this section.
(c) The flight safety analysis requirements of §§ 417.203, 417.205, 417.207, 417.211, 417.223, 417.224, 417.225, 417.227, 417.229, 417.231, and 417.233 apply to the flight of any unguided suborbital launch vehicle that uses a wind-weighting safety system. Appendices B, C, and I of this part also apply.
(d) For any alternative flight safety system approved by the FAA under § 417.301(b), the FAA will determine during the licensing process which of the analyses required by this subpart apply.
§ 417.203   Compliance.
(a) General. A launch operator's flight safety analysis must satisfy the performance requirements of this subpart. The flight safety analysis must also meet the requirements for methods of analysis contained in appendices A and B of this part for a launch vehicle flown with a flight safety system and appendices B and C of this part for an unguided suborbital launch vehicle that uses a wind-weighting safety system except as otherwise permitted by this section. A flight safety analysis for a launch may rely on an earlier analysis from an identical or similar launch if the analysis still applies to the later launch.
(b) Method of analysis. (1) For each launch, a launch operator's flight safety analysis must use—
(i) A method approved by the FAA during the licensing process;
(ii) A method approved as a license modification by the FAA; or,
(iii) If the launch takes place from a Federal launch range, a method approved as part of the FAA's launch site safety assessment of the Federal range's processes.
(2) Appendix A of this part contains requirements that apply to all methods of flight safety analysis. A licensee must notify the FAA for any change to the flight safety analysis method. A licensee must file any material change with the FAA as a request for license modification before the launch to which the proposed change would apply. Section 417.11 contains requirements governing a license modification.
(c) Alternate analysis method. The FAA will approve an alternate flight safety analysis method if a launch operator demonstrates, in accordance with § 406.3(b), that its proposed analysis method provides an equivalent level of fidelity to that required by this subpart. A launch operator must demonstrate that an alternate flight safety analysis method is based on accurate data and scientific principles and is statistically valid. The FAA will not find a launch operator's application for a license or license modification sufficiently complete to begin review under § 413.11 of this chapter until the FAA approves the alternate flight safety analysis method.
(d) Analyses performed by a Federal launch range. This provision applies to all sections of this subpart. The FAA will accept a flight safety analysis used by a Federal launch range without need for further demonstration of compliance to the FAA, if:
(1) A launch operator has contracted with a Federal launch range for the provision of flight safety analysis; and
(2) The FAA has assessed the Federal launch range, through its launch site safety assessment, and found that the range's analysis methods satisfy the requirements of this subpart. In this case, the FAA will treat the Federal launch range's analysis as that of a launch operator.
(e) Analysis products. For a licensed launch that does not satisfy paragraph (d) of this section, a launch operator must demonstrate to the FAA compliance with the requirements of this subpart, and must include in its demonstration the analysis products required by part 415 subpart F of this chapter, part 417 subpart A, and appendices A, B, C, and I of this part, depending on whether the launch vehicle uses a flight safety system or a wind-weighting safety system.
§ 417.205   General.
(a) Public risk management. A flight safety analysis must demonstrate that a launch operator will, for each launch, control the risk to the public from hazards associated with normal and malfunctioning launch vehicle flight. The analysis must employ risk assessment, hazard isolation, or a combination of risk assessment and partial isolation of the hazards, to demonstrate control of the risk to the public.
(1) Risk assessment. When demonstrating control of risk through risk assessment, the analysis must demonstrate that any risk to the public satisfies the public risk criteria of § 417.107(b). The analysis must account for the variability associated with:
(i) Each source of a hazard during flight;
(ii) Normal flight and each failure response mode of the launch vehicle;
(iii) Each external and launch vehicle flight environment;
(iv) Populations potentially exposed to the flight; and
(v) The performance of any flight safety system, including time delays associated with the system.
(2) Hazard isolation. When demonstrating control of risk through hazard isolation, the analysis must establish the geographical areas from which the public must be excluded during flight and any operational controls needed to isolate all hazards from the public.
(3) Combination of risk assessment and partial isolation of hazards. When demonstrating control of risk through a combination of risk assessment and partial isolation of the hazards from the public, the analysis must demonstrate that the residual public risk due to any hazard not isolated from the public under paragraph (a)(2) of this section satisfies the public risk criteria of § 417.107(b).
(b) Dependent analyses. Because some analyses required by this subpart are inherently dependent on one another, the data output of any one analysis must be compatible in form and content with the data input requirements of any other analysis that depends on that output. Figure 417.205-1 illustrates the flight safety analyses that might be performed for a launch flown with a flight safety system and the typical dependencies that might exist among the analyses.
§ 417.207   Trajectory analysis.
(a) General. A flight safety analysis must include a trajectory analysis that establishes:
(1) For any time after lift-off, the limits of a launch vehicle's normal flight, as defined by the nominal trajectory and potential three-sigma trajectory dispersions about the nominal trajectory.
(2) A fuel exhaustion trajectory that produces instantaneous impact points with the greatest range for any given time after liftoff for any stage that has the potential to impact the Earth and does not burn to propellant depletion before a programmed thrust termination.
(3) For launch vehicles flown with a flight safety system, a straight-up trajectory for any time after lift-off until the straight-up time that would result if the launch vehicle malfunctioned and flew in a vertical or near vertical direction above the launch point.
(b) Trajectory model. A final trajectory analysis must use a six-degree of freedom trajectory model to satisfy the requirements of paragraph (a) of this section.
(c) Wind effects. A trajectory analysis must account for all wind effects, including profiles of winds that are no less severe than the worst wind conditions under which flight might be attempted, and must account for uncertainty in the wind conditions.
§ 417.209   Malfunction turn analysis.
(a) General. A flight safety analysis must include a malfunction turn analysis that establishes the launch vehicle's turning capability in the event of a malfunction during flight. A malfunction turn analysis must account for each cause of a malfunction turn, such as thrust vector offsets or nozzle burn-through. For each cause of a malfunction turn, the analysis must establish the launch vehicle's turning capability using a set of turn curves. The analysis must account for:
(1) All trajectory times during the thrusting phases of flight.
(2) When a malfunction begins to cause each turn throughout the thrusting phases of flight. The analysis must account for trajectory time intervals between malfunction turn start times that are sufficient to establish flight safety limits and hazard areas that are smooth and continuous.
(3) The relative probability of occurrence of each malfunction turn of which the launch vehicle is capable.
(4) The time, as a single value or a probability time distribution, when each malfunction turn will terminate due to vehicle breakup.
(5) What terminates each malfunction turn, such as, aerodynamic breakup or inertial breakup.
(6) The launch vehicle's turning behavior from the time when a malfunction begins to cause a turn until aerodynamic breakup, inertial breakup, or ground impact. The analysis must account for trajectory time intervals during the malfunction turn that are sufficient to establish turn curves that are smooth and continuous.
(7) For each malfunction turn, the launch vehicle velocity vector turn angle from the nominal launch vehicle velocity vector.
(8) For each malfunction turn, the launch vehicle velocity turn magnitude from the nominal velocity magnitude that corresponds to the velocity vector turn angle.
(9) For each malfunction turn, the orientation of the launch vehicle longitudinal axis measured relative to the nominal launch vehicle longitudinal axis or Earth relative velocity vector at the start of the turn.
(b) Set of turn curves for each malfunction turn cause. For each cause of a malfunction turn, the analysis must establish a set of turn curves that satisfies paragraph (a) of this section and must establish the associated envelope of the set of turn curves. Each set of turn curves must describe the variation in the malfunction turn characteristics for each cause of a turn. The envelope of each set of curves must define the limits of the launch vehicle's malfunction turn behavior for each cause of a malfunction turn. For each malfunction turn envelope, the analysis must establish the launch vehicle velocity vector turn angle from the nominal launch vehicle velocity vector. For each malfunction turn envelope, the analysis must establish the vehicle velocity turn magnitude from the nominal velocity magnitude that corresponds to the velocity vector turn angle envelope.
§ 417.211   Debris analysis.
(a) General. A flight safety analysis must include a debris analysis. For an orbital or suborbital launch, a debris analysis must identify the inert, explosive, and other hazardous launch vehicle debris that results from normal and malfunctioning launch vehicle flight.
(b) Launch vehicle breakup. A debris analysis must account for each cause of launch vehicle breakup, including at a minimum:
(1) Any flight termination system activation;
(2) Launch vehicle explosion;
(3) Aerodynamic loads;
(4) Inertial loads;
(5) Atmospheric reentry heating; and
(6) Impact of intact vehicle.
(c) Debris fragment lists. A debris analysis must produce lists of debris fragments for each cause of breakup and any planned jettison of debris, launch vehicle components, or payload. The lists must account for all launch vehicle debris fragments, individually or in groupings of fragments whose characteristics are similar enough to be described by a single set of characteristics. The debris lists must describe the physical, aerodynamic, and harmful characteristics of each debris fragment, including at a minimum:
(1) Origin on the vehicle, by vehicle stage or component, from which each fragment originated;
(2) Whether it is inert or explosive;
(3) Weight, dimensions, and shape;
(4) Lift and drag characteristics;
(5) Properties of the incremental velocity distribution imparted by breakup; and
(6) Axial, transverse, and tumbling area.
§ 417.213   Flight safety limits analysis.
(a) General. A flight safety analysis must identify the location of populated or other protected areas, and establish flight safety limits that define when a flight safety system must terminate a launch vehicle's flight to prevent the hazardous effects of the resulting debris impacts from reaching any populated or other protected area and ensure that the launch satisfies the public risk criteria of § 417.107(b).
(b) Flight safety limits. The analysis must establish flight safety limits for use in establishing flight termination rules. Section 417.113(c) contains requirements for flight termination rules. The flight safety limits must account for all temporal and geometric extents on the Earth's surface of a launch vehicle's hazardous debris impact dispersion resulting from any planned or unplanned event for all times during flight. Flight safety limits must account for all potential contributions to the debris impact dispersions, including at a minimum:
(1) All time delays, as established by the time delay analysis of § 417.221;
(2) Residual thrust remaining after flight termination implementation or vehicle breakup due to aerodynamic and inertial loads;
(3) All wind effects;
(4) Velocity imparted to vehicle fragments by breakup;
(5) All lift and drag forces on the malfunctioning vehicle and falling debris;
(6) All launch vehicle guidance and performance errors;
(7) All launch vehicle malfunction turn capabilities; and
(8) Any uncertainty due to map errors and launch vehicle tracking errors.
(c) Gates. If a launch involves flight over any populated or other protected area, the flight safety analysis must establish a gate as required by §§ 417.217 and 417.218.
(d) Designated debris impact limits. The analysis must establish designated impact limit lines to bound the area where debris with a ballistic coefficient of three or more is allowed to impact if the flight safety system functions properly.
§ 417.215   Straight-up time analysis.
A flight safety analysis must establish the straight-up time for a launch for use as a flight termination rule. Section 417.113(c) contains requirements for flight termination rules. The analysis must establish the straight-up time as the latest time after liftoff, assuming a launch vehicle malfunctioned and flew in a vertical or near vertical direction above the launch point, at which activation of the launch vehicle's flight termination system or breakup of the launch vehicle would not cause hazardous debris or critical overpressure to affect any populated or other protected area.
§ 417.217   Overflight gate analysis.
For a launch that involves flight over a populated or other protected area, the flight safety analysis must include an overflight gate analysis. The analysis must establish the portion of a flight safety limit, a gate, through which a normally performing launch vehicle's tracking icon will be allowed to proceed. A tracking icon must enable the flight safety crew to determine whether the launch vehicle's flight is in compliance with the flight safety rules established under § 417.113. When establishing that portion of a flight safety limit, the analysis must demonstrate that the launch vehicle flight satisfies the flight safety requirements of § 417.107.
§ 417.218   Hold-and-resume gate analysis.
(a) For a launch that involves overflight or near overflight of a populated or otherwise protected area prior to the planned safe flight state calculated as required by § 417.219, the flight safety analysis must construct a hold-and-resume gate for each populated or otherwise protected area. After a vehicle's tracking icon crosses a hold-and-resume gate, flight termination must occur as required by sections 417.113(d)(6).
(b) The hold-and-resume gate analysis must account for:
(1) Overflight of a wholly contained populated or otherwise protected area. A hold-and-resume gate must be a closed, continuous contour that encompasses any populated or otherwise protected area located wholly within the impact limit lines. The hold-and-resume gate must encompass a populated or otherwise protected area such that flight termination or breakup of the launch vehicle while the tracking icon is outside the gate would not cause hazardous debris or overpressure to endanger the populated or otherwise protected area.
(2) Overflight of an uncontained populated or otherwise protected area. A hold-and-resume gate must be a closed, continuous contour that encompasses any area in which flight termination is allowed to occur. The hold-and-resume gate must encompass all hazard areas such that flight termination or breakup of the launch vehicle while the vehicle's tracking icon is inside the gate would not cause hazardous debris or critical overpressure to endanger any populated or otherwise protected area.
§ 417.219   Data loss flight time and planned safe flight state analyses.
(a) General. For each launch, a flight safety analysis must establish data loss flight times, as identified by paragraph (b) of this section, and a planned safe flight state to establish each flight termination rule that applies when launch vehicle tracking data is not available for use by the flight safety crew. Section 417.113(d) contains requirements for flight termination rules.
(b) Data loss flight times. A flight safety analysis must establish the shortest elapsed thrusting time during which a launch vehicle can move from normal flight to a condition where the launch vehicle's hazardous debris impact dispersion extends to any protected area as a data loss flight time. The analysis must establish a data loss flight time for all times along the nominal trajectory from liftoff through that point during nominal flight when the minimum elapsed thrusting time is no greater than the time it would take for a normal vehicle to reach the overflight gate, or the planned safe flight state established under paragraph (c) of this section, whichever occurs earlier.
(c) Planned safe flight state. For a launch vehicle that performs normally during all portions of flight, the planned safe flight state is the point during the nominal flight of a launch vehicle where:
(1) No launch vehicle component, debris, or hazard can impact or affect a populated or otherwise protected area for the remainder of the launch;
(2) The launch vehicle achieves orbital insertion; or
(3) The launch vehicle's state vector reaches a state where the absence of a flight safety system would not significantly increase the accumulated risk from debris impacts and maintains positive flight safety system control to the maximum extent feasible.
§ 417.221   Time delay analysis.
(a) General. A flight safety analysis must include a time delay analysis that establishes the mean elapsed time between the violation of a flight termination rule and the time when the flight safety system is capable of terminating flight for use in establishing flight safety limits as required by § 417.213.
(b) Analysis constraints. A time delay analyses must determine a time delay distribution that accounts for the following:
(1) The variance of all time delays for each potential failure scenario, including but not limited to, the range of malfunction turn characteristics and the time of flight when the malfunction occurs;
(2) A flight safety official's decision and reaction time, including variation in human response time; and
(3) Flight termination hardware and software delays including all delays inherent in:
(i) Tracking systems;
(ii) Data processing systems, including all filter delays;
(iii) Display systems;
(iv) Command control systems; and
(v) Flight termination systems.
§ 417.223   Flight hazard area analysis.
(a) General. A flight safety analysis must include a flight hazard area analysis that identifies any regions of land, sea, or air that must be surveyed, publicized, controlled, or evacuated in order to control the risk to the public from debris impact hazards. The risk management requirements of § 417.205(a) apply. The analysis must account for, at a minimum:
(1) All trajectory times from liftoff to the planned safe flight state of § 417.219(c), including each planned impact, for an orbital launch, and through final impact for a suborbital launch;
(2) Regions of land potentially exposed to debris resulting from normal flight events and events resulting from any potential malfunction;
(3) Regions of sea and air potentially exposed to debris from normal flight events, including planned impacts;
(4) In the vicinity of the launch site, any waterborne vessels, populated offshore structures, or aircraft exposed to debris from events resulting from any potential abnormal flight events, including launch vehicle malfunction;
(5) Any operational controls implemented to control risk to the public from debris hazards;
(6) Debris identified by the debris analysis of § 417.211; and
(7) All launch vehicle trajectory dispersion effects in the surface impact domain.
(b) Public notices. A flight hazard areas analysis must establish the ship hazard areas for notices to mariners that encompass the three-sigma impact dispersion area for each planned debris impact. A flight hazard areas analysis must establish the aircraft hazard areas for notices to airmen that encompass the 3-sigma impact dispersion volume for each planned debris impact. Section 417.121(e) contains procedural requirements for issuing notices to mariners and airmen.
§ 417.224   Probability of failure analysis.
(a) General. All flight safety analyses for a launch, regardless of hazard or phase of flight, must account for launch vehicle failure probability in a consistent manner. A launch vehicle failure probability estimate must use accurate data, scientific principles, and a method that is statistically or probabilistically valid. For a launch vehicle with fewer than two flights, the failure probability estimate must account for the outcome of all previous launches of vehicles developed and launched in similar circumstances. For a launch vehicle with two or more flights, launch vehicle failure probability estimates must account for the outcomes of all previous flights of the vehicle in a statistically valid manner.
(b) Failure. For flight safety analysis purposes, a failure occurs when a launch vehicle does not complete any phase of normal flight or when any anomalous condition exhibits the potential for a stage or its debris to impact the Earth or reenter the atmosphere during the mission or any future mission of similar launch vehicle capability. Also, either a launch incident or launch accident constitutes a failure.
(c) Previous flight. For flight analysis purposes, flight begins at a time in which a launch vehicle normally or inadvertently lifts off from a launch platform. Lift-off occurs with any motion of the launch vehicle with respect to the launch platform.
§ 417.225   Debris risk analysis.
A flight safety analysis must demonstrate that the risk to the public potentially exposed to inert and explosive debris hazards from any one flight of a launch vehicle satisfies the public risk criterion of § 417.107(b) for debris. A debris risk analysis must account for risk to populations on land, including regions of launch vehicle flight following passage through any gate in a flight safety limit established as required by § 417.217. A debris risk analysis must account for any potential casualties to the public as required by the debris thresholds and requirements of § 417.107(c).
§ 417.227   Toxic release hazard analysis.
A flight safety analysis must establish flight commit criteria that protect the public from any hazard associated with toxic release and demonstrate compliance with the public risk criterion of § 417.107(b). The analysis must account for any toxic release that will occur during the proposed flight of a launch vehicle or that would occur in the event of a flight mishap. The analysis must account for any operational constraints and emergency procedures that provide protection from toxic release. The analysis must account for all members of the public that may be exposed to the toxic release, including all members of the public on land and on any waterborne vessels, populated offshore structures, and aircraft that are not operated in direct support of the launch.
§ 417.229   Far-field overpressure blast effects analysis.
(a) General. A flight safety analysis must establish flight commit criteria that protect the public from any hazard associated with far field blast overpressure effects due to potential explosions during launch vehicle flight and demonstrate compliance with the public risk criterion of § 417.107(b).
(b) Analysis constraints. The analysis must account for:
(1) The potential for distant focus overpressure or overpressure enhancement given current meteorological conditions and terrain characteristics;
(2) The potential for broken windows due to peak incident overpressures below 1.0 psi and related casualties;
(3) The explosive capability of the launch vehicle at impact and at altitude and potential explosions resulting from debris impacts, including the potential for mixing of liquid propellants;
(4) Characteristics of the launch vehicle flight and the surroundings that would affect the population's susceptibility to injury, such as, shelter types and time of day of the proposed launch;
(5) Characteristics of the potentially affected windows, including their size, location, orientation, glazing material, and condition; and
(6) The hazard characteristics of the potential glass shards, such as falling from upper building stories or being propelled into or out of a shelter toward potentially occupied spaces.
§ 417.231   [Reserved]
§ 417.233   Analysis for an unguided suborbital launch vehicle flown with a wind weighting safety system.
For each launch of an unguided suborbital launch vehicle flown with a wind weighting safety system, in addition to the other requirements in this subpart outlined in § 417.201(c), the flight safety analysis must:
(a) Establish flight commit criteria and other launch safety rules that a launch operator must implement to control the risk to the public from potential adverse effects resulting from normal and malfunctioning flight;
(b) Establish any wind constraints under which launch may occur; and
(c) Include a wind weighting analysis that establishes the launcher azimuth and elevation settings that correct for the windcocking and wind-drift effects on the unguided suborbital launch vehicle.
§ 417.301   General.
(a) Applicability. This subpart applies to any flight safety system that a launch operator uses. The requirements of § 417.107(a) define when a launch operator must use a flight safety system. A launch operator must ensure that its flight safety system satisfies all the requirements of this subpart, including the referenced appendices. Paragraph (b) of this section provides an exception to this.
(b) Alternate flight safety system. A flight safety system need not satisfy one or more of the requirements of this subpart for a launch if a launch operator demonstrates, in accordance with § 406.3(b), that the launch achieves an equivalent level of safety as a launch that satisfies all the requirements of this part. The flight safety system must undergo analysis and testing that is comparable to that required by this part to demonstrate that the system's reliability to perform each intended function is comparable to that required by this subpart.
(c) Functions, subsystems, and components. When initiated in the event of a launch vehicle failure, a flight safety system must prevent any launch vehicle hazard, including any payload hazard, from reaching a populated or other protected area. A flight safety system must consist of all of the following:
(1) A flight termination system that satisfies appendices D, E, and F of this part;
(2) A command control system that satisfies §§ 417.303 and 417.305;
(3) Each support system required by § 417.307; and
(4) The functions of any personnel who operate flight safety system hardware or software including a flight safety crew that satisfies § 417.311.
(d) Compliance —(1) Non-Federal launch site. For launch from a non-Federal launch site, any flight safety system, including all components, must:
(i) Comply with a launch operator's flight safety system compliance matrix of § 415.127(g) that accounts for all the design, installation, and monitoring requirements of this subpart, including the referenced appendices; and
(ii) Comply with a launch operator's testing compliance matrix of § 415.129(b) that accounts for all the test requirements of this subpart, including the referenced appendices.
(2) Federal launch range. This provision applies to all sections of this subpart. The FAA will accept a flight safety system used or approved on a Federal launch range without need for further demonstration of compliance to the FAA if:
(i) A launch operator has contracted with a Federal launch range for the provision of flight safety system property and services; and
(ii) The FAA has assessed the Federal launch range, through its launch site safety assessment, and found that the Federal launch range's flight safety system property and services satisfy the requirements of this subpart. In this case, the FAA will treat the Federal launch range's flight safety system property and services as that of a launch operator.
§ 417.303   Command control system requirements.
(a) General. When initiated by a flight safety official, a command control system must transmit a command signal that has the radio frequency characteristics and power needed for receipt of the signal by the onboard vehicle flight termination system. A command control system must include all of the following:
(1) All flight termination system activation switches;
(2) All intermediate equipment, linkages, and software;
(3) Any auxiliary stations;
(4) Each command transmitter and transmitting antenna; and
(5) All support equipment that is critical for reliable operation, such as power, communications, and air conditioning systems.
(b) Performance specifications. A command control system and each subsystem, component, and part that can affect the reliability of a component must have written performance specifications that demonstrate, and contain the details of, how each satisfies the requirements of this section.
(c) Reliability prediction. A command control system must have a predicted reliability of 0.999 at the 95 percent confidence level when operating, starting with completion of the preflight testing and system verification of § 417.305(c) through initiation of flight and until the planned safe flight state for each launch. Any demonstration of the system's predicted reliability must satisfy § 417.309(b).
(d) Fault tolerance. A command control system must not contain any single-failure-point that, upon failure, would inhibit the required functioning of the system or cause the transmission of an undesired flight termination message. A command control system's design must ensure that the probability of transmitting an undesired or inadvertent command during flight is less than 1 × 10 −7.
(e) Configuration control. A command control system must undergo configuration control to ensure its reliability and compatibility with the flight termination system used for each launch.
(f) Electromagnetic interference. Each command control system component must function within the electromagnetic environment to which it is exposed. A command control system must include protection to prevent interference from inhibiting the required functioning of the system or causing the transmission of an undesired or inadvertent flight termination command. Any susceptible remote control data processing or transmitting system that is part of the command control system must prevent electromagnetic interference.
(g) Command transmitter failover. A command control system must include independent, redundant transmitter systems that automatically switch, or “fail-over,” from a primary transmitter to a secondary transmitter when a condition exists that indicates potential failure of the primary transmitter. The switch must be automatic and provide all the same command control system capabilities through the secondary transmitter system. The secondary transmitter system must respond to any transmitter system configuration and radio message orders established for the launch. The fail-over criteria that trigger automatic switching from the primary transmitter to the secondary transmitter must account for each of the following transmitter performance parameters and failure indicators:
(1) Low transmitter power;
(2) Center frequency shift;
(3) Out of tolerance tone frequency;
(4) Out of tolerance message timing;
(5) Loss of communication between central control and transmitter site;
(6) Central control commanded status and site status disagree;
(7) Transmitter site fails to respond to a configuration or radiation order within a specified period of time; and
(8) For a tone-based system, tone deviation and tone imbalance.
(h) Switching between transmitter systems. Any manual or automatic switching between transmitter systems, including fail-over, must not result in the radio carrier being off the air long enough for any command destruct system to be captured by an unauthorized transmitter. The time the radio carrier is off the air must account for any loss of carrier and any simultaneous multiple radio carrier transmissions from two transmitter sites during switching.
(i) Radio carrier. For each launch, a command control system must provide all of the following:
(1) The radio frequency signal and radiated power density that each command destruct system needs to activate during flight;
(2) The 12-dB power density margin required by section D417.9(d) of appendix D of this part under nominal conditions; and
(3) A 6-dB power density margin under worst-case conditions.
(j) Command control system monitoring and control. A command control system must provide for monitoring and control of the system from the flight safety system displays and controls required by § 417.307(f), including real-time selection of a transmitter, transmitter site, communication circuits, and antenna configuration.
(k) Command transmitter system. For each launch, a command transmitter system must:
(1) Transmit signals that are compatible with any command destruct system's radio frequency receiving system of section D417.25 and command receiver decoder of section D417.29 of appendix D of this part;
(2) Ensure that all arm and destruct commands transmitted to a flight termination system have priority over any other commands transmitted;
(3) Employ an authorized radio carrier frequency and bandwidth with a guard band that provides the radio frequency separation needed to ensure that the system does not interfere with any other flight safety system that is required to operate at the same time;
(4) Transmit an output bandwidth that is consistent with the signal spectrum power used in the link analysis of § 417.309(f); and
(5) Not transmit other frequencies that could degrade the airborne flight termination system's performance.
(l) Command control system antennas. A command control system antenna or antenna system must satisfy all of the following:
(1) The antenna system must provide two or more command signals to any command destruct system throughout normal flight and in the event of a launch vehicle failure regardless of launch vehicle orientation;
(2) Each antenna beam-width must:
(i) Allow for complete transmission of the command destruct sequence of signal tones before a malfunctioning launch vehicle can exit the 3-dB point of the antenna pattern;
(ii) When the vehicle is centered in the antenna pattern at the beginning of the malfunction, account for the launch vehicle's malfunction turn capability determined by the analysis of § 417.209, the data loss flight times of § 417.219, and the time delay of § 417.221.
(iii) Encompass the boundaries of normal flight for the portion of flight that the antenna is scheduled to support; and
(iv) Account for any error associated with launch vehicle tracking and pointing of the antenna;
(3) The location of each antenna must provide for an unobstructed line of site between the antenna and the launch vehicle;
(4) The antenna system must provide a continuous omni-directional radio carrier pattern that covers the launch vehicle's flight from the launch point to no less than an altitude of 50,000 feet above sea level, unless the system uses a steerable antenna that satisfies paragraphs (l)(1) and (2) of this section for the worst-case launch vehicle malfunction that could occur during that portion of flight;
(5) An antenna must radiate circularly polarized radio waves that are compatible with the flight termination system antennas on the launch vehicle; and
(6) Any steerable antenna must allow for control of the antenna manually at the antenna site or by remote slaving data from a launch vehicle tracking source. A steerable antenna's positioning lag, accuracy, and slew rates must allow for tracking a nominally performing launch vehicle within one half of the antenna's beam-width and for tracking a malfunctioning launch vehicle to satisfy paragraph (l)(2) of this section.
§ 417.305   Command control system testing.
(a) General. (1) A command control system, including its subsystems and components must undergo the acceptance testing of paragraph (b) of this section when new or modified. For each launch, a command control system must undergo the preflight testing of paragraph (c) of this section.
(2) Each acceptance and preflight test must follow a written test plan that specifies the procedures and test parameters for the test and the testing sequence. A test plan must include instructions on how to handle procedural deviations and how to react to test failures.
(3) If hardware or software is redesigned or replaced with a different hardware or software that is not identical to the original, the system must undergo all acceptance testing and analysis with the new hardware or software and all preflight testing for each launch with the new hardware or software.
(4) After a command control system passes all acceptance tests, if a component is replaced with an identical component, the system must undergo testing to ensure that the new component is installed properly and is operational.
(b) Acceptance testing. (1) All new or modified command control system hardware and software must undergo acceptance testing to verify that the system satisfies the requirements of § 417.303.
(2) Acceptance testing must include functional testing, system interface validation testing, and integrated system-wide validation testing.
(3) Each acceptance test must measure the performance parameters that demonstrate whether the requirements of § 417.303 are satisfied.
(4) Any computing system, software, or firmware that performs a software safety critical function must undergo validation testing and satisfy § 417.123. If command control system hardware interfaces with software, the interface must undergo validation testing.
(c) Preflight testing —(1) General. For each launch, a command control system must undergo preflight testing to verify that the system satisfies the requirements of § 417.303 for the launch.
(2) Coordinated command control system and flight termination system testing. For each launch, a command control system must undergo preflight testing during the preflight testing of the associated flight termination system under section E417.41 of appendix E of this part.
(3) Command transmitter system carrier switching tests. A command transmitter system must undergo a test of its carrier switching system no earlier than 24 hours before a scheduled flight. The test must satisfy all of the following:
(i) Automatic carrier switching. For any automatic carrier switching system, the test must verify that the switching algorithm selects and enables the proper transmitter site for each portion of the planned flight; and
(ii) Manual carrier switching. For any manual carrier switching, the test must verify that the flight safety system crew can select and enable each transmitter site planned to support the launch.
(4) Independent radio frequency open loop verification tests. A command control system must undergo an open loop end-to-end verification test for each launch as close to the planned flight as operationally feasible and after any modification to the system or break in the system configuration. The test must:
(i) Verify the performance of each element of the system from the flight safety system displays and controls to each command transmitter site;
(ii) Measure all system performance parameters received and transmitted using measuring equipment that does not physically interface with any elements of the operational command control system;
(iii) Verify the performance of each flight safety system display and control and remote command transmitter site combination by repeating all measurements for each combination, for all strings and all operational configurations of cross-strapped equipment; and
(iv) Verify that all critical command control system performance parameters satisfy all their performance specifications. These parameters must include:
(A) Transmitter power output;
(B) Center frequency stability;
(C) Tone deviation;
(D) Tone frequency;
(E) Message timing;
(F) Status of each communication circuit between the flight safety system display and controls and any supporting command transmitter sites;
(G) Status agreement between the flight safety system display and controls and each and any supporting command transmitter sites;
(H) Fail-over conditions;
(I) Tone balance; and
(J) Time delay from initiation of a command at each flight safety system control to transmitter output of the command signal.
(d) Test reports. If a Federal launch range oversees the safety of a launch, the range's requirements are consistent with this subpart, and the range provides and tests the command control system, a launch operator need only obtain the range's verification that the system satisfies all the test requirements. For any other case a launch operator must prepare or obtain one or more written reports that:
(1) Verify that the command control system satisfies all the test requirements;
(2) Describe all command control system test results and test conditions;
(3) Describe any analysis performed instead of testing;
(4) Identify by serial number or other identification each test result that applies to each system or component;
(5) Describe any test failure or anomaly, including any variation from an established performance baseline, each corrective action taken, and all results of any additional tests; and
(6) Identify any test failure trends.
§ 417.307   Support systems.
(a) General. (1) A flight safety system must include the systems required by this section to support the functions of the flight safety system crew, including making a flight termination decision.
(2) Each support system and each subsystem, component, and part that can affect the reliability of the support system must have written performance specifications that demonstrate, and contain the details of, how each satisfies the requirements of this section.
(3) For each launch, each support system must undergo testing to ensure it functions according to its performance specifications.
(b) Launch vehicle tracking. (1) A flight safety system must include a launch vehicle tracking system that provides launch vehicle position and status data to the flight safety crew from the first data loss flight time until the planned safe flight state for the launch.
(2) The tracking system must consist of at least two sources of launch vehicle position data. The data sources must be independent of one another, and at least one source must be independent of any vehicle guidance system.
(3) All ground tracking systems and components must be compatible with any tracking system components onboard the launch vehicle.
(4) If a tracking system uses radar as one of the independent tracking sources, the system must:
(i) Include a tracking beacon onboard the launch vehicle; or
(ii) If the system relies on skin tracking, it must maintain a tracking margin of no less than 6 dB above noise throughout the period of flight that the radar is used. The flight safety limits must account for the larger tracking errors associated with skin tracking.
(5) The tracking system must provide real-time data to the flight safety data processing, display, and recording system required by paragraph (e) of this section.
(6) For each launch, each tracking source must undergo validation of its accuracy. For each stage of flight that a launch vehicle guidance system is used as a tracking source, a tracking source that is independent of any system used to aid the guidance system must validate the guidance system data before the data is used in the flight termination decision process.
(7) The launch vehicle tracking error from all sources, including data latency and any possible gaps or dropouts in tracking coverage, must be consistent with the flight safety limits of § 417.213 and the flight safety system time delay of § 417.221.
(8) Any planned gap in tracking coverage must not occur at the same time as any planned switching of command transmitters.
(c) Telemetry. (1) A flight safety system must include a telemetry system that provides the flight safety crew with accurate flight safety data during preflight operations and during flight until the planned safe flight state.
(2) The onboard telemetry system must monitor and transmit the flight termination system monitoring data of section D417.17 and any launch vehicle tracking data used to satisfy paragraph (b) of this section.
(3) The telemetry receiving system must acquire, store, and provide real-time data to the flight safety data processing, display, and recording system required by paragraph (e) of this section.
(d) Communications network. A flight safety system must include a communications network that connects all flight safety functions with all launch control centers and any down-range tracking and command transmitter sites. The system must provide for recording all required data and all voice communications channels during launch countdown and flight.
(e) Data processing, display, and recording. A flight safety system must include one or more subsystems that process, display, and record flight safety data to support the flight safety crew's monitoring of the launch, including the data that the crew uses to make a flight termination decision. The system must:
(1) Satisfy § 417.123 for any computing system, software, or firmware that must operate properly to ensure the accuracy of the data;
(2) Receive vehicle status data from tracking and telemetry, evaluate the data for validity, and provide valid data for display and recording;
(3) Perform any reformatting of the data as appropriate and forward it to display and recording devices;
(4) Display real-time data against background displays of the nominal trajectory and flight safety limits established in accordance with the flight safety analysis required by subpart C of this part;
(5) Display and record raw input and processed data at a rate that maintains the validity of the data and at no less than 0.1-second intervals;
(6) Record the timing of when flight safety system commands are input by the flight safety crew; and
(7) Record all health and status parameters of the command control system, including the transmitter failover parameters, command outputs, check channel or pilot tone monitor, and status of communications.
(f) Displays and controls. (1) A flight safety system must include the displays of real-time data and controls that the flight safety crew needs to perform all its functions, such as to monitor and evaluate launch vehicle performance, communicate with other flight safety and launch personnel, and initiate flight termination.
(2) A flight safety system must present all data that the flight safety crew needs to ensure that all flight commit criteria are satisfied for each launch, such as hazard area surveillance, any aircraft and ship traffic information, meteorological conditions, and the flight termination system monitoring data of section D417.17.
(3) The real-time displays must include all data that the flight safety crew needs to ensure the operational functionality of the flight safety system, including availability and quality, and that all flight termination rules are satisfied for each launch, such as:
(i) Launch vehicle tracking data, such as instantaneous vacuum impact point, drag corrected debris footprint, or present launch vehicle position and velocities as a function of time;
(ii) Vehicle status data from telemetry, including yaw, pitch, roll, and motor chamber pressure;
(iii) The flight termination system monitoring data of section D417.17;
(iv) Background displays of nominal trajectory, flight safety limits, data loss flight times, planned safe flight state, and any overflight gate through a flight safety limit all as determined by the flight safety analysis required by subpart C of this part; and
(v) Any video data when required by the flight safety crew to perform its functions, such as video from optical program and flight line cameras.
(4) The controls must allow the flight safety crew to turn a command transmitter on and off, manually switch from primary to backup transmitter antenna, and switch between each transmitter site. These functions may be accomplished through controls available to command transmitter support personnel and communications between those personnel and the flight safety crew.
(5) Each set of command transmitter system controls must include a means of identifying when it has primary control of the system.
(6) The displays must include a means of immediately notifying the flight safety system crew of any automatic fail-over of the system transmitters.
(7) All flight safety system controls must be dedicated to the flight safety system and must not rely on time or equipment shared with other systems.
(8) All data transmission links between any control, transmitter, or antenna must consist of two or more complete and independent duplex circuits. The routing of these circuits must ensure that they are physically separated from each other to eliminate any potential single failure point in the command control system in accordance with § 417.303(d).
(9) The system must include hardware or procedural security provisions for controlling access to all controls and other related hardware. These security provisions must ensure that only the flight safety crew can initiate a flight safety system transmission.
(10) The system must include two independent means for the flight safety crew to initiate arm and destruct messages. The location and functioning of the controls must provide the crew easy access to the controls and prevent inadvertent activation.
(11) The system must include a digital countdown for use in implementing the flight termination rules of § 417.113 that apply data loss flight times and the planned safe flight state. The system must also include a manual method of applying the data loss flight times in the event that the digital countdown malfunctions.
(g) Support equipment calibration. Each support system and any equipment used to test flight safety system components must undergo calibration to ensure that measurement and monitoring devices that support a launch provide accurate indications.
(h) Destruct initiator simulator. A flight safety system must include one or more destruct initiator simulators that simulate each destruct initiator during the flight termination system preflight tests. Each destruct initiator simulator must:
(1) Have electrical and operational characteristics matching those of the actual destruct initiator;
(2) Monitor the firing circuit output current, voltage, or energy, and indicate whether the firing output occurs. The indication that the output occurred must remain after the output is removed;
(3) Have the ability to remain connected throughout ground processing until the electrical connection of the actual initiators is accomplished;
(4) Include a capability that permits the issuance of destruct commands by test equipment only if the simulator is installed and connected to the firing lines; and
(5) For any low voltage initiator, provide a stray current monitoring device in the firing line. The stray current monitoring device, such as a fuse or automatic recording system, must be capable of indicating a minimum of one-tenth of the maximum no-fire current.
(i) Timing. A flight safety system must include a timing system that is synchronized to a universal time coordinate. The system must:
(1) Initiate first motion signals;
(2) Synchronize flight safety system instrumentation, including countdown clocks; and
(3) Identify when, during countdown or flight, a data measurement or voice communication occurs.
§ 417.309   Flight safety system analysis.
(a) General. (1) Each flight termination system and command control system, including each of their components, must satisfy the analysis requirements of this section.
(2) Each analysis must follow an FAA approved system safety and reliability analysis methodology.
(b) System reliability. Each flight termination system and command control system must undergo an analysis that demonstrates the system's predicted reliability. Each analysis must:
(1) Account for the probability of a flight safety system anomaly occurring and all of its effects as determined by the single failure point analysis and the sneak circuit analysis required by paragraphs (c) and (g) of this section;
(2) Demonstrate that each system satisfies the predicted reliability requirement of 0.999 at the 95 percent confidence level;
(3) Use a reliability model that is statistically valid and accurately represents the system;
(4) Account for the actual or predicted reliability of all subsystems and components;
(5) Account for the effects of storage, transportation, handling, maintenance, and operating environments on component predicted reliability; and
(6) Account for the interface between the launch vehicle systems and the flight termination system.
(c) Single failure point. A command control system must undergo an analysis that demonstrates that the system satisfies the fault tolerance requirements of § 417.303(d). A flight termination system must undergo an analysis that demonstrates that the system satisfies the fault tolerance requirements of section D417.5(b). Each analysis must:
(1) Follow a standard industry methodology such as a fault tree analysis or a failure modes effects and criticality analysis;
(2) Identify all possible failure modes and undesired events, their probability of occurrence, and their effects on system performance;
(3) Identify single point failure modes;
(4) Identify areas of design where redundancy is required and account for any failure mode where a component and its backup could fail at the same time due to a single cause;
(5) Identify functions, including redundancy, which are not or cannot be tested;
(6) Account for any potential system failures due to hardware, software, test equipment, or procedural or human errors;
(7) Account for any single failure point on another system that could disable a command control system or flight termination system, such as any launch vehicle system that could trigger safing of a flight termination system; and
(8) Provide input to the reliability analysis of paragraph (b) of this section.
(d) Fratricide. A flight termination system must undergo an analysis that demonstrates that the flight termination of any stage, at any time during flight, will not sever interconnecting flight termination system circuitry or ordnance to other stages until flight termination on all the other stages has been initiated.
(e) Bent pin. Each component of a flight termination system and command control system must undergo an analysis that demonstrates that any single short circuit occurring as a result of a bent electrical connection pin will not result in inadvertent system activation or inhibiting the proper operation of the system.
(f) Radio frequency link. (1) The flight safety system must undergo a radio frequency link analysis to demonstrate that it satisfies the required 12-dB margin for nominal system performance and 6-dB margin for worst-case system performance.
(2) When demonstrating the 12-dB margin, each link analysis must account for the following nominal system performance and attenuation factors:
(i) Path losses due to plume or flame attenuation;
(ii) Vehicle trajectory;
(iii) Ground system and airborne system radio frequency characteristics; and
(iv) The antenna gain value that ensures that the margin is satisfied over 95% of the antenna radiation sphere surrounding the launch vehicle.
(3) When demonstrating the 6-dB margin, each link analysis must account for the following worst-case system performance and attenuation factors:
(i) The system performance and attenuation factors of paragraph (f)(2) of this section;
(ii) The command transmitter failover criteria of § 417.303(g) including the lowest output power provided by the transmitter system;
(iii) Worst-case power loss due to antenna pointing inaccuracies; and
(iv) Any other attenuation factors.
(g) Sneak circuit. Each electronic component that contains an electronic inhibit that could inhibit the functioning, or cause inadvertent functioning of a flight termination system or command control system, must undergo a sneak circuit analysis. The analysis must demonstrate that there are no latent paths of an unwanted command that could, when all components otherwise function properly, cause the occurrence of an undesired, unplanned, or inhibited function that could cause a system anomaly. The analysis must determine the probability of an anomaly occurring for input to the system reliability analysis of paragraph (b) of this section.
(h) Software and firmware. Any computing system, software, or firmware that performs a software safety critical function must undergo the analysis needed to ensure reliable operation and satisfy § 417.123.
(i) Battery capacity. A flight termination system must undergo an analysis that demonstrates that each flight termination system battery has a total amp hour capacity of no less than 150% of the capacity needed during flight plus the capacity needed for load and activation checks, preflight and launch countdown checks, and any potential launch hold time. For a launch vehicle that uses any solid propellant, the analysis must demonstrate that the battery capacity allows for an additional 30-minute hang-fire hold time. The battery analysis must also demonstrate each flight termination system battery's ability to meet the charging temperature and current control requirements of appendix D of this part.
(j) Survivability. A flight termination system must undergo an analysis that demonstrates that each subsystem and component, including their location on the launch vehicle, provides for the flight termination system to complete all its required functions when exposed to:
(1) Breakup of the launch vehicle due to aerodynamic loading effects at high angle of attack trajectories during early stages of flight, including the effects of any automatic or inadvertent destruct system;
(2) An engine hard-over nozzle induced tumble during each phase of flight for each stage; or
(3) Launch vehicle staging, ignition, or any other normal or abnormal event that, when it occurs, could damage flight termination system hardware or inhibit the functionality of any subsystem or component, including any inadvertent separation destruct system.
§ 417.311   Flight safety crew roles and qualifications.
(a) A flight safety crew must operate the flight safety system hardware. A flight safety crew must document each flight safety crew position description and maintain documentation on individual crew qualifications, including education, experience, and training as part of the personnel certification program required by § 417.105.
(b) A flight safety crew must be able to demonstrate the knowledge, skills, and abilities needed to operate the flight safety system hardware in accordance with § 417.113.
(1) A flight safety crew must have knowledge of:
(i) All flight safety system assets and responsibilities, including:
(A) Communications systems and launch operations procedures;
(B) Both voice and data systems;
(C) Graphical data systems;
(D) Tracking; and
(E) Telemetry real time data;
(ii) Flight termination systems; and
(iii) Contingency operations, including hold, recycle and abort procedures.
(2) An individual who monitors vehicle performance and performs flight termination must have knowledge of and be capable of resolving malfunctions in:
(i) The application of safety support systems such as position tracking sources;
(ii) Digital computers;
(iii) Displays;
(iv) Command destruct;
(v) Communications;
(vi) Telemetry;
(vii) All electrical functions of a flight termination system;
(viii) The principles of radio frequency transmission and attenuation;
(ix) The behavior of ballistic and aerodynamic vehicles in flight under the influence of aerodynamic forces; and
(x) The application of flight termination rules.
(3) An individual who operates flight safety support systems must have knowledge of and be capable of resolving malfunctions in:
(i) The design and assembly of the flight safety support system hardware;
(ii) The operation of electromechanical systems; and
(iii) The nature and inherent tendencies of the flight safety system hardware being operated.
(4) An individual who performs flight safety analysis must have knowledge of orbital mechanics and be proficient in the calculation and production of range safety displays, impact probabilities, and casualty expectations.
(c) Flight safety crew members must complete a training and certification program to ensure launch site familiarization, launch vehicle familiarization, flight safety system functions, equipment, and procedures related to a launch before being called upon to support that launch. Each flight safety crew member must complete a preflight readiness training and certification program. This preflight readiness training and certification program must include:
(1) Mission specific training programs to ensure team readiness.
(2) Launch simulation exercises of system failure modes, including nominal and failure modes, that test crew performance, flight termination criteria, and flight safety data display integrity.
§ 417.401   Scope.
This subpart contains public safety requirements that apply to launch processing and post-launch operations at a launch site in the United States. Ground safety requirements in this subpart apply to activities performed by, or on behalf of, a launch operator at a launch site in the United States. A licensed launch site operator must satisfy the requirements of part 420 of this chapter.
§ 417.402   Compliance.
(a) General. A launch operator's ground safety process must satisfy this subpart.
(b) Ground safety analysis conducted for launch at a Federal launch range. This provision applies to all sections of this subpart. The FAA will accept a ground safety process conducted for a launch from a Federal launch range without need for further demonstration of compliance to the FAA if:
(1) A launch operator has contracted with a Federal launch range for the provision of the ground safety process; and
(2) The FAA has assessed the Federal launch range, through its launch site safety assessment, and found that the Federal launch range's ground safety process satisfies the requirements of this subpart. In this case, the FAA will treat the Federal launch range's process as that of a launch operator.
(c) Toxic release hazard analysis conducted for launch processing at a Federal launch range. The FAA will accept a toxic release hazard analysis conducted for launch processing from a Federal launch range provided the toxic release analysis satisfies the Federal launch range's requirements, and the FAA has assessed the Federal launch range, through its launch site safety assessment, and found that the applicable Federal launch range safety-related launch services and property satisfy the requirements of this subpart.
(d) Demonstration of compliance. For a licensed launch that does not satisfy paragraphs (b) and (c) of this section, a launch operator must demonstrate compliance to the FAA with the requirements of this subpart, and must include in its demonstration the analysis products required by subparts A and E of this part, and appendices I and J of this part.
(e) Alternate methods. The FAA will approve an alternate hazard control method if a launch operator demonstrates, in accordance with § 406.3(b), that its proposed hazard control method provides an equivalent level of safety to that required by this subpart.
§ 417.403   General.
(a) Public safety. A launch operator must ensure that each hazard control is in place to protect the public from each potential hazard associated with launch processing and post-launch operations.
(b) Ground safety analysis. A launch operator must perform and document a ground safety analysis that satisfies § 417.405 and appendix J of this part.
(c) Local agreements. A launch operator must coordinate and perform launch processing and post-launch operations that satisfy local agreements to ensure the responsibilities and requirements in this part and § 420.57 of this chapter are met. A launch operator, when using a launch site of a licensed launch site operator, must coordinate the launch operator's operations with the launch site operator and with any agreements that the launch site operator has with local authorities that form a basis for the launch site operator's license.
(d) Launch operator's exclusive use of a launch site. For a launch conducted from a launch site exclusive to its own use, a launch operator must satisfy the requirements of this subpart and of part 420 of this chapter, including subpart D of part 420.
§ 417.405   Ground safety analysis.
(a) A launch operator must perform a ground safety analysis for launch vehicle hardware, ground hardware including launch site and ground support equipment, launch processing, and post-launch operations at a launch site in the United States. The requirements of this section apply to the performance of the ground safety analysis and to the ground safety analysis products that a launch operator must file with the FAA as required by § 417.402(d). This analysis must identify each potential hazard, each associated cause, and each hazard control that a launch operator must establish and maintain to keep each identified hazard from affecting the public. A launch operator must incorporate the launch site operator's systems and operations involved in ensuring public safety into the ground safety analysis.
(b) Technical personnel who are knowledgeable of launch vehicle systems, launch processing, ground systems, operations, and their associated hazards must prepare the ground safety analysis. These individuals must be qualified to perform the ground safety analysis through training, education, and experience.
(c) A launch operator must ensure personnel performing a ground safety analysis or preparing a ground safety analysis report will have the cooperation of the entire launch operator's organization. A launch operator must maintain supporting documentation and it must be available upon request.
(d) A launch operator must:
(1) Begin a ground safety analysis by identifying the systems and operations to be analyzed;
(2) Define the extent of each system and operation being assessed to ensure there is no miscommunication as to what the hazards are, and who, in a launch operator's organization or other organization supporting the launch, controls those hazards; and
(3) Ensure that the ground safety analysis accounts for each launch vehicle system and operation involved in launch processing and post-launch operations, even if only to show that no hazard exists.
(e) A ground safety analysis need not account for potential hazards of a component if a launch operator demonstrates that no hazard to the public exists at the system level. A ground safety analysis need not account for an operation's individual task or subtask level if a launch operator demonstrates that no hazard to the public exists at the operation level. A launch operator must provide verifiable controls for hazards that are confined within the boundaries of a launch operator's facility to ensure the public will not have access to the associated hazard area while the hazard exists.
(f) A launch operator must identify each potential hazard, including non-credible hazards. The probability of occurrence is not relevant with respect to identifying a hazard. Where an assertion is made that no hazard exists for a particular system or operation, the ground safety analysis must provide the rationale. A launch operator must identify the following hazards of each launch vehicle system, launch site and ground support equipment, launch processing, and post-launch operations:
(1) System hazards, including explosives and other ordnance, solid and liquid propellants, toxic and radioactive materials, asphyxiants, cryogens, and high pressure. System hazards generally exist even when no operation is occurring; and
(2) Operation hazards derived from an unsafe condition created by a system, operating environment, or an unsafe act.
(g) A launch operator must categorize identified system and operation hazards as follows:
(1) Public hazard. A hazard that extends beyond the launch location under the control of a launch operator. Public hazards include the following:
(i) Blast overpressure and fragmentation resulting from an explosion;
(ii) Fire and deflagration, including hazardous materials such as radioactive material, beryllium, carbon fibers, and propellants. A launch operator must assume that in the event of a fire, hazardous smoke from systems containing hazardous materials will reach the public;
(iii) Sudden release of a hazardous material into the air, water, or ground; and
(iv) Inadvertent ignition of a propulsive launch vehicle payload, stage, or motor.
(2) Launch location hazard. A hazard that stays within the confines of the location under the control of a launch operator but extends beyond individuals doing the work. The confines may be bounded by a wall or a fence line of a facility or launch complex, or by a fenced or unfenced boundary of an entire industrial complex or multi-user launch site. A launch location hazard may affect the public depending on public access controls. Launch location hazards that may affect the public include the hazards listed in paragraphs (g)(1)(i)-(iv) of this section and additional hazards in potentially unsafe locations accessible to the public such as:
(i) Unguarded electrical circuits or machinery;
(ii) Oxygen deficient environments;
(iii) Falling objects;
(iv) Potential falls into unguarded pits or from unguarded elevated work platforms; and
(v) Sources of ionizing and non-ionizing radiation such as x-rays, radio transmitters, and lasers.
(3) Employee hazard. A hazard to individuals performing a launch operator's work, but not to other people in the area. A launch operator must comply with all applicable Federal, state, and local employee safety regulations. A launch operator's ground safety analysis must identify employee hazards and demonstrate that there are no associated public safety issues.
(4) Non-credible hazard. A hazard for which possible adverse effects on people or property would be negligible and where the possibility of adverse effects on people or property is remote. A launch operator's ground safety analysis must identify non-credible hazards and demonstrate that the hazard is non-credible.
(h) A ground safety analysis must identify each hazard cause for each public hazard and launch location hazard. The ground safety analysis must account for conditions, acts, or chain of events that can result in a hazard. The ground safety analysis must account for the possible failure of any control or monitoring circuitry within hardware systems that can cause a hazard.
(i) A ground safety analysis must identify the hazard controls to be established by a launch operator for each hazard cause identified in paragraph (h) of this section. A launch operator's hazard controls include the use of engineering controls for the containment of hazards within defined areas and the control of public access to those areas.
(j) A launch operator must verify all information in a ground safety analysis, including design margins, fault tolerance and successful completion of tests. A launch operator must:
(1) Trace any identified hardware to an engineering drawing or other document that describes hardware configuration;
(2) Trace any test or analysis used in developing the ground safety analysis to a report or memorandum that describes how the test or analysis was performed;
(3) Ensure the accuracy of the test or analysis and the associated results;
(4) Trace any procedural hazard control identified to a written procedure, and approved by the person designated under § 417.103(b)(2) or the person's designee, with the paragraph or step number of the procedure specified;
(5) Identify a verifiable hazard control for each hazard; if a hazard control is not verifiable, a launch operator may include it as an informational note on the hazard analysis form;
(6) For each hazard control, reference a released drawing, report, procedure or other document that verifies the existence of the hazard control; and
(7) Maintain records, as required by § 417.15, of the documentation that verifies the information in the ground safety analysis.
(k) A launch operator must ensure the continuing accuracy of its ground safety analysis. The analysis of systems and operations must not end upon submission of a ground safety analysis report to the FAA during the license application process. A launch operator must analyze each new or modified system or operation for potential hazards that can affect the public. A launch operator must ensure that each existing system and operation is subject to continual scrutiny and that the information in a ground safety analysis report is kept current.
§ 417.407   Hazard control implementation.
(a) General. A launch operator must establish and maintain the hazard controls identified by the ground safety analysis including:
(1) System hazard controls that satisfy § 417.409;
(2) Safety clear zones for hazardous operations that satisfy § 417.411;
(3) Hazard areas and controls for allowing public access that satisfy § 417.413;
(4) Hazard controls after launch or an attempt to launch that satisfy § 417.415; and
(5) Controls for propellant and explosive hazards that satisfy § 417.417.
(b) Hazard control verification. A launch operator must establish a hazard tracking process to ensure that each identified hazard has a verifiable hazard control. Verification status must remain “open” for an individual hazard control until the hazard control is verified to exist in a released drawing, report, procedure, or similar document.
(c) Hazard control configuration control. A launch operator must establish and maintain a configuration control process for safety critical hardware. Procedural steps to verify hazard controls, and their associated documentation, cannot be changed without coordination with the person designated in § 417.103(b)(2).
(d) Inspections. When a potential hazard exists, a launch operator must conduct periodic inspections of related hardware, software, and facilities. A launch operator must ensure qualified and certified personnel, as required by § 417.105, conduct the inspection. A launch operator must demonstrate that the time interval between inspections is sufficient to ensure satisfaction of this subpart. A launch operator must ensure safety devices and other hazard controls must remain in place for that hazard, and that safety devices and other hazard controls must remain in working order so that no unsafe conditions exist.
(e) Procedures. A launch operator must conduct each launch processing or post-launch operation involving a public hazard or a launch location hazard pursuant to written procedures that incorporate the hazard controls identified by a launch operator's ground safety analysis and as required by this subpart. The person designated in § 417.103(b)(2) must approve the procedures. A launch operator must maintain an “as-run” copy of each procedure. The “as-run” procedure copy must include changes, start and stop dates, and times that each procedure was performed and observations made during the operations.
(f) Hazardous materials. A launch operator must establish procedures for the receipt, storage, handling, use, and disposal of hazardous materials, including toxic substances and sources of ionizing radiation. A launch operator must establish procedures for responding to hazardous material emergencies and protecting the public that complies with the accident investigation plan as defined in § 417.111(h)(2). These procedures must include:
(1) Identification of each hazard and its effects;
(2) Actions to be taken in response to release of a hazardous material;
(3) Identification of protective gear and other safety equipment that must be available in order to respond to a release;
(4) Evacuation and rescue procedures;
(5) Chain of command; and
(6) Communication both on-site and off-site to surrounding communities and local authorities.
(g) Toxic release hazard notifications and evacuations. A launch operator must perform a toxic release hazard analysis for launch processing performed at the launch site that satisfies section I417.7 of this part. A launch operator must apply toxic plume modeling techniques that satisfy section I417.7 of this part and ensure that notifications and evacuations are accomplished to protect the public from potential toxic release.
§ 417.409   System hazard controls.
(a) General. A launch operator must establish and maintain hazard controls for each system that presents a public hazard as identified by the ground safety analysis and satisfy the requirements of this section. A launch operator must:
(1) Ensure a system be at least single fault tolerant to creating a public hazard unless other hazard control criteria are specified for the system by the requirements of this part. A system capable of creating a catastrophic public hazard must be at least dual fault tolerant. Dual fault tolerant system hazard controls include: Switches, valves, or similar components that prevent an unwanted transfer or release of energy or hazardous materials;
(2) Ensure each hazard control used to provide fault tolerance is independent from other hazard controls so that no single action or event can remove more than one inhibit. A launch operator must prevent inadvertent activation of hazard control devices such as switches and valves;
(3) Provide at least two fully redundant safety devices if a safety device must function in order to control a public hazard. A single action or event must not be capable of disabling both safety devices; and
(4) Ensure computing systems and software used to control a public hazard satisfy the requirements of § 417.123.
(b) Structures and material handling equipment. A launch operator must ensure safety factors applied in the design of a structure or material handling equipment account for static and dynamic loads, environmental stresses, expected wear, and duty cycles. A launch operator must:
(1) Inspect structures and material handling equipment to verify workmanship, proper operations, and maintenance;
(2) Prepare plans to ensure proper operations and maintenance of structures and material handling equipment;
(3) Assess structures and material handling equipment for potential single point failure;
(4) Eliminate single point failures from structures and material handling equipment or subject the structures and material handling equipment to specific inspection and testing to ensure proper operation. Single point failure welds must undergo both surface and volumetric non-destructive inspection to verify that no rejectable discontinuities exist;
(5) Establish other non-destructive inspection techniques if a volumetric inspection cannot be performed. A launch operator, in such a case, must demonstrate through the licensing process that the inspection processes used accurately verify the absence of rejectable discontinuities; and
(6) Ensure qualified and certified personnel, as defined in § 417.105, conduct the inspections.
(c) Pressure vessels and pressurized systems. A launch operator must apply the following hazard controls to a pressurized flight or ground pressure vessel, component, or systems:
(1) Qualified and certified personnel, as defined in § 417.105, must test each pressure vessel, component, or system upon installation and before being placed into service, and periodically inspect to ensure that no rejectable discontinuities exists;
(2) Safety factors applied in the design of a pressure vessel, component, or system must account for static and dynamic loads, environmental stresses, and expected wear;
(3) Pressurized system flow-paths, except for pressure relief and emergency venting, must be single fault tolerant to causing pressure ruptures and material releases during launch processing; and
(4) Provide pressure relief and emergency venting capability to protect against pressure ruptures. Pressure relief devices must provide the flow rate necessary to prevent a rupture in the event a pressure vessel is exposed to fire.
(d) Electrical and mechanical systems. A launch operator must apply the following hazard controls to electrical or mechanical systems that can release electrical or mechanical energy during launch processing:
(1) A launch operator must ensure electrical and mechanical systems, including systems that generate ionizing or non-ionizing radiation, are single fault tolerant to providing or releasing electrical or mechanical energy;
(2) In areas where flammable material exists, a launch operator must ensure electrical systems and equipment are hermetically sealed, explosion proof, intrinsically safe, purged, or otherwise designed so as not to provide an ignition source. A launch operator must assess each electrical system as a possible source of thermal energy and ensure that the electrical system can not act as an ignition source; and
(3) A launch operator must prevent unintentionally conducted or radiated energy due to possible bent pins in a connector, a mismated connector, shorted wires, or unshielded wires within electrical power and signal circuits that interface with hazardous subsystems.
(e) Propulsion systems. A propulsion system must be dual fault tolerant to inadvertently becoming propulsive. Propulsion systems must be single fault tolerant to inadvertent mixing of fuel and oxidizer. Each material in a propulsion system must be compatible with other materials that may contact the propulsion system during launch processing including materials used to assemble and clean the system. A launch operator must use engineering controls, including procedures, to prevent connecting incompatible systems. A launch operator must comply with § 417.417 for hazard controls applicable to propellants and explosives.
(f) Ordnance systems. An ordnance system must be at least single fault tolerant to prevent a hazard caused by inadvertent actuation of the ordnance system. A launch operator must comply with § 417.417 for hazard controls applicable to ordnance. In addition, an ordnance system must satisfy the following requirements;
(1) A launch operator must ensure ordnance electrical connections are disconnected until final preparations for flight;
(2) An ordnance system must provide for safing and arming of the ordnance. An electrically initiated ordnance system must include ordnance initiation devices and arming devices, also referred to as safe and arm devices, that provide a removable and replaceable mechanical barrier or other positive means of interrupting power to each ordnance firing circuit to prevent inadvertent initiation of ordnance. A mechanical safe and arm device must have a safing pin that locks the mechanical barrier in a safe position. A mechanical actuated ordnance device must also have a safing pin that prevents mechanical movement within the device. A launch operator must comply with section D417.13 of this part for specific safing and arming requirements for a flight termination system;
(3) Protect ordnance systems from stray energy through grounding, bonding, and shielding; and
(4) Current limit any monitoring or test circuitry that interfaces with an ordnance system to protect against inadvertent initiation of ordnance. Equipment used to measure bridgewire resistance on electro-explosive devices must be special purpose ordnance system instrumentation with features that limit current.
§ 417.411   Safety clear zones for hazardous operations.
(a) A launch operator must define a safety clear zone that confines the adverse effects of each operation involving a public hazard or launch location hazard. A launch operator's safety clear zones must satisfy the following:
(1) A launch operator must establish a safety clear zone that accounts for the potential blast, fragment, fire or heat, toxic and other hazardous energy or material potential of the associated systems and operations. A launch operator must base a safety clear zone on the following criteria:
(i) For a possible explosive event, base a safety clear zone on the worst case event, regardless of the fault tolerance of the system;
(ii) For a possible toxic event, base a safety clear zone on the worst case event. A launch operator must have procedures in place to maintain public safety in the event toxic releases reach beyond the safety clear zone; and
(iii) For a material handling operation, base a safety clear zone on a worst case event for that operation.
(2) A launch operator must establish a safety clear zone when the launch vehicle is in a launch command configuration with the flight safety systems fully operational and on internal power.
(b) A launch operator must establish restrictions that prohibit public access to a safety clear zone during a hazardous operation. A safety clear zone may extend to areas beyond the launch location boundaries if local agreements provide for restricting public access to such areas and a launch operator verifies that the safety clear zone is clear of the public during the hazardous operation.
(c) A launch operator's procedures must verify that the public is outside of a safety clear zone prior to a launch operator beginning a hazardous operation.
(d) A launch operator must control a safety clear zone to ensure no public access during the hazardous operation. Safety clear zone controls include:
(1) Use of security guards and equipment;
(2) Physical barriers; and
(3) Warning signs, and other types of warning devices.
§ 417.413   Hazard areas.
(a) General. A launch operator must define a hazard area that confines the adverse effects of a hardware system should an event occur that presents a public hazard or launch location hazard. A launch operator must prohibit public access to the hazard area whenever a hazard is present unless the requirements for public access of paragraph (b) of this section are met.
(b) Public access. A launch operator must establish a process for authorizing public access if visitors or members of the public must have access to a launch operator's facility or launch location. The process must ensure that each member of the public is briefed on the hazards within the facility and related safety warnings, procedures, and rules that provide protection, or a launch operator must ensure that each member of the public is accompanied by a knowledgeable escort.
(c) Hazard controls during public access. A launch operator must establish procedural controls that prevent hazardous operations from taking place while members of the public have access to the launch location and must verify that system hazard controls are in place that prevent initiation of a hazardous event. Hazard controls and procedures that prevent initiation of a hazardous event include the following:
(1) Use of lockout devices or other restraints on system actuation switches or other controls to eliminate the possibility of inadvertent actuation of a hazardous system.
(2) Disconnect ordnance systems from power sources, incorporate the use of safing plugs, or have safety devices in place that prevent inadvertent initiation. Activity involving the control circuitry of electrically activated safety devices must not be ongoing while the public has access to the hazard area. Install safing pins on safe and arm devices and mechanically actuated devices. Disconnect explosive transfer lines, not protected by a safe and arm device or a mechanically actuated device or equivalent.
(3) When systems or tanks are loaded with hypergols or other toxic materials, close the system or tank and verify it is leak-tight with two verifiable closures, such as a valve and a cap, to every external flow path or fitting. Such a system must also be in a steady-state condition.
(4) Keep each pressurized system below its maximum allowable working pressure and do not allow it to be in a dynamic state. Activity involving the control circuitry of electrically activated pressure system valves must not be ongoing while the public has access to the associated hazard area. Launch vehicle systems must not be pressurized to more than 25% of the system's design burst pressure, when the public has access to the associated hazard area.
(5) Do not allow sources of ionizing or non-ionizing radiation, such as, x-rays, nuclear power sources, high-energy radio transmitters, radar, and lasers to be present or verify they are to be inactive when the public has access to the associated hazard area.
(6) Guard physical hazards to prevent potential physical injury to visiting members of the public. Physical hazards include the following:
(i) Potential falling objects;
(ii) Falls from an elevated height; and
(iii) Protection from potentially hazardous vents, such as pressure relief discharge vents.
(7) Maintain and verify that safety devices or safety critical systems are operating properly prior to permitting public access.
§ 417.415   Post-launch and post-flight-attempt hazard controls.
(a) A launch operator must establish, maintain and perform procedures for controlling hazards and returning the launch facility to a safe condition after a successful launch. Procedural hazard controls must include:
(1) Provisions for extinguishing fires;
(2) Re-establishing full operational capability of safety devices, barriers, and platforms; and
(3) Access control.
(b) A launch operator must establish procedures for controlling hazards associated with a failed flight attempt where a solid or liquid launch vehicle engine start command was sent, but the launch vehicle did not liftoff. These procedures must include the following:
(1) Maintaining and verifying that each flight termination system remains operational until verification that the launch vehicle does not represent a risk of inadvertent liftoff. If an ignition signal has been sent to a solid rocket motor, the flight termination system must remain armed and active for a period of no less than 30 minutes. During this time, flight termination system batteries must maintain sufficient voltage and current capacity for flight termination system operation. The flight termination system receivers must remain captured by the command control system transmitter's carrier signal;
(2) Assuring that the vehicle is in a safe configuration, including its propulsion and ordnance systems. The flight safety system crew must have access to the vehicle status. Re-establish safety devices and bring each pressurized system down to safe pressure levels; and
(3) Prohibiting launch complex entry until the launch pad area safing procedures are complete.
(c) A launch operator must establish procedural controls for hazards associated with an unsuccessful flight where the launch vehicle has a land or water impact. These procedures must include the following provisions:
(1) Evacuation and rescue of members of the public, to include modeling the dispersion and movement of toxic plumes, identification of areas at risk, and communication with local government authorities;
(2) Extinguishing fires;
(3) Securing impact areas to ensure that personnel and the public are evacuated, and ensure that no unauthorized personnel or members of the public enter, and to preserve evidence; and
(4) Ensuring public safety from hazardous debris, such as plans for recovery and salvage of launch vehicle debris and safe disposal of hazardous materials.
§ 417.417   Propellants and explosives.
(a) A launch operator must comply with the explosive safety criteria in part 420 of this chapter.
(b) A launch operator must ensure that:
(1) The explosive site plan satisfies part 420 of this chapter;
(2) Only those explosive facilities and launch points addressed in the explosive site plan are used and only for their intended purpose; and
(3) The total net explosive weight for each explosive hazard facility and launch point must not exceed the maximum net explosive weight limit indicated on the explosive site plan for each location.
(c) A launch operator must establish, maintain, and perform procedures that ensure public safety for the receipt, storage, handling, inspection, test, and disposal of explosives.
(d) A launch operator must establish and maintain each procedural system control to prevent inadvertent initiation of propellants and explosives. These controls must include the following:
(1) Protect ordnance systems from stray energy through methods of bonding, grounding, and shielding, and controlling radio frequency radiation sources in a radio frequency radiation exclusion area. A launch operator must determine the vulnerability of its electro-explosive devices and systems to radio frequency radiation and establish radio frequency radiation power limits or radio frequency radiation exclusion areas as required by the launch site operator or to ensure safety.
(2) Keep ordnance safety devices, as required by § 417.409, in place until the launch complex is cleared as part of the final launch countdown. No members of the public may re-enter the complex until each safety device is re-established.
(3) Do not allow heat and spark or flame producing devices in an explosive or propellant facility without written approval and oversight from a launch operator's safety organization.
(4) Do not allow static producing materials in close proximity to solid or liquid propellants, electro-explosive devices, or systems containing flammable liquids.
(5) Use fire safety measures including:
(i) Elimination or reduction of flammable and combustible materials;
(ii) Elimination or reduction of ignition sources;
(iii) Fire and smoke detection systems;
(iv) Safe means of egress; and
(v) Timely fire suppression response.
(6) Include lightning protection on each facility used to store or process explosives to prevent inadvertent initiation of propellants and explosives due to lightning unless the facility complies with the lightning protection criteria of § 420.71 of this part.
(e) A launch operator, in the event of an emergency, must perform the accident investigation plan as defined in § 417.111(h).